Geotrackable.com

Android app setup

In the Android Sync tab, save only the site origin as the endpoint. Do not add /api.

https://Geotrackable.com

Sign in by posting local account credentials to /api/auth/login?useCookies=false&useSessionCookies=false, then send the returned bearer token in the Authorization header.

Expected responses

Protected routes return HTTP 401 until the client sends a bearer token. Opening a POST-only route in a browser returns HTTP 405 because the browser sends GET.

Each offline sync cycle must push first and pull second.

An unknown API path returns HTTP 404. A known path called with the wrong verb normally returns HTTP 405 and may include an Allow header. The delete-only /api/account path intentionally has no GET endpoint, so GET /api/account returns an actionable 404; use /api/auth/manage/info for account reads.

Check the host, sign in, and confirm the token before calling private routes.

The current account information route comes from the framework identity API. The separate account route is only for permanent deletion.

Health check

This route is anonymous and is the fastest way to confirm that the production API host is reachable.

curl "https://Geotrackable.com/api/system/status"
{
  "status": "online",
  "utcNow": "2026-06-20T12:00:00Z",
  "androidBetaPageUrl": "https://Geotrackable.com/en-US/Account/Beta"
}

Register

Create a local account with an email, password, and public profile user name before requesting a bearer token. User names may contain lowercase letters, numbers, and underscores only.

curl -X POST "https://Geotrackable.com/api/auth/register" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "tester@example.com",
    "userName": "trail_tester",
    "password": "StrongP@ssw0rd!"
  }'

Bearer login

Use local account credentials with cookies disabled when a script, app, or API client needs a bearer token.

curl -X POST "https://Geotrackable.com/api/auth/login?useCookies=false&useSessionCookies=false" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "tester@example.com",
    "password": "StrongP@ssw0rd!"
  }'
{
  "tokenType": "Bearer",
  "accessToken": "eyJhbGciOi..."
}

Current account and profile

There is no GET /api/account profile endpoint. Use the identity manage-info endpoint for signed-in account metadata, and use the website profile pages for public profile display.

GET /api/account is not a published read route.

GET /api/auth/manage/info returns signed-in identity details.

DELETE /api/account permanently deletes the current account.

curl "https://Geotrackable.com/api/auth/manage/info" \
  -H "Authorization: Bearer <access token>"

Start with these routes when checking an Android or API-client connection.

Method Route
GET /api/system/status
POST /api/auth/register
POST /api/auth/login?useCookies=false&useSessionCookies=false
GET /api/auth/manage/info
POST /api/sync/push
POST /api/sync/pull
GET /api/notes/public/bounds
GET /api/notes/public/nearby
GET /api/categories/mine
GET /api/notes/mine
GET /api/trackables/public
POST /api/trackables/lookup
GET /api/trackables/active
DELETE /api/account

Public map reads are anonymous; personal location and category writes require bearer auth.

Geotrackable uses Locations language on the website, while the API route names still use the shared notes contracts underneath.

Public locations in map bounds

Use bounds when your client already has a map viewport and wants visible public location notes for that area.

curl "https://Geotrackable.com/api/notes/public/bounds?minLatitude=41.78&minLongitude=-87.75&maxLatitude=41.96&maxLongitude=-87.54&contentLanguage=en-US"
[
  {
    "noteId": "4d6c5df3-3c53-4d0e-8e72-7d98a0f8a9f3",
    "title": "Trailhead parking",
    "body": "Small public lot near the north entrance.",
    "contentLanguage": "en-US",
    "latitude": 41.8818,
    "longitude": -87.6231,
    "visibility": "Public",
    "updatedUtc": "2026-06-20T12:00:00Z"
  }
]

Create a personal location

A signed-in caller can create private or public locations. Public locations require an authenticated account, not anonymous local-only storage.

curl -X POST "https://Geotrackable.com/api/notes/mine" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "categoryId": "4de6bb76-f25d-4c73-b8e3-81b9ca3bf08f",
    "title": "Cache hide approach",
    "body": "Use the east footpath after rain.",
    "contentLanguage": "en-US",
    "latitude": 41.8818,
    "longitude": -87.6231,
    "visibility": "Private",
    "commentPolicy": "Disabled"
  }'
curl -X POST "https://Geotrackable.com/api/categories/mine" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Weekend route checks",
    "contentLanguage": "en-US",
    "parentCategoryId": null
  }'

Push local changes first, then pull the server view for the user and current public area.

Both sync routes require bearer auth. Anonymous private locations can stay local on the device, but they are not accepted by the server sync API.

Push request

curl -X POST "https://Geotrackable.com/api/sync/push" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "deviceId": "5dd06ca7-34a5-4f2e-812d-3f1ef3e48290",
    "notes": [
      {
        "noteId": "ef90c4ca-88a9-4a9b-b3a8-36e2649c5dcb",
        "ownerUserId": "a7cfd28f-c17f-4cf7-8913-47fa10fd0d1f",
        "categoryId": "ca90c4ca-88a9-4a9b-b3a8-36e2649c5dcb",
        "title": "Offline field stop",
        "body": "Saved while disconnected.",
        "contentLanguage": "en-US",
        "latitude": 41.8818,
        "longitude": -87.6231,
        "visibility": 0,
        "isDeleted": false,
        "updatedUtc": "2026-06-20T12:05:00Z",
        "clientMutationId": "android-offline-42",
        "teamId": null
      }
    ],
    "categories": [
      {
        "categoryId": "ca90c4ca-88a9-4a9b-b3a8-36e2649c5dcb",
        "ownerUserId": "a7cfd28f-c17f-4cf7-8913-47fa10fd0d1f",
        "name": "Offline field notes",
        "contentLanguage": "en-US",
        "teamId": null,
        "parentCategoryId": null,
        "sortOrder": 0,
        "isDeleted": false,
        "updatedUtc": "2026-06-20T12:04:00Z"
      }
    ]
  }'

Every note must reference a category already visible to the signed-in account or a category included in the same push. Keep the categoryId identical in both records when creating them offline together.

Pull request

curl -X POST "https://Geotrackable.com/api/sync/pull" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "lastSyncUtc": "2026-06-20T11:30:00Z",
    "publicArea": {
      "minLatitude": 41.78,
      "minLongitude": -87.75,
      "maxLatitude": 41.96,
      "maxLongitude": -87.54
    }
  }'
{
  "serverSyncUtc": "2026-06-20T12:06:00Z",
  "userNotes": [],
  "userCategories": [],
  "teamCategories": [],
  "publicNotes": [],
  "teamNotes": []
}

Resolve push conflicts before pulling

A valid push can return HTTP 200 with a conflicts collection. That is a per-entity synchronization result, not a transport failure. Every conflict includes the entityId, entityType, human reason, stable code, and a concrete action.

