Build on the
WorldOSView platform
WorldOSView aggregates aviation, maritime, seismic, conflict, cyber, and OSINT feeds onto a single GPU-rendered map — and exposes every one of them as a plain HTTP endpoint. This is the same API the dashboard runs on. There is no separate, privileged internal tier.
Overview
Every data point on the map is rendered through WebGL via MapLibre GL, which is what lets the interface hold thousands of concurrent entities at 60fps. The application is a Next.js app: the map and HUD run in the browser, and each live feed is normalised by a route under /api before it reaches the client.
That boundary is deliberate. Upstream sources disagree about formats, rate limits, and CORS policy, so the API layer absorbs those differences and hands back consistent JSON.
Quick Start
Every read endpoint is a plain GET returning JSON. Nothing below needs authentication — paste any of it into a terminal.
curl -s https://osint.shez.app/api/flights | jq '.commercial_flights | length'If you only need magnitudes rather than geometry, /api/stats is the right endpoint to poll — it collapses the heavy feeds into a handful of counters.
curl -s https://osint.shez.app/api/stats
# { "stats": { "flights": 9241, "sats": 2043, "cctv": 2117,
# "weather": 58, "nuclear": 191, "incidents": 412 },
# "timestamp": "2026-07-29T12:00:00Z" }The OSINT lookups each take one subject, so they compose cleanly in a pipeline:
curl -s "https://osint.shez.app/api/osint/certs?domain=example.com" | jq -r '.subdomains[]'Self-Hosting
WorldOSView needs Node 20+ and no database. A local instance is three commands:
git clone https://github.com/mohamedshez/worldosview.git
cd worldosview
npm install
npm run dev # http://localhost:3000For a production build, or to run the checks:
npm run build && npm start
npm run lint
npm test # vitest
npm run test:live # includes tests that hit live upstream feedsA Dockerfile and docker-compose.yml ship with the repository. The container always listens on port 3000 internally; OSIRIS_PORT controls the host port it is published on.
cp .env.example .env
docker compose up -dConfiguration
Copy .env.example to .env, then fill only the integrations this deployment will use. The map and keyless feeds need no secret; blank optional values leave their capabilities off.
Read by the application
Reserved compatibility values
FIRMS_API_KEY, N2YO_API_KEY, and OSIRIS_TELEGRAM_CHANNELS are documented for upstream compatibility but are not read by this revision.
openssl rand -hex 32. Never commit a populated .env — only .env.example belongs in version control.Interface Guide
The map fills the viewport and every control floats above it. Panels are toggles rather than destinations, so you can build up exactly the picture you need and drop the rest.
Keyboard Shortcuts
Press ? at any time inside the application to bring up this list.
In these docs, ⌘K (or /) opens search from anywhere on the page.
Conventions
All routes live under /api on whatever origin serves the application. Reads are GET, writes are POST with a JSON body. Nothing requires authentication except /api/sdk/ingest and /api/github-webhook.
/api/osint/sweep generate traffic against the targets you name. Only point them at infrastructure you own or have written authorisation to test. The remaining OSINT routes are passive and query third-party datasets rather than the subject itself.System
Liveness and aggregate counters. Safe to poll from monitoring.
Aviation & Space
Aircraft, orbital objects, and heliophysics.
Earth & Environment
Seismic, fire, atmospheric, and orbital-imagery feeds.
Geopolitical
Conflict zones, frontlines, event streams, and country-level risk.
Media & Markets
News aggregation, live broadcast streams, and financial instruments.
Surveillance & Infrastructure
Camera networks, fixed infrastructure, maritime traffic, and tile/stream proxies.
Cyber Threat
Vulnerability, attack, and malware telemetry.
OSINT Toolkit
The lookup tools behind the RECON panel. Every route takes a single subject and returns a normalised result, so they compose well in scripts.
Recon Scanner
Active scanning, delegated to a separate backend so the web tier never runs scans itself.
Entity Graph
Link analysis over entities surfaced elsewhere in the platform.
AI Analysis
Gemini-backed correlation over feed data you supply. All three are POST, all three are rate limited to 5 requests per minute per IP.
Polybolos SDK
Push entities from an external platform into the Common Operating Picture, and stream the merged picture back out.
Webhooks
Inbound hooks from external services.