osrmroute-com Mobile Access API
The Mobile Access API API from osrmroute-com — 2 operation(s) for mobile access api.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/osrmroute-com:osrmroute-com-mobile-access-api-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: OSRMRoute Mobile Access API
version: 1.1.0
description: 'OSRMRoute — Maps, Routing, Truck Routing, Search, Road Data, Studio and integration APIs. Use `Authorization: Bearer ` unless an operation documents another flow. Legacy APIs also accept the key query parameter; New geospatial APIs, MCP and private map delivery require Bearer authentication. Mobile challenge/token endpoints use device attestation instead. Coordinates and units are documented per operation: GeoJSON uses longitude,latitude; some legacy and background-job inputs use latitude,longitude. Examples are illustrative, not guaranteed current results. Guides · Mobile Access · MCP · Postman collection.'
contact:
name: OSRMRoute Support
url: https://osrmroute.com/contact
email: support@osrmroute.com
termsOfService: https://osrmroute.com/terms
servers:
- url: https://osrmroute.com
security:
- bearerAuth: []
- apiKeyQuery: []
tags:
- name: Mobile Access API
paths:
/api/mobile/challenge:
post:
tags:
- Mobile Access API
operationId: createMobileChallenge
summary: Create a device verification challenge
description: No API key in the app bundle. Register the app in your workspace first. Android uses Play Integrity; iOS uses App Attest. Requires enabled provider verification and a real supported device. Body limit 32 KiB; 30 requests/minute/IP and 300/minute/app. Challenges last 120 seconds and are single-use, including failed verification. Mobile integration guide.
security: []
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
app_id:
type: string
format: uuid
description: Public mobile application ID from workspace settings.
key_id:
type: string
pattern: ^[A-Za-z0-9_+/=-]{16,256}$
description: Installation key identifier; use the same value throughout challenge and token exchange.
required:
- app_id
- key_id
example:
app_id: 00000000-0000-4000-8000-000000000001
key_id: <installation key identifier>
responses:
'200':
description: Sign the returned challenge with the platform-specific proof flow.
content:
application/json:
schema:
type: object
properties:
challenge:
type: string
pattern: ^[A-Za-z0-9_-]{43}$
challenge_id:
type: string
format: uuid
enrolled:
type: boolean
required:
- challenge
- challenge_id
- enrolled
example:
challenge: <single-use challenge>
challenge_id: 00000000-0000-4000-8000-000000000002
enrolled: false
'400':
description: invalid_mobile_input
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: invalid_mobile_input
'401':
description: mobile_challenge_expired
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_challenge_expired
'403':
description: mobile_app_unavailable
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_app_unavailable
'413':
description: mobile_payload_too_large
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_payload_too_large
'429':
description: mobile_rate_limited
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_rate_limited
'503':
description: mobile_access_unavailable
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_access_unavailable
/api/mobile/token:
post:
tags:
- Mobile Access API
operationId: exchangeMobileProof
summary: Exchange device proof for a short-lived Bearer token
description: 'No API key in the app bundle. Register the app in your workspace first. Android uses Play Integrity; iOS uses App Attest. Requires enabled provider verification and a real supported device. Body limit 32 KiB; 30 requests/minute/IP and 300/minute/app. Challenges last 120 seconds and are single-use, including failed verification. Mobile integration guide.
Sign/hash the exact UTF-8 payload joined with newline characters: osrmroute-mobile-v1, app_id, challenge_id, challenge, key_id. The returned token lasts 300 seconds and uses the app''s allowed services and normal API metering. Private Studio, AI and background jobs are excluded. A failed exchange requires a new challenge. Revoked installations and invalid provider proofs return 403.'
security: []
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
app_id:
type: string
format: uuid
description: Public mobile application ID from workspace settings.
challenge_id:
type: string
format: uuid
challenge:
type: string
pattern: ^[A-Za-z0-9_-]{43}$
key_id:
type: string
pattern: ^[A-Za-z0-9_+/=-]{16,256}$
description: Installation key identifier; use the same value throughout challenge and token exchange.
proof:
type: string
maxLength: 24000
pattern: ^[A-Za-z0-9_+/.=-]{1,24000}$
description: Android integrity token or iOS attestation/assertion from the device. Illustrative placeholders are not valid proofs.
required:
- app_id
- challenge_id
- challenge
- key_id
- proof
example:
app_id: 00000000-0000-4000-8000-000000000001
challenge_id: 00000000-0000-4000-8000-000000000002
challenge: <challenge from previous response>
key_id: <installation key identifier>
proof: <device-generated proof>
responses:
'200':
description: 'Use Authorization: Bearer <access_token> on supported APIs.'
content:
application/json:
schema:
type: object
properties:
access_token:
type: string
token_type:
type: string
enum:
- Bearer
expires_in:
type: number
enum:
- 300
required:
- access_token
- token_type
- expires_in
example:
access_token: <short-lived token>
token_type: Bearer
expires_in: 300
'400':
description: invalid_mobile_input
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: invalid_mobile_input
'401':
description: mobile_challenge_expired
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_challenge_expired
'403':
description: mobile_app_unavailable
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_app_unavailable
'413':
description: mobile_payload_too_large
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_payload_too_large
'429':
description: mobile_rate_limited
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_rate_limited
'503':
description: mobile_access_unavailable
content:
application/json:
schema:
type: object
properties:
error:
type: string
required:
- error
example:
error: mobile_access_unavailable
components:
securitySchemes:
apiKeyQuery:
type: apiKey
in: query
name: key
bearerAuth:
type: http
scheme: bearer