{
  "entityId": "ef90c4ca-88a9-4a9b-b3a8-36e2649c5dcb",
  "entityType": "Note",
  "reason": "Incoming note update is stale.",
  "code": "stale_update",
  "action": "Pull the current server copy, merge or discard the local edit, and then push a newer update."
}

Do not silently loop a rejected entity. stale_update requires a pull and merge decision; team_membership_required requires refreshed membership; online_team_management_required moves the change to the online team APIs; entity_ownership_conflict means the server copy wins for this account.

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

Secret codes and private QR payloads are sensitive credentials. Normal read routes do not return them after creation.

The secretCode property on POST /api/trackables is optional. Omit it when you want Geotrackable to generate a unique system secret code, or send an allowed custom value when a physical item already has a code you need to keep.

Public browse and lookup

curl "https://Geotrackable.com/api/trackables/public?contentLanguage=en-US"
curl -X POST "https://Geotrackable.com/api/trackables/lookup" \
  -c geotrackable.cookies \
  -H "Content-Type: application/json" \
  -d '{
    "code": "GT7F3K9"
  }'

Secret and QR lookup can create a browser-style active session. Keep the response cookie jar for later active-session calls, protect that file like a credential, and delete it when the session is no longer needed.

Create a trackable

The recommended request omits secretCode. An omitted, null, empty, or whitespace-only value asks the server to generate the code. A non-empty value is a request for that exact custom code after normalization and availability checks.

curl -X POST "https://Geotrackable.com/api/trackables" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Scout trail coin",
    "description": "Move this coin along family-friendly trails.",
    "visibility": "AlwaysVisibleToEveryone",
    "activateImmediately": true
  }'

Request a specific secret code

Send secretCode only when the item already has a custom identifier. If the normalized value is available, the server honors it and returns HTTP 201. The generated public code is separate and is still assigned by Geotrackable.

curl -X POST "https://Geotrackable.com/api/trackables" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Existing event tag",
    "description": "Uses the identifier already printed on the tag.",
    "visibility": "VisibleOnceAccessed",
    "activateImmediately": true,
    "secretCode": "TAG42"
  }'

Custom codes must be no longer than 32 characters and available across the public and secret trackable-code namespace. Codes beginning with GT, LN, TB, GK, or GC are reserved for system-issued or origin-site identifiers and cannot be adopted as custom Geotrackable secret codes.

Creation response is the one-time reveal

Save the returned secretCode and scanUrl immediately. Later list, detail, lookup, comment, and journey routes intentionally do not reveal those credentials again.

HTTP/1.1 201 Created
{
  "trackableId": "13a2c0b1-582f-4a7b-92aa-16922f7bdb63",
  "heading": "Scout trail coin",
  "items": [
    {
      "trackableId": "13a2c0b1-582f-4a7b-92aa-16922f7bdb63",
      "name": "Scout trail coin",
      "publicCode": "GT-7F3K9Q",
      "secretCode": "GT8M2Q7V",
      "scanUrl": "https://geotrackable.com/trackable/<private-qr-token>",
      "qrPayload": "<private-qr-token>"
    }
  ]
}

Active secret access

After a browser enters a valid secret code or scan payload, the active-session routes show what that browser can currently reopen.

curl "https://Geotrackable.com/api/trackables/active" \
  -b geotrackable.cookies
curl -X POST "https://Geotrackable.com/api/trackables/active/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/message" \
  -b geotrackable.cookies \
  -H "Content-Type: application/json" \
  -d '{
    "statusMessage": "Live hunt in progress"
  }'

When the requested code is already taken

A custom-code collision returns HTTP 409 with code trackable_secret_code_taken. The request has not created a trackable. Do not keep retrying the same value: omit secretCode to receive a generated code, or choose a different allowed custom code.

{
  "type": "/en-US/api-docs#errors-and-problem-details",
  "title": "Requested secret code is unavailable.",
  "status": 409,
  "detail": "That secret code is already in use by another Geotrackable identifier. Supplying a secret code is optional: omit it to receive a unique system-generated code, or choose a different code.",
  "instance": "/api/trackables",
  "code": "trackable_secret_code_taken",
  "field": "secretCode",
  "action": "Omit secretCode to receive a unique system-generated code, or submit a different allowed secretCode.",
  "requestId": "0HN7EXAMPLE:00000001",
  "documentation": "/en-US/api-docs#errors-and-problem-details"
}

Reserved-prefix recovery

Reserved or invalid custom values return a problem response with an action and documentation link. The safe fallback is always to remove secretCode from the create request.

Log a journey stop

A direct journey stop is the lightweight route update when a full location note is not needed.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/journey-stops" \
  -H "Content-Type: application/json" \
  -d '{
    "latitude": 41.8818,
    "longitude": -87.6231,
    "accessCode": "GT-SECRET-OR-SCAN-PAYLOAD"
  }'

Comment on a trackable

Signed-in callers can comment with their bearer identity. Anonymous callers can also comment on an activated trackable when this client has the active secret-backed session or sends the accessCode for this exact item.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments" \
  -b geotrackable.cookies \
  -H "Content-Type: application/json" \
  -d '{
    "body": "Found near the overlook and moved west.",
    "accessCode": ""
  }'

About Trackables

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

Create a team

curl -X POST "https://Geotrackable.com/api/teams" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "trail-club",
    "title": "Trail Club",
    "description": "Weekend route and trackable group.",
    "joinPolicy": "RequestsAllowed",
    "pageVisibility": "Public",
    "defaultNoteVisibility": "Public",
    "contentLanguage": "en-US"
  }'

Create an invite link

curl -X POST "https://Geotrackable.com/api/teams/73edb511-cd8c-4888-8c45-3a04b3d6da11/invite-links" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "isSingleUse": false
  }'
curl -X POST "https://Geotrackable.com/api/teams/invite-links/trail-club/INVITE-CODE/join" \
  -H "Authorization: Bearer <access token>"

About Teams

Media and support routes follow the visibility of the page or content they are attached to.

Images

List reads can be anonymous when the parent page is public-safe. Upload and delete routes require bearer auth.

curl "https://Geotrackable.com/api/images/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"
curl -X POST "https://Geotrackable.com/api/images/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@trail-coin.jpg"

External link verification

Verify an external link before storing it on a location, team, trackable, or trackable group.

curl -X POST "https://Geotrackable.com/api/external-links/verify" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/trail-guide"
  }'

Content and error reports

Use reports for public-page content concerns and errors for client-side diagnostics that support may need to review.

curl -X POST "https://Geotrackable.com/api/compliance/reports" \
  -H "Content-Type: application/json" \
  -d '{
    "pageType": "Trackable",
    "contentType": "Trackable",
    "pageTitle": "Scout trail coin",
    "pageUrl": "https://Geotrackable.com/trackable/GT7F3K9",
    "pageReference": "GT7F3K9",
    "contentLabel": "Trackable page",
    "contentReference": "13a2c0b1-582f-4a7b-92aa-16922f7bdb63",
    "contentPreview": "Move this coin along family-friendly trails.",
    "reportTitle": "Outdated public link",
    "reportExplanation": "The linked trail guide now points somewhere unexpected."
  }'

Delete account from the API

Authenticated clients can permanently delete the current account and synced personal data through the API. Read the Delete Data page first when you need export steps or shared trackable retention rules.

curl -X DELETE "https://Geotrackable.com/api/account" \
  -H "Authorization: Bearer <access token>"
{
  "deletedAccount": true,
  "notesDeleted": 14,
  "categoriesDeleted": 6,
  "linkedProvidersDeleted": 2
}

Delete data

Errors include the next useful action

API problem responses identify the failure with a stable code, explain the request-specific detail, and provide an action clients can show or follow. Use requestId when support needs to correlate the request with server diagnostics.

