How to get air-raid alert data programmatically

A single GET request is enough to test. Without a key the limit is 60 req/min (300 req/day per IP); with a registered Free developer key it is 120 req/min (1 000 req/day).

curl -s https://map.megainet.art/api/alerts.php

In the response: regions — state of all 25 oblasts, updated — snapshot timestamp, stale — source staleness flag. changed_ts holds the Unix timestamp of the last state transition.

import json, urllib.request

req = urllib.request.Request(
    "https://map.megainet.art/api/alerts.php",
    headers={"X-API-Key": "ak_ваш_ключ"}
)
with urllib.request.urlopen(req, timeout=10) as r:
    data = json.load(r)

for iso, region in data["regions"].items():
    if region["alert"]:
        print(iso, "— тривога з", region.get("changed_ts"))

Polling every 15 seconds burns 5,760 requests a day for a dozen events. A webhook subscription pushes a signed POST the second an alert starts or ends.

$ts   = $_SERVER['HTTP_X_MAP_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_MAP_SIGNATURE'] ?? '';
$body = file_get_contents('php://input');

// Перевіряємо підпис ДО того, як щось зробимо з подією.
if (!hash_equals(hash_hmac('sha256', $ts . "\n" . $body, $SECRET), $sig)) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);   // alert.start | alert.end

Every delivery carries X-Map-Timestamp, X-Map-Signature (HMAC-SHA256 over «timestamp \n body»), X-Map-Event and X-Map-Delivery. Always verify the signature before acting on the payload.

If your endpoint does not return 2xx within 8 seconds, we retry after 1, 5, 30 minutes, 2 and 6 hours.

How many alerts occurred in a day, how many hours each oblast spent under alert, and the hourly heat map:

curl -s "https://map.megainet.art/api/history.php?hours=24"
curl -s "https://map.megainet.art/api/analytics.php?hours=168"

Pass hours=24|48|168. Architectural boundary: airborne target tracks are kept for 24 hours, the monitor feed for 72 hours. The 168-hour window returns complete regional alert history.