Rovas API

Rovas exposes a REST API so partners, plugins, and apps can create accounts, file work reports, read Merits, and plug into NeoFund products such as Civic.

Service paths use the prefix /rovas. OAuth protocol paths use /oauth2.

Send Accept: application/json and, for POST/PUT bodies, Content-Type: application/json.

If you are planning an integration, contact us — we can provision partner access and review your use case.

Which API should I use?

Do not mix both on one request. Classic endpoints expect API keys; Civic-oriented endpoints have API-key auth disabled and expect Bearer (or are public).

Classic API — how to use it

Credentials

1. Sign in to Rovas and open My account → Rovas API.
2. Generate credentials for the rovas_endpoint endpoint.
3. On each authenticated call, send:

API-KEY: <your api key>
TOKEN: <your token>

Each key pair belongs to one Rovas user. Calls run as that user.

Partner signup (create or link an end user)

Charities and other partners that create Rovas accounts for donors or members need a technical account with the api client role (assigned by NeoFund/Rovas admins). That account’s API key is used only for account provisioning.

Preferred endpoint

POST /rovas/rovas_partner_user

Legacy equivalent: POST /rovas/rules/rules_create_user (same body and response).

Request body (required fields)

Optional: hybridauth_provider (defaults to Nabezky if empty), partner_client_id.

List allowed providers: GET /rovas/rovas_hybridauth_providers.json (usually public).

Success response

{
  "rovas_uid": 123,
  "api_key": "…",
  "token": "…"
}

Store the returned api_key / token and use them as API-KEY / TOKEN for later calls on behalf of that end user.

Example

curl -sS -X POST "https://rovas.app/rovas/rovas_partner_user" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "API-KEY: $PARTNER_API_KEY" \
  -H "TOKEN: $PARTNER_TOKEN" \
  -d '{
    "user_name": "Jane Partner User",
    "user_id": 12345,
    "user_email": "jane@example.com",
    "user_country": "SK",
    "user_language": "en",
    "server_url": "https://partner.example/",
    "hybridauth_provider": "Nabezky"
  }'

Typical errors: 400 validation, 401 bad credentials, 403 missing api client permission.

Classic endpoint reference

Request/response schemas for these calls are maintained in an OpenAPI file (available on request). Summary:

Accounts & balances

*When “Disable API keys authentication” is enabled for that resource.

Projects & work reports

Shares, purchases, quotes

Views

OAuth 2 / Bearer — how to use it

OAuth is used by NeoFund’s Civic app and by other clients we register. New products need their own OAuth client — do not reuse Civic’s client_id from a third-party app.

Protocol endpoints

Civic client (reference)

Authorize query extras: lang=sk|en, intent=login|register.

Call an API with Bearer

curl -sS "https://rovas.app/rovas/me" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Example GET /rovas/me response:

{
  "uid": 42,
  "username": "sano",
  "display_name": "Alexander Žaťko",
  "total_me": 1248.35,
  "total_chr": 320.0,
  "created": "2019-03-12T14:22:01+00:00",
  "language": "sk",
  "receipt_history_retention": null
}

OAuth / Civic endpoint reference

Auth labels: Bearer = required access token; Public = no token; Optional Bearer = public, with extra fields when signed in.

Home & profile

Users

Tax (VAT) claims

Projects & public-benefit orgs

*Anonymous access for approved public-benefit projects; otherwise access rules apply.

Volunteer work reports

Verification & notices

Merit index

Support

Questions, OpenAPI schemas, or a new OAuth client: contact NeoFund.