mobileapi.dsbcontrol.de is the new endpoint, likely first seen on March 30th 2020 in the Apple App Store DSBmobile version 3.4.1 and also used in the Android version of DSBmobile from version 3.0.12, uploaded to Google Play on April 8th 2020. Here are the requests you can make to this endpoint.

The example credentials 187801 / public are demo credentials; they are also used by the demo button in DSBmobile.

"Optional" always means that this field can be left empty. If you forget a parameter, you will get this response: {"Message":"No HTTP resource was found that matches the request URI '…'."}.

All queries must use HTTPS. Queries not using HTTPS will 404 since around April 19th 2020.

Verify credentials (authcheck)

GET mobileapi.dsbcontrol.de/authcheck?user=187801&password=public

Takes a user and a password.

Returns a boolean value indicating whether the given credentials are valid.

It's unclear what this request is good for. You can just as well immediately try to obtain an auth token.

Get token (authid)

GET mobileapi.dsbcontrol.de/authid?user=187801&password=public&bundleid=de.heinekingmedia.dsbmobile&appversion=35&osversion=22&pushid

Takes:

• user: ID
• password: Pass
• bundleid: Package ID, currently optional (best bet is to use de.heinekingmedia.dsbmobile)
• appversion: Application version code, currently optional, DSBmobile's version code for version 3.0.12 is 35
• osversion: Android API level, currently optional
• pushid: Token for GMS push notifications, optional

Returns:

• {"Message":"An error has occurred."} if you forgot to pass ID or Pass
• "" if your credentials are incorrect
• A token in the form "13ccccbb-e6a8-466a-addc-00bba830c6cf" if your credentials are correct

Get plans (dsbtimetables) | Get notices (dsbdocuments) | Get news (newstab)

GET mobileapi.dsbcontrol.de/dsbtimetables?authid=13ccccbb-e6a8-466a-addc-00bba830c6cf

GET mobileapi.dsbcontrol.de/dsbdocuments?authid=13ccccbb-e6a8-466a-addc-00bba830c6cf

GET mobileapi.dsbcontrol.de/newstab?authid=13ccccbb-e6a8-466a-addc-00bba830c6cf

Takes an authid token as a parameter.

Returns a JSON array containing the data you requested. If the token is invalid, an empty array is returned.

These requests won't work in your browser if its Accept header is telling the server that it doesn't support JSON.