API and permissions
A map of JSON routes and authorization keys for integrations and extension work.
HTTP contract
Routes live under /api and require an administrator session except for sign-in, bootstrap, and health. Mutations use POST and validate X-CSRF-Token. Most send JSON; logo uploads use multipart/form-data. Most responses are JSON, errors contain error and an HTTP status, and downloads return files. /api/bootstrap returns the session, public settings, translations, and CSRF token; the public user profile includes permissions.
| Module | Main routes (omit /api) | Permission groups |
|---|---|---|
| Session | GET /bootstrap, POST /login, POST /logout, GET /me, GET /sessions, POST /sessions/revoke. | Own session; admin.sessions.revoke for others. |
| Players | GET /players, /player-options, /player, /levels; POST /player/profile, /player/update, /player/license, /player/licenses/grant-all, /player/delete, /player/ban. | player.*, license.*, faction/donor, and ban permissions. |
| World | GET /vehicles, /houses, /gangs, /wanted; POST /vehicle/create, /vehicle/update, /property/update, /gang/member, /wanted/create, /resource/update, /resource/delete. | vehicle.*, property.*, gang.*, wanted.*. |
| Moderation | GET /bans, /server-allowlist, /logs; POST /rcon/action, /ban/delete, /server-allowlist/configure, /server-allowlist/add, /server-allowlist/remove, /logs/delete, /logs/clear. | ban.*, rcon.*, allowlist.*, logs.*. |
| Server | GET /server, /server/players, /rcon/logs, /rcon/settings; POST /server/action, /rcon/settings. | server.*, rcon.*. |
| Access | GET /admins, /roles, /permissions; POST /admin/create, /admin/profile, /admin/roles, /role/save, /role/delete. | admin.*, role.*. |
| Settings | GET /settings, /timezones, /backup/list, /update/status; POST /settings, /branding/upload, /backup/create, /backup/schedule, /license/activate, /update/check, /update/install. | settings.*, backup.*, license.manage, updates.*. |
Additional detail, preview, and download routes are defined in src/Api.php. Consult that file for exact parameters and error codes. Backup downloads are authenticated GET requests.
Permission catalog
src/Security.php defines the catalog and seed_permissions() inserts the keys into ac_permissions. Effective access combines ac_role_permissions and ac_user_permissions.
| Module | Keys (abbreviated groups) |
|---|---|
| Players | player.view, player.edit, player.delete, player.cash.view/edit, player.bank.view/edit, donor.add/level.edit/remove. |
| Staff and licenses | police.view/add/remove/level.edit, medic.view/add/remove/level.edit, license.view/add/remove. |
| Profiles and access | notes.view/create/edit/delete, whitelist.view/edit. Profile whitelist.* differs from server allowlist.*. |
| World | vehicle.view/create/edit/block.edit/delete/transfer, property.view/edit/transfer/delete, gang.view/edit/active.edit/delete/members.edit/bank.edit, wanted.view/edit/delete. |
| Server and sanctions | server.view/start/stop/restart, rcon.view/configure/players.view/message/kick/ban.temp/ban.permanent/unban/console.raw, ban.view/delete, allowlist.view/add/remove/configure. |
| Administration | admin.view/create/edit/delete/sessions.revoke/higher.edit, role.view/create/edit/delete, logs.view/export/delete/clear, settings.view/edit, backup.view/create/download/delete/schedule.edit, license.manage, updates.view/check/install/backups.manage. |
player.cash.view/edit abbreviates two complete keys: player.cash.view and player.cash.edit. The server always checks the full key.