Now, curbs on giving real-time Co-WIN slot availability data

PUNE: The Centre has put restrictions on multiple users and platforms that have emerged to provide real-time data on slot availability for prospective vaccine beneficiaries in their respective districts, senior officials of the Union health and family welfare ministry have told TOI.
Ever since vaccination started for the 18-44 age group, several techies have been trying to develop programmes or running scripts for searching vaccine slots in real time using public Application Program Interfaces (APIs) on Co-WIN.This was inconveniencing people who are not so tech-savvy, said officials.
An API is a set of programming code that enables data transmission between one software product and another. In fact, multiple portals have emerged which automatically search for new vaccination slots from the Co-WIN server and send it to users who have punched in their personal details for the service.
Mazahir Poonawalla, a city-based working professional who tried something similar via a third-party programme, said, “These programmes automatically search for slots as soon as they are out on Co-WIN and send an alert to the user through email or SMS. The user can then log in on Co-WIN and book a slot, instead of being on the portal all day and refreshing it over and over again to find slots.”
Poonawalla, however, said the method never worked for him. “I got an alert. But by the time I logged in on Co-WIN, all slots had already been booked. This means that thousands of users are using such programmes to find a vaccine slot and log in as soon as they get such alerts,” he said.
“Techies and portals have been using the APIs openly available on the Co-WIN portal under the option ‘Open APIs’ to get access to vaccine slot availability in a district programmatically. Using the APIs on the portal, I made a programme with an internal application to see if it works. I hit the program multiple times in a minute to see if it found slots. But after multiple attempts, it stopped due to rate limitation,” a city-based IT professional told TOI on the condition of anonymity.
The Co-WIN public APIs portal now states, “These APIs are available for use by all third- party applications. The appointment availability data is cached and may be up to 30 minutes old. Further, these APIs are subject to a rate limit of 100 API calls per 5 minutes per IP.”
Experts said since the appointment availability data was now cached, it would now not show the slot availability in real time. This would ultimately render such portals redundant.
Those desperately searching for slots in Pune and other cities have been resorting to these portals or individuals on Twitter, WhatsApp and other social media, requesting for such “scripts”. The users have to provide details such as mobile number or email address and district/pin code on these portals to get a notification on real-time data on slot availability.
After reports that programmers were not only using Co-WIN APIs for getting alerts on new slots, but were also booking slots through these scripts, a senior health and family welfare official ministry told TOI, “ We are closely monitoring the system, checking for number of hits from various IPs and also the number of appointments made via these IP’s. Anyone found involved in any sort of hanky-panky will be known to us. We have introduced the CAPTCHA feature in the Co-WIN system while booking slots. This will ensure human intervention while booking slots.”
The official added, “The appointment availability data is also cached, precluding the possibility of running a script to have early information about slot availability and informing others of it. This possibility has been closed because there are many who tend to lose vaccination slots to those who use such programs to get the slot first.”
While ministry officials said that there was nothing wrong in using Co-WIN Public APIs to find appointment availability to help others find slots, the recent limitation has been introduced to ensure that those who are not tech savvy do not miss out on vaccine appointments to those with IT know-how.
The official said the problem in booking the slots was due to the rush for appointments in the face of less vaccine availability. “The number of slots will increase in the coming days, as more and more states mobilize their vaccine supplies,” the official said.Cybercrime experts in Pune have been getting requests from acquaintances to develop such programmes using the APIs openly available on Co-WIN. The experts have warned the users to not rely on the third-party developers, as the information provided to them could be misused.
Shweta Chawla, a digital forensic investigator and head at Pune-based SC Cyber Solutions Private Limited said, “The danger in such scripts is that somebody can hide a malicious code in it. If the script is sent to someone, it may have an additional code in it which may give a fraudster access to another’s system where it is run — be it a cellphone or laptop. We suggest people to just keep looking for the slots the normal way, instead of giving out details on such portals or links.”