Read the error payload and recovery reference

Sign in

Handle the machine code, preserve the request ID, and follow the action instead of parsing English text.

API failures use application/problem+json and an RFC-style problem-details object. Human-readable title and detail text can improve over time or be localized; code is the stable value for program logic.

Problem response shape

Content-Type: application/problem+json
{
  "type": "/en-US/api-docs#errors-and-problem-details",
  "title": "Trackable access is required.",
  "status": 403,
  "detail": "This request needs access to this specific trackable.",
  "instance": "/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments",
  "code": "trackable_access_code_required",
  "action": "Sign in, keep this trackable active in this client, or provide its secret code or private QR access value.",
  "requestId": "0HN7EXAMPLE:00000002",
  "documentation": "/en-US/api-docs#errors-and-problem-details"
}

What each field is for

Validation errors include field names

HTTP 400 validation failures add an errors object. Each key is the JSON property or request area that needs correction, and each value is an array because one field can violate more than one rule.

{
  "type": "/en-US/api-docs#errors-and-problem-details",
  "title": "Request validation failed.",
  "status": 400,
  "detail": "One or more request fields are invalid. Correct every field listed in errors and submit the request again.",
  "instance": "/api/trackables",
  "code": "validation_failed",
  "action": "Correct every field listed in errors and submit the request again.",
  "requestId": "0HN7EXAMPLE:00000003",
  "documentation": "/en-US/api-docs#errors-and-problem-details",
  "errors": {
    "name": ["Name cannot be longer than 160 characters."],
    "secretCode": ["Secret code cannot be longer than 32 characters."]
  }
}

Malformed JSON and content type

Invalid JSON is a request validation failure. Preserve the requestId, fix the syntax, and send the body again with Content-Type: application/json. File-upload endpoints instead require multipart/form-data and a files or file part with the route-specific field name.

A syntactically valid body can still fail a business rule. Use errors for field-level issues, code for program logic, detail for context, and action for the next step. Do not display a raw server exception or stack trace to users.

Status What it means Recovery Retry guidance
400 Bad Request The JSON, query values, field constraints, or a business rule rejected the request. Read errors when present, otherwise read code, detail, and action. Correct the request before sending it again. Do not retry the unchanged request.
401 Unauthorized A protected route did not receive a usable bearer token. Login failures also use 401 without revealing whether an email exists. Acquire or refresh a token, confirm the Bearer scheme and host, and then repeat the intended call once. Retry only after authentication changes; repeated unchanged attempts will not help.
403 Forbidden The caller is known but lacks the required ownership, team role, active trackable session, or secret-backed access. Follow action: use an eligible account, request access, activate the item, or provide access for that exact trackable. Do not retry until access state changes.
404 Not Found The route or resource was not found. Private resources can deliberately look missing when the caller may not learn that they exist. Confirm the method, route, GUID, public code, and current list state. Refresh stale client data. Do not loop. Retry only after correcting the identifier or refreshing state.
405 Method Not Allowed The path exists but the HTTP verb is wrong, such as opening a POST-only route with a browser GET. Use the method shown in this documentation and inspect the Allow response header when supplied. Retry only with the correct method and request shape.
409 Conflict The request is valid but conflicts with current server state, including a requested trackable secret code that is already taken. Reload current state or change the conflicting value. For trackable creation, omit secretCode for generation or choose another custom code. Do not retry the same create value; retry only after changing the request or state.
413 Content Too Large The request body or uploaded file set exceeds the accepted size. Reduce image count or size, split the upload when the workflow permits it, and keep metadata requests separate from media. Retry only with a smaller payload.
415 Unsupported Media Type The body encoding does not match the endpoint. Use application/json for JSON endpoints and multipart/form-data for image or GPX upload endpoints. Let the HTTP library generate multipart boundaries. Retry only after correcting Content-Type and body encoding.
429 Too Many Requests The client has exceeded a request limit or is sending bursts too quickly. Honor Retry-After when present, reduce concurrency, cache public reads, and coalesce duplicate requests. Wait for Retry-After; otherwise use exponential backoff with jitter and a retry cap.
500 Internal Server Error An unexpected failure was logged by Geotrackable. The response does not expose stack traces or internal secrets. Keep requestId and ticketNumber when present, then contact support with the time, method, route template, status, and code. Retry safe reads after a delay. Do not blindly repeat a create or other non-idempotent write when its commit state is unknown.

Retry writes deliberately

GET requests are normally safe to retry. A POST can create data even when the client times out before receiving the response. Before repeating trackable creation, refresh GET /api/trackables/mine and reconcile the result so a network timeout does not create duplicate physical items.

For 429 or a transient 500, use bounded exponential backoff with jitter. Stop when the action says the request itself must change. Never turn a 400, 403, 404, 405, 409, 413, or 415 into an automatic retry loop.

Keep diagnostics useful without leaking credentials

Never log Authorization headers, bearer or refresh tokens, passwords, cookies, secretCode, accessCode, QR payloads, private scan URLs, or raw /trackable/{code} entry paths. Redact them before telemetry, crash reporting, screenshots, and support attachments.

Safe diagnostic fields include requestId, ticketNumber, HTTP status, stable code, method, route template, client version, and a timestamp. Do not copy the full request body when it can contain location text, exact coordinates, contact details, or a trackable credential.

POST /api/trackables -> 409
code=trackable_secret_code_taken
requestId=0HN7EXAMPLE:00000001
secretCode=[REDACTED]

Published Geotrackable API routes

This table is generated from the running Geotrackable endpoint table so the published documentation stays aligned with the host.

