Version: 1.0

Zander API

REST API for the Zander community platform (zander-web). Covers the public site API, the admin dashboard API, and the plugin-ingestion endpoints called by the Minecraft plugins (zander-addon, zander-auth, zander-hub, zander-pgm, zander-velocity, zander-waterfall) and the Discord bot.

Most write endpoints require the x-access-token header (an internal API key shared between the web app, its plugins, and its bot). Some endpoints are session-authenticated (the caller must be logged into the web dashboard) and some are fully public. See Authentication for details.

This spec was generated from source-verified documentation of zander-web's route and controller files. Where a field's exact shape wasn't confirmed against source, it is marked in the description rather than guessed.

Authentication

API Key: apiKeyHeader

Internal API key shared between zander-web, its Minecraft plugins, and its Discord bot.

Security Scheme Type:	apiKey
Header parameter name:	x-access-token

HTTP: Bearer Auth

Bearer-token variant of the same internal API key, used by zander-pgm's ingestion client.

Security Scheme Type:	http
HTTP Authorization Scheme:	bearer

API Key: sessionCookie

Web dashboard session cookie — the caller must be logged in with sufficient LuckPerms permissions.

Security Scheme Type:	apiKey
Cookie parameter name:	connect.sid

License