Skip to content
Documentation

API reference

Generated from the router, so it describes the API that is running.

The 10 endpoints an API key can call, each with the capability that gates it, a request you can paste into a terminal, and the JSON that comes back. The route list is generated from the router itself, so it describes what is running rather than what someone remembered to write down.

The credential

One header, on every request:

Authorization: Bearer dyl_your_api_key
  • A key is scoped: you choose its capabilities, you choose which servers it may touch, it has its own rate limit, and you can revoke it without touching anything else.
  • It never gains authority from whoever holds it. Every request re-checks that the account that minted the key still holds the capability being used, so removing someone from a server stops the keys they made for it - nobody has to remember to revoke them.
  • There is no admin API key. Panel administration capabilities cannot be carried by a key at all, on any account. An admin's key reaches exactly these routes, on the servers it was scoped to, and nothing else.
  • A key scoped to no servers can use no per-server capability, so that combination is refused when the key is created rather than issued as one that fails later.

Keys are made in the panel under your account. Whether users other than admins may hold one at all is an operator setting and it is off by default: no "New API Key" button means an admin has not turned it on.

/api/external10

Errors

Every error has the same shape, with the matching HTTP status:

{"success": false, "message": "..."}
401
The key is invalid, revoked, or its owner is gone.
403
Valid key, but it does not carry the capability this route needs - or its owner no longer does.
404
No such server, or one outside this key's allowlist. The two are deliberately indistinguishable.
429
Over a rate limit. Retry-After: 60 says how long to wait. Honour it: there is a per-key limit and a per-IP limit checked before the database is touched at all.
503
The first-run wizard has not completed, or maintenance mode is blocking writes. Back off rather than retrying immediately.

One exception is worth building around: RCON answers 200 with success: false when the command could not run. Check the field, not the status.