Method Route Access
DELETE /api/account Authorization required
GET /api/auth/confirmEmail Anonymous
POST /api/auth/forgotPassword Anonymous
POST /api/auth/login Anonymous
POST /api/auth/manage/2fa Authorization required
GET /api/auth/manage/info Authorization required
POST /api/auth/manage/info Authorization required
POST /api/auth/refresh Anonymous
POST /api/auth/register Anonymous
POST /api/auth/resendConfirmationEmail Anonymous
POST /api/auth/resetPassword Anonymous
GET /api/categories/mine Authorization required
POST /api/categories/mine Authorization required
GET /api/categories/mine/tree Authorization required
GET /api/categories/mine/tree/children Authorization required
GET /api/categories/mine/tree/sections Authorization required
DELETE /api/categories/mine/{categoryId} Authorization required
POST /api/categories/mine/{categoryId}/move Authorization required
POST /api/compliance/errors Anonymous
GET /api/compliance/reports Authorization required
POST /api/compliance/reports Anonymous
GET /api/compliance/reports/mine Authorization required
GET /api/compliance/reports/{contentReportId} Authorization required
PUT /api/compliance/reports/{contentReportId} Authorization required
POST /api/external-links/verify Authorization required
GET /api/images/notes/{noteId} Anonymous
POST /api/images/notes/{noteId} Authorization required
POST /api/images/profiles Authorization required
GET /api/images/profiles/{userId} Anonymous
GET /api/images/teams/{teamId} Anonymous
POST /api/images/teams/{teamId} Authorization required
GET /api/images/trackable-groups/{trackableGroupId} Anonymous
POST /api/images/trackable-groups/{trackableGroupId} Authorization required
GET /api/images/trackables/{trackableId} Anonymous
POST /api/images/trackables/{trackableId} Authorization required
DELETE /api/images/{contentImageId} Authorization required
GET /api/images/{contentImageId}/{variant} Anonymous
GET /api/locations/mine/gpx Authorization required
POST /api/locations/mine/gpx Authorization required
GET /api/notes/mine Authorization required
POST /api/notes/mine Authorization required
GET /api/notes/mine/gpx Authorization required
POST /api/notes/mine/gpx Authorization required
DELETE /api/notes/mine/{noteId} Authorization required
POST /api/notes/mine/{noteId}/move Authorization required
GET /api/notes/public/bounds Anonymous
GET /api/notes/public/nearby Anonymous
GET /api/public/notes/{noteId} Anonymous
GET /api/public/notes/{noteId}/comments Anonymous
POST /api/public/notes/{noteId}/comments Authorization required
GET /api/public/notes/{noteId}/trackables Anonymous
POST /api/public/notes/{noteId}/trackables Authorization required
GET /api/public/profiles/{userName}/notes/nearby Anonymous
GET /api/public/teams/{teamName}/notes/nearby Anonymous
POST /api/sync/pull Authorization required
POST /api/sync/push Authorization required
GET /api/system/beta-android Anonymous
GET /api/system/coordinate-locality Anonymous
GET /api/system/ip-location Anonymous
GET /api/system/status Anonymous
GET /api/teams Authorization required
POST /api/teams Authorization required
POST /api/teams/invite-links/{teamSlug}/{inviteCode}/join Authorization required
DELETE /api/teams/{teamId} Authorization required
GET /api/teams/{teamId}/categories Authorization required
POST /api/teams/{teamId}/categories Authorization required
GET /api/teams/{teamId}/categories/tree Authorization required
GET /api/teams/{teamId}/categories/tree/children Authorization required
GET /api/teams/{teamId}/categories/tree/sections Authorization required
DELETE /api/teams/{teamId}/categories/{categoryId} Authorization required
POST /api/teams/{teamId}/categories/{categoryId}/move Authorization required
GET /api/teams/{teamId}/invite-links Authorization required
POST /api/teams/{teamId}/invite-links Authorization required
DELETE /api/teams/{teamId}/invite-links/{inviteLinkId} Authorization required
GET /api/teams/{teamId}/locations/gpx Authorization required
POST /api/teams/{teamId}/locations/gpx Authorization required
POST /api/teams/{teamId}/memberships/invite Authorization required
POST /api/teams/{teamId}/memberships/request Authorization required
DELETE /api/teams/{teamId}/memberships/{membershipId} Authorization required
POST /api/teams/{teamId}/memberships/{membershipId}/accept Authorization required
POST /api/teams/{teamId}/memberships/{membershipId}/approve Authorization required
POST /api/teams/{teamId}/memberships/{membershipId}/deny Authorization required
POST /api/teams/{teamId}/memberships/{membershipId}/promote-admin Authorization required
POST /api/teams/{teamId}/memberships/{membershipId}/refuse Authorization required
GET /api/teams/{teamId}/notes Authorization required
POST /api/teams/{teamId}/notes Authorization required
GET /api/teams/{teamId}/notes/gpx Authorization required
POST /api/teams/{teamId}/notes/gpx Authorization required
DELETE /api/teams/{teamId}/notes/{noteId} Authorization required
DELETE /api/teams/{teamId}/notes/{noteId}/delete Authorization required
POST /api/teams/{teamId}/notes/{noteId}/move Authorization required
PUT /api/teams/{teamId}/settings Authorization required
POST /api/trackables Authorization required
GET /api/trackables/active Anonymous
GET /api/trackables/active-indicator Anonymous
DELETE /api/trackables/active/{trackableId} Anonymous
GET /api/trackables/active/{trackableId} Anonymous
POST /api/trackables/active/{trackableId}/deactivate Anonymous
POST /api/trackables/active/{trackableId}/message Anonymous
POST /api/trackables/groups Authorization required
DELETE /api/trackables/groups/{trackableGroupId}/watch Authorization required
POST /api/trackables/groups/{trackableGroupId}/watch Authorization required
POST /api/trackables/legacy-lookup Anonymous
GET /api/trackables/lookup Anonymous
POST /api/trackables/lookup Anonymous
GET /api/trackables/mine Authorization required
GET /api/trackables/public Anonymous
GET /api/trackables/{trackableId} Anonymous
POST /api/trackables/{trackableId}/activate Authorization required
GET /api/trackables/{trackableId}/comments Anonymous
POST /api/trackables/{trackableId}/comments Anonymous
DELETE /api/trackables/{trackableId}/comments/{commentId} Authorization required
PUT /api/trackables/{trackableId}/comments/{commentId} Authorization required
DELETE /api/trackables/{trackableId}/group Authorization required
POST /api/trackables/{trackableId}/group Authorization required
GET /api/trackables/{trackableId}/journey Anonymous
POST /api/trackables/{trackableId}/journey-stops Anonymous
DELETE /api/trackables/{trackableId}/journey-stops/{journeyStopId} Authorization required
DELETE /api/trackables/{trackableId}/watch Authorization required
POST /api/trackables/{trackableId}/watch Authorization required

DELETE /api/account

Authenticated clients can permanently delete the current account and synced personal data through the API. Read the Delete Data page first when you need export steps or shared trackable retention rules.

curl -X DELETE "https://Geotrackable.com/api/account" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns deletion counts after the signed-in account and eligible personal data were permanently removed. A successful response signs the current session out.

Common failures and recovery

401 requires a valid bearer token. 400 explains why deletion cannot complete. Account deletion is destructive: do not automatically retry after an unknown timeout; check sign-in state first.

