Configuration

Everything lives in plugins/WorldAPI/config.yml, with a comment on every setting. /worldapi reload applies it without a restart.

A misspelled key is an error rather than a silent default. A failed reload keeps the old config and says why. A change under http or cors restarts the HTTP server, which drops open WebSocket connections; clients reconnect.

Sections

Section	What it sets
http	Host, port (8110), base path (/api/v1), trusted proxies, the body size cap, and how long a request waits for the server thread
cors	Sites that may call the API from a browser
auth	Tokens, groups, and the paths visitors without a token may read
rateLimit	Requests per minute for visitors (per IP) and for tokens (per token)
privacy	Whether visitors see coordinates, inventories, IP addresses, and chat; all off by default
websocket	Client limits, queue size, sampling intervals, and the topics open to visitors
events	Chat recording, off by default, and how many days to keep history (0 keeps it forever)
extensions	Other plugins' data, and what of it visitors must not see anyway
limits	Caps on page size, fills, spawns, removals, search radii, file reads, backups, and more
panel	The panel's public address for links in game, and item icons
scripts	Java scripts, off by default
database	SQLite, PostgreSQL, or MySQL and MariaDB

A public site

A site in the browser needs its origin in cors:

cors:
  allowedOrigins: ["https://example.com"]

What it may read without a token is auth.anonymous.endpoints. * matches one path segment, ** any number:

auth:
  anonymous:
    enabled: true
    endpoints:
      - /server
      - /players
      - /players/*
      - /leaderboards/*

Database

WorldAPI keeps the event history, play sessions, the audit log, experience totals, and panel accounts in a database. By default that's SQLite in plugins/WorldAPI/worldapi.db, which needs no setup.

To use PostgreSQL, MySQL, or MariaDB:

1. Create the database and the user. WorldAPI creates its tables on start.

2. Point the database section at it. The drivers ship in the jar.

   database:
     type: postgresql
     host: db.example.com
     port: 5432
     name: worldapi
     user: worldapi
     password: "secret"
     properties: { sslmode: require }

   For MySQL and MariaDB alike, use type: mysql and port 3306.

3. Restart the server. /worldapi reload keeps the current connection.

Give each server its own database. Switching databases starts the new one empty: nothing is copied over.

Next: Reverse proxy.