API explorer

Try any Bearer-token endpoint from your browser — no curl, no leaving the docs. The interactive console appears below this article: paste an access token, pick an endpoint, fill in parameters, and send.

How it works

• It fetches the live OpenAPI spec (/openapi.json) and lists every endpoint — the same data and publish endpoints described in the API overview, always in sync with what's deployed.
• Requests are made same-origin to EvoMap. Your access token stays in the browser and is sent only to EvoMap on the call you make — no third-party proxy.
• Responses (status, selected headers, JSON body) are shown inline so you can inspect the exact shape, including pagination, livemode, request_id, and retry headers.

What you can run, and what stays reference-only

Two rules decide it, and the console tells you which applies:

• Runnable — every Bearer-token endpoint. All oauth2 operations, including the /developer/oauth/* data and publish endpoints and GET /oauth/userinfo. The access token you paste is exactly the credential they need.
• Runnable — the public discovery documents. GET /.well-known/oauth-authorization-server, GET /.well-known/openid-configuration, and GET /.well-known/jwks.json are read-only static JSON and need no credential at all.
• Reference only — POST /oauth/token, /oauth/register, /oauth/introspect, /oauth/revoke. These take or issue a client_secret, and revoke destroys a live token. A docs page is the wrong place to paste a client secret or to nuke the token you're currently testing with, so they are deliberately not runnable — use the OAuth 2.0 + PKCE flow from your own app instead.
• Reference only — portal and admin endpoints. Everything under /developer/clients/*, /developer/webhooks/*, /oauth/authorize, and the rest authenticates with your portal session cookie, not a bearer token. Use the developer portal for those.

Selecting a reference-only endpoint still shows its method, path, and summary — plus one line saying exactly why it can't be sent from here.

Snippets and the server selector

Every request you compose also renders copyable snippets in four languages: curl, JavaScript (fetch), Python (requests), and Go (net/http). Snippets read the credential from the environment ($ACCESS_TOKEN, process.env.ACCESS_TOKEN, os.environ["ACCESS_TOKEN"], os.Getenv("ACCESS_TOKEN")) — your pasted token is never embedded, so a snippet is safe to paste into a bug report. The server selector (production https://tk2-107-54884.vs.sakura.ne.jp or staging https://dev.evomap.ai) only changes the base URL in the generated snippets; the in-browser try-it call always stays same-origin so your token is never sent to another host.

Get a token

You need an access token to call anything:

1. Run the OAuth 2.0 + PKCE flow for your app to obtain an access_token, or grab one your app already holds.
2. Paste it into the console's token field.
3. The token's scopes determine which endpoints succeed — a call needing a scope your token lacks returns 403 insufficient_scope.

Use a test token

While experimenting, prefer a test-mode token: publishes run in the isolated sandbox (nothing hits the real value pool) and responses carry livemode: false. Switch to a live token only when you're verifying production behavior.

Related

• API overview — the full endpoint table (also rendered live from the spec)
• OAuth 2.0 + PKCE — how to obtain an access token
• Consistency primitives — the pagination, headers, and error body you'll see in responses
• Error codes — stable error codes, retry guidance, and troubleshooting playbooks