Orbweave API
Server-to-server. Each source (an app backend, a sponsor console, the storefront) authenticates with its own secret — Authorization: Bearer <secret> or the HMAC headers. Full machine-readable spec: /api/v1/openapi.json.
| Call | What | Notes |
|---|---|---|
GET /api/v1/ping | Connectivity check | Returns the source the secret belongs to. |
POST /api/v1/attribution | Attribute an install to a code / Weaver | Call at signup with the ow code the install carried, and again at the activity gate (pays the Weaver's bounty; falls back to the signup's Weaver when no code is sent). App secrets only. |
GET /api/v1/sponsors | Live local sponsors for this app | By point (?lat&lng&radius_km, default 25 km) or by town (?town&state&country). Returns offer_text for the in-game Local deals list. |
POST /api/v1/sponsors | A sponsor paid (sponsor console → Orbweave) | One call per payment with a unique external_ref (invoice / charge id). Attribution: code > weaver_code > the town's claimed Weaver. Flips the lead to live and credits commission. v0.3.0: also accepts band ('city'|'small' |
POST /api/v1/sponsors/refund | A sponsor payment was refunded | |
POST /api/v1/redemptions | A player redeemed a sponsor offer | staff_confirmed=true when staff confirmed in-app (PIN / tap); otherwise confirm later. Only confirmed redemptions pay the Weaver bonus. |
POST /api/v1/redemptions/{id}/confirm | Staff confirmation for an earlier redemption | |
GET /api/v1/weavers/{code} | Validate a Weaver code | For the 'Who signed you up?' field in sponsor consoles and storefront checkout. |
POST /api/v1/sales | An app was sold through a Weaver code (storefront) | Off by default since v0.3.0 (settings.storefront.enabled) — Indrevo releases are separate from Orbweave. |
GET /api/v1/towns | Town autocomplete | |
GET /api/v1/arachne/overview | Network totals and a daily series (partner / Mission Control secrets) | |
GET /api/v1/arachne/towns | Town rollups: leads, live sponsors, sponsor cents, scans, signups, gates, redemptions | |
GET /api/v1/argus/latest | The latest Argus daily report (SOC guardian / Mission Control) | |
POST /webhooks/{source} | Webhook alternative to the calls above | {event, data}: sponsor.paid · sponsor.refunded · install.signup · install.activity_gate · redemption.created · redemption.confirmed · app.sale · ping. Stored in the inbox first, then processed. |
GET /api/v1/towns/nearest | Nearest town to a point — the town-band authority | The town a venue sits in and its band ('city' | 'small', TOWN_BANDS_SPEC v1.1: under 50,000 residents and outside a metro orbit = small = half price on local packs). No client decides a band; call this at venue sign-up a |
GET /api/v1/towns/{id} | Town by id | |
GET /api/v1/app/version | Weaver app: latest version + APK (no auth) | |
POST /api/v1/app/session | Weaver app sign-in (Weaver code + Loom password, + totp when enabled) | |
GET /api/v1/app/{resource} | Weaver app reads: me · summary · sponsors · players (counts only) · silk · top5 · gifts · messages | Authorization: Weaver <token>. Every figure is the signed-in Weaver's own, at 100%. |
POST /api/v1/app/events | Weaver app field log (offline queue; idempotent on client_event_id) | |
POST /api/v1/app/uploads | Weaver app photo proof (jpeg/png/webp ≤ 3 MB, base64) | |
POST /api/v1/weavers/{code}/gift | Register a gift app for a Weaver (source gift-maker) | |
GET /api/v1/gifts/due | Birthdays + rebuilds due (sources gift-maker, argus, mission-control) |
Every response is {"ok": true|false, …}; repeats with the same reference return {"ok":true,"duplicate":true}, so retries are always safe.