`.otmp` & 1tap:// Protocol Specification

A lightweight, static, offline-first spatial data specification and URI protocol designed to execute zero-API micro-anchor navigation on mobile and web clients. Packages carry pre-configured decimal coordinates and venue metadata; no map SDK, API key, or network signal is required to execute a navigation handoff.

An .otmp file is plain UTF-8 JSON. It is parsed locally by the 1TapMap PWA Service Worker without any remote API calls. The PWA registers as a system-level file handler for the .otmp extension so that opening a pass from a device launches execution immediately.

2.1 Schema

2.2 Anchor Object

2.3 Example Payload

{
  "format": "otmp",
  "version": 1,
  "id": "ucf-mbb-official-visit",
  "title": "Official Visit Pass",
  "org": "UCF Men's Basketball",
  "subtitle": "Recruit + family — game day micro-anchors",
  "anchors": [
    {
      "id": "vip-lot",
      "label": "VIP Recruits Parking Lot",
      "note": "Lot B7 · attendant gate, show pass on phone",
      "lat": 28.6089,
      "lng": -81.1934
    },
    {
      "id": "arena-players-gate",
      "label": "Addition Financial Arena (Players Gate)",
      "note": "Players Gate — southwest tunnel door, not main box office",
      "lat": 28.6072,
      "lng": -81.1966
    }
  ]
}

The 1tap:// custom URI scheme executes a hardware-level handoff, triggering native OS navigation (maps:// on iOS, geo: on Android) to exact sub-meter coordinates — bypassing browser rendering entirely.

3.1 Syntax

1tap://[action]?lat=[decimal]&lon=[decimal]&anchor=[name]&label=[display]&note=[arrival]

3.2 Browser Registration

Browsers register custom protocols via the web+ prefix. The 1TapMap PWA registers itself as the handler for web+1tap, routing execution through the /open handoff endpoint.

3.3 Example

1tap://route?lat=28.6072&lon=-81.1966&anchor=arena_players_gate&label=Players%20Gate&note=southwest%20tunnel

On execution, the parsed coordinates are handed off to the platform's native navigation app. The handoff target is selected by user-agent — no map SDK or paid API is invoked.

maps://?daddr=28.6072,-81.1966&q=Players%20Gate&dirflg=d

geo:28.6072,-81.1966?q=28.6072,-81.1966(Players%20Gate)

https://www.google.com/maps/dir/?api=1&destination=28.6072,-81.1966

• ✓Non-executable payloads. .otmp files are static JSON data. They are never evaluated as code or executed as scripts.
• ✓HTTPS transport. Packages and URI handoffs are transported exclusively over HTTPS, protecting coordinates and metadata in transit.
• ✓Client-side schema validation. Payloads are validated locally against the schema before any navigation handoff is triggered. Malformed or invalid packages are rejected without execution.
• ✓No remote API calls. The zero-API architecture means no third-party map credentials are transmitted, stored, or exposed — eliminating credential leakage as an attack surface.
• ✓Offline execution. Passes are cached in local browser memory via the Service Worker and execute identically with zero network signal.