Connect your system to Pasay City GIS

The API gives other systems the same data the map uses: the GIS input entries (public facilities, utilities, overpasses, bridges, businesses and parcels) with their attachments, the registered businesses per barangay, and the zone parcel layers with their tax declaration details. With a read and write key, a system can also add, edit and delete GIS input entries.

Everything changed through the API shows on the map straight away, and is recorded in the platform's history under the key's account, marked via API key.

Getting a key

Keys are created by a platform administrator (a staff account):

1. Open the map, click the gear ⚙ at the top right, then API keys (or go to /admin/pasay/apikey/).
2. Click Add API key. Give it a name that says who uses it, e.g. City Hall ERP.
3. Choose the account it acts as. Entries added or edited with the key are recorded under that account, so a dedicated account per system (e.g. erp-integration) keeps the history clear.
4. Choose the access: Read only (fetch data) or Read and write (also add, edit and delete entries). Optionally set an expiry.
5. Save. The key is shown once — copy it then. Only a fingerprint of it is kept, so a lost key can't be recovered: revoke it (select it in the list → Revoke selected keys) and add a new one.

A key looks like pasay_1a2b3c4d.Xy…. The part before the dot identifies it in the admin list.

Authentication

Send the key with every request, in either header:

Authorization: Bearer pasay_1a2b3c4d.your-secret-part
X-API-Key: pasay_1a2b3c4d.your-secret-part

Requests without a valid key get 401. Revoked keys, expired keys and keys whose account has been deactivated stop working immediately. Read only keys get 403 on POST, PUT, PATCH and DELETE.

Quick start

Check the key works — the service answers with the key's name and access:

export PASAY_GIS_API_KEY="pasay_1a2b3c4d.your-secret-part"

curl -H "Authorization: Bearer $PASAY_GIS_API_KEY" http://localhost/api/v1/

# Parcel/Lot entries in Zone 9, changed since 1 January
curl -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
     "http://localhost/api/v1/entries/?category=parcel&zone=9&updated_since=2026-01-01"

import os
import requests

API = "http://localhost/api/v1"
session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['PASAY_GIS_API_KEY']}"

print(session.get(f"{API}/").json())

# Every Business entry, page by page
url, params = f"{API}/entries/", {"category": "business", "page_size": 500}
while url:
    page = session.get(url, params=params)
    page.raise_for_status()
    body = page.json()
    for feature in body["features"]:
        props = feature["properties"]
        print(props["id"], props["name"], props["details"].get("acctno"))
    url, params = body["next"], None   # "next" already carries the parameters

// Node 18+ (or any server-side JavaScript with fetch). Keep keys out of web pages.
const API = "http://localhost/api/v1";
const headers = { Authorization: `Bearer ${process.env.PASAY_GIS_API_KEY}` };

const service = await fetch(`${API}/`, { headers }).then(r => r.json());
console.log(service.key);

const res = await fetch(`${API}/zones/9/parcels/?q=claudio&geometry=0`, { headers });
if (!res.ok) throw new Error((await res.json()).error.message);
const { count, features } = await res.json();
console.log(count, features.map(f => f.properties.PIN));

Responses & errors

Successful calls return 200 (or 201 when something was created) with JSON. Errors always have this shape:

{
  "error": {
    "code": "invalid",
    "message": "Please correct the highlighted fields.",
    "fields": { "details.acctno": ["This field is required."] }
  }
}

Times are ISO 8601 with time zone, e.g. 2026-11-06T09:15:00+00:00. Coordinates are WGS 84 (longitude, latitude), as in GeoJSON.

Paging & limits

Lists are paged. Pass page (from 1) and page_size; every list response carries count, page, page_size, pages, and full next / previous URLs (null at the ends) — follow next until it's null.

Rate limit: 120 requests per minute per key. Responses include X-RateLimit-Limit and X-RateLimit-Remaining; over the limit you get 429 with Retry-After. For syncing, prefer updated_since over re-reading everything.

