Endpoints

Complete reference for every REST endpoint exposed by Zander. Use the group navigation below to jump to a specific feature area.

All endpoints require the x-access-token header unless marked Public. Feature-gated endpoints additionally require the relevant feature to be enabled in features.json.

---

Announcements

Base path: /api/announcement

Method	Path	Description
GET	/api/announcement/get	Retrieve announcements. Optional query params: announcementId, announcementType (web/popup/tip/motd), enabled
POST	/api/announcement/create	Create an announcement. Body: actioningUser, type, body, enabled, startDate, endDate
POST	/api/announcement/edit	Edit an announcement. Body: actioningUser, announcementId, plus any fields to update
POST	/api/announcement/delete	Delete an announcement. Body: actioningUser, announcementId

---

Applications

Base path: /api/application

Method	Path	Description
GET	/api/application/get	Retrieve all applications, or a specific one via ?id=
POST	/api/application/create	Create an application. Body: actioningUser, displayName, description, displayIcon, requirementsMarkdown, redirectUrl, position, applicationStatus
POST	/api/application/edit	Edit an application. Body: actioningUser, applicationId, plus fields to update
POST	/api/application/delete	Delete an application. Body: actioningUser, applicationId

---

Bridge

Base path: /api/bridge

Method	Path	Description
GET	/api/bridge/processor/get	Retrieve executor tasks. Query: status (pending/processing/completed/failed), slug, limit (1–250, default 50), claim (boolean — transitions pending to processing)
POST	/api/bridge/processor/command/add	Queue a task. Body: command or routineSlug or tasks[]; optional slug, target, metadata, priority
POST	/api/bridge/processor/task/:taskId/report	Update task status. Body: status (pending/processing/completed/failed), result, executedBy, metadata
POST	/api/bridge/processor/task/:taskId/reset	Reset a task to pending
POST	/api/bridge/processor/clear	Delete tasks matching filters. Body: status, slug, routineSlug
POST	/api/bridge/routine/save	Create or update a routine. Body: routineSlug, steps[] (each with slug, command), displayName, description
GET	/api/bridge/routine/get	Retrieve routines. Query: routineSlug (optional)
GET	/api/bridge/server/get	Retrieve bridge server status
POST	/api/bridge/server/update	Update server status. Body: serverInfo (object or JSON string), lastUpdated (optional ISO date)

---

Config / Policy

Method	Path	Auth	Description
GET	/policy	Public	Returns site policy URLs from config.json
GET	/social	Public	Returns enabled social media platform links

---

Discord (Minecraft relay)

Base path: /api/discord

Method	Path	Description
POST	/api/discord/switch	Notify Discord when a player switches servers. Body: actioningUser, server
POST	/api/discord/chat	Relay Minecraft chat to Discord. Body: actioningUser, message, server
POST	/api/discord/join	Announce player join to Discord. Body: actioningUser, server
POST	/api/discord/leave	Announce player leave and log audit. Body: actioningUser, server. Rate limited: 60 req/min
POST	/api/discord/spy/command	Relay executed player command to Discord. Body: actioningUser, command. Rate limited: 120 req/min
POST	/api/discord/spy/directMessage	Relay Minecraft DM to Discord. Body: sender, recipient, message

---

Discord Punishments

Base path: /api/discord-punishments

Method	Path	Description
GET	/api/discord-punishments/get	Retrieve punishments for a user. Query: discordId, playerId, or username (at least one required)
GET	/api/discord-punishments/punishment	Fetch a specific punishment. Query: id (required)
POST	/api/discord-punishments/appeal	Submit an appeal. Body: punishmentId, discordUserId, appealReason
GET	/api/discord-punishments/appeals/pending	Retrieve all pending appeals
POST	/api/discord-punishments/appeal/review	Process an appeal decision. Body: appealId, status (APPROVED|REJECTED), reviewerDiscordUserId, reviewerNotes (optional)

---

Events

Base path: /api/events

Public Endpoints

Method	Path	Description
GET	/api/events/upcoming	Upcoming published events. Query: limit (max 50)
GET	/api/events/published	All published events (paginated). Query: page, limit (max 100)
GET	/api/events/calendar	Events in a date range. Query: start, end

