API reference

GET/me

Read what this token can do. Call this first. capabilities is what the token can write right now: its scopes, the owner's current permissions and the unit's settings together.

Auth: Any personal token.

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members

List members. Every member of the unit, departed members included (they have leftDate). See Member for when contact appears.

Auth: Personal token with members:read_basic.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members/{memberId}

Read a member.

Auth: Personal token with members:read_basic.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members/{memberId}/advancement

List a member's advancement. Your own family's members, or any member with View All Advancement (advancement:view_all). Others are 404.

Auth: Personal token with advancement:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members/{memberId}/activities

List a member's activities. Camping nights, service hours and miles. Same visibility as advancement.

Auth: Personal token with activities:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members/{memberId}/account

Read a member's account balance. The member's family account, or their individual account when they have no family. Your own family's account (any member of it), or every family's with View All Finances (finances:view_all); Manage Finances alone is not enough. Any other member is 404. Needs Campfire Pro or a trial with finances turned on (403 feature_disabled).

Auth: Personal token with finances:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/members/{memberId}/account/transactions

List the entries on a member's account. Charges, payments, credits and adjustments on the member's family account (or individual account). Pages come in document-id order, not date order: sort by date yourself. Old entries stored with no familyId field at all are not listed on a family's ledger, though the balance still counts them. Your own family's account (any member of it), or every family's with View All Finances (finances:view_all); Manage Finances alone is not enough. Any other member is 404. Needs Campfire Pro or a trial with finances turned on (403 feature_disabled).

Auth: Personal token with finances:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/events

List events in a date range. Events starting from the start of from through the end of to (UTC), ordered by start. Not paginated: the whole range comes back at once. Every member sees every event in the app, so every caller does here, including events hidden from the public website.

Auth: Personal token with events:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/events/{eventId}

Read an event.

Auth: Personal token with events:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/events/{eventId}/rsvps

List an event's RSVPs. Every member sees an event's RSVPs in the app, so every caller does here.

Auth: Personal token with events:read.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/import-types

List import types.

Auth: Any personal token.

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/import-types/{type}

Describe an import type's columns.

Auth: Any personal token.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/import-types/{type}/template.csv

Download a type's template. A CSV file with the header row only: the columns with inTemplate true. There is no example row, because a leftover example would be imported.

Auth: Any personal token.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/imports

List imports. Newest first, every import in the unit, from the app and the API. As in the app's import history, anyone whose role holds a permission some import type uses sees them all: an advancement sign-off permission, Add Members, Edit Members, Manage Health Forms, Manage Roles & Permissions, Create / Edit Events, Edit Events, RSVP for Other Members or Manage Finances. Anyone else gets 403.

Auth: Personal token with imports:write.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

POST/organizations/{orgId}/imports

Preview an import. Plans every row against the unit as it is and writes nothing to the unit's records. The preview can be applied for an hour. Send JSON rows, or a CSV or .xlsx file as the body with ?type=. A file's header row may use the column keys or the template headers; unknown columns are ignored and listed in an ignored_columns warning. Long ids that Excel turned into 1.36681E+08 reject the file. Up to 5,000 rows and 10 MB. The caller needs a permission the type lists (403 access_denied) and the unit must allow it (403 feature_disabled: health forms turned off, or for accountHistory no Pro or finances off). Limited to 20 previews an hour per account.

Auth: Personal token with imports:write.

Parameters

Request body

Responses

Errors: 400, 401, 403, 404, 405, 413, 429, 503. See Errors.

GET/organizations/{orgId}/imports/{importId}

Read an import. Visible to the same people as the list. Poll this after an apply or undo whose response timed out.

Auth: Personal token with imports:write.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/organizations/{orgId}/imports/{importId}/rows

List an import's row results. In row order. Only the person who ran the import can read its rows (they hold the uploaded cells, such as contact details and exam dates); anyone else gets 404. Row results are deleted 31 days after the preview or apply. After apply, each row has its final outcome; after undo, kept rows carry undo: kept.

Auth: Personal token with imports:write.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

POST/organizations/{orgId}/imports/{importId}/apply

Apply a preview. Plans the rows again against the unit as it is now and writes them. If what any row would write has changed since the preview (apart from the rows you chose for), nothing is written: 409 plan_changed, the import becomes expired, and applying it again keeps returning 409 plan_changed; preview again. A preview over an hour old is 410. Only the person who made the preview can apply it (anyone else gets 403), since the choices come from row results only they can read. A retry may send the same choices again. Applying an import that is already running, complete, failed or undone returns it as it stands, so a retry never applies twice. Over the API, Firebase Hosting cuts the request off after about 60 seconds with a 504 while the apply carries on (for up to 540 seconds): on a 504 or a client timeout, poll GET /imports/{importId} until the status is complete or failed. If the apply fails partway, the request returns an error (usually 503), or the import reads as failed 10 minutes after it started; undo it (every type but members), then import again. Limited, with undo, to 10 an hour per unit, and one running import per unit at a time.

Auth: Personal token with imports:write.

Parameters

Request body (optional)

Responses

Errors: 400, 401, 403, 404, 405, 409, 410, 429, 503, 504. See Errors.