GET /api/auth/confirmEmail

Complete email confirmation with the user ID and URL-encoded confirmation code from the confirmation link.

curl "https://Geotrackable.com/api/auth/confirmEmail?userId=13a2c0b1-582f-4a7b-92aa-16922f7bdb63&code=URL_ENCODED_CONFIRMATION_CODE"

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/forgotPassword

Start an email-based account recovery or confirmation workflow. The response deliberately does not reveal whether the email address exists.

curl -X POST "https://Geotrackable.com/api/auth/forgotPassword" \
  -H "Content-Type: application/json" \
  -d '{ "email": "api-user@example.com" }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/login

Exchange local account credentials, and a two-factor value when required, for bearer and refresh tokens. API clients must keep cookies disabled.

curl -X POST "https://Geotrackable.com/api/auth/login?useCookies=false&useSessionCookies=false" \
  -H "Content-Type: application/json" \
  -d '{ "email": "api-user@example.com", "password": "Use-a-strong-password-123!" }'

Successful response

HTTP 200 returns tokenType, accessToken, expiration data, and the signed-in user summary. Store credentials in platform-secure storage and never log them.

Common failures and recovery

400 covers malformed JSON or missing fields. 401 authentication_failed deliberately does not reveal whether the email exists; verify credentials or use the password-reset flow before retrying. A 401 two_factor_required response keeps requiresTwoFactor true and tells the client to repeat login with either twoFactorCode or twoFactorRecoveryCode.

POST /api/auth/manage/2fa

Enable, disable, reset, or inspect two-factor authentication for the signed-in account. Authenticator and recovery values are sensitive credentials.

curl -X POST "https://Geotrackable.com/api/auth/manage/2fa" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "enable": true, "twoFactorCode": "123456", "resetSharedKey": false, "resetRecoveryCodes": false, "forgetMachine": false }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

GET /api/auth/manage/info

Read the signed-in account email and confirmation state, or update the email/password with the current password when required.

curl "https://Geotrackable.com/api/auth/manage/info" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/manage/info

Read the signed-in account email and confirmation state, or update the email/password with the current password when required.

curl -X POST "https://Geotrackable.com/api/auth/manage/info" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "newEmail": "new-api-user@example.com", "oldPassword": "Use-a-strong-password-123!" }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/refresh

Exchange a still-usable refresh token for a new access-token response without resending the account password.

curl -X POST "https://Geotrackable.com/api/auth/refresh" \
  -H "Content-Type: application/json" \
  -d '{ "refreshToken": "<refresh token from login>" }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/register

Create a local account with an email address, public user name, and strong password. Registration does not return a bearer token; sign in next.

curl -X POST "https://Geotrackable.com/api/auth/register" \
  -H "Content-Type: application/json" \
  -d '{ "email": "api-user@example.com", "userName": "api_trail_user", "password": "Use-a-strong-password-123!" }'

Successful response

HTTP 200 means the local account was created. The response has no bearer token; call the login route next.

Common failures and recovery

400 validation_failed identifies malformed JSON or email, password, and userName field errors. Correct the listed errors; duplicate values require a different email or public user name.

POST /api/auth/resendConfirmationEmail

Start an email-based account recovery or confirmation workflow. The response deliberately does not reveal whether the email address exists.

curl -X POST "https://Geotrackable.com/api/auth/resendConfirmationEmail" \
  -H "Content-Type: application/json" \
  -d '{ "email": "api-user@example.com" }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

POST /api/auth/resetPassword

Complete password recovery with the exact reset code from email and a new strong password. Reset codes are credentials and must not be logged.

curl -X POST "https://Geotrackable.com/api/auth/resetPassword" \
  -H "Content-Type: application/json" \
  -d '{ "email": "api-user@example.com", "resetCode": "URL_ENCODED_RESET_CODE", "newPassword": "Use-a-new-strong-password-456!" }'

Successful response

HTTP 200 means the identity operation completed. Read the returned identity payload when the operation provides one; password and confirmation operations can intentionally return an empty success body.

Common failures and recovery

400 includes field-level identity validation guidance; 401 means the bearer token or credentials are unusable. Follow action and do not retry unchanged credentials in a loop.

GET /api/categories/mine

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/categories/mine" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the personal category list, management tree, sections, or requested children. Empty branches are successful.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/categories/mine

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/categories/mine" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Trail research", "contentLanguage": "en-US", "parentCategoryId": null }'

Successful response

HTTP 200 returns the created or moved category, or acknowledges deletion after descendant rules are satisfied.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/categories/mine/tree

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/categories/mine/tree" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the personal category list, management tree, sections, or requested children. Empty branches are successful.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/categories/mine/tree/children

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/categories/mine/tree/children" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the personal category list, management tree, sections, or requested children. Empty branches are successful.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/categories/mine/tree/sections

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/categories/mine/tree/sections" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the personal category list, management tree, sections, or requested children. Empty branches are successful.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

DELETE /api/categories/mine/{categoryId}

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X DELETE "https://Geotrackable.com/api/categories/mine/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the created or moved category, or acknowledges deletion after descendant rules are satisfied.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/categories/mine/{categoryId}/move

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/categories/mine/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/move" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "parentCategoryId": null }'

Successful response

HTTP 200 returns the created or moved category, or acknowledges deletion after descendant rules are satisfied.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/compliance/errors

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/compliance/errors" \
  -H "Content-Type: application/json" \
  -d '{ "requestUrl": "/api/example", "httpMethod": "POST", "responseStatusCode": 500, "traceIdentifier": "0HN7EXAMPLE:00000004", "userExplanation": "The save failed after the map was updated." }'

Successful response

HTTP 200 or 201 returns an error ticket receipt. HTTP 200 means the request was attached to an existing ticket; HTTP 201 means a new ticket was created.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

GET /api/compliance/reports

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/compliance/reports" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the report or report collection visible to the signed-in reporter or authorized administrator.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

POST /api/compliance/reports

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/compliance/reports" \
  -H "Content-Type: application/json" \
  -d '{ "pageType": "Trackable", "contentType": "Trackable", "pageTitle": "Scout trail coin", "pageUrl": "/trackable/GT-EXAMPLE", "reportTitle": "Outdated public link", "reportExplanation": "The destination is no longer related to this trackable." }'

Successful response

HTTP 201 returns the content-report receipt and report identifier for later follow-up.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

GET /api/compliance/reports/mine

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/compliance/reports/mine" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the report or report collection visible to the signed-in reporter or authorized administrator.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

GET /api/compliance/reports/{contentReportId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/compliance/reports/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the report or report collection visible to the signed-in reporter or authorized administrator.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

PUT /api/compliance/reports/{contentReportId}

Media and support routes follow the visibility of the page or content they are attached to.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X PUT "https://Geotrackable.com/api/compliance/reports/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the report or report collection visible to the signed-in reporter or authorized administrator.

Common failures and recovery

400 explains missing report context or invalid workflow state; 401 protects personal/admin lists; 403 requires the appropriate reporter or SuperAdmin role; 404 means preserve the ID but refresh the report list.

POST /api/external-links/verify

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/external-links/verify" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/resource" }'

Successful response

HTTP 200 returns the normalized destination, verified page title, and safe metadata the editor can use before saving the link.

