Skip to main content

REST API Reference

KitsuneCommand exposes a JSON REST API on port 8888 (internal; proxied through port 8890 with the bundled frontend). Endpoints are grouped by feature area.

Authentication​

Every non-auth endpoint requires a bearer token obtained from POST /api/auth/login. Include it as:

Authorization: Bearer <access_token>

Tokens expire after AccessTokenExpireMinutes (default 24h). Use POST /api/auth/refresh with the refresh token to rotate without re-authenticating.

Response envelope​

Every response is wrapped in an envelope:

{
  "success": true,
  "data": { /* endpoint-specific payload */ },
  "message": null
}

On error: success: false, data: null, and message carries a human-readable reason. HTTP status codes follow convention (200, 400, 401, 403, 404, 500).

Pagination​

List endpoints use query parameters:

ParamDefaultDescription
pageIndex0Zero-based page index
pageSize20Items per page
searchOptional search string

Paginated responses wrap the result as:

{
  "items": [ /* page contents */ ],
  "total": 123,
  "pageIndex": 0,
  "pageSize": 20
}

Role model​

Three roles, in order of permission:

  • viewer. Read-only
  • moderator. Most actions on players, tickets, economy; can't touch server admin
  • admin. Everything

Endpoint docs call out the minimum role required when it's stricter than [Authorize].

Feature groups​

Conventions used below​

  • Path column is relative to each page's stated route prefix.
  • Request / Response use a shorthand: { field, field, field } lists top-level field names. DtoName[] is an array. An empty cell means no body.
  • Admin-only endpoints are called out in the Description column.