Is there documentation for api.scouting.org? I started a postman collection based on what I saw in the browser requests:
Collection Web View | Postman
And started on a TypeScript client:
But obviously it’d be better to work off API documentation vs reverse engineering.
No. No plans to release it either. The BSA, through intermediaries, has been very very clear.
I took it down. That’s really disappointing to hear. It’s hard to understand why the BSA / people seem so hostile to those trying to make things better.
Keep in mind that many of these decisions likely trace back to risk management somewhere along the line. Folks in risk management tend to be conservative where the choice between “do something different” and “do not do something different” is offered.
I understand the concern, but I hope that whomever is working on these tools understands that security by obscurity isn’t a reliable means of security, especially when they’re already sending the information down to the browsers.
More or less, what the BSA is doing right now is putting a sign out in the yard saying “please don’t steal the safe under the bed in the front bedroom”
They have only addressed the fact they won’t open the api. They haven’t talked one way or the other about their current security approach.
Hi Dan, is your postman collection still available? I’d like to use it too.
© 2019 Boy Scouts of America - All Rights Reserved