Common failures and recovery

400 includes detail, action, supportUrl, and upstreamStatusCode when available. Correct blocked, private-network, malformed, unreachable, or unsupported destinations before retrying verification.

GET /api/images/notes/{noteId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible managed image metadata for that profile, note, team, trackable, or group; an empty array is valid.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

POST /api/images/notes/{noteId}

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/images/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@example.jpg"

Successful response

HTTP 200 returns managed image metadata and URLs after screening and JPEG variant processing. Use the returned URLs instead of assuming the original filename survives.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

POST /api/images/profiles

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/images/profiles" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@example.jpg"

Successful response

HTTP 200 returns managed image metadata and URLs after screening and JPEG variant processing. Use the returned URLs instead of assuming the original filename survives.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/images/profiles/{userId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/profiles/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible managed image metadata for that profile, note, team, trackable, or group; an empty array is valid.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/images/teams/{teamId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible managed image metadata for that profile, note, team, trackable, or group; an empty array is valid.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

POST /api/images/teams/{teamId}

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/images/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@example.jpg"

Successful response

HTTP 200 returns managed image metadata and URLs after screening and JPEG variant processing. Use the returned URLs instead of assuming the original filename survives.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/images/trackable-groups/{trackableGroupId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/trackable-groups/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible managed image metadata for that profile, note, team, trackable, or group; an empty array is valid.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

POST /api/images/trackable-groups/{trackableGroupId}

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/images/trackable-groups/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@example.jpg"

Successful response

HTTP 200 returns managed image metadata and URLs after screening and JPEG variant processing. Use the returned URLs instead of assuming the original filename survives.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/images/trackables/{trackableId}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible managed image metadata for that profile, note, team, trackable, or group; an empty array is valid.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

POST /api/images/trackables/{trackableId}

Media and support routes follow the visibility of the page or content they are attached to.

curl -X POST "https://Geotrackable.com/api/images/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -F "files=@example.jpg"

Successful response

HTTP 200 returns managed image metadata and URLs after screening and JPEG variant processing. Use the returned URLs instead of assuming the original filename survives.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

DELETE /api/images/{contentImageId}

Media and support routes follow the visibility of the page or content they are attached to.

curl -X DELETE "https://Geotrackable.com/api/images/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 204 confirms the image and its managed variants were deleted; there is no response body.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/images/{contentImageId}/{variant}

Media and support routes follow the visibility of the page or content they are attached to.

curl "https://Geotrackable.com/api/images/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/thumbnail"

Successful response

HTTP 200 streams the requested visible JPEG variant with an image content type.

Common failures and recovery

400 image_variant_invalid lists the supported download variants and other 400 responses explain screening constraints; 401/403 require a valid owner or team-admin context; 404 means the content is missing or not visible; 500 image_variant_unavailable means metadata exists but the stored variant could not be served. 413 requires fewer or smaller files; 415 requires multipart/form-data for uploads.

GET /api/locations/mine/gpx

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/locations/mine/gpx" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 downloads GPX containing the eligible mapped waypoints in this scope.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/locations/mine/gpx

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/locations/mine/gpx" \
  -H "Authorization: Bearer <access token>" \
  -F "file=@waypoints.gpx"

Successful response

HTTP 200 returns import counts and item-level results after the GPX waypoint file is processed.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/notes/mine

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/notes/mine" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/notes/mine

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/notes/mine" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "title": "Trailhead", "body": "Parking and route notes.", "contentLanguage": "en-US", "latitude": 41.8818, "longitude": -87.6231, "visibility": "Private" }'

Successful response

HTTP 200 returns the saved note, comment, attachment, move result, or deletion acknowledgement for the requested scope.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/notes/mine/gpx

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/notes/mine/gpx" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 downloads GPX containing the eligible mapped waypoints in this scope.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/notes/mine/gpx

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/notes/mine/gpx" \
  -H "Authorization: Bearer <access token>" \
  -F "file=@waypoints.gpx"

Successful response

HTTP 200 returns import counts and item-level results after the GPX waypoint file is processed.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

DELETE /api/notes/mine/{noteId}

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X DELETE "https://Geotrackable.com/api/notes/mine/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the saved note, comment, attachment, move result, or deletion acknowledgement for the requested scope.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

POST /api/notes/mine/{noteId}/move

Public map reads are anonymous; personal location and category writes require bearer auth.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/notes/mine/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/move" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the saved note, comment, attachment, move result, or deletion acknowledgement for the requested scope.

Common failures and recovery

400 identifies field, hierarchy, bounds, GPX, or move/delete rules; 401 requires a token; 403 requires ownership; 404 means refresh personal workspace state. Uploads can also return 413 or 415.

GET /api/notes/public/bounds

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/notes/public/bounds?minLatitude=41.78&minLongitude=-87.75&maxLatitude=41.96&maxLongitude=-87.54&contentLanguage=en-US"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

GET /api/notes/public/nearby

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/notes/public/nearby?latitude=41.8818&longitude=-87.6231&radiusKm=8&contentLanguage=en-US"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

GET /api/public/notes/{noteId}

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/public/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

GET /api/public/notes/{noteId}/comments

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/public/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments"

Successful response

HTTP 200 returns the visible comment panel, policy, and current comments. An empty comment list is a successful result.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

POST /api/public/notes/{noteId}/comments

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/public/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Found near the overlook.", "accessCode": "" }'

Successful response

HTTP 200 returns the saved comment state. Anonymous writes require this client's active session or an accessCode for this exact activated trackable.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

GET /api/public/notes/{noteId}/trackables

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/public/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/trackables"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

POST /api/public/notes/{noteId}/trackables

Public map reads are anonymous; personal location and category writes require bearer auth.

curl -X POST "https://Geotrackable.com/api/public/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/trackables" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "trackableSecretCodes": "TAG42", "selectedActiveTrackableIds": [] }'

Successful response

HTTP 200 returns the saved note, comment, attachment, move result, or deletion acknowledgement for the requested scope.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

GET /api/public/profiles/{userName}/notes/nearby

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/public/profiles/trail-guide/notes/nearby?latitude=41.8818&longitude=-87.6231&radiusKm=8&contentLanguage=en-US"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

GET /api/public/teams/{teamName}/notes/nearby

Public map reads are anonymous; personal location and category writes require bearer auth.

curl "https://Geotrackable.com/api/public/teams/trail-club/notes/nearby?latitude=41.8818&longitude=-87.6231&radiusKm=8&contentLanguage=en-US"

Successful response

HTTP 200 returns the visible note, comment, attachment, or map result. Empty collections are successful; a missing single resource returns 404.

Common failures and recovery

400 identifies incomplete bounds, invalid coordinate ranges, or invalid comment/attachment input; 403 protects restricted writes; 404 can hide a private or missing page. Correct the query as directed by errors and action.

