CrowdConnected endpoints & re-check URLs (all CC-enabled apps)
Generated 2026-06-27. Purpose: make it easy to re-verify the location-tracking state of every CrowdConnected-enabled Appmiral app without re-deriving everything.
The CrowdConnected SDK does not use a per-app hostname. Every app talks to the
same backend and is distinguished only by its per-app appKey / token /
secret (sent in the request body, not the URL). So “the URL to check again later”
is really: the shared CC backend + each app’s credentials, or the app’s
on-device Room database.
1. Shared CrowdConnected backend (same for every app)
Base host (found in every APK’s dex): https://mobile.crowdconnected.com/prod/
| Path | Method | Purpose |
|---|---|---|
/prod/register |
POST | Register device with appKey+token+secret; response carries the live config: active, geozones (lat,lng,radius1,radius2), polling frequencies. This is the call to replay to re-check tracking state. |
/prod/settings |
POST | Settings / kill-switch (active, pollingFrequency, geo frequencies). |
/prod/geo , /prod/zones |
POST | Geozone definitions (inner radius1, outer radius2). |
/prod/position |
POST | Where the app uploads observed GPS positions. |
/prod/status , /prod/alias , /prod/surface , /prod/device(s) |
POST | SDK status, user aliasing, surface, device records. |
Downstream ingestion (from runtime logs): AWS Kinesis Firehose
firehose.us-east-1.amazonaws.com (Firehose_20150804.PutRecordBatch).
Push registration uses sns.eu-west-1.
2. Per-app re-check identity (the 12-app CC club)
appKey is the stable per-app identifier. On-device DB path is the fastest
re-check if the app has been launched far enough to init the SDK:
/data/data/<package>/databases/CrowdConnected-RoomDatabase.
| # | Package | appKey | Indoor flag | Live state captured? |
|---|---|---|---|---|
| 1 | com.appmiral.ttfestival |
dd54d39d |
false | yes (active=1) |
| 2 | com.appmiral.dutchgp |
36fe15a0 |
false | yes (geo observer) |
| 3 | com.appmiral.mdlbeast |
d61997e4 |
false | yes (active=0) |
| 4 | com.appmiral.rockforpeople |
4ddafa25 |
false | yes (active=0) |
| 5 | com.appmiral.museumnachtamsterdam |
30d143df |
false | yes (geo present) |
| 6 | be.appstrakt.werchter2010 |
490f94a3 |
false | no DB yet (static key only) |
| 7 | com.appmiral.loversandfriends |
34c90857 |
false | no DB yet |
| 8 | com.appmiral.sicknewworld |
34500b15 |
true | no DB yet |
| 9 | com.appmiral.teamnl |
48b6d281 |
false | no DB yet |
| 10 | com.appmiral.tomorrowlandbrasil |
9ccdd0a0 |
false | no DB yet |
| 11 | com.appmiral.werchterboutique |
8d9ea3c7 |
false | no DB yet |
| 12 | com.appmiral.werchterparklife |
142f2a03 |
false | not installable (32-bit only) |
3. Live geozones captured on-device (inner / outer circle + status)
Pulled from each app’s CrowdConnected-RoomDatabase (GeoZone + Settings) on
2026-06-26/27. radius1 = inner circle (high-frequency / 30s zone),
radius2 = outer circle (activation boundary). Distances in metres.
| Package | appKey | Centre lat | Centre lng | Inner (r1) | Outer (r2) | Active | Notes |
|---|---|---|---|---|---|---|---|
com.appmiral.ttfestival |
dd54d39d |
52.994439 | 6.563694 | 820 | 60000 | 1 (ON) | Assen TT circuit; live exfiltration confirmed |
com.appmiral.dutchgp |
36fe15a0 |
52.387479 | 4.544506 | 800 | 34000 | n/a* | Zandvoort area; older Settings schema (no active col, geoEnabled=1) |
com.appmiral.mdlbeast |
d61997e4 |
21.488454 | 39.187019 | 282 | 60000 | 0 (off) | Jeddah/Saudi; server-stopped |
com.appmiral.rockforpeople |
4ddafa25 |
50.245537 | 15.841379 | 1354 | 40000 | 0 (off) | Hradec Kralove CZ; server-stopped |
com.appmiral.museumnachtamsterdam |
30d143df |
52.363654 | 4.893890 | 10155 | 80000 | n/a* | Amsterdam; older schema (no active col) |
*Older SDK config schema (bluetoothCycleOnTime/foregroundOnly, no explicit
active kill-switch column); tracking gated by geoEnabled instead.
