API Access control

Tokens, groups, panel accounts, and the audit log. Every path starts with /api/v1.

Endpoint	Permission	What it does
GET /accounts	tokens:manage	Admin panel accounts
POST /accounts/invite	tokens:manage	Make a code that creates a panel account
PATCH /accounts/{name}	tokens:manage	Change an account's groups
DELETE /accounts/{name}	tokens:manage	Delete an account and end its sessions
POST /accounts/{name}/reset	tokens:manage	Make a code that sets a new password for an account
GET /audit	tokens:manage	What tokens and accounts changed, newest first
GET /groups	tokens:manage	Groups from config.yml and every permission
GET /tokens	tokens:manage	Every token: from config.yml and issued in game or here
POST /tokens	tokens:manage	Issue a token
DELETE /tokens/{name}	tokens:manage	Revoke a token made in game or here

Nobody hands out a permission they lack: a token or an account with tokens:manage grants only what it has itself.

Panel sign-in

The admin panel calls the same API with a session cookie instead of a token. These endpoints aren't in the OpenAPI document:

Endpoint	What it does
GET /auth/status	Whether the panel has an account yet, WorldAPI's version, and whether the connection is secure
GET /auth/me	Who's calling and the permissions they come to; answers for tokens too
POST /auth/setup	Takes a code from /worldapi admin or an invite, with a password, and signs in
POST /auth/login	Signs in with a name and a password
POST /auth/password	Changes your password
POST /auth/logout	Ends the session

The cookie is HttpOnly and SameSite=Strict, and every write it carries must also send X-WorldAPI-Panel: 1, or WorldAPI answers 403 csrf. Another site can't act through it.

Next: WebSocket.