Staging API server:

https://api-staging.connectionpoint.com

Production API server:

https://api.connectionpoint.com

The API follows REST principles. Data is provided in JSON format only. Dates are represented in Unix timestamps (Seconds elapsed since 01-01-1970 00:00:00 UTC). The staging API will return all JSON responses pretty printed.

ConnectionPoint uses OAuth 2.0 for granting access to resources. Every API request listed in this document requires either a user access token or an app access token. To authorize a request pass your access token in the Authorization header of your HTTP request as follows:

Authorization: Bearer ACCESS_TOKEN

You can create and manage multiple client applications. Every API client has to be approved first in order to be able to interact with our API.

Staging:

https://beta.connectionpoint.com/apps

Production:

https://connectionpoint.com/apps

User authorization

Obtain a user's consent by redirecting them to the following authorization endpoint.

Staging:

https://beta.connectionpoint.com/oauth2/authorize

Production:

https://connectionpoint.com/oauth2/authorize

Request

Response

Scope

Example

https://beta.connectionpoint.com/oauth2/authorize?client_id=123&redirect_uri=https%3A%2F%2Fclient.domain&scope=read_only&state=3ksdf8sdf3 

Generating an user access token

After obtaining the user's consent you will be able to retrieve a user access token.

POST /oauth2/token

Request

Response

Example

curl --data "grant_type=authorization_code&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&redirect_uri=https%3A%2F%2Fclient.domain&code=ACCESS_TOKEN" https://api-staging.connectionpoint.com/v1/oauth2/token

All API requests that return lists as a result support pagination. Lists are returned in an envelope that contains additional pagination information. The list results itself are contained in the entries parameter. The maximum number of results is limited to 50. If no limit is specified the default limit of 20 will be used.

Request

Response

Example

curl -H "Authorization: Bearer APP_ACCESS_TOKEN" "https://api-staging.connectionpoint.com/v1/campaigns/search?type=newest&limit=10&after=212"

Currently you are permitted to make up to 1,000 authorized requests per hour. You can check the HTTP headers of any API response to see your current rate limit status. Please contact us if you require a higher rate limit for your app.

The Campaign object

The Organization object

The User object

Types of activities

There are currently four types of campaign activities. Types

1. Contribution: A campaign payments, pledge or offline contribution
2. Comment: A comment made by a user
3. Story Update: A campaign update
4. Milestone: An auto-generated campaign milestone based on funding progress

The Activity object

All types of activities share the following attributes:

The Contribution object

In addition to the common activity attributes, a comment contains the following:

The Comment object

In addition to the common activity attributes, a story update contains the following:

The Story Update object

In addition to the common activity attributes, a story update contains the following:

The Milestone object

In addition to the common activity attributes, a milestone contains the following:

The Contact object

The Fundraiser object

The Invitation object

The Payment object

The Address object

The Partner object

The Webhook endpoint object

The Webhook types

The Webhook event message object

Securing webhook endpoints

Every webhook event message request sent to a registered endpoint will include the following two request headers.

The HMAC signature is calculated via the SHA512 algorithm and the secret of the receiving webhook endpoint. As the secret is only returned upon registering a webhook endpoint, you need to ensure to have it stored in order to verify the signature of webhook event messages. The input for the HMAC signature creation is the concatenation of the X-Webhook-Signature-Timestamp request header value and the request body.

Below is a sample implementation of the signature verification process

  const crypto = require('crypto');
  
  const SIGNING_SECRET_ALGORITHM = "sha512";
  const HEADER_WEBHOOK_SIGNATURE = 'Http-X-Webhook-Signature';
  const HEADER_WEBHOOK_SIGNATURE_TIMESTAMP = 'Http-X-Webhook-Signature-Timestamp';
  const WEBHOOK_ENDPOINT_SECRET = "{The secret you stored after registering your webhook endpoint}";
  
  
  function isSignatureValid(signature, timestamp, requestBody) {
    let hmac = crypto.createHmac(SIGNING_SECRET_ALGORITHM, WEBHOOK_ENDPOINT_SECRET);
    let sig = hmac.update(timestamp + requestBody).digest("base64");
  
    return (
      Buffer.compare(
        Buffer.from(signature),
        Buffer.from(sig)
      ) === 0
    )
  }
  
  function processWebhookMessage(request) {
    let signature = request.headers[HEADER_WEBHOOK_SIGNATURE];
    let timestamp = request.headers[HEADER_WEBHOOK_SIGNATURE_TIMESTAMP];
    let requestBody = request.content;
    
    if (!isSignatureValid(signature, timestamp, requestBody))
      throw new Error("The webhook signature is invalid");
    
    // Continue to process the webhook event message here
  }