Skip to content
Jonathan Wu edited this page Mar 10, 2024 · 9 revisions

Welcome

This page describes CTFOJ's API and how to use it. All endpoints labelled with Login required signify that they need to be authenticated, either by a session cookie or an API key.

To get started, generate an API key on the settings page.

Issues/Troubleshooting

Found a bug? File a bug report here

Authenticated Requests

All GET requests that require authentication should pass the api key as a query parameter. For example, /api/endpoint?key=00000000-0000-0000-0000-000000000000

All POST requests that require authentication should pass the api key as part of the post data.

Responses

If the responses succeeds, the API endpoint will respond with a JSON string like the following:

{"status": "success", "data": {the data that was requested}}

If it fails, the API endpoint will respond with a JSON string like the following:

{"status": "fail", "message": "brief reason why it failed"}

Sample Responses

Request (curl):

curl 'http://localhost:5000/api/problem?id=helloworld&key=00000000-0000-0000-0000-000000000000'

Response:

{"status": "success", "data": {"description": "Here is a sample Hello World problem. It can include [links](https://www.youtube.com/watch?v=dQw4w9WgXcQ) because it uses Markdown!\n\nThe flag for this problem is: `CTF{welcome_to_ctf_club}`", "hints": "", "editorial": ""}}

Response (pretty):

{
    "status": "success",
    "data": {
        "description": "Here is a sample Hello World problem. It can include [links](https://www.youtube.com/watch?v=dQw4w9WgXcQ) because it uses Markdown!\n\nThe flag for this problem is: `CTF{welcome_to_ctf_club}`",
        "hints": "",
        "editorial": ""
    }
}

API Endpoints

GET /api/problem

Login required

Usage

This endpoint is used to get the problem description, hints, and editorial with the specified problem id.

URL Parameters

key - your API key
id - the problem id

Sample Request

curl 'http://localhost:5000/api/problem?id=helloworld&key=00000000-0000-0000-0000-000000000000'
Sample Response
{
    "status": "success",
    "data": {
        "description": "A sample practice problem",
        "hints": "",
        "editorial": ""
    }
}

Responses

Status Code Meaning
400 Your request is malformed, likely because you did not include a problem id
401 You are unauthorized; make sure your API key is valid and included in your request
404 The problem doesn't exist
200 The request has succeeded

GET /api/instancer/query

Login required

Usage

TODO

URL Parameters

TODO

Sample Request

TODO

Responses

TODO

GET /api/instancer/create

Login required

Usage

TODO

URL Parameters

TODO

Sample Request

TODO

Responses

TODO

GET /api/instancer/destroy

Login required

Usage

TODO

URL Parameters

TODO

Sample Request

TODO

Responses

TODO

GET /api/contest/problem

Login required

Usage

This endpoint is used to get the problem description and hints with the specified contest and problem id.

URL Parameters

key - your API key
cid - the contest id
pid - the problem id

Sample Request

curl 'http://localhost:5000/api/contest/problem?cid=contest_id&pid=problem_id&key=00000000-0000-0000-0000-000000000000'
Sample Response
{
    "status": "success",
    "data": {
        "description": "A sample contest problem",
        "hints": "Unfortunately for you, this hint doesn't help"
    }
}

Response

Status Code Meaning
400 Your request is malformed, likely because you did not include a problem or contest id
401 You are unauthorized; make sure your API key is valid and included in your request
403 You are unauthorized; the contest has not started yet and you are not admin
404 The problem or contest doesn't exist
200 The request has succeeded

GET /api/contest/scoreboard

Usage

TODO

URL Parameters

TODO

Sample Request

TODO

Responses

TODO

GET /api/contests

Usage

This endpoint is used to get the description of the contests with the specified contest ids. If a contest requested doesn't exist, it will not exist in the response.

URL Parameters

key - your API key
id - a comma-separated list of contest ids

Sample Request

curl 'http://localhost:5000/api/contests?id=contest1,contest2,nonexistent&key=00000000-0000-0000-0000-000000000000'
Sample Response
{
    "status": "success",
    "data": {
        "contest1": "The description for contest1",
        "contest2": "The description for contest2"
    }
}

Response

Status Code Meaning
400 Your request is malformed, likely because you did not include any contest id
200 The request has succeeded

GET /api/announcements

Login special

Usage

This endpoint is used to get the contents of the first 10 announcements with valid specified ids. Authentication will be required if the site requires logging in to view announcements. If an announcement requested doesn't exist, it will not exist in the response.

URL Parameters

key - your API key (if required)
id - a comma-separated list of announcement ids

Sample Request

curl 'http://localhost:5000/api/announcement?id=1,2,9992730&key=00000000-0000-0000-0000-000000000000'
Sample Response
{
    "status": "success",
    "data": {
        "1": "The description for announcement 1",
        "2": "The description for announcement 2"
    }
}

Response

Status Code Meaning
400 Your request is malformed, likely because you did not include any announcement id
401 You are unauthorized; make sure your API key is valid and included in your request
200 The request has succeeded

GET /api/homepage

Login special

Usage

This endpoint is used to get the contents of the homepage, if it is enabled. If the homepage is disabled, admin authentication will be required.

URL Parameters

key - your API key (if required)

Sample Request

curl 'http://localhost:5000/api/homepage?key=00000000-0000-0000-0000-000000000000'
Sample Response
{
    "status": "success",
    "data": {
        "data": "Here is a sample homepage"
    }
}

Response

Status Code Meaning
401 You are unauthorized; make sure your API key is valid and included in your request
200 The request has succeeded

Undocumented API

These API endpoints are used internally, and should not be used.

  • POST /api/getkey