Endpoints
Every endpoint - method, path, parameters, request/response schema, and auth requirement - is documented in the interactive API Reference, generated directly from the OpenAPI spec and grouped the same way as the table below. This page is a map of that reference, not a duplicate of it.
All endpoints require the x-access-token header unless the interactive reference marks them public or session-authenticated. Feature-gated endpoints additionally require the relevant feature to be enabled in features.json.
Groups
| Group | Base Path | Description | Reference |
|---|---|---|---|
| Announcements | /api/announcement | Create and manage announcements | → |
| Applications | /api/application | Manage application listings | → |
| Auth & Sessions | /api/session | Player session tracking | → |
| Badges | /api/badges, /admin/badges | Profile achievement badges | → |
| Bridge | /api/bridge | Command executor bridge | → |
| Command Bridge | /command-bridge | Vote reward command delivery to plugins | → |
| Discord Relay | /api/discord | Minecraft-to-Discord relay | → |
| Discord Punishments | /api/discord-punishments | Discord punishment records and appeals | → |
| Events | /api/events | Event management (public, authenticated, and template endpoints) | → |
| Filter | /api/filter | Content filtering | → |
| Finance | /api/finance | Dashboard-only income/expense/budget tracker | → |
| Forms | /api/forms | Custom forms and response management | → |
| Forums | /forums, /dashboard/forums | Forum discussions, replies, polls, and moderation. Mostly HTML/redirect responses, not JSON | → |
| Mixed | /api/mixed | PGM ("Mixed") server stats portal: plugin ingestion, public/user API, live SSE stream, admin API, and the Stripe webhook | → |
| Punishments | /api/punishments | Public punishment log (reads the external LiteBans database) | → |
| Ranks | /api/rank | Rank management via LuckPerms | → |
| Reports | /api/report | Player reports | → |
| Scheduler | /api/scheduler | Scheduled Discord messages | → |
| Servers | /api/server | Server registry | → |
| Shop Directory | /api/shop | In-game shop listings | → |
| Upload | /api/upload | Image upload via Cloudinary | → |
| Users | /api/user | User accounts and profiles | → |
| Vault | /api/vault | Vault entries | → |
| Voting | /vote, /admin/vote | Vote tracking and rewards | → |
| Watch | /api/watch | Creator content | → |
| Web | /api/web, /policy, /social | Site stats, configuration, and policy/social links | → |
Notes worth reading before you integrate
A few things don't fit neatly into a per-endpoint reference and are easy to miss:
- Forums is mostly not a JSON API. Its routes render server-side HTML and respond with redirects - they're form-submission targets for the forum UI. The one exception is the post-report endpoint. See Forums.
- Mixed's plugin-ingestion endpoints use
Authorization: Bearer <apiKey>- the same app-wide key as everywhere else, not a Mixed-specific token.vote/currentandvote/castaccept either a browser session or that plugin token (see Mixed and Authentication). - Two unrelated Stripe webhooks exist:
/api/stripe/webhook(Mixed's Map Tokens / Supporter purchases) and the Webstore's own webhook - don't conflate them. See Webstore. - Two separate "punishments" systems exist:
/api/punishments/getreads the external LiteBans database (read-only, public log); the dashboard's Web Punishments feature writes to this app's owndiscord_punishmentstable and never touches LiteBans. See Punishments. - The rank, server, and scheduler write endpoints (
/api/rank/*,/api/server/*,/api/scheduler/*) are gated by the dashboard UI's session check but were flagged during an audit as potentially missing an equivalent in-route check on the API endpoints themselves - see the interactive reference and each feature page for the current status of that finding.