Adding & editing data

A business — placed by coordinates; its BPLO columns go in details:

curl -X POST http://localhost/api/v1/entries/ \
  -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "category": "business",
        "name": "ABACUS BOOK & CARD CORPORATION",
        "latitude": 14.5376,
        "longitude": 120.9912,
        "details": {
          "acctno": "02-000028",
          "owner": "ABACUS BOOK & CARD CORPORATION",
          "owndesc": "CORPORATION",
          "statcode": "R",
          "foryear": 2025,
          "commaddr": "UNIT 115 G/F, METROPOINT MALL, TAFT AVE., Barangay 097",
          "barangay": "Barangay 97",
          "busdesc": "Retailer - General Merchandise"
        }
      }'

A parcel with photos and a PDF — placed by its zone and PIN (no coordinates; the platform puts it inside the parcel), files in the same call:

curl -X POST http://localhost/api/v1/entries/ \
  -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
  -F 'data={"category": "parcel", "zone": "zone_9", "pin": "123-01-086-03-010",
            "details": {"arp_tdn": "C1-086-00173", "parcel_class": "Residential"}}' \
  -F files=@front.jpg \
  -F files=@tax-declaration.pdf

An unsure parcel — it has no PIN, so give its parcel_ref from GET /zones/{zone}/parcels/?class=Unsure. Only the class is required; send whatever else is known:

curl -X POST http://localhost/api/v1/entries/ \
  -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category": "parcel", "zone": "zone_10", "parcel_ref": "1tiu9qd7px7",
       "details": {"parcel_class": "Commercial", "actual_use": "C"}}'

The entry's values then show on the zone layer in place of "Unsure".

Each parcel has one live Parcel/Lot entry; adding a second for the same PIN (or parcel_ref) fails with a message naming the existing entry — find it with GET /entries/?category=parcel&pin=… (or &parcel_ref=…) and edit that one.

A parcel's updated shape — any parcel, by its parcel_ref. The shape is a GeoJSON Polygon or MultiPolygon in WGS84 longitude / latitude (reproject a shapefile first); it replaces the parcel's shape on the zone layer until the entry is deleted. One live shape update per parcel.

curl -X POST http://localhost/api/v1/entries/ \
  -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category": "parcel_shape", "zone": "zone_10", "parcel_ref": "1tiu9qd7px7",
       "shape": {"type": "Polygon", "coordinates": [[[120.9897, 14.5384], [120.9899, 14.5384],
                                                     [120.9899, 14.5386], [120.9897, 14.5386], [120.9897, 14.5384]]]},
       "details": {"change_type": "Resurvey", "remarks": "New survey plan"}}'

Edit — only what changes:

curl -X PATCH http://localhost/api/v1/entries/42/ \
  -H "Authorization: Bearer $PASAY_GIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"details": {"noe": 12}, "remove_files": [7]}'

Python — add attachments to an existing entry, then delete one:

with open("site-visit.mp4", "rb") as video:
    r = session.post(f"{API}/entries/42/files/", files=[("files", video)])
r.raise_for_status()
attachments = r.json()["properties"]["attachments"]

session.delete(f"{API}/files/{attachments[0]['id']}/").raise_for_status()

Form fields

What each form needs when you add an entry. details fields go inside the details object. Choice fields take one of the listed values exactly. Also available as JSON from /forms/.

Numbers: int and decimal fields take numbers (or numeric strings), 0 or more. Dates are YYYY-MM-DD.

Security checklist

• Keep keys on servers. Don't put a key in a web page or mobile app — anyone can read it there. Call the API from your back end.
• Use HTTPS so keys and data are encrypted in transit.
• One key per system, with the least access it needs (read only unless it must write), and an expiry where it makes sense.
• Store keys like passwords — environment variables or a secrets manager, never in source code.
• Revoke a key straight away if it may have leaked, and issue a new one.
• Attachments can contain personal or property documents — protect what you download.