scorecardIndian coders are working around the CoWIN app to help people bag the elusive vaccine slots
  1. Home
  2. tech
  3. apps
  4. news
  5. Indian coders are working around the CoWIN app to help people bag the elusive vaccine slots

Indian coders are working around the CoWIN app to help people bag the elusive vaccine slots

Indian coders are working around the CoWIN app to help people bag the elusive vaccine slots
Tech4 min read
The CoWIN platform is the official portal for Indian citizens to register for the vaccine and book an appointment for their doses    BI India
  • The CoWIN app doesn't let you know when a COVID vaccine slot becomes available, but these Indian coders have found a way out.
  • Vaccine appointments, especially for those between the ages of 18 to 45 years, and hard to come by in the face of vaccine shortages.
  • Coders in India are stepping up by creating websites and scripts to help send alerts to people about when a vaccination slot becomes available in their area.

Not only are COVID-19 vaccines in short supply, but appointment slots for those between the age of 18 to 45 years are also scarce. However, coders in India are coming to the rescue.

For instance, the engineering manager at PhonePe, Debarko De, has posted a script on code hosting platform GitHub to help people in Bangalore looking for appointment slots.

Agra-based software developer Amit Agarwal has created a COVID-19 vaccine tracker, built with Google Sheets, so that people can get alerts over email whenever an appointment opens up for a particular age group within a prescribed pincode.

Many are questioning whether such an endeavour is legal or not. But many more are questioning why the CoWIN platform — the main portal provided by the government to register for a vaccine, find a slot and get your certificate — doesn’t already have this functionality.

cowin slots
No slots were available for people between the ages of 18 to 45 years on April 28, when the CoWIN platform opened up registration for that age group      BI India

Ravi Srinivasan, the chief facilitator at the ed-tech platform Code Space, told Business Insider that Agarwal’s script can be used to look for vaccination centres and appointments outside of Bangalore, too, by simply changing the pin code. “The public API just allows you to see what slots are available by district, age etc. But it doesn’t let you register. For getting an appointment, you need the protected API,” he said.

Coders are plugging the holes in the CoWIN platform

Another programmer, Berty Thomas, pushed out a full fledged website called for those between the age of 18 to 45 years, looking to get their first jab. The site is a little slow to load, but once you’re in, all you have to do is select your state and district to see appointment availability.

He also created multiple groups on Telegram for those who wish to receive alerts for their respective districts. The list is not exhaustive, but does cover most of the main metropolitan regions across the country. And Thomas isn’t using the government’s API to do it. The API is only powering the alerts, not storing your information.

Similar sites like and are also doing the same thing.

And, the reason they’re being allowed to stick around is because users still have to login into the CoWIN platform to register. That part of the process cannot be done externally. This is important because this is where the government draws the line between what is allowed and what is not allowed to be done with its APIs.

What is an API?

An application programming interface, or API, is basically a bridge between two applications. It’s like the waiter who takes your order, ensures that it gets relayed to the chef, and then brings you your final meal.

In the case of looking for CoWIN appointment slots, you’re placing your request on a website, and that website then relays it to the API, like the customer at the restaurant. The API then checks with the CoWIN portal — or the chef — before showing you the availability of slots.

The Indian government opened up the CoWIN APIs to allow third party access, on April 28. They can be found on the government’s API Setu website which contains authentication, metadata, beneficiary registration, vaccination appointment and certificate APIs.

With these APIs, the third party users can access information like vaccination centres, list of districts, vaccination appointments among others.

There are two types of APIs -- public and protected. Using public APIs is not a problem and they’re freely available on the government site. To use the protected APIs, on the other hand, the government needs an organisation to put in for a special approval, which is a whole lot of red tape to cut through.

There is still no data capture policy in place for third party access

Last month, an organisation called Project Step One created a bot on WhatsApp that would allow people to register for the vaccine. It undercut the requirement of having to log into the official website or use the CoWIN app. But it was shut down by the government for being a ‘fake’ service.

The primary concern around the service being offered by Step One, a non-profit organisation, was the potential risk posed by privacy issues. In order to book an appointment, or even register, users have to share data that is personal and highly sensitive in nature.

According to Step One, it does not store any of the data. It was only using the government’s open APIs, the bot passed user data to COWIN servers, and none of data was accessed by the organisation. It even offered up the code for its WhatsApp bot for further examination, but to no avail.