GEBETA Developer API
Base URL: https://gebetaexpress.com/api/v1
· Flutter --dart-define=GEBETA_API=https://gebetaexpress.com/api/v1
Developer API
Base URL: https://gebetaexpress.com/api/v1
Two apps, one API. Passenger and rider are separate accounts. The same phone can exist on both.
JSON body. Content-Type: application/json. CSRF is off for /api/v1/*. These docs pages are public HTML. They do not use X-APP-KEY.
Sign in
Passenger: POST /auth/passenger/login { "phone": "09xxxxxxxx", "password": "..." }
Rider: POST /auth/rider/login { "phone": "09xxxxxxxx", "password": "..." }
200 returns data.token (raw 64 hex characters). The database stores SHA-256 of that value. Send the raw token, never the hash.
Login also stores that token on the ci_session cookie. Keep the cookie jar from the login response on every later call. Log in again after this change. Older sessions have no token.
OTP verify (POST /auth/passenger/otp/verify and POST /auth/rider/otp/verify) issues the same token and cookie.
Authenticated calls
Send both:
- Authorization: Bearer <data.token> - Cookie: ci_session=... from that same login
https://gebetaexpress.com sits behind a proxy that drops Authorization. When the header is missing, the API reads the token from ci_session. A client that keeps only the Bearer token and drops cookies gets 401 on the public host. Direct calls to the origin that still carry Authorization work either way.
Logout (POST /auth/rider/logout, POST /auth/passenger/logout) revokes the token and clears it from the session.
401 and 422
| HTTP | message | Meaning ||------|-----------|---------|| 200 | Logged in | Token in data.token. Keep ci_session. || 401 | Unauthorized | No token reached the API. Header was dropped and this session has no token, or the token is unknown or expired. Log in again on the same client. || 401 | Invalid phone or password. | Login rejected. Not a missing header. || 403 | Rider is not approved. or Approved rider required | Rider account exists and is not approved. || 422 | Phone and password are required. | Phone shorter than 9 digits, or password empty. Not an auth failure. || 422 | Phone and password (min 6) are required. | Passenger register. || 422 | other field text | A required body field is missing (address, items, coordinates). Not an auth failure. |errors is {} or [] on these failures. data is null.
Rider app (after login)
| Method | Path ||--------|------|| GET | /auth/rider/me || GET | /auth/rider/earnings || GET | /auth/rider/history || POST | /riders/availability | { "online": true } || GET | /rider/sync || GET | /delivery/offers || POST | /riders/location | { "latitude", "longitude" } |Full table: rider-api.md.
Passenger app (after login)
| Method | Path ||--------|------|| GET | /auth/passenger/me || GET | /favorites || GET | /passenger/orders?limit=50 || GET | /sync/passenger || POST | /orders/checkout | Bearer, or phone on the body |Full table: guest-api.md. Poll loops: mobile-api.md.
curl -sS -c /tmp/gebeta.ck -H 'Content-Type: application/json' \
-d '{"phone":"09XXXXXXXX","password":"..."}' \
https://gebetaexpress.com/api/v1/auth/rider/login
curl -sS -b /tmp/gebeta.ck https://gebetaexpress.com/api/v1/auth/rider/meThe second call must send the cookie saved by the first. Replace the phone and password with a real approved rider.