Open Source · MIT

Build on the
WorldOSView platform

WorldOSView aggregates aviation, maritime, seismic, conflict, cyber, and OSINT feeds onto a single GPU-rendered map — and exposes every one of them as a plain HTTP endpoint. This is the same API the dashboard runs on. There is no separate, privileged internal tier.

56
Endpoints
20+
Live feeds
0
Keys required
Guide

Overview

Every data point on the map is rendered through WebGL via MapLibre GL, which is what lets the interface hold thousands of concurrent entities at 60fps. The application is a Next.js app: the map and HUD run in the browser, and each live feed is normalised by a route under /api before it reaches the client.

That boundary is deliberate. Upstream sources disagree about formats, rate limits, and CORS policy, so the API layer absorbs those differences and hands back consistent JSON.

Useful without credentials
The base map plus aviation, satellites, fires, earthquakes, weather, news, CVE, port, and chokepoint data work from public keyless feeds. Optional credentials add provider quota or capabilities; live AIS ship positions additionally require a persistent Node/Docker receiver.
Guide

Quick Start

Every read endpoint is a plain GET returning JSON. Nothing below needs authentication — paste any of it into a terminal.

curl -s https://osint.shez.app/api/flights | jq '.commercial_flights | length'

If you only need magnitudes rather than geometry, /api/stats is the right endpoint to poll — it collapses the heavy feeds into a handful of counters.

Aggregate counters
curl -s https://osint.shez.app/api/stats
# { "stats": { "flights": 9241, "sats": 2043, "cctv": 2117,
#              "weather": 58, "nuclear": 191, "incidents": 412 },
#   "timestamp": "2026-07-29T12:00:00Z" }

The OSINT lookups each take one subject, so they compose cleanly in a pipeline:

Passive subdomain enumeration
curl -s "https://osint.shez.app/api/osint/certs?domain=example.com" | jq -r '.subdomains[]'
Try before you write code
Every GET endpoint in the reference below has a Send request button that runs it against this instance and shows the live response.
Guide

Self-Hosting

WorldOSView needs Node 20+ and no database. A local instance is three commands:

Local development
git clone https://github.com/mohamedshez/worldosview.git
cd worldosview
npm install
npm run dev        # http://localhost:3000

For a production build, or to run the checks:

Build and test
npm run build && npm start
npm run lint
npm test           # vitest
npm run test:live  # includes tests that hit live upstream feeds

A Dockerfile and docker-compose.yml ship with the repository. The container always listens on port 3000 internally; OSIRIS_PORT controls the host port it is published on.

Docker
cp .env.example .env
docker compose up -d
Guide

Configuration

Copy .env.example to .env, then fill only the integrations this deployment will use. The map and keyless feeds need no secret; blank optional values leave their capabilities off.

Read by the application

NEXT_PUBLIC_SITE_URL
Canonical HTTPS origin used by metadata, the sitemap, and share links. Set it to the final deployment domain.
SCANNER_URL / SCANNER_KEY
Points at the separate RECON scanner backend. SCANNER_KEY must equal that backend’s OSIRIS_KEY. Leave both empty to disable RECON — /api/scanner then returns 503 by design.
INTEL_URL / ASTRA_GPU_URL
Optional hosted entity-graph and ASTRA analysis services. Docker Compose supplies its bundled intelligence URL automatically.
CLOUDFLARE_API_TOKEN / OPENSKY_* / AIS_API_KEY
Enable Cloudflare Radar, authenticated aviation, or live AIS vessel feeds. AIS uses a long-lived WebSocket and is reliable only on a persistent Node/Docker service, not a stateless serverless function.
PHOTON_API_URL
Optional Photon geocoder endpoint. The default public demo is best effort and protected by caching and per-client limits; self-host Photon for sustained production traffic.
ETHERSCAN_API_KEY / HELIUS_API_KEY
Add richer Ethereum and Solana transaction details to keyless baseline wallet analysis.
GEMINI_API_KEY_1 (and higher)
Enables Gemini summaries and analysis. Numbered keys can provide failover and stay server-side.
SDK_INGEST_KEY / GITHUB_WEBHOOK_*
Protect external SDK ingestion and authenticate/forward GitHub webhook events. Ingestion fails closed when its key is unset.
OSIRIS_PORT
Host port the UI is published on. The container itself always listens on 3000.