POST /api/sync/pull

Push local changes first, then pull the server view for the user and current public area.

curl -X POST "https://Geotrackable.com/api/sync/pull" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "lastSyncUtc": "2026-06-20T11:30:00Z", "publicArea": { "minLatitude": 41.78, "minLongitude": -87.75, "maxLatitude": 41.96, "maxLongitude": -87.54 } }'

Successful response

HTTP 200 returns the current personal, public, and team synchronization view. Call this after push in each offline cycle.

Common failures and recovery

400 identifies malformed sync envelopes or a request rejected before processing; 401 requires a new bearer token. Per-entity reconciliation problems return HTTP 200 inside conflicts with code and action. Never retry push blindly after an unknown timeout.

POST /api/sync/push

Push local changes first, then pull the server view for the user and current public area.

curl -X POST "https://Geotrackable.com/api/sync/push" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "deviceId": "5dd06ca7-34a5-4f2e-812d-3f1ef3e48290", "notes": [], "categories": [] }'

Successful response

HTTP 200 acknowledges accepted client changes and reports synchronization results. Preserve client IDs so the following pull can reconcile the same records.

Common failures and recovery

400 identifies malformed sync envelopes or a request rejected before processing; 401 requires a new bearer token. Per-entity reconciliation problems return HTTP 200 inside conflicts with code and action. Never retry push blindly after an unknown timeout.

GET /api/system/beta-android

This route is anonymous and is the fastest way to confirm that the production API host is reachable.

curl "https://Geotrackable.com/api/system/beta-android"

Successful response

HTTP 200 returns current Android beta release metadata and download guidance when a beta package is published.

Common failures and recovery

400 identifies missing or malformed query binding; 500 includes requestId for support. Optional Android beta data returns HTTP 200 with available:false. Coordinate range and location-provider failures return HTTP 200 with resolved:false plus failureMessage, action, and retryable.

GET /api/system/coordinate-locality

This route is anonymous and is the fastest way to confirm that the production API host is reachable.

curl "https://Geotrackable.com/api/system/coordinate-locality?latitude=41.8818&longitude=-87.6231"

Successful response

HTTP 200 returns the best available locality facts. A successful response can contain partial or unavailable location fields when resolution is intentionally limited.

Common failures and recovery

400 identifies missing or malformed query binding; 500 includes requestId for support. Optional Android beta data returns HTTP 200 with available:false. Coordinate range and location-provider failures return HTTP 200 with resolved:false plus failureMessage, action, and retryable.

GET /api/system/ip-location

This route is anonymous and is the fastest way to confirm that the production API host is reachable.

curl "https://Geotrackable.com/api/system/ip-location"

Successful response

HTTP 200 returns the best available locality facts. A successful response can contain partial or unavailable location fields when resolution is intentionally limited.

Common failures and recovery

400 identifies missing or malformed query binding; 500 includes requestId for support. Optional Android beta data returns HTTP 200 with available:false. Coordinate range and location-provider failures return HTTP 200 with resolved:false plus failureMessage, action, and retryable.

GET /api/system/status

This route is anonymous and is the fastest way to confirm that the production API host is reachable.

curl "https://Geotrackable.com/api/system/status"

Successful response

HTTP 200 returns the service status, server UTC time, and Android beta-page URL. This confirms reachability, not authenticated access.

Common failures and recovery

A network, DNS, TLS, or 500 failure means the host check did not complete. Preserve requestId when returned and use bounded backoff; status does not return 401.

GET /api/teams

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Trail Club", "title": "Trail Club", "description": "Shared field work.", "joinPolicy": "InviteOnly", "pageVisibility": "Public", "defaultNoteVisibility": "Public", "contentLanguage": "en-US" }'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/invite-links/{teamSlug}/{inviteCode}/join

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/invite-links/trail-club/INVITE-CODE/join" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/categories

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/categories

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Team trail research", "contentLanguage": "en-US", "parentCategoryId": null }'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/categories/tree

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories/tree" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/categories/tree/children

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories/tree/children" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/categories/tree/sections

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories/tree/sections" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}/categories/{categoryId}

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/categories/{categoryId}/move

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/categories/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/move" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "parentCategoryId": null }'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/invite-links

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/invite-links" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/invite-links

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/invite-links" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "isSingleUse": true }'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}/invite-links/{inviteLinkId}

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/invite-links/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/locations/gpx

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/locations/gpx" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 downloads GPX for mapped team waypoints visible to the member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/locations/gpx

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/locations/gpx" \
  -H "Authorization: Bearer <access token>" \
  -F "file=@waypoints.gpx"

Successful response

HTTP 200 returns team GPX import counts and item-level results.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/invite

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/invite" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/request

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/request" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}/memberships/{membershipId}

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/{membershipId}/accept

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/accept" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/{membershipId}/approve

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/approve" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/{membershipId}/deny

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/deny" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/{membershipId}/promote-admin

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/promote-admin" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/memberships/{membershipId}/refuse

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/memberships/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/refuse" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/notes

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the team, workspace, membership, category, note, or invite-link data visible to the signed-in member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/notes

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "title": "Team trailhead", "body": "Shared route notes.", "contentLanguage": "en-US", "latitude": 41.8818, "longitude": -87.6231, "visibility": "Public" }'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

GET /api/teams/{teamId}/notes/gpx

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes/gpx" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 downloads GPX for mapped team waypoints visible to the member.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/notes/gpx

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes/gpx" \
  -H "Authorization: Bearer <access token>" \
  -F "file=@waypoints.gpx"

Successful response

HTTP 200 returns team GPX import counts and item-level results.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}/notes/{noteId}

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

DELETE /api/teams/{teamId}/notes/{noteId}/delete

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

curl -X DELETE "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/delete" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/teams/{teamId}/notes/{noteId}/move

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/notes/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/move" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

PUT /api/teams/{teamId}/settings

Team APIs manage shared locations, categories, invite links, membership decisions, and team-owned trackable scope.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X PUT "https://Geotrackable.com/api/teams/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/settings" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting team state or acknowledges the membership, workspace, invite, settings, or deletion operation.

Common failures and recovery

400 explains membership, invite, hierarchy, GPX, move, or deletion rules; 401 requires login; 403 requires the stated member/admin role; 404 means refresh team state before submitting another change.

POST /api/trackables

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Scout trail coin", "description": "Move this coin along family-friendly trails.", "visibility": "AlwaysVisibleToEveryone", "activateImmediately": true }'

Successful response

HTTP 201 returns the one-time reveal. Omit secretCode for a generated GT code; an available allowed custom value is honored. Save secretCode and scanUrl now because read routes do not reveal them later.

Common failures and recovery

400 validation_failed identifies invalid fields; 400 trackable_secret_code_reserved explains GT, LN, TB, GK, or GC prefixes; 409 trackable_secret_code_taken means omit secretCode for generation or choose another value; 401 requires login.