The other 7 CC-club apps have no materialized geozone yet because the SDK only
writes the DB after it initializes and fetches config from /prod/register.
Launch the app (grant location) once, then pull the DB to capture their circles.
4. Credentials to replay /prod/register (re-check without the phone)
These ship in each APK’s string resources (crowdConnectedKey/Token/Secret).
Treat token + secret as exposed secrets.
| Package | appKey | token | secret |
|---|---|---|---|
com.appmiral.ttfestival |
dd54d39d |
a86ff3cfbc7b4cdfa285a3a1b2eaecb0 |
kW2g4625iYp65osY3T8q12ei68G86xJ7 |
com.appmiral.dutchgp |
36fe15a0 |
7710682e443d4974876e46e0c610463a |
nw6A3f5482575n73sClhD9S19U3gXrn3 |
com.appmiral.mdlbeast |
d61997e4 |
d348a9788c86438e91f913c871b94f87 |
4VsM5744v33h5Dj57cm3ltn71KK3s4G8 |
com.appmiral.rockforpeople |
4ddafa25 |
ef1f755dae914bc8b247f67cdf3f8c51 |
M287M65EO68TfG2723w678T85E68Gy6i |
com.appmiral.museumnachtamsterdam |
30d143df |
13e1bb50bc41429e82588526bf690455 |
te4V98a3J4Gn83h2793Yy8q7738cVk86 |
be.appstrakt.werchter2010 |
490f94a3 |
e85b96f411e74ef8aead75fbae357e96 |
74vcT2A755Jmj2z64hG2b426421UbI6C |
com.appmiral.loversandfriends |
34c90857 |
d71db19c42374e569436e9af2f1b8424 |
22an63Q58OATt15L1T6c917NQFe296mV |
com.appmiral.sicknewworld |
34500b15 |
730c39224eaa4c1b8cbf7265d6fc01fa |
hmh18X2XB6Kil1yU85L5C1B6Xg74A25c |
com.appmiral.teamnl |
48b6d281 |
9e96192fd3ca4391bc30b5258757dc3b |
iB7833326sXTXyO3J7B7p25l3st19cP9 |
com.appmiral.tomorrowlandbrasil |
9ccdd0a0 |
f057ae3e482741d780d5d7409a7f7839 |
67c8hD13Wj7B17411G3A5CE7jqq243Ee |
com.appmiral.werchterboutique |
8d9ea3c7 |
13ba7455c13c433baf5687f80bbbc926 |
GO345v3sVmeR7Yt9Wg4M2yX7qJ27AUfS |
com.appmiral.werchterparklife |
142f2a03 |
a12a24e73ead4c589029e51c6e6d4529 |
Vsay885rGgc688m7Dv6EPPp4q8a5x594 |
Version note: an older
cc_keyssnapshot listedttfestivalappKey0e0957e1/ token5b88db72c92546139cb870bfae68e10d. The currently installed v2.0.1 (versionCode 5) build usesdd54d39d(verified viaaapt2 dump resourcesand confirmed against the live Room DB). Older build keys may still be valid tenants on the CC backend.
5. Other Appmiral URLs (content API, not CC)
Same for every app; useful for cross-referencing identity/content data flow.
| Resource | Value |
|---|---|
| Appmiral REST API | https://app.appmiral.com/api/v7/ |
| Appmiral function API | https://app.appmiral.com/function/ |
| App catalogue (discovery) | https://appmiral.com/our-work |
| TT deep-link host | https://ttfestival2026.deeplink.appmiral.com/ |
The content API is identity-authenticated via runtime x-account-* /
x-cognito-token headers (per-user, stored in shared_prefs/), not a static key.
6. Re-check runbook
A. Fastest (app already launched on a rooted device):
adb shell "su -c 'cp /data/data/<pkg>/databases/CrowdConnected-RoomDatabase* /sdcard/'"
adb pull /sdcard/CrowdConnected-RoomDatabase /sdcard/CrowdConnected-RoomDatabase-wal /sdcard/CrowdConnected-RoomDatabase-shm .
# read Settings.active + GeoZone(lat,lng,radius1,radius2) with Python sqlite3 (WAL applied)
B. Materialize a not-yet-initialized app: launch it, grant location, give it a
minute to hit /prod/register, then run step A.
C. Off-device: POST to https://mobile.crowdconnected.com/prod/register with
the app’s appKey/token/secret from section 4 and read active + geozones
from the response.
D. Re-extract static keys from any APK:
aapt2 dump resources <app>.apk | Select-String -Context 0,1 'string/crowdConnected'