Reserved compatibility values

FIRMS_API_KEY, N2YO_API_KEY, and OSIRIS_TELEGRAM_CHANNELS are documented for upstream compatibility but are not read by this revision.

Secrets hygiene
Generate secrets with openssl rand -hex 32. Never commit a populated .env — only .env.example belongs in version control.
Guide

Interface Guide

The map fills the viewport and every control floats above it. Panels are toggles rather than destinations, so you can build up exactly the picture you need and drop the rest.

Layer Panel
The left rail. Switches individual feeds on and off, and carries the theme selector.
RECON Toolkit
DNS, WHOIS, certificate transparency, IP and ASN enrichment, breach checks, sanctions, CVE lookup, port scanning.
Intel Feed
A running stream of incoming events across every enabled feed.
Region Dossier
Right-click the map for a composite summary of that location from every feed covering it.
Entity Graph
Link analysis, expanding one node at a time into its neighbours.
Status Bar
Community and docs links on the left, then a live ticker of prices and significant seismic events.
Guide

Keyboard Shortcuts

Press ? at any time inside the application to bring up this list.

FToggle fullscreen
SShare current view
LToggle layer panel
MToggle markets panel
IToggle intel feed
RReset to global view
?Show help
ESCClose panels / popups

In these docs, ⌘K (or /) opens search from anywhere on the page.

API Reference

Conventions

All routes live under /api on whatever origin serves the application. Reads are GET, writes are POST with a JSON body. Nothing requires authentication except /api/sdk/ingest and /api/github-webhook.

Errors
Failures return a non-2xx status with an `error` key, often alongside `detail` carrying the upstream message. Most routes proxy third parties, so treat upstream failure as normal — check response.ok before reading the body.
Caching
Routes set their own Cache-Control TTLs: typically 45–60s for fast-moving feeds, up to a day for static reference data. Polling faster than the TTL gains nothing but load. Where a route advertises refreshInterval, use it.
Rate limits
The three AI endpoints allow 5 requests per minute per IP and return 429 beyond that. Other routes are bounded indirectly by their upstream sources.
Timestamps
Every timestamp field is ISO 8601 in UTC.
Responsible use
The RECON scanner and /api/osint/sweep generate traffic against the targets you name. Only point them at infrastructure you own or have written authorisation to test. The remaining OSINT routes are passive and query third-party datasets rather than the subject itself.
API Reference

System

Liveness and aggregate counters. Safe to poll from monitoring.

API Reference

Aviation & Space

Aircraft, orbital objects, and heliophysics.

API Reference

Earth & Environment

Seismic, fire, atmospheric, and orbital-imagery feeds.

API Reference

Geopolitical

Conflict zones, frontlines, event streams, and country-level risk.

API Reference

Media & Markets

News aggregation, live broadcast streams, and financial instruments.

API Reference

Surveillance & Infrastructure

Camera networks, fixed infrastructure, maritime traffic, and tile/stream proxies.

API Reference

Cyber Threat

Vulnerability, attack, and malware telemetry.

API Reference

OSINT Toolkit

The lookup tools behind the RECON panel. Every route takes a single subject and returns a normalised result, so they compose well in scripts.

API Reference

Recon Scanner

Active scanning, delegated to a separate backend so the web tier never runs scans itself.

API Reference

Entity Graph

Link analysis over entities surfaced elsewhere in the platform.

API Reference

AI Analysis

Gemini-backed correlation over feed data you supply. All three are POST, all three are rate limited to 5 requests per minute per IP.

API Reference

Polybolos SDK

Push entities from an external platform into the Common Operating Picture, and stream the merged picture back out.

API Reference

Webhooks

Inbound hooks from external services.