Non-profits
Non-profits (#2098): the directory, a verified 501(c)(3)'s page and its tabs, follow, join requests, team invites, and the add flow.
The non-profit directory
Verified pages only (paused ones after them); never drafts, never pages under review. Facets count causes and cities over the other filter. Each card is built for the caller (viewer: their role and Follow state).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Query Parameters
Name, mission or a 9-digit EIN (2+ characters).
A city (place) slug.
A cause key.
"animals""arts_culture""children_youth""community_development""disaster_relief""education""environment""food_security""health""housing_homelessness""human_rights""immigrant_refugee""mental_health""seniors""veterans""women_girls""religious""other"Order.
"impact""newest""name""impact"Page size.
2448Offset.
0Responses
OK
Create a non-profit draft from an EIN
Add flow (requireVerifiedEmail). Allowed for lookup outcomes verified and manual_review (and revoked with route: reinstatement). Creates the org (kind nonprofit, verification pending) with the caller as owner; one unfinished draft per person per EIN (the existing one is returned).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Request Body
Responses
OK
Look an EIN up
Add flow step 1 (requireVerifiedEmail; 20 per hour per person). The six outcomes, first match wins: existing, revoked, verified, manual_review (church, group, private_foundation), not_eligible, not_found.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Request Body
Responses
OK
My unfinished non-profit drafts
The add flow's resume list.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Responses
OK
Notify me when an EIN appears
EIN lookup outcome 6: the monthly IRS load emails the person when the EIN becomes an eligible 501(c)(3).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Request Body
Responses
Done
Report a wrong claim on an EIN
Writes an org_reports row (category impersonation) on the existing page.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Request Body
Responses
Reported
Read a team invite
Public, built for the caller. What the invite page shows: the invited address as a hint, and in full only to a caller one of whose verified emails it is; whether accepting will work and whether the caller is already on the team.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The invite token from the email.
Responses
OK
Accept a team invite
Joins with the invite's role and title; On page as chosen, else on for owner/admin/fundraiser/viewer and off for member. One of the person's VERIFIED emails must equal the invited address. Publishes org.invite_accepted and emails the inviter.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The invite token from the email.
Request Body
Responses
OK
Decline a team invite
The invited person says no. One of the person's VERIFIED emails must equal the invited address. The invite stops waiting, so the team can invite the address again. Declining twice answers the same.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The invite token from the email.
Responses
OK
A non-profit page
404 for a draft unless the viewer is its owner or staff; a page under review (or rejected, suspended) only for its team and staff. An old slug answers with the current one in slug.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
OK
Delete my non-profit draft
The owner deletes their own draft only (slug is the draft's id).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The draft's id.
Responses
Done
A draft's add-flow state
Owner of the draft only, else 404.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Responses
OK
Save add-flow fields
Any of {step, title, attestation} and the page settings fields (validated as Settings), links replaced as a list.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
Send a work-email code
The domain must be the org website's (or a subdomain), never a free mail domain.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
Verify the work-email code
Six digits, 15 minutes, 5 attempts.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
Claim authority by the latest Form 990
Staff check the name against the 990.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
Claim authority by an officer letter
The letter is uploaded first through POST /org-admin/{slug}/documents with doc_type officer_letter.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
Submit a volunteer affiliation claim for staff review
Only the verified-email owner of a draft may submit. The claim stays pending until staff verify it; it never enables donations by itself.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Responses
OK
Submit a draft for review
Records the terms, runs every check and publishes organization.created (kind nonprofit). The page becomes under_review.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's id.
"uuid"Request Body
Responses
OK
A non-profit's Fundlies
Only its own Fundlies (beneficiary_type nonprofit, this org), publicly listed; never a team member's personal Fundly. Rows are the communities Fundlies tab rows plus goal_reached_at (the Impact tab's rows). Active = live and not fully funded.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Query Parameters
Tab.
"active""completed""all""active"The communities Fundlies tab's sorts; omitted keeps each tab's own order (Active: live first, newest; Completed: most recently ended).
"newest""most_raised""ending"Page size.
1248Offset.
Responses
OK
A non-profit's Members tab
On page members only, grouped by their title's category (governance/executive: leadership; programs/fundraising/operations: staff; community: volunteers), else by role. The followers it names are chosen for the caller.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
OK
A non-profit's activity
Updates, Fundlies launched, 25/50/75% and goals reached, newest first.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Query Parameters
How many.
1050Responses
OK
A non-profit's impact
Raised, counted Fundlies and donors on its own Fundlies (the same figures as the card), each counted Fundly as the Fundlies tab's row (most raised first; their raised adds up to raised_cents), and its city: the shared city block plus the city page's impact, communities and verified non-profits.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
OK
Open a non-profit's public document
A document staff approved and the team shows on About (the determination letter); never a W-9 or bank document. PDFs and images open inline (nosniff); anything else downloads. 404 for anything else, or for a page the caller may not see.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
The document id (tax.determination_letter.id).
"uuid"Responses
The file
Follow a non-profit
followers, following_type organization.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
OK
Unfollow a non-profit
Idempotent.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
OK
Count a link click
Report a non-profit
requireVerifiedEmail. The org_reports flow (one report per person per org).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Request Body
Responses
OK
Ask to join the team
requireVerifiedEmail. Publishes nonprofit.join_requested and emails the owner and admins.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Request Body
Responses
OK
Withdraw my join request
Idempotent.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The non-profit's slug (an old slug resolves too) or id.
Responses
Done