Web API

API Endpoints

All endpoints require Authorization: Bearer <session token> unless noted otherwise.

Endpoint	Description
`GET /api/lang`	Dashboard strings in the configured language (public, rate limited)
`GET /api/modules`	Registered web modules and the descriptors of their pages
`GET /api/metrics`	Server name, uptime, players and TPS. Public if `metrics-public: true`; versions, memory, storage and cache figures are added only for an authenticated caller.
`GET /api/players`	Player list, searchable and paged
`GET/POST /api/<addon>/config/raw`	Read or replace an addon's `config.yml`. The YAML is parsed before anything is written, and the addon is reloaded after.

Each addon registers its own routes under /api/<name>/. For example, XBans provides /api/xbans/... and XLogin provides /api/xlogin/....

Run /xcore dashboard in game and take the token out of the link it gives you:

curl -H "Authorization: Bearer YOUR_SESSION_TOKEN" http://localhost:8085/api/modules

Revoke it with /xcore dashboard revoke when the script is retired. Tokens expire after session-ttl-hours.

Never expose the dashboard port publicly without a reverse proxy (nginx, Caddy) and HTTPS.