POST/organizations/{orgId}/imports/{importId}/undo

Undo an import. Deletes the records the import created, unless they have been changed or built on in the app since; those are kept and counted in undoResult.kept. Kept: an event with any RSVP, ride, checklist, event chat or files, or one edited or canceled; an RSVP whose status changed; an advancement record whose dates, sign-offs or notes changed; an account entry or past position edited (notes included). Undoing attendance also removes the camping nights and service hours the deleted RSVPs earned (the event's own records; manual entries stay), and auto-charge removes their charges. Undoing a completed rank recalculates the Scout's permissions; undoing account history recalculates the families' balances. Changes the import made to records that already existed stay. Only for imports of any type but members that are complete or failed (including an apply that died partway) and within 30 days of apply (undoUntil); anything else is 409 not_undoable. Undoing an undone import returns it unchanged. Needs the permission the import type needs (the feature doesn't have to still be turned on), and the permission to delete each record it removes: Delete Events (events:delete) for events, the item type's sign-off permission for advancement; otherwise 403 access_denied and nothing is removed. An accountHistory undo that would remove an entry in a month closed since is 409 month_closed. Over the API, a 504 after about 60 seconds means the undo carries on: poll GET /imports/{importId} until the status is undone.

Auth: Personal token with imports:write.

Parameters

Request body (optional)

Responses

Errors: 400, 401, 403, 404, 405, 409, 429, 503, 504. See Errors.

POST/organizations/{orgId}/payments

Record a payment. Writes what Record Payment writes in the app: a completed payment on the member's family account (or individual account), lowering the family balance in the same transaction, with source api and the token owner as recorder. Sends no notifications. Needs Manage Finances (finances:manage; else 403 access_denied) and Campfire Pro or a trial with finances turned on (403 feature_disabled). The same reference with the same body returns the recorded payment (200) before any other check, so a retry still succeeds after the month closed, the member left or a year passed; the same reference with a different body is 409 reference_conflict. A new payment with paidOn inside a closed month is 409 month_closed. Limited to 120 new payments an hour per token.

Auth: Personal token with payments:write.

Parameters

Request body

Responses

Errors: 400, 401, 403, 404, 405, 409, 429, 503. See Errors.

GET/organizations/{orgId}/payments/{paymentId}

Read a payment recorded through the API. Payments recorded in the app or through Stripe are 404 here. Needs payments:write; finances:read doesn't open this endpoint (read the member's account transactions instead).

Auth: Personal token with payments:write.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

DELETE/organizations/{orgId}/payments/{paymentId}

Void a payment recorded through the API. Removes the payment and credits the amount back to the family the payment is on at the moment of voiding. Only payments recorded through the API (others 404). 409 month_closed once its month is closed. After a void, the same reference can be recorded again.

Auth: Personal token with payments:write.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 409, 429, 503. See Errors.

GET/connections

List your tokens. This account's tokens, including expired and revoked ones. Works while the API is switched off.

Auth: Firebase sign-in (the app's settings page), not a personal token.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

POST/connections

Create a token. Used by the app's Connected apps & API access page. Needs a Firebase sign-in from the last five minutes, an active linked adult membership in the organization, and for each write scope a current permission that scope can use. Creating a token with a write scope emails the owner. Limited to 5 new tokens an hour per account.

Auth: Firebase sign-in (the app's settings page), not a personal token.

Request body

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

GET/connections/eligibility

Check whether you can create a token.

Auth: Firebase sign-in (the app's settings page), not a personal token.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

DELETE/connections/{connectionId}

Revoke a token. Idempotent. Works after leaving the unit and while the API is switched off.

Auth: Firebase sign-in (the app's settings page), not a personal token.

Parameters

Responses

Errors: 400, 401, 403, 404, 405, 429, 503. See Errors.

Scope

What a token may carry. A scope is a ceiling, never a grant: every request also re-checks the owner's current membership, roles, family links and unit settings. Tokens holding imports:write or payments:write start with cf_rw_; read-only tokens with cf_ro_.

string. One of: members:read_basic, members:read_contact, advancement:read, activities:read, events:read, finances:read, imports:write, payments:write.

ImportTypeName

members: roster, households, roles and departures (Add Members or Edit Members; no undo). activities: camping nights, service hours and miles (any advancement sign-off permission). healthForms: exam dates (Manage Health Forms; health forms on). roleHistory: past positions with start and end dates (Manage Roles & Permissions). events: calendar events, past or future, keyed by your own id (Create / Edit Events or Edit Events; undo needs Delete Events). attendance: RSVPs on events that have ended (RSVP for Other Members). advancement: completion and awarded dates for ranks, merit badges, awards and adventures, filling blanks only (the sign-off permission for each item type). accountHistory: charges and credits on family accounts, never payments (Manage Finances; Pro or trial with finances on). Every type but members can be undone. Columns: GET /import-types/{type}.

string. One of: members, activities, healthForms, roleHistory, events, attendance, advancement, accountHistory.

Error

ConnectionInput

Connection

ConnectionCreated

Eligibility

Me

Member

Fields not set in Campfire are omitted. contact appears only when the token holds members:read_contact and the caller may see this member's contact details in the app: themselves and their family always; otherwise View Adult Contact Info (members:view_adult_contact_info) for an adult or View Youth Contact Info (members:view_youth_contact_info) for a youth.

MemberContact

Requirement

Advancement

Activity

Account

Transaction

One entry on an account. Optional fields the entry doesn't have are omitted. Not returned: notes, who recorded it, card or bank digits, receipt links, Stripe ids.

Event

Optional fields are omitted when the event doesn't have them. Files, checklists, meeting plans, drivers and the creator are not returned.

Rsvp

Notes are not returned.

ImportTypeSummary

ImportColumn

ImportType

ImportRowsInput

ImportSummary

Counts per outcome. After apply, rows that still needed a choice count as skip.

ImportWarning

Something a person must see before applying. ignored_columns (with columns), merges_families (with count, members imports), and for attendance imports in a unit that tracks finances charges_families and removes_charges (with count and amountCents). An event's cost is part of the preview, so a cost added after it makes apply answer 409 plan_changed.

Import

Candidate

Change

ImportRow

ApplyInput

PaymentInput

Payment