36 lines
2.0 KiB
Markdown
36 lines
2.0 KiB
Markdown
# LEARNINGS.md — auto-reverse
|
|
|
|
## Session: 2026-05-31 — URA GLS API Reverse Engineering
|
|
|
|
### Environment & Config
|
|
- Server IP `185.5.132.28` is NOT in Singapore — gets 403 from SG gov sites
|
|
- `OPENROUTER_API_KEY` is in `.env`, loaded by flake.nix shellHook
|
|
- Default model changed to `openrouter/xiaomi/mimo-v2.5-pro`
|
|
- `anthropic` SDK replaced with `litellm` for multi-provider support
|
|
|
|
### Codebase Conventions
|
|
- `archive.log` is summary only; `archive.jsonl` has full request/response detail
|
|
- `CapturedFlow` model stores everything: `req_headers`, `resp_headers`, `req_body`, `resp_body`, `query`
|
|
- Tool schemas use Anthropic format (`name`, `description`, `input_schema`) — adapter converts to OpenAI format for litellm
|
|
- Tests assert default model string — update when changing model
|
|
|
|
### Business Context
|
|
- URA GLS (Government Land Sales) site at `eservice.ura.gov.sg/maps/?service=GLSRELEASE&site=1`
|
|
- Uses ArcGIS REST services on `maps.ura.gov.sg`
|
|
- Auth via OneMap JSONP tokens (`getOnemapToken`, `getOnemapLandLotToken`)
|
|
- 60+ fields per GLS parcel including location, dates, prices, development codes
|
|
- Geo-blocked to Singapore IPs via Azure Application Gateway WAF
|
|
|
|
### Key Findings — API Architecture
|
|
- **ArcGIS endpoints** (`maps.ura.gov.sg/ArcGis/rest/services/lsag/...`): No auth needed, just standard ArcGIS query params
|
|
- **OneMap APIs** (`www.onemap.gov.sg/api/...`): Need `Authorization: <jwt>` header from JSONP token endpoint
|
|
- **eService APIs** (`eservice.ura.gov.sg/ecasService/...`): Session-based, need cookies from browser
|
|
- **LandLot API** (`www.onemap.gov.sg/api/public/landlotAPI/...`): Needs AWS Signature auth (different from Bearer)
|
|
|
|
### Tool Usage Patterns
|
|
- The MITM proxy is the core value — captures all traffic automatically
|
|
- JS source files contain the real API documentation (auth flows, endpoints, fields)
|
|
- The LLM agent adds cost but wasn't essential for this workflow
|
|
- `archive.jsonl` format is critical for replay — without it, captured data is useless
|
|
- Browser must be on an authorized IP for geo-blocked sites
|