Warning
This independently developed project is not affiliated with, endorsed by, sponsored by, or supported by Vorwerk, Thermomix, or Cookidoo. It documents an internal web interface observed in the Polish market, not an official or stable public API.
This repository contains an OpenAPI 3.1 description of 44 paths and 58 operations observed or advertised through 17 August 2026. The specification keeps uncertain operations visible, but marks their evidence and risk explicitly. An advertised path is not proof of a method, payload, permission, or continued availability.
Cookidoo® and Thermomix® are registered trademarks of their respective owner. Their names are used only to identify compatibility. No logos, recipe content, captured responses, application code, or vendor-authored specifications are included.
openapi.yaml— canonical, single-file specificationdocs/methodology.md— how observations were classifieddocs/provenance.md— evidence and sanitization policydocs/authentication.md— login, cookie-jar, and CSRF findingsdocs/search.md— search, cluster, filter, and pagination findingsdocs/created-recipes.md— created-recipe TTS settings and execution boundarydocs/protocol-behavior.md— retry, rate-limit, idempotency, and concurrency guidancedocs/responsible-use.md— project safety boundariesdocs/legal-context.md— sources reviewed and limitations
The API reference is intentionally generated with Redoc as static, non-interactive documentation. Do not paste credentials or browser session cookies into hosted documentation, client generators, issues, or pull requests.
Every operation contains an x-cookidoo object:
| Status | Meaning |
|---|---|
observed |
Seen in the first-party UI, a current bundle, or a low-volume public/private read. |
corroborated |
Consistent with a current independent client and other evidence. |
advertised-only |
The route is advertised by public discovery; method or payload may be inferred. |
vendor-spec |
Independently re-expressed from a currently advertised vendor specification that is not redistributed here. |
Risk metadata distinguishes reads, private writes, deletion, public sharing,
public ratings, and device linking. responseShape: unknown deliberately maps
to unconstrained JSON instead of pretending that an unverified response is an
object.
Requires Node.js 24 or newer:
npm ci
npm run checkThe check lints and bundles the specification, validates project policy, generates TypeScript declarations, compiles them, builds static documentation, and checks the generated artifacts. It makes no Cookidoo requests.
Generated output is written to the ignored dist/ directory.
Use Cookidoo only with accounts and data you are authorized to access. This project does not grant permission to bypass technical restrictions, test authorization boundaries, access another person's data, redistribute Cookidoo content, or overload the service. Review the terms applicable to your account and region before using any observed interface.
See SECURITY.md before reporting a possible vulnerability and
CONTRIBUTING.md before submitting evidence.
Original work in this repository is available under the MIT License. The license boundary and trademark notice are described in NOTICE.