IIT Delhi Departmental Site Platform API

openapi: 3.1.0
info:
  title: IIT Delhi Departmental Site Platform API
  version: '2026-08-30'
  summary: >-
    Undocumented but publicly readable JSON API backing the shared React/Express
    site platform IIT Delhi runs across its departmental and unit subdomains.
  description: |
    Indian Institute of Technology Delhi operates a shared web platform used by several
    of its departments and administrative units — the Convocation office
    (`convocation.iitd.ac.in`), the Industrial Research & Development Unit
    (`ird.iitd.ac.in`) and the Computer Services Centre (`csc.iitd.ac.in`) all serve a
    create-react-app front end backed by an Express JSON API mounted at `/api`.

    IIT Delhi publishes NO documentation, no version marker, no OpenAPI and no changelog
    for this surface. It is not advertised as a product; it is the private backend of
    public web sites, and its read endpoints happen to answer anonymous requests with
    `application/json`. This document was reconstructed ENTIRELY from live probes on
    2026-08-30 — every path, status code and schema below was observed, none was assumed.
    Endpoints not listed here either 404 on all three deployments or were not probed.

    Write operations and some media collections are gated behind the institute's own
    OAuth 2 server at `https://oauth.iitd.ac.in/`; the API says so itself in its 401 body
    (`"Authentication required. Please login via IITD OAuth."`). No scope vocabulary,
    token endpoint or client-registration document is published, so the authenticated
    half of this API is unreadable from outside.

