VolgaCTF Final API

VolgaCTF Final is an automatic checking system (ACS) for A/D CTF contests.

This document describes VolgaCTF Final public APIs:

• Capsule API
• Service API
• Flag API
• Open Data API

In the samples below, curl is used to make HTTP requests. The API url is https://final.volgactf.ru.

Capsule API

Get public key

$ curl https://final.volgactf.ru/api/capsule/v1/public_key
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6O4HeeDG/p7CYoHrDh54SBV2RoYW
oOvajNCsb0tBWPC6VZK2jTFhwzShgAnkwkUvzZMMdDiSmHCZOm5x6KZ25Q==
-----END PUBLIC KEY-----

Service API

List services

$ curl https://final.volgactf.ru/api/service/v1/list | jq
[
  {
    "id": 1,
    "name": "Lorem"
  },
  {
    "id": 2,
    "name": "Ipsum"
  }
]

Responses

HTTP code	Response	Description
200	see above ⬆️	JSON with service identifiers and names

Get service status

$ curl https://final.volgactf.ru/api/service/v1/status/1
NOT_UP

Responses

HTTP code	Response	Description
200	UP	last PUSH and PULL both report UP
200	NOT_UP	one of last PUSH and PULL or both of them report MUMBLE, CORRUPT or DOWN
403	ERROR_ACCESS_DENIED	Request is made from a non-team network
404	ERROR_NOT_FOUND	Service identifier is invalid

Flag API

Get flag info

$ curl https://final.volgactf.ru/api/flag/v1/info/869d8f1008731701a2bab8fca8b971ba= | jq
{
  "flag": "869d8f1008731701a2bab8fca8b971ba=",
  "nbf": "2018-05-31T11:38:55+00:00",
  "exp": "2018-05-31T11:43:55+00:00",
  "round": 10,
  "team": "Lorem",
  "service": "Ipsum"
}

Responses

HTTP code	Response	Description
200	see above ⬆️	JSON with flag metadata
403	ERROR_ACCESS_DENIED	Request is made from a non-team network
404	ERROR_NOT_FOUND	The flag does not exist
429	ERROR_RATELIMIT	Rate limit exceeded
	ERROR_UNKNOWN	General error

Submit a flag

$ curl https://final.volgactf.ru/api/flag/v1/submit -H 'Content-Type: text/plain' -d 'c457f2f062ddd353d67a4c05b43bfda9='
SUCCESS

Responses

HTTP code	Response	Description
200	SUCCESS	The submitted flag has been accepted
403	ERROR_ACCESS_DENIED	Request is made from a non-team network
400	ERROR_COMPETITION_NOT_STARTED	The competition has not started yet
400	ERROR_COMPETITION_PAUSED	The competition is paused
400	ERROR_COMPETITION_FINISHED	The competition has already finished
400, 413	ERROR_FLAG_INVALID	Submitted data has invalid format
429	ERROR_RATELIMIT	Rate limit exceeded
400	ERROR_FLAG_EXPIRED	The submitted flag has expired
400	ERROR_FLAG_YOUR_OWN	The submitted flag belongs to the attacking team themselves
400	ERROR_FLAG_SUBMITTED	The submitted flag has been earlier accepted
400	ERROR_FLAG_NOT_FOUND	The submitted flag does not exist
400	ERROR_SERVICE_STATE_INVALID	The attacking team's service is not up

Open Data API

Open data is public traces that some service checkers expose to facilitate flag discovery.

Get open data for all live flags

$ curl https://final.volgactf.ru/api/open_data/v1 | jq
[
  {
    "round_id": 48,
    "team_id": 1,
    "service_id": 2,
    "open_data": "{\"username\": \"chk_c59edf8b4cf94c099037994ccf607858\"}",
    "expires": "2026-09-15T20:33:28+00:00"
  },
  {
    "round_id": 48,
    "team_id": 1,
    "service_id": 1,
    "open_data": "{\"username\": \"chk_a619e215ac3ab0ff42036d57c4ec8a70\"}",
    "expires": "2026-09-15T20:33:28+00:00"
  },
  {
    "round_id": 49,
    "team_id": 3,
    "service_id": 1,
    "open_data": "{\"username\": \"chk_a1067b80986c6d05df0edf2068d872b6\"}",
    "expires": "2026-09-15T20:35:28+00:00"
  },
  {
    "round_id": 49,
    "team_id": 1,
    "service_id": 2,
    "open_data": "{\"username\": \"chk_4e3953d1e07ed40201c2120e027240bd\"}",
    "expires": "2026-09-15T20:35:29+00:00"
  },
  {
    "round_id": 50,
    "team_id": 1,
    "service_id": 2,
    "open_data": "{\"username\": \"chk_977f75e17a5f2ace753168416b71db41\"}",
    "expires": "2026-09-15T20:37:28+00:00"
  },
  {
    "round_id": 50,
    "team_id": 3,
    "service_id": 1,
    "open_data": "{\"username\": \"chk_8b829418bc98b3a00115eb915a921fbf\"}",
    "expires": "2026-09-15T20:37:28+00:00"
  }
]

Responses

HTTP code	Response	Description
200	see above ⬆️	JSON containing open data for all live flags

Maintainers

• Aleksandr Piatkin

License

MIT @ VolgaCTF