HTTP API and OpenAPI

ozProtect HTTP services have separate origins, methods and credentials. The same /methods/account.* prefix does not identify one backend. Panel actions also use Socket.IO API.

Specifications

Service	Readable reference	OpenAPI 3.1.1
Network	Methods and routes	network.json
SSO	Implemented methods	sso.json
AntiCheat backend	RPC and HTTP routes	anticheat.json

Import JSON into a compatible OpenAPI client. servers: / means your selected origin, not an operational public endpoint. These specifications do not authorize financial, administrative or game actions against another environment or production.

The format follows the official OpenAPI specification. This describes HTTP; Socket.IO events are not disguised as REST paths.

Network RPC

Route: GET|POST /methods/category.method. Some registered objects also have nested groups. Network matches exported keys; preserve method case. The HTTP layer handles JSON, urlencoded and multipart. GetParam reads merged query/body, with body taking precedence. GetBody and GetQuery read only their respective location.

Use POST for credentials and mutations. A legacy dispatcher accepting GET for a mutation does not make it safe for retries, links, crawlers or caching.

Catalogue read example without an actual token:

curl "$NETWORK_ORIGIN/methods/front.getLicenses"

Normal response:

{"status":"success","response":{},"info":{"category":"front","method":"getLicenses"}}

An application error can use HTTP 200:

{"status":"error","error":{"name":"access_denied","message":"..."}}

Always check status, then response or the error. Do not treat info/debug fields as a stable data model or retain credentials from diagnostic responses in logs.

Authentication

Context	Credentials	Additional checks
Network HTTP v2	Authorization: Bearer with a personal RS256 account token	Signature/issuer/audience/expiry/version plus method access
Legacy Network HTTP account	access_token request field, normally POST body	Auth hash, owner/staff/server access, feature and dedicated scope per method
Server token issuance	core.genToken: project, server, key	Server/project association and project key
Panel network token	account.genNetToken: project, server, key, client_id, access_token	Current key uses SessionDecrypt; it is not a plain Bearer credential
Appeals integration	X-Appeal-Key / supported aliases	Production guard rejects missing/placeholder keys; development behavior follows the shared-key helper
Cron/internal	Intended cron credential and infrastructure isolation	Not a public API; guard configuration matters
SSO	Legacy application/token fields and valider checks	Separate contract and errors
AntiCheat panel/client	JWT, server key, API key or SecureChannel depending on route	Do not substitute a Network token

OpenAPI AccessToken models legacy query credentials for GET; POST documents them as a body field. Missing security on an extracted method does not establish anonymous access: middleware/modules can own checks. x-source-checks is an observation list, not authorization certification.

New SSO browser login

Cookie-based /auth/login/session/logout/profile/projects/network-token, Steam, registration and recovery are described in SSO and included in SSO OpenAPI. Browsers send no application keys. api_v=2 on old /methods/* is a separate transitional application contract.

SSO issues short-lived personal RS256 tokens; Network needs separate support for HTTP Authorization: Bearer and Socket.IO auth.token verification. Network source verifier is present in 50e0478; client integration/acceptance is separate. Legacy credentials above serve compatible applications, not new browser forms.

AntiCheat SecureChannel

Allowlisted POST /methods/client.method uses X-HWID, X-Timestamp in milliseconds, X-Nonce and {iv, ct, tag} body. iv/tag are hex; ciphertext ct is base64. AES-256-GCM AAD includes HWID, timestamp and nonce; current clock tolerance is 30 seconds. Obtain the key through the implemented challenge/register flow, not from documentation data.

Successful channel responses are encrypted too. Middleware can return a plain HTTP error before handler execution. Some legacy aliases have hybrid HMAC/JWT/server-key paths; these are not plaintext RPC equivalents. Use the existing client and AntiCheat contract, rather than inventing signature formats.

Coverage and updates

The reference extracts registered RPC, explicit HTTP registrations and Socket.IO handlers by reading AST without importing backend code or loading .env. Source snapshot records commit/dirty markers. Dirty source includes local changes and is not a published release.

x-source identifies file/line; x-observed-required-input, x-observed-errors, x-feature-keys record visible guards. Table * marks a direct required-input guard. Branches, dynamic payloads, nested forms and delegated validation may require more fields. Unknown types and response schemas are deliberately left open. Administrative/debug helpers can appear in registered objects; their presence does not make them supported external APIs.

Some AC aliases are registered through wrappers; the specification records their existence but leaves response schemas open for redirects, binary or encrypted results. It is not an exhaustive model of every payload.

Regenerate against sibling source:

npm run reference:generate -- --sso-ref origin/claude/dev-work
npm run docs:check

These commands change only documentation and do not call APIs. Runtime/production compatibility requires separate service-owner verification.

Errors and retries · Sockets