Rovas API

Rovas exposes a REST API so partners, plugins, and apps can create accounts, file work reports, read Merits, and plug into NeoFund products such as Civic.

Service paths use the prefix /rovas. OAuth protocol paths use /oauth2.

Send Accept: application/json and, for POST/PUT bodies, Content-Type: application/json.

If you are planning an integration, contact us — we can provision partner access and review your use case.

Solutions built with the API

Apps and plugins that integrate third-party tools with Rovas are listed on the Rovas connectors page.

Which API should I use?

Do not mix both on one request. Classic endpoints expect API keys; Civic-oriented endpoints have API-key auth disabled and expect Bearer (or are public).

Auth labels in this reference

Classic API — how to use it

Credentials

1. Sign in to Rovas and open My account → Rovas API.
2. Generate credentials for the rovas_endpoint endpoint.
3. On each authenticated call, send:

API-KEY: <your api key>
TOKEN: <your token>

Each key pair belongs to one Rovas user. Calls run as that user.

Partner signup (create or link an end user)

Charities and other partners that create Rovas accounts for donors or members need a technical account with the api client role (assigned by NeoFund/Rovas admins). That account’s API key is used only for account provisioning.

Preferred endpoint

POST /rovas/rovas_partner_user

Legacy equivalent: POST /rovas/rules/rules_create_user (same body and response).

Request body (required fields)

Optional: hybridauth_provider (defaults to Nabezky if empty), partner_client_id.

List allowed providers: GET /rovas/rovas_hybridauth_providers.json (usually public).

Success response

{
  "rovas_uid": 123,
  "api_key": "…",
  "token": "…"
}

Store the returned api_key / token and use them as API-KEY / TOKEN for later calls on behalf of that end user.

Example

curl -sS -X POST "https://rovas.app/rovas/rovas_partner_user" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "API-KEY: $PARTNER_API_KEY" \
  -H "TOKEN: $PARTNER_TOKEN" \
  -d '{
    "user_name": "Jane Partner User",
    "user_id": 12345,
    "user_email": "jane@example.com",
    "user_country": "SK",
    "user_language": "en",
    "server_url": "https://partner.example/",
    "hybridauth_provider": "Nabezky"
  }'

Typical errors: 400 validation, 401 bad credentials, 403 missing api client permission.

Classic endpoint reference

Request/response schemas for these calls are maintained in an OpenAPI file (available on request). Summary:

Accounts & identity

*Usually public when “Disable API keys authentication” is set on the resource.

Projects & work reports

†Typo in rule machine name (acccess) is intentional in the live path.

Shares, purchases, conversions

Views (leaderboards / feeds)

OAuth 2 / Bearer — how to use it

OAuth is used by NeoFund’s Civic app and by other clients we register. New products need their own OAuth client — do not reuse Civic’s client_id from a third-party app.

Protocol endpoints

Civic client (reference)

Authorize query extras: lang=sk|en, intent=login|register.

Token exchange (authorization code + PKCE)

curl -sS -X POST "https://rovas.app/oauth2/token" \
  -d grant_type=authorization_code \
  -d client_id=civic \
  -d redirect_uri=civic://oauth/callback \
  -d code=PASTE_CODE \
  -d code_verifier=$VERIFIER

Call an API with Bearer

curl -sS "https://rovas.app/rovas/me" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Example GET /rovas/me response:

{
  "uid": 42,
  "username": "sano",
  "display_name": "Alexander Žaťko",
  "total_me": 1248.35,
  "total_chr": 320.0,
  "created": "2019-03-12T14:22:01+00:00",
  "language": "sk",
  "receipt_history_retention": null
}

OAuth / Civic endpoint reference

API-key authentication is disabled on these resources. Use Bearer where required.

Home & profile

Users

Optional: lang=sk|en on lookup for localized fields.

Tax claims

Projects, charity catalog, gifts

‡Anonymous allowed for NeoFund-approved public-benefit projects; otherwise Bearer / access rules apply.

Volunteer work reports

Verification & notifications

Merit index & spotlight

Support

Questions, OpenAPI schemas, or a new OAuth client: contact NeoFund.