PSUV Election API
572,103 voter records, vote tallies, and election employee identities extracted from Venezuela's unauthenticated GraphQL election management system.
createAdmin. setVotacion. Zero authentication. The API that documents itself.
About This Investigation
Between February and March 2026, ODINT extracted the complete dataset from the PSUV's election management system for Guarico state. The API — an Apollo GraphQL server at api-psuv-elecciones.guarico.gob.ve/graphql — responded to standard introspection queries without authentication, serving its complete schema including mutations for creating admin accounts and recording votes. Standard read queries returned 572,103 registered voters, vote tallies across 523 voting centers, and full PII for 23 election employees. The server shared an IP with a Portainer Docker panel, a voter registry, and five other GraphQL APIs — all with introspection enabled.
The Mutations That Should Stop You Cold
The API schema exposes createAdmin — create administrator accounts on the election system — alongside setVotacion — record or modify vote tallies. Both served to any anonymous HTTP client. Combined, these mutations describe a system where anyone who can reach the endpoint can potentially create themselves an admin account and then use it to record votes, open and close voting centers, and manage election workers. Six endpoints served the identical schema: /graphql, /graphiql, /v1/graphql, /api/graphql, /query, /gql. All unauthenticated.
Exposed Mutations
Write operations against election infrastructure — publicly documented by the server
| Mutation | What It Does |
|---|---|
createAdmin | Create administrator accounts on the election system |
setVotacion | Record or modify vote tallies |
aperturaCentroVotacion | Open a voting center for election day |
cierreCentroVotacion | Close a voting center and finalize results |
aperturaMesa | Open an individual voting table/booth |
cierreMesa | Close an individual voting table/booth |
createEmployee | Create new election worker accounts |
deleteEmployeeById | Remove election workers from the system |
loginEmployee | Authenticate as an election worker |
me | Return current authenticated user identity |
Vote Results
Aggregate vote tallies across Guarico state — 15 municipalities, 39 parishes
Near-Parity Results
The API returned aggregate vote tallies for all 523 voting centers: 54,495 in favor (49.91%) vs 54,684 against (50.09%) — a margin of just 189 votes. Guarico state has approximately 600,000–650,000 eligible voters; the 572,103 figure represents 88–95% coverage, consistent with a production voter registry. The election frontend at psuv-elecciones.guarico.gob.ve was last modified July 23, 2024 — five days before the contested July 28 presidential election.
Co-Hosted Infrastructure
12 services sharing one server at 190.205.119.210 (CANTV AS8048)
| Domain | Purpose | Introspection |
|---|---|---|
api-psuv-elecciones.guarico.gob.ve | PSUV Election API | ON |
psuv-elecciones.guarico.gob.ve | Election frontend | — |
electores.guarico.gob.ve | Voter registry (React/Vite) | — |
portainer.guarico.gob.ve | Docker/K8s management panel | — |
api-distribucion-gas.guarico.gob.ve | Gas distribution + voter lookup by cedula | ON |
api-asistencia.guarico.gob.ve | Attendance tracking | ON |
api-festividades.guarico.gob.ve | Events/festivals | ON |
demo-api-sgd.guarico.gob.ve | Document management | ON |
election.guarico.gob.ve | Election backend (Django) | — |
soporte.guarico.gob.ve | IT support | — |
office.guarico.gob.ve | Office suite | — |
Connected Findings
Voter surveillance infrastructure across government platforms
Gas API Voter Cross-Reference
The gas distribution API on the same server includes a voterByCedulaRif query — a voter lookup function inside a gas distribution system. Combined with customerByCedulaRif for subsidy recipients, the system is architecturally designed to cross-reference gas subsidies with voter registration records by national ID across all 24 Venezuelan states.
Chamba Juvenil Vote Tracking
The youth employment program source code (21,128 files, 434 MB, recovered from exposed .git/) contains a complete vote registration module titled "ESTRUCTURA DE REGISTRO DEL VOTO". The statistics dashboard includes hardcoded offsets that add 1,073 phantom votes to every displayed total. The same module deploys across three government domains: registro.chambajuvenil.gob.ve, registro.juventudsocialista.org.ve, and comunajoven.com.ve.
Raw Data Downloads
Complete data archive — 62 GraphQL dumps, 3 frontend snapshots, SFTP keys, and published articles