    x-operator: institution — every host is under IIT Delhi's own registrable domain
    `iitd.ac.in`, the content is the institute's own, and no vendor identity appears in
    any response.
  contact:
    name: Computer Services Centre, IIT Delhi
    url: https://csc.iitd.ac.in/
  x-operator: institution
  x-provenance:
    generated: '2026-08-30'
    method: derived
    x-derivation: probed
    source:
      - https://convocation.iitd.ac.in/api/news
      - https://convocation.iitd.ac.in/api/contact
      - https://convocation.iitd.ac.in/api/gallery
      - https://ird.iitd.ac.in/api/contact
      - https://ird.iitd.ac.in/api/circulars
      - https://ird.iitd.ac.in/api/announcements
      - https://ird.iitd.ac.in/api/pages
      - https://csc.iitd.ac.in/api/contact
      - https://csc.iitd.ac.in/api/pages
    note: >-
      Reverse-described from observed anonymous responses. IIT Delhi did not publish this
      document and does not describe this API anywhere. Not a provider-authored contract.
servers:
  - url: https://convocation.iitd.ac.in/api
    description: Convocation office deployment (verified 2026-08-30)
  - url: https://ird.iitd.ac.in/api
    description: Industrial Research & Development Unit deployment (verified 2026-08-30)
  - url: https://csc.iitd.ac.in/api
    description: Computer Services Centre deployment (verified 2026-08-30)
tags:
  - name: Contact
    description: Departmental office contact directory entries.
  - name: News
    description: Announcements and news items published by the unit.
  - name: Circulars
    description: Numbered administrative circulars with attached documents.
  - name: Pages
    description: CMS page bodies rendered by the front end.
  - name: Media
    description: Image galleries. Gated behind IITD OAuth.
paths:
  /contact:
    get:
      operationId: listContacts
      tags: [Contact]
      summary: List departmental contact directory entries
      description: >-
        Verified 200 on all three deployments. Returns a flat array; an empty unit
        returns `[]` rather than 404.
      responses:
        '200':
          description: Array of contact entries
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Contact'
              examples:
                ird:
                  summary: Observed on ird.iitd.ac.in 2026-08-30
                  value:
                    - id: 1
                      title: Industrial Research & Development Unit
                      phone: (91) 011-2659 7194
                      email: arird@admin.iitd.ac.in
                      location: null
                      created_at: '2024-08-14T00:00:00.000Z'
                      updated_at: null
  /news:
    get:
      operationId: listNews
      tags: [News]
      summary: List announcements and news items
      description: >-
        Verified 200 on convocation.iitd.ac.in. 404 on the ird and csc deployments — the
        platform mounts routes per unit, so a path present on one host may be absent on
        another.
      responses:
        '200':
          description: Array of news / announcement records
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/NewsItem'
        '404':
          description: Route not mounted on this deployment
  /announcements:
    get:
      operationId: listAnnouncements
      tags: [News]
      summary: List unit announcements
      description: Verified 200 on ird.iitd.ac.in, returning an empty array at probe time.
      responses:
        '200':
          description: Array of announcement records (may be empty)
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
              examples:
                empty:
                  summary: Observed on ird.iitd.ac.in 2026-08-30
                  value: []
        '404':
          description: Route not mounted on this deployment
  /circulars:
    get:
      operationId: listCirculars
      tags: [Circulars]
      summary: List administrative circulars
      description: >-
        Verified 200 on ird.iitd.ac.in, 49 records at probe time. Note the capitalised
        `Circular` and `Description` property names — the platform serialises database
        columns verbatim and its casing is not consistent across resources.
      responses:
        '200':
          description: Array of circular records
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Circular'
        '404':
          description: Route not mounted on this deployment
  /pages:
    get:
      operationId: listPages
      tags: [Pages]
      summary: List CMS page bodies
      description: >-
        Verified 200 on csc.iitd.ac.in. On ird.iitd.ac.in the same path returns HTTP 500
        with `{"error":"Failed to fetch cards"}` — an unhandled server fault surfaced to
        anonymous callers, observed 2026-08-30.
      responses:
        '200':
          description: Array of page records carrying HTML bodies
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Page'
        '500':
          description: Unhandled server fault
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerError'
  /gallery:
    get:
      operationId: listGallery
      tags: [Media]
      summary: List image gallery entries
      description: >-
        Verified 401 for anonymous callers on convocation.iitd.ac.in. The error body names
        IITD OAuth as the required authentication route and leaks session diagnostics.
      security:
        - iitdOAuthSession: []
      responses:
        '200':
          description: Array of gallery entries (not observable anonymously)
        '401':
          description: Authentication required via IITD OAuth
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthError'
components:
  securitySchemes:
    iitdOAuthSession:
      type: apiKey
      in: cookie
      name: connect.sid
      description: >-
        Session cookie issued after an interactive login against the institute OAuth 2
        server at https://oauth.iitd.ac.in/. That server publishes no OpenID Connect
        discovery document, no authorization or token endpoint documentation and no scope
        vocabulary — verified 404 on /.well-known/openid-configuration and
        /.well-known/oauth-authorization-server on 2026-08-30 — so the flow cannot be
        described further from public evidence.
  schemas:
    Contact:
      type: object
      title: Contact
      properties:
        id: { type: integer }
        title: { type: string, description: Office or role name }
        phone: { type: [string, 'null'] }
        email: { type: [string, 'null'], format: email }
        location: { type: [string, 'null'] }
        created_at: { type: [string, 'null'], format: date-time }
        updated_at: { type: [string, 'null'], format: date-time }
      required: [id, title]
    NewsItem:
      type: object
      title: NewsItem
      properties:
        announcement_id: { type: integer }
        convocation_id: { type: [integer, 'null'] }
        announcement_text: { type: string }
        announcement_date: { type: [string, 'null'], format: date-time }
        image_path: { type: [string, 'null'], description: Relative path under uploadsNews/ }
        link: { type: [string, 'null'] }
        pdf_path: { type: [string, 'null'] }
        created_at: { type: [string, 'null'], format: date-time }
        updated_at: { type: [string, 'null'], format: date-time }
      required: [announcement_id, announcement_text]
    Circular:
      type: object
      title: Circular
      properties:
        id: { type: integer }
        Circular: { type: string, description: Circular reference number and date }
        Description: { type: [string, 'null'] }
        file: { type: [string, 'null'], description: Relative path to the attached document }
        c_date: { type: [string, 'null'], format: date-time }
      required: [id, Circular]
    Page:
      type: object
      title: Page
      properties:
        id: { type: integer }
        page_details: { type: [string, 'null'], description: HTML body, unescaped }
      required: [id]
    AuthError:
      type: object
      title: AuthError
      properties:
        success: { type: boolean, const: false }
        error: { type: string }
        code: { type: string, examples: [NOT_AUTHENTICATED] }
        debug:
          type: object
          description: >-
            Session diagnostics returned to unauthenticated callers, including a session
            identifier. Exposing this to anonymous clients is a reportable finding.
      required: [success, error, code]
    ServerError:
      type: object
      title: ServerError
      properties:
        error: { type: string }
      required: [error]