GET /api/trackables/active

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/active"

Successful response

HTTP 200 returns the active secret-backed trackables remembered by this client. An empty array is a successful result, not an authentication failure.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

GET /api/trackables/active-indicator

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/active-indicator"

Successful response

HTTP 200 returns the trackable data visible in the caller's public, signed-in, or active-session access context.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

DELETE /api/trackables/active/{trackableId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/active/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 ends this client's remembered secret-backed session for the item. It does not delete or deactivate the trackable.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

GET /api/trackables/active/{trackableId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/active/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the current active landing state or updated status message for the trackable while this client still has its secret-backed session.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

POST /api/trackables/active/{trackableId}/deactivate

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/trackables/active/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/deactivate" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the current active landing state or updated status message for the trackable while this client still has its secret-backed session.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

POST /api/trackables/active/{trackableId}/message

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/active/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/message" \
  -H "Content-Type: application/json" \
  -d '{ "statusMessage": "Live hunt in progress" }'

Successful response

HTTP 200 returns the current active landing state or updated status message for the trackable while this client still has its secret-backed session.

Common failures and recovery

404 means this client no longer has the requested active trackable session; revisit the private code or scan route. 400 covers invalid status text. This session uses cookies, so preserve the cookie jar across calls.

POST /api/trackables/groups

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/groups" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Trail event set", "description": "Event inventory", "trackableCount": 12, "visibility": "AlwaysVisibleToEveryone", "activateImmediately": false, "watchGroupActivityWhenCreated": true }'

Successful response

HTTP 201 returns the new group plus the one-time public, secret, and scan credentials for every generated member. Persist the reveal before leaving the response.

Common failures and recovery

400 explains invalid defaults, count, visibility, category, or team rules; 401 requires login; 403 means the caller cannot create in that team. Correct the request before retrying the batch.

DELETE /api/trackables/groups/{trackableGroupId}/watch

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/groups/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/watch" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting trackable or group state after the signed-in account's watch preference changes. Repeating the desired final state should not create duplicate watches.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/groups/{trackableGroupId}/watch

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/trackables/groups/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/watch" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting trackable or group state after the signed-in account's watch preference changes. Repeating the desired final state should not create duplicate watches.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/legacy-lookup

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/trackables/legacy-lookup" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting trackable state after the requested ownership, grouping, or monitoring operation completes.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

GET /api/trackables/lookup

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/lookup?code=GT-EXAMPLE"

Successful response

HTTP 200 returns found, the resolved trackable ID, match type, and redirect guidance. An ordinary mistyped or unknown code is also HTTP 200 with found false so lookup UI can remain in place.

Common failures and recovery

An unknown or mistyped code is normally HTTP 200 with found false, not problem details. 400 is reserved for malformed input. Never log the submitted secret or QR value while diagnosing lookup.

POST /api/trackables/lookup

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/lookup" \
  -H "Content-Type: application/json" \
  -d '{ "code": "GT-EXAMPLE" }'

Successful response

HTTP 200 returns found, the resolved trackable ID, match type, and redirect guidance. An ordinary mistyped or unknown code is also HTTP 200 with found false so lookup UI can remain in place.

Common failures and recovery

An unknown or mistyped code is normally HTTP 200 with found false, not problem details. 400 is reserved for malformed input. Never log the submitted secret or QR value while diagnosing lookup.

GET /api/trackables/mine

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/mine" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the trackable data visible in the caller's public, signed-in, or active-session access context.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

GET /api/trackables/public

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/public?contentLanguage=en-US"

Successful response

HTTP 200 returns the trackable data visible in the caller's public, signed-in, or active-session access context.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

GET /api/trackables/{trackableId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63"

Successful response

HTTP 200 returns the trackable data visible in the caller's public, signed-in, or active-session access context.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/{trackableId}/activate

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/activate" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Activated trail coin", "description": "Ready to travel", "teamId": null }'

Successful response

HTTP 200 returns the activated trackable details after personal or team ownership and item-level metadata are established.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

GET /api/trackables/{trackableId}/comments

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments"

Successful response

HTTP 200 returns the visible comment panel, policy, and current comments. An empty comment list is a successful result.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

POST /api/trackables/{trackableId}/comments

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Found near the overlook.", "accessCode": "" }'

Successful response

HTTP 200 returns the saved comment state. Anonymous writes require this client's active session or an accessCode for this exact activated trackable.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

DELETE /api/trackables/{trackableId}/comments/{commentId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the saved comment state. Anonymous writes require this client's active session or an accessCode for this exact activated trackable.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

PUT /api/trackables/{trackableId}/comments/{commentId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X PUT "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/comments/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Updated field note." }'

Successful response

HTTP 200 returns the saved comment state. Anonymous writes require this client's active session or an accessCode for this exact activated trackable.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

DELETE /api/trackables/{trackableId}/group

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/group" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting trackable state after the requested ownership, grouping, or monitoring operation completes.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/{trackableId}/group

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/group" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{ "trackableGroupId": "13a2c0b1-582f-4a7b-92aa-16922f7bdb63" }'

Successful response

HTTP 200 returns the resulting trackable state after the requested ownership, grouping, or monitoring operation completes.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

GET /api/trackables/{trackableId}/journey

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/journey"

Successful response

HTTP 200 returns the visible journey points in route order. An activated trackable with no reported stops returns an empty collection.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/{trackableId}/journey-stops

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/journey-stops" \
  -H "Content-Type: application/json" \
  -d '{ "latitude": 41.8818, "longitude": -87.6231, "accessCode": "" }'

Successful response

HTTP 200 returns the saved direct journey stop. The latitude and longitude become an immutable route-history point for the activated trackable.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

DELETE /api/trackables/{trackableId}/journey-stops/{journeyStopId}

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/journey-stops/13a2c0b1-582f-4a7b-92aa-16922f7bdb63" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 confirms the authorized direct journey stop was removed. Refresh the journey before offering another action on that stop.

Common failures and recovery

400 trackable_activation_required means an eligible owner must activate first; 403 trackable_access_code_required or trackable_access_code_invalid requires this exact item's session or credential; 404 means refresh stale IDs.

DELETE /api/trackables/{trackableId}/watch

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

curl -X DELETE "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/watch" \
  -H "Authorization: Bearer <access token>"

Successful response

HTTP 200 returns the resulting trackable or group state after the signed-in account's watch preference changes. Repeating the desired final state should not create duplicate watches.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

POST /api/trackables/{trackableId}/watch

Trackable routes cover public browsing, private ownership, remembered secret access, comments, and journey stops.

# Request-body placeholder: replace {} with the fields required by this route before sending.
curl -X POST "https://Geotrackable.com/api/trackables/13a2c0b1-582f-4a7b-92aa-16922f7bdb63/watch" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{}'

Successful response

HTTP 200 returns the resulting trackable or group state after the signed-in account's watch preference changes. Repeating the desired final state should not create duplicate watches.

Common failures and recovery

400 reports a trackable business rule; 401 applies to bearer-only management; 403 supplies the ownership, team-role, grouping, or access action; 404 means refresh the current trackable or group state.

Support