Technical reference in English. API field names are stable across app languages.
Connect your server
- Sign in to your developer portal, accept the terms and register your business app.
- Purchase a 30-day pass. Payment must be verified before keys can be issued.
- Choose the minimum scopes. Copy the key once into your server’s secret manager.
- Send the key in the Authorization header. Never use query parameters, frontend bundles or logs for secrets.
curl https://oops-home.crownthrive.chatgpt.site/api/developer/v1/catalog -H "Authorization: Bearer $OOPS_API_KEY"The unauthenticated public capability catalog is free to read. It does not expose account information. The authenticated API is intended for server use and does not enable browser CORS.
Endpoints and ownership
| Endpoint | Scope | Result |
|---|---|---|
| GET /api/developer/v1/catalog | catalog:read | Capabilities, exclusions and limits |
| GET /api/developer/v1/requests | requests:read | Your account’s partner request status, quote and review progress |
| POST /api/developer/v1/requests | requests:submit | An attested request in the AI review queue |
Ownership comes from the stored key, never a body or query member ID. No endpoint reads consumer plans, contacts, wallet files, location links, health data or staff records. No endpoint takes a payment or approves content.
GET requests accepts limit (1–50, default 20) and the returned next_cursor. Results are ordered by descending UUID; follow cursors until null. Concurrent new submissions can change the list; restart pagination to refresh.
POST requires Content-Type: application/json and an Idempotency-Key header containing a new UUID. Retry the same normalized content with the same key after a timeout. Reusing that key with changed content returns 409. A replay consumes an API call, but does not create a second submission.
{
"kind": "featured",
"name": "Example local café",
"headline": "Dinner near campus",
"description": "An evening menu at our independently owned café. See our website for current hours and prices.",
"website": "https://example.com/",
"country": "US",
"area": "Your city",
"category": "food",
"rights_accepted": true,
"terms_accepted": true
}kind: featured or integration. category: food, activities, transport, campus, military or services. Required lengths: name 2–100, headline 5–100, description 20–1,600, area 2–120; country is a two-letter ISO code. Website must be public HTTPS. Both attestations must be true. Read the partner terms before automating submissions.
A featured request carries a $25 proposal. Payment is unavailable until approval. Managed work requires a verified feasible scope and quote. Follow progress and accept a quote in the partner workspace.
Limits and errors
A pass shares 1,000 calls/day and 60/minute across three active apps and two active keys each. New submissions are capped at ten/day and five awaiting review. UTC windows apply. Authorized calls count even when content validation fails. Invalid authentication, insufficient scope and inactive passes do not consume the API allowance.
200: success. 400: invalid content or missing idempotency key. 401: missing, expired or revoked key. 402: no active pass. 403: insufficient scope. 404: unknown route. 409: conflicting idempotency content. 413: payload too large. 415: wrong content type. 429: limit reached. 503: provider or service unavailable.
For 429, wait at least the Retry-After value (60 seconds). A daily cap remains until UTC midnight; a full review queue remains until work leaves review. Do not retry these every minute indefinitely. Successful responses include daily usage. Request bodies are limited to 12,000 characters. Keys last 90 days; pass expiry is checked separately. Revoke a key immediately if exposed.
Provider readiness
| Connection | Current behavior | Required for more |
|---|---|---|
| Local food & fuel | Google discovery; source-reported fields where available | Coverage and timestamps vary. A fuel price is not a guaranteed pump quote. |
| Ticketmaster | Provider purchase links; Discovery adapter awaits credentials | Server API key, authorized usage, successful search readback. Discovery does not authorize purchase. |
| Ticket buying & commissions | Provider checkout; no verified commission claim | Approved commerce API, signed commercial rights, settlement and refund terms, tested purchase lifecycle |
| Delivery, rides & wearables | Provider links or individually supported connections | Separate account consent, supported API scopes and a successful provider readback |
Use your private secret manager or approved account connection flow for credentials. Never paste keys into chat, support tickets or partner descriptions. AI can verify configured access, prepare implementation and update status; it cannot create provider approval or agree to contracts for you.
Official references: Ticketmaster Discovery · Ticketmaster Partner API · Google Places.
OS, operations and verification
Oops is registered under the existing CrownThrive OS surface ct.surface.asrm.safe-ride. Public developer keys belong to business owners and do not grant OS administration. The existing hourly PentaMarketer intake workflow reviews eligible partner submissions and records progress, missing access and completion evidence.
Payment verification, key checks, usage limits and approved area-matched placement delivery run in backend code. AI review and supported integration implementation use the existing bounded job queue. Changes require implementation evidence and provider readback before a connection is marked complete.
Install & permissions runs optional browser readiness checks. These reports do not certify a physical Android or iPhone installation, permission persistence, offline relaunch or background behavior. Real-device verification remains separate.
Staff use the authenticated operator portal. Moderators handle allowed content and support categories; administrators handle operations; protected superadmins manage staff grants. API keys have none of these permissions.