RestAPI
- By
An HTTP API and RCON for Hytale servers. Named keys with scopes, rate limits, an audit log of every change, an OpenAPI document and a docs page. Binds to 127.0.0.1 until you change it.
Description
Join my Discord if you run into issues or have ideas https://discord.gg/mKgxyk6qvb
Hytale 0.7.1 has no remote console, no query port and no management port. The server reads commands from stdin and that is all. I wanted to watch my server from Grafana, restart it from a panel and let a Discord bot look things up, so RestAPI puts a small HTTP server inside the server process with 70 routes of its own.
Every request carries a named key with scopes, a request limit per minute and an optional list of addresses it may come from. Only the SHA-256 of a key is stored. Every change made through the API or RCON goes to a daily audit file with the key name and the address.
What it covers
Players with kick, ban, whitelist, teleport, give and permission groups. Console commands with their output and the server log as a live stream. Plugin reloads, world time, weather, saves, backups, and a stop or restart with a countdown. Join, chat, death and command events as a stream and as signed webhooks. /metrics in Prometheus format with TPS and tick times. GET /openapi.json describes the routes mounted right now and /docs lets you try them from a browser.
RCON is there too, off by default, for tools that already speak it. Any key with the commands scope is the password, and the same deny list applies as over HTTP, so stop and a reload of RestAPI itself are refused.
| Command | What it does |
|---|---|
/restapi status |
Where the API listens, routes, keys, RCON and a line per suite mod |
/restapi reload |
Reads the settings, messages and keys again |
/restapi keys create grafana read metrics |
Makes a key and shows it once |
/restapi keys revoke grafana |
Removes a key at once |
/restapi audit tail |
The newest audit lines |
Every command needs
restapi.admin, the key commands alsorestapi.admin.keys. The first start makes a key namedadminwith every scope and prints it in the server log once. The README on GitHub lists every route and all 123 settings.
With my other mods
All optional, and each link has a setting siblings.<id> with auto, always or never. A mod's routes are mounted under /api/<id> with a scope of their own while it runs and taken away when it stops, so a script never sees a route that answers "not installed". With all eight there are 135 routes.
TrackerAPI adds counters, leaderboards and the journal. Coinage adds balances and the ledger, and with coinage.write a key can move money under its own name. Dominion Factions adds factions, claims, sieges and relations, and with dominion.write the staff actions. Feats adds progress per player, the points board and recent unlocks. Chronicle Stats adds player stats, boards per week and month, and the server series. Atlas adds the map link, render status, worlds and markers. Lullaby adds who is in bed and how many are still needed per world. SocialBridge adds the Discord account linked to a player and the other way round, and with socialbridge.write a key can post to its Discord channels.
Coinage, Dominion Factions, SocialBridge and RestAPI itself are not on CurseForge yet, the links above use the pages they will have.
Limits
Needs server 0.7.0 or newer and Java 25. RestAPI has 416 automated tests and boots cleanly with all nine of my mods on a headless 0.7.2 server. Please report anything that answers wrong.
There is no TLS. Keep it on 127.0.0.1 or put a reverse proxy with TLS in front, the README has a Caddy example. The JDK web server reads one request time limit per JVM, so Atlas, Chronicle Stats and RestAPI share it.
Links
- More mods by ryvrook https://www.curseforge.com/members/ryvrook/projects
- TrackerAPI, Feats, Chronicle Stats, Atlas, Lullaby
- Coinage, Dominion Factions, SocialBridge
- Source, every route and every setting https://github.com/ryvrook/Hytale-RestAPI
- Discord https://discord.gg/mKgxyk6qvb
RestAPI Team
