REST API
Secrets travel in headers only — never in URLs:
X-Api-Token (game),
X-Api-Private-Token (game admin),
X-Player-Token (player, scoped to the game).
| Method | Endpoint | Purpose |
|---|---|---|
POST |
api/player.php?action=register | Create a player → returns player token |
POST |
api/player.php?action=login | Re-login by name → returns player token |
GET |
api/player.php?action=me | Player info + current room |
POST |
api/player.php?action=heartbeat | Presence + liveness |
POST |
api/player.php?action=logout | Mark player offline |
GET |
api/player.php?action=updates | Poll pending player_updates |
POST |
api/room.php?action=create | Create room → fires on_room_created |
POST |
api/room.php?action=join | Join room (id/password or join_token) → fires on_player_join |
POST |
api/room.php?action=leave | Leave room → fires on_player_leave |
GET |
api/room.php?action=list | List open rooms |
GET |
api/room.php?action=info | Current room + member list |
GET |
api/logic.php?action=meta | Published program version + trigger table |
POST |
api/logic.php?action=do | Fire on_player_action — the gameplay trigger endpoint |
POST |
api/logic.php?action=message | Fire on_message — server-validated custom messages |
GET |
api/state.php | Reconnect snapshot: own player_state + room members |
GET |
api/blocks.php | Block/op catalogue — the engine whitelist as data |
POST |
api/simulate.php | Cabinet-only: dry-run a draft program in a sandbox |