API

Public API — preview

REST and webhooks. The complete reference is available below.

Base URL

https://bonjour.unpourtousettouspourun-asso.fr/api/public/v1

OpenAPI schema

The machine-readable OpenAPI 3.1 description is public and can be imported into Postman, Insomnia or an SDK generator. /api/public/v1/openapi.json — import it into Postman, Insomnia, or an SDK generator.

Interactive API console

Requests are sent from your browser. Without a valid token, the expected response is 401.

EndpointToken (Bearer)

Request

curl -X GET \
  "https://bonjour.unpourtousettouspourun-asso.fr/api/public/v1/ping" \
  -H "Authorization: Bearer bja_<prefix>_<secret>"

Example response

{
  "ok": true,
  "organisationId": "8f14e45f-ceea-467a-9a2e-1b7c1cbd7f21",
  "version": "1.0.0",
  "at": "2026-01-12T09:30:00.000Z"
}

Live response

—

Authorisation schemes

apiKey — Authorization: Bearer bja_<prefix>_<secret>, portées read / write, quota 60 req/min.
Webhooks sortants — signature x-bonjour-signature: sha256=<hex> (HMAC-SHA256 sur le corps brut).

Webhook events

Webhook events
Event	Trigger
`incident.declared`	Incident je nahlášen s nastavenou úrovní závažnosti.
`incident.contained`	Incident je označen jako vyřešený.
`incident.notified`	Dozorový úřad byl vyrozuměn.
`incident.closed`	Incident byl uzavřen.
`incident.deadline_72h`	Alarm: porušení stále otevřeno 60 h po detekci (lhůta GDPR 72 h).

Example payload

POST https://votre-endpoint.example/hooks/bonjour
x-bonjour-signature: sha256=6f1c…d4

{
  "event": "incident.declared",
  "organisationId": "8f14e45f-ceea-467a-9a2e-1b7c1cbd7f21",
  "incident": {
    "id": "1f4d3a2b-…",
    "severity": "critical",
    "category": "data_breach",
    "detectedAt": "2026-01-12T08:05:00.000Z"
  },
  "attempt": 1
}

Endpoints

GET /ping — key health probe
GET /members — anonymised membership statistics
GET /events — upcoming public events
GET /impact — latest published social-impact report

Authentication

Bearer tokens are issued from your organisation console and shown once. Permissions: read and write. Revoke them at any time.

Rate limits

60 requests per minute and per token by default. The Enterprise level is configurable.

Webhooks

Events are signed with HMAC-SHA256 over the raw body and retried five times with exponential backoff. x-bonjour-signature

incident.declared / incident.contained / incident.notified / incident.closed
incident.deadline_72h
member.created
contribution.received
timebank.payout.settled
sanctuary.file.expired

SDKs

TypeScript SDK coming soon. A Python client is planned.

Getting API access

Email us with a short use case. We respond within two working days. contact@unpourtousettouspourun-asso.fr