Me

The signed-in user — profile, devices, my submissions, appeals, deletion, rewards.

GET/v1/meAvailable

Current user

Host: https://api.atasumaps.com · getMe
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered

Only what the map side stores — map reputation, trust level, locale. No phone, real name, wallet data or Atasuai sub. Staff consoles read the caller's role here: trust_level moderator / admin (the token carries no roles claim; two-factor sign-in is still proven by the token's amr / acr). A banned user gets 403. Like every /v1 user route it needs an API key (any scope) as well as the user token; staff consoles use a web key of their own.

Responses

Status	Description	Type
`200`	Profile	`Me`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`403`	Authenticated but not allowed (`scope_denied`, `key_restriction_failed`, `forbidden`, `user_banned`, `mfa_required`, `self_moderation_forbidden`, `feature_disabled`)	`Problem`
`429`	Rate limit (`rate_limited`) or monthly plan quota (`quota_exceeded`: `reject` plans only; `Retry-After` = seconds until the next Asia/Almaty month; `context` = `product`, `included`, `used`, `period_end`)	`Problem`

PATCH/v1/mePlanned

Update display name or locale

Host: https://api.atasumaps.com · updateMe
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Request body `MeUpdate`

Name	Type	Required	Description
`display_name`	`string \| null`
`locale`	`Lang`
`expected_version`	`integer`

Responses

Status	Description	Type
`200`	Updated profile	`Me`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`

POST/v1/me/devicesPlanned

Register this device

Host: https://api.atasumaps.com · registerDevice
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

Returns the device_id sent with event reports. Attestation (Play Integrity / App Attest) is optional in the MVP and only raises weight later. Push tokens are not accepted until push providers outside Kazakhstan are legally approved.

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Request body `DeviceRegister`

Name	Type	Required	Description
`platform`	`"android" \| "ios" \| "web"`	yes
`app_version`	`string`
`attestation_token`	`string`		Play Integrity / App Attest token; verified server-side, not stored

Responses

Status	Description	Type
`201`	Device registered (or the same device returned on replay)	`Device`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`

GET/v1/me/submissionsAvailable

My submissions and reports with their status

Host: https://api.atasumaps.com · listMySubmissions
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered

Parameters

Name	In	Type	Description
`kind`	query	`ReportKind[]`
`status`	query	`SubmissionDisplayStatus[]`
`lang`	query	`Lang`	Response language; overrides `Accept-Language`. Default `kk` (Cyrillic).
`cursor`	query	`string`	Opaque cursor from the previous page's `next_cursor`.
`limit`	query	`integer`

Responses

Status	Description	Type
`200`	Page of submissions, newest first	`MySubmissionPage`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`429`	Rate limit (`rate_limited`) or monthly plan quota (`quota_exceeded`: `reject` plans only; `Retry-After` = seconds until the next Asia/Almaty month; `context` = `product`, `included`, `used`, `period_end`)	`Problem`

GET/v1/me/submissions/{report_id}Available

One of my submissions, with status history

Host: https://api.atasumaps.com · getMySubmission
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered

Parameters

Name	In	Type	Required	Description
`report_id`	path	`string (uuid)`	yes
`lang`	query	`Lang`		Response language; overrides `Accept-Language`. Default `kk` (Cyrillic).

Responses

Status	Description	Type
`200`	Submission	`MySubmissionDetail`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`404`	No such resource, or not visible to the caller (`not_found`)	`Problem`
`429`	Rate limit (`rate_limited`) or monthly plan quota (`quota_exceeded`: `reject` plans only; `Retry-After` = seconds until the next Asia/Almaty month; `context` = `product`, `included`, `used`, `period_end`)	`Problem`

POST/v1/me/submissions/{report_id}/withdrawPlanned

Withdraw a pending submission

Host: https://api.atasumaps.com · withdrawMySubmission
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

Parameters

Name	In	Type	Required	Description
`report_id`	path	`string (uuid)`	yes
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Request body `ExpectedVersionOnly`

Name	Type	Required	Description
`expected_version`	`integer`	yes

Responses

Status	Description	Type
`200`	Withdrawn	`CommandResult`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`403`	Authenticated but not allowed (`scope_denied`, `key_restriction_failed`, `forbidden`, `user_banned`, `mfa_required`, `self_moderation_forbidden`, `feature_disabled`)	`Problem`
`404`	No such resource, or not visible to the caller (`not_found`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`

POST/v1/me/submissions/{report_id}/appealAvailable

Appeal a rejected submission (once)

Host: https://api.atasumaps.com · appealMySubmission
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

rejected → pending_review, at most once per submission (409 appeal_already_used). Re-approval of a new place re-enables the original place; an edit is first rebased by a moderator. Someone else's submission → 404. Through this endpoint a moderator is an ordinary reporter (moderator re-opening only via the admin API).

