ashelex/umb.md

Universal Studios API Unofficial Documentation

New Documentation

Last updated 3/14/24 @ 8:00 PM EST

Currently contains 7 fully documented endpoints.

Please ⭐ if you enjoy and want updates!

• Endpoints
• Authentication
• Assets Requests
  • Wait Time Attraction List
  • Show List
• Service Requests
  • Venues
  • Queues
  • General Information for Parks
  • Paths

Universal uses OIDC for their application authentication. It has a secret attached to it.

POST Request
URL: https://api.universalparks.com/oidc/connect/token

Secret: 3d8f26d8-d302-4bfe-8670-8816e7713b90:AeweCuThiedaowecheighiereizeochiungaesielaechoifie
Needs to be encoded to base64 then used as a Basic auth header.

API Key: UORFlutterAndroidApp
Needs to be put into x-uniwebservice-apikey

Request (needs to be urlencoded):

scope=openid+default+offline_access&grant_type=password&username={EMAIL}&password={PASSWORD}

{EMAIL} is your Universal Account email
{PASSWORD} is your Universal Account password.

There is a way to do this WITHOUT a Universal Account, just makes things easier.

This creates a JWT token that you can now use for any API request.

All requests have to be send as GET since most of them are just grabbing a JSON file.

Auth: No
URL: https://assets.universalparks.com/{REGION}/wait-time/wait-time-attraction-list.json

Gets the current statuses and wait times for all parks in the Universal Region.

Auth: No
URL: https://assets.universalparks.com/{REGION}/wait-time/show-list.json

Gets all the shows, the times that they're running, and the status for each show.

All requests either are GET or POST. All responses are in JSON.

This is still a work in progress as I don't have everything marked yet.

Auth: No
Method: GET
URL: https://services.universalorlando.com/api/venues

Queries:

Example: ?city=Orlando&pageSize=All

⚠️ This seems pratically useless... like idk what to tell ya.

Auth: No
Method: GET
URL: https://services.universalorlando.com/api/Queues

Queries:

Example: ?city=Orlando&pageSize=All

Auth: Yes
Method: POST
URL: https://services.universalorlando.com/api

Body:

{"signature":"{SIGNATURE}","apiKey":"AndroidMobileApp"}

I have no clue on how the signature is generated, it seems to be a one time use generated inside the app?

Queries:

Example: ?city=Orlando

Auth: No
Method: GET
URL: https://services.universalorlando.com/api/Routing/Paths

Queries:

Example: ?city=Orlando&pageSize=All