§01
OpenAPI 3.1.1
Single source of truth at /api/openapi.json. The iOS companion app is generated from the same contract.
API
Build on SkyCanvass.
The same REST surface the SkyCanvass web and iOS apps run on, documented in one OpenAPI 3.1.1 contract.
Surface
§02
Bearer token auth
Sign in via /api/auth/login with X-Client-Platform: ios to receive an access token for the Authorization header.
§03
Abuse-throttled
Per-IP and per-account rate limits on auth and public endpoints return clean HTTP 429s.
§04
Same surface as the app
These are the production endpoints the web and iOS apps run on — not a parallel integration tier that drifts.
Endpoints
/api/healthService health + running build SHA. No auth./api/auth/loginEmail + password sign-in. Returns an access token for Bearer use./api/auth/sessionCurrent session + account context./api/account/profileAccount profile, company details, preferences./api/account/storm_reportsStorm reports generated by your account./api/account/storm_feedStorm activity feed for your saved areas./api/account/storm_alertsSaved-area storm alert subscriptions./api/account/permitsPermit lookups attached to your account./api/account/photo_packetsPhoto packets generated by your account.Quickstart
# Health check — no auth required
curl https://skycanvass.com/api/health
# Sign in and capture the access token
curl -X POST https://skycanvass.com/api/auth/login \
-H "Content-Type: application/json" \
-H "X-Client-Platform: ios" \
-d '{"email":"[email protected]","password":"..."}'
# Call an authenticated endpoint with the returned accessToken
# (account reads are POST — Leptos server-fn convention)
curl -X POST https://skycanvass.com/api/account/storm_reports \
-H "Authorization: Bearer <accessToken>"