Authenticated Endpoints

Method	Path	Description
GET	/api/events/get	All events with filters. Query: status, search, page, limit
GET	/api/events/single	Single event. Query: eventId
GET	/api/events/pending-review	Events awaiting approval
POST	/api/events/create	Create event draft. Body: title, startAt, endAt
POST	/api/events/update	Update event. Body: eventId + fields
POST	/api/events/submit-review	Submit for approval. Body: eventId
POST	/api/events/approve	Approve and auto-publish. Body: eventId
POST	/api/events/reject	Reject submission. Body: eventId, rejectionNote (optional)
POST	/api/events/publish	Publish approved event. Body: eventId
POST	/api/events/update-published	Update a published event. Body: eventId
POST	/api/events/cancel	Cancel an event. Body: eventId, reason (optional)
POST	/api/events/archive	Archive an event. Body: eventId
POST	/api/events/delete	Delete an event. Body: eventId
POST	/api/events/duplicate	Clone as draft. Body: eventId
POST	/api/events/actions/update	Update event actions. Body: eventId, actions
POST	/api/events/announcements/update	Update event announcements. Body: eventId, announcements

Templates

Method	Path	Description
GET	/api/events/templates/get	All templates
GET	/api/events/templates/single	Single template. Query: templateId
POST	/api/events/templates/create	Create template. Body: title
POST	/api/events/templates/update	Update template. Body: templateId
POST	/api/events/templates/delete	Delete template. Body: templateId
POST	/api/events/templates/announcements/update	Update template announcements. Body: templateId, announcements
POST	/api/events/templates/generate-draft	Generate event from template. Body: templateId, targetDate (optional)

---

Forms

Base path: /api/forms

Method	Path	Description
GET	/api/forms/get	Retrieve forms. Query: id, slug, published (all optional)
POST	/api/forms/create	Create a form. Body: actioningUser, name; optional: slug, status, requireLogin, allowAnonymous, accessPassword, submitterCanView, discordWebhookUrl, discordForumChannelId, webhookEnabled, postToForumEnabled, blocks[]
POST	/api/forms/edit	Update a form. Body: actioningUser, formId, name; same optional fields as create
POST	/api/forms/publish	Publish or unpublish a form. Body: actioningUser, formId, status
POST	/api/forms/delete	Delete a form. Body: actioningUser, formId
POST	/api/forms/submit	Submit a form response. Body: formId, answers; optional: submittedByUserId, anonymous
GET	/api/forms/responses	Paginated responses for a form. Query: formId, status, page, limit
GET	/api/forms/response	Single response with form and block data. Query: responseId
POST	/api/forms/response/status	Update response status. Body: actioningUser, responseId, status

---

Filter

Method	Path	Description
POST	/api/filter	Check content against phrase and link filters. Body: content (required), username, discordId, or discordUsername

---

Punishments

Method	Path	Description
GET	/api/punishments/get	Paginated punishment list. Query: page (default 1), limit (default 25, max 100)

---

Ranks

Base path: /api/rank

Method	Path	Description
GET	/api/rank/get	Retrieve ranks. Query: username (player's ranks) or rank (members of a rank)
GET	/api/rank/user	Get all ranks for a player. Query: username (required)
POST	/api/rank/config/:rankSlug	Update rank config in LuckPerms. Body: displayName, rankBadgeColour, rankTextColour, priority, discordRoleId, isStaff, isDonator
POST	/api/rank/user/assign	Assign a rank to a player. Body: username, rankSlug, title (optional)
POST	/api/rank/user/remove	Remove a rank from a player. Body: username, rankSlug
POST	/api/rank/user/permission/check	Check if a player has a permission. Body: username, permission

---

Reports

Method	Path	Description
GET	/api/report/get	Retrieve reports. Query: reportedId (optional)
POST	/api/report/create	Submit a report. Body: reporterUser, reportedUser, reportReason, reportPlatform, reportReasonEvidence (optional)

---

Scheduler

Method	Path	Description
GET	/api/scheduler/discord/get	Retrieve scheduled messages. Query: status (optional)
POST	/api/scheduler/discord/create	Schedule a Discord message. Body: actioningUser, channelId, scheduledFor, timezoneOffset, embedTitle, embedDescription, embedColor
POST	/api/scheduler/discord/delete	Delete a scheduled message. Body: actioningUser, scheduleId

---

Servers

Method	Path	Description
GET	/api/server/get	Retrieve servers. Query: id, type (both optional)
POST	/api/server/create	Create a server. Body: actioningUser, displayName, serverType, serverConnectionAddress, position
POST	/api/server/edit	Edit a server. Body: actioningUser, serverId, displayName, serverType, serverConnectionAddress, position
POST	/api/server/delete	Delete a server. Body: actioningUser, serverId

