Public info API

These endpoints return permission names, resource id mappings, and the display info for an OAuth2 client. They are for developers who create tokens, handle usage, or implement OAuth2. The content changes only when the server is updated, so it is a good cache candidate.

Authentication

No API Token is required right now.

Get the permission list

Definitions of every permission and group. The permission text shown on the dashboard and on the OAuth2 consent page comes from this payload. See Permissions.

GEThttps://manager.exptech.com.tw/api/v1/info/permissions

ServerManager

Request

curl "https://manager.exptech.com.tw/api/v1/info/permissions"

const res = await fetch("https://manager.exptech.com.tw/api/v1/info/permissions");
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import requests

res = requests.get("https://manager.exptech.com.tw/api/v1/info/permissions", timeout=10)
res.raise_for_status()
print(res.json())

Response

200

Success (uncompressed JSON)

{
  "permissions": [
    {
      "bit": 0,
      "name": "*",
      "description": "全部權限"
    },
    {
      "bit": 1,
      "name": "account",
      "description": "帳號 API"
    },
    {
      "bit": 2,
      "name": "trem.rts",
      "description": "TREM 即時測站",
      "resource_id": 1
    },
    {
      "bit": 3,
      "name": "trem.rtw",
      "description": "TREM 即時波形",
      "resource_id": 8
    },
    {
      "bit": 4,
      "name": "trem.raw",
      "description": "TREM 原始資料",
      "resource_id": 4
    },
    {
      "bit": 5,
      "name": "trem.eew",
      "description": "TREM 地震速報",
      "resource_id": 6
    },
    {
      "bit": 6,
      "name": "trem.intensity",
      "description": "TREM 震度",
      "resource_id": 7
    },
    {
      "bit": 7,
      "name": "trem.oeews",
      "description": "TREM 現地型"
    },
    {
      "bit": 8,
      "name": "trem.control",
      "description": "TREM 控制 API",
      "resource_id": 5
    },
    {
      "bit": 10,
      "name": "eq.report",
      "description": "地震報告",
      "resource_id": 2
    }
  ],
  "groups": [
    {
      "name": "eq.*",
      "description": "地震全部",
      "includes": [
        "eq.report"
      ]
    },
    {
      "name": "trem.*",
      "description": "TREM 全部（不含控制 API）",
      "includes": [
        "trem.rts",
        "trem.rtw",
        "trem.raw",
        "trem.eew",
        "trem.intensity",
        "trem.oeews"
      ]
    }
  ]
}

Try it

Response fields

Field	Type	Description
`permissions`	`array`	Every permission, sorted by bit ascending
`bit`	`number`	Internal number for the permission. When you name a permission, use name, not this number
`name`	`string`	Permission name, used on the dashboard and in the OAuth2 scope
`description`	`string`	Display text
`resource_id`	`number`	Resource id used for metering. Permissions that are not metered omit this field
`groups`	`array`	Groups, sorted by name
`name`	`string`	Group name, for example trem.*
`description`	`string`	Display text
`includes`	`string[]`	Permission names in the group. Use this field for the exact set. Do not infer it from the name prefix

Get the resource map

The mapping between resource_id and permission names. Usage and quota are counted per resource. Look up this map when you need to turn a resource_id into a name.

GEThttps://manager.exptech.com.tw/api/v1/info/resources

ServerManager

Request

curl --compressed "https://manager.exptech.com.tw/api/v1/info/resources"

const res = await fetch("https://manager.exptech.com.tw/api/v1/info/resources");
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import requests

res = requests.get("https://manager.exptech.com.tw/api/v1/info/resources", timeout=10)
res.raise_for_status()
print(res.json())

Response

200

Success (zstd-compressed JSON)

{
  "resources": {
    "1": "trem.rts",
    "2": "eq.report",
    "4": "trem.raw",
    "5": "trem.control",
    "6": "trem.eew",
    "7": "trem.intensity",
    "8": "trem.rtw"
  }
}

Try it

Response fields

Field	Type	Description
`resources`	`object`	The key is the resource_id as a decimal string. The value is the permission name. Only metered permissions are included. Key order is not fixed

Get OAuth2 client info

Display name and description of an OAuth2 client. The secret, redirect_uri, and permissions are not included.

GEThttps://manager.exptech.com.tw/api/v1/info/oauth-client

ServerManager

Query parameters

client_idstringRequired
OAuth2 client id

Request

curl --compressed "https://manager.exptech.com.tw/api/v1/info/oauth-client?client_id=<client_id>"

const params = new URLSearchParams({ client_id: "<client_id>" });
const res = await fetch(`https://manager.exptech.com.tw/api/v1/info/oauth-client?${params}`);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://manager.exptech.com.tw/api/v1/info/oauth-client",
    params={"client_id": "<client_id>"},
    timeout=10,
)
res.raise_for_status()
print(res.json())

Response

200400

Success (zstd-compressed JSON)

{
  "client_id": "100001",
  "name": "Example Quake App",
  "description": "顯示即時地震資訊的範例 App"
}

client_id is missing (invalid_request), or the client does not exist (invalid_client)

{
  "error": "invalid_client"
}

Try it

Response fields

Field	Type	Description
`client_id`	`string`	client id
`name`	`string`	App name. A token issued through OAuth2 uses this name as its note
`description`	`string`	App description. An empty string when none is set

Notes

Compression: the resource map and OAuth2 client info are always zstd-compressed (Content-Encoding: zstd). See OAuth2 notes for how to handle that. The permission list is uncompressed JSON.
CORS: the permission list allows any origin, so a browser can call it directly. The resource map and OAuth2 client info allow only the official site. Call those from your server.
Caching: the permission list response sends Cache-Control: public, max-age=300, and the server also caches it for 300 seconds. The other two endpoints are cached on the server for 10 seconds.
The permission list accepts only GET. Other methods return 405.
The body changes only when the server is updated. Read it once at startup and cache it. You do not need to query it on every request.