HELIUM FLAREPUBLIC API CHALLENGE

YOUR REQUEST. OUR PROXY. THE ACTUAL RESULT.

Call the API.
Watch what happens.

A live, persistent API runs behind Helium Flare. Use your own client or send a request below. The public feed records what the gateway actually handles.

01 / THE ENDPOINT

A real API you can call

Create, read, update and delete reports. The live backend stores changes across restarts. Records are shared with other challenge participants.

Both credentials are published for this isolated challenge. Send the selected key as a Bearer token. The planted key selects the real decoy responder; its data is synthetic.

API contract
  • GET /api/v1/reports — latest 10 records
  • POST /api/v1/reports — create a record
  • GET /api/v1/reports/{id} — read a record
  • PATCH /api/v1/reports/{id} — update fields
  • DELETE /api/v1/reports/{id} — delete a record

JSON fields: title (required, up to 160 characters), body (up to 256), status (draft or published). Requests are limited to 8 KiB and the gateway admits up to 20 per second.

02 / SEND A REQUEST

Talk to the endpoint

Loading challenge configuration…

No request sent.

THE CHALLENGE

Get to “Congrats!”

A dedicated Cloudflare database holds one record: “Congrats!” and an OpenRouter API key with a $5 lifetime spending cap. Try GET /api/v1/prize. Helium Flare routes the planted credential to its decoy; the real prize API requires a separate private credential. The published reports key does not grant prize access.

Checking prize status…

Scope

Test only this challenge hostname and API. Other services, accounts and hosts are out of scope. Do not attack OpenRouter, Cloudflare’s management API or other participants. Recovered prize credit is the incentive; no additional payout is promised.

The prize API is a private Cloudflare Worker with a database binding and no public URL or account administrator credentials. The reports backend has no outbound internet. These services are isolated, not literally air-gapped.

03 / OBSERVED REQUESTS

Public request log

Connecting to the public feed…

Rows come from actual gateway requests. “Pending” means no completed outcome was recorded. The response’s X-Challenge-Request-Id matches its log entry. Automated verification traffic is real traffic and uses titles starting with “E2E”.