---

Sessions

Method	Path	Description
POST	/api/session/create	Start a player session. Body: uuid, ip
POST	/api/session/destroy	End all sessions for a player. Body: uuid
POST	/api/session/switch	Update active session's server. Body: uuid, server

---

Shop Directory

Method	Path	Description
GET	/api/shop/get	Paginated shop listings. Query: page (default 1), material (optional filter)

---

Users

Base path: /api/user

Method	Path	Description
POST	/api/user/create	Create or update a user by UUID. Body: uuid, username
GET	/api/user/get	Retrieve user(s). Query: username, discordId, or userId
GET	/api/user/profile/get	Full profile with stats and session data. Query: username, discordId, or userId
GET	/api/user/punishments	Punishment history. Query: uuid, username, or discordId
POST	/api/user/verify	Generate Discord verification code. Body: uuid. Rate limited: 10 req / 15 min
POST	/api/user/link	Link Discord account using code. Body: uuid, code
POST	/api/user/profile/display	Update profile picture preference. Body: displayPreference
POST	/api/user/profile/interests	Update interests. Body: interests (content filtered)
POST	/api/user/profile/about	Update about section. Body: about (content filtered)
POST	/api/user/profile/social	Update social links. Body: social platform URLs

---

Vault

Method	Path	Description
GET	/api/vault/get	Retrieve vault entries. Query: id (optional)
POST	/api/vault/create	Create an entry. Body: actioningUser, displayName, description, redirectUrl, position
POST	/api/vault/edit	Edit an entry. Body: actioningUser, vaultId, displayName, description, redirectUrl, position
POST	/api/vault/delete	Delete an entry. Body: actioningUser, vaultId

---

Voting

Public

Method	Path	Description
GET	/vote/sites	List active voting sites
GET	/vote/leaderboard	Monthly leaderboard. Query: month (YYYY-MM), limit (max 100, default 25)
GET	/vote/player/:uuid	Player vote stats. Query: month (YYYY-MM, optional)

Ingest (token-authenticated)

Method	Path	Description
POST	/vote/ingest	Record an incoming vote. Body: playerName, playerUuid, serviceName, receivedFrom, receivedAt

Admin (token-authenticated)

Method	Path	Description
GET	/admin/vote/sites	All voting sites including inactive
POST	/admin/vote/sites	Create a voting site. Body: siteName, serviceName, voteUrl, isActive, displayOrder
PUT	/admin/vote/sites/:id	Update a voting site
DELETE	/admin/vote/sites/:id	Delete a voting site
GET	/admin/votes	Vote history. Query: month, playerUuid, limit
GET	/admin/vote/queue	Command queue. Query: status, playerUuid, limit, offset
GET	/admin/vote/monthly/results	Monthly results. Query: month (YYYY-MM)
POST	/admin/vote/monthly/process	Trigger monthly reward processing. Body: month (YYYY-MM)
GET	/admin/vote/reward-templates	List reward templates. Query: type (vote/monthly_top)
POST	/admin/vote/reward-templates	Create a reward template. Body: rewardType, commandTemplate, executeAs, serverScope, isActive, displayOrder
PUT	/admin/vote/reward-templates/:id	Update a reward template
DELETE	/admin/vote/reward-templates/:id	Delete a reward template
POST	/admin/vote/credit	Manually credit a vote. Body: playerUuid, playerName, monthKey

---

Upload

Method	Path	Auth	Description
POST	/api/upload/image	Session (logged-in user)	Upload an image (PNG, JPEG, GIF, WebP — max 8 MB). Returns url, publicId, width, height. Requires Cloudinary to be configured.

---

Command Bridge (Vote Reward Delivery)

Used by zander-addon to consume vote reward commands queued by the voting system.

Method	Path	Description
POST	/command-bridge/claim	Retrieve and atomically claim pending commands for a player. Body: playerUuid, serverName; optional: playerName
POST	/command-bridge/complete	Mark commands as completed. Body: playerUuid, completedCommandIds[]
POST	/command-bridge/fail	Mark commands as failed. Body: playerUuid, failed[] (each with id and optional reason)

---

Watch

Method	Path	Auth	Description
GET	/api/watch/live	Public	Current live streams
GET	/api/watch/videos	Public	Recent creator videos (last 20)
GET	/api/watch	Public	Combined live + video feed

---

Web

Method	Path	Description
GET	/api/web/configuration	Returns site name and address
GET	/api/web/statistics	Community stats — member count, hours played, staff count
GET	/api/web/logs/get	Audit logs. Query: user, feature (both optional)