Parameters

Name	In	Type	Required	Description
`report_id`	path	`string (uuid)`	yes
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Request body `AppealCreate`

Name	Type	Required	Description
`reason`	`string`	yes
`expected_version`	`integer`	yes

Responses

Status	Description	Type
`200`	Back in the review queue	`CommandResult`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`403`	Authenticated but not allowed (`scope_denied`, `key_restriction_failed`, `forbidden`, `user_banned`, `mfa_required`, `self_moderation_forbidden`, `feature_disabled`)	`Problem`
`404`	No such resource, or not visible to the caller (`not_found`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`
`429`	Rate limit (`rate_limited`) or monthly plan quota (`quota_exceeded`: `reject` plans only; `Retry-After` = seconds until the next Asia/Almaty month; `context` = `product`, `included`, `used`, `period_end`)	`Problem`

POST/v1/me/submissions/{report_id}/mediaPlanned

Attach a photo to my submission

Host: https://api.atasumaps.com · uploadSubmissionPhoto
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

Stored in object storage inside Kazakhstan. Size and type limited, content scanned, EXIF and location stripped before any publication; the original is kept separately and only moderators can see it, with every view logged. Max 10 MB, JPEG / PNG / HEIC, 5 photos per submission.

Parameters

Name	In	Type	Required	Description
`report_id`	path	`string (uuid)`	yes
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Responses

Status	Description	Type
`201`	Stored	`MediaRef`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`403`	Authenticated but not allowed (`scope_denied`, `key_restriction_failed`, `forbidden`, `user_banned`, `mfa_required`, `self_moderation_forbidden`, `feature_disabled`)	`Problem`
`404`	No such resource, or not visible to the caller (`not_found`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`
`413`	`payload_too_large`	`Problem`
`415`	`unsupported_media_type`	`Problem`

GET/v1/me/deletion-requestPlanned

Status of my deletion request

Host: https://api.atasumaps.com · getDeletionRequest
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered

Responses

Status	Description	Type
`200`	Request	`DeletionRequest`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`404`	No such resource, or not visible to the caller (`not_found`)	`Problem`

POST/v1/me/deletion-requestPlanned

Request deletion of my data

Host: https://api.atasumaps.com · requestDeletion
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered
Idempotency-Key: Required: one key per command; a retry returns the first result

Covers the primary database, search index, photos and caches; backups expire by policy. Approved public contributions are kept but detached from the account (draft — see open questions). Replays return the existing request.

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	`string`	yes	Client-generated unique key per logical command (UUID v4/v7 recommended). Scope: caller + endpoint + key. Same key + same body → first result (`Idempotent-Replayed: true`); same key + different body → `409 idempotency_key_reused`. Missing → `400 idempotency_key_required`. Keys are kept at least 24 hours.

Request body `DeletionRequestCreate`

Name	Type	Required	Description
`confirm`	`true`	yes
`reason`	`string`

Responses

Status	Description	Type
`202`	Request recorded	`DeletionRequest`
`400`	Invalid request (`invalid_request`, `idempotency_key_required`, `limit_exceeded`, `future_departure_not_supported`, `observation_in_future`)	`Problem`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`409`	Conflict — never a silent overwrite. Codes: `idempotency_key_reused` (same key, different body), `version_conflict` (stale `expected_version`; body has `current_version`), `invalid_state` (transition not allowed from the current status), `appeal_already_used`, `base_version_stale` (place changed since the edit's baseline; rebase first), `later_edits_exist` (revert needs compensation), `already_claimed`, `last_owner`, `already_member`, `deletion_pending`. A retry with the original `Idempotency-Key` still returns the original result, never a 409.	`Problem`

GET/v1/me/rewardsPlanned

My jarmaq grant history (Beta; off until its tests pass)

Host: https://api.atasumaps.com · listMyRewards
Access: Any API key + signed-in user (Atasuai)
Metering: Not metered

The Atasuai wallet is the ledger of record; this lists the map side's grant records only. Returns 403 feature_disabled until rewards are switched on.

Parameters

Name	In	Type	Required	Description
`cursor`	query	`string`		Opaque cursor from the previous page's `next_cursor`.
`limit`	query	`integer`

Responses

Status	Description	Type
`200`	Grants, newest first	`RewardGrantPage`
`401`	Missing or invalid credentials (`unauthenticated`, `key_invalid`, `key_revoked`, `token_expired`, `token_invalid`)	`Problem`
`403`	Authenticated but not allowed (`scope_denied`, `key_restriction_failed`, `forbidden`, `user_banned`, `mfa_required`, `self_moderation_forbidden`, `feature_disabled`)	`Problem`

Me

Responses

Parameters

Request body MeUpdate

Responses

Parameters

Request body DeviceRegister

Responses

Parameters

Responses

Parameters

Responses

Parameters

Request body ExpectedVersionOnly

Responses

Parameters

Request body AppealCreate

Responses

Parameters

Responses

Responses

Parameters

Request body DeletionRequestCreate

Responses

Parameters

Responses

Request body `MeUpdate`

Request body `DeviceRegister`

Request body `ExpectedVersionOnly`

Request body `AppealCreate`

Request body `DeletionRequestCreate`