Open endpoints · no account

Public API

Everything a participant or auditor needs is readable without signing in. These are the calls the public pages and the CLI verifier make — there is nothing privileged behind them.

Verify a giveaway Protocol spec

These are served by the Supabase project directly, so the base URL is the project host. A stable api.opengiveaway.org alias can be pointed at it without any change to the calls below.

POST

Read a published giveaway

https://tfdqoqpowsxsthbrgrwj.supabase.co/rest/v1/rpc/get_public_giveawayAnonymous. Send the project's publishable key as apikey.

Everything the public pages render: status, prizes, entry count, commitment, block, and the winners once drawn. Unpublished giveaways — drafts, ones awaiting review, and approved-but-unpaid — return null.

Request

curl -X POST 'https://tfdqoqpowsxsthbrgrwj.supabase.co/rest/v1/rpc/get_public_giveaway' -H 'apikey: <publishable-key>' -H 'Content-Type: application/json' -d '{"p_team_slug":"acme","p_slug":"summer-launch"}'

Response shape

{
  "id": "uuid",
  "team": { "slug": "acme", "name": "Acme Studios" },
  "slug": "summer-launch",
  "title": "...",
  "status": "frozen" | "drawn" | ...,
  "entry_count": 124503,
  "winner_count": 5,
  "commitment": "<64 hex>",
  "merkle_root": "<64 hex>",
  "block_height": 968250,
  "block_hash": "<64 hex | null>",
  "seed": "<64 hex | null>",
  "prizes":  [{ "rank_from": 1, "rank_to": 1, "label": "...", "details": "..." }],
  "winners": [{ "rank": 1, "position": 41233, "prize": "...", "id_commit": "<64 hex>" }]
}

GET

Download the published artifacts

https://tfdqoqpowsxsthbrgrwj.supabase.co/storage/v1/object/public/artifacts/<giveaway_id>/<file>Anonymous, no key required. Plain static files.

The files every verifier reads. They are immutable once written, so they can be mirrored, archived or served from anywhere — verification does not have to go through us.

file	contents
`manifest.json`	everything that was committed
`commitment.txt`	SHA-256 of the canonical manifest
`shard_roots.bin`	top of the Merkle tree
`giveaway.ots`	OpenTimestamps proof of the commitment
`result.json`	winners, seed and block — after the draw
`shards/000000.bin`	full entry list — public lists only

POST

Fetch an inclusion proof

https://tfdqoqpowsxsthbrgrwj.supabase.co/functions/v1/lookup-entryAnonymous. Rate limited per instance; put a gateway limit in front in production.

Returns the salt and Merkle paths for one identifier. This is a convenience, not a trusted party: the browser checks the proof against the committed root itself, so a wrong or invented proof is rejected locally.

Request

curl -X POST 'https://tfdqoqpowsxsthbrgrwj.supabase.co/functions/v1/lookup-entry' -H 'Content-Type: application/json' -d '{"team":"acme","giveaway":"summer-launch","source":"x","identifier":"@alice"}'

{ "status": "included",
  "proof": { "position": 41233, "shard_index": 10, "local_index": 233,
             "salt": "<64 hex>", "shard_path": ["<64 hex>", ...],
             "top_path": ["<64 hex>", ...] } }

{ "status": "not_included" }

A proof reveals only that one entry. Nothing in the response says anything about anyone else on the list.

POST

Read the current fee tiers

https://tfdqoqpowsxsthbrgrwj.supabase.co/rest/v1/rpc/get_pricingAnonymous. Send the publishable key as apikey.

What the pricing page renders — tier amounts in integer cents and their entry ceilings.

{ "currency": "USD",
  "tier1_cents": 499,  "tier1_max": 1000000,
  "tier2_cents": 1000, "tier2_max": 20000000 }

Verify without writing any code

The CLI wraps all of the above, and adds the OpenTimestamps check the browser can't do.

npx opengiveaway-verify https://tfdqoqpowsxsthbrgrwj.supabase.co/storage/v1/object/public/artifacts/<giveaway_id>/

Browser verifier Protocol spec

Not documented here

Everything an organizer does — creating giveaways, uploading entries, paying, publishing — is authenticated and enforced by row-level security in the database rather than by an API layer. Those calls are not part of the public surface and may change without notice. The endpoints on this page are the ones verification depends on, and those are meant to stay put.