{
  "openapi": "3.1.1",
  "info": {
    "title": "ozProtect anticheat HTTP source reference",
    "version": "2026-10-28",
    "description": "Public user-facing source reference. Only explicitly permitted operations are published; service, maintenance and private interfaces are excluded. Unknown schemas stay unconstrained. Source checks do not replace authorization or establish runtime availability."
  },
  "servers": [
    {
      "url": "/",
      "description": "Select the actual assigned service origin; this is not a deployment URL."
    }
  ],
  "paths": {
    "/auth/steam": {
      "get": {
        "operationId": "anticheat_get__auth_steam",
        "tags": [
          "auth/steam"
        ],
        "summary": "GET /auth/steam",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 58
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/auth/steam/return": {
      "get": {
        "operationId": "anticheat_get__auth_steam_return",
        "tags": [
          "auth/steam"
        ],
        "summary": "GET /auth/steam/return",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 65
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/auth/callback": {
      "get": {
        "operationId": "anticheat_get__auth_callback",
        "tags": [
          "auth/callback"
        ],
        "summary": "GET /auth/callback",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 102
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/api/auth/me": {
      "get": {
        "operationId": "anticheat_get__api_auth_me",
        "tags": [
          "api/auth"
        ],
        "summary": "GET /api/auth/me",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 109
        },
        "x-source-checks": [
          "authLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/auth/token": {
      "get": {
        "operationId": "anticheat_get__api_auth_token",
        "tags": [
          "api/auth"
        ],
        "summary": "GET /api/auth/token",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 113
        },
        "x-source-checks": [
          "authLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/api/auth/logout": {
      "post": {
        "operationId": "anticheat_post__api_auth_logout",
        "tags": [
          "api/auth"
        ],
        "summary": "POST /api/auth/logout",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 133
        },
        "x-source-checks": [
          "authLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/create": {
      "post": {
        "operationId": "anticheat_post__api_servers_create",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/create",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 146
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers": {
      "get": {
        "operationId": "anticheat_get__api_servers",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 150
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/servers/{serverId}": {
      "delete": {
        "operationId": "anticheat_delete__api_servers_serverId_",
        "tags": [
          "api/servers"
        ],
        "summary": "DELETE /api/servers/{serverId}",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 158
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/stats": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_stats",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/stats",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 162
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/servers/{serverId}/bans": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_bans",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/bans",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 166
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/servers/{serverId}/players": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_players",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/players",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 170
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/servers/{serverId}/ban": {
      "post": {
        "operationId": "anticheat_post__api_servers_serverId_ban",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/{serverId}/ban",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 174
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/unban": {
      "post": {
        "operationId": "anticheat_post__api_servers_serverId_unban",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/{serverId}/unban",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 178
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/reset-fingerprint": {
      "post": {
        "operationId": "anticheat_post__api_servers_serverId_reset_fingerprint",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/{serverId}/reset-fingerprint",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 183
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/fingerprint-history": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_fingerprint_history",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/fingerprint-history",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 187
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/client/versions": {
      "get": {
        "operationId": "anticheat_get__api_client_versions",
        "tags": [
          "api/client"
        ],
        "summary": "GET /api/client/versions",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 240
        },
        "x-source-checks": [
          "clientLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/api/anticheat/extension-release": {
      "get": {
        "operationId": "anticheat_get__api_anticheat_extension_release",
        "tags": [
          "api/anticheat"
        ],
        "summary": "GET /api/anticheat/extension-release",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 244
        },
        "x-source-checks": [
          "clientLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/api/servers/{serverId}/violations": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_violations",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/violations",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "player_id",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string",
              "description": "String input; preserve identifier precision and credential encoding."
            }
          },
          {
            "name": "push",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 249
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      }
    },
    "/api/servers/{serverId}/whitelist": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_whitelist",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/whitelist",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 282
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      },
      "post": {
        "operationId": "anticheat_post__api_servers_serverId_whitelist",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/{serverId}/whitelist",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "player_id",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string",
              "description": "String input; preserve identifier precision and credential encoding."
            }
          },
          {
            "name": "player_name",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "reason",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 300
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "player_id": {
                    "type": "string",
                    "description": "String input; preserve identifier precision and credential encoding."
                  },
                  "player_name": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "reason": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "player_id": {
                    "type": "string",
                    "description": "String input; preserve identifier precision and credential encoding."
                  },
                  "player_name": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "reason": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/whitelist/{playerId}": {
      "delete": {
        "operationId": "anticheat_delete__api_servers_serverId_whitelist_playerId_",
        "tags": [
          "api/servers"
        ],
        "summary": "DELETE /api/servers/{serverId}/whitelist/{playerId}",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "playerId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "playerId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 327
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "playerId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "playerId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/servers/{serverId}/config": {
      "get": {
        "operationId": "anticheat_get__api_servers_serverId_config",
        "tags": [
          "api/servers"
        ],
        "summary": "GET /api/servers/{serverId}/config",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 349
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ]
      },
      "post": {
        "operationId": "anticheat_post__api_servers_serverId_config",
        "tags": [
          "api/servers"
        ],
        "summary": "POST /api/servers/{serverId}/config",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [
          {
            "name": "serverId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "config",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          },
          {
            "name": "serverId",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 373
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "config": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "config": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  },
                  "serverId": {
                    "description": "Read by source. No type is asserted without an explicit reviewed schema."
                  }
                },
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/plugin/download": {
      "post": {
        "operationId": "anticheat_post__api_plugin_download",
        "tags": [
          "api/plugin"
        ],
        "summary": "POST /api/plugin/download",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerApplicationRoutes.js",
          "line": 412
        },
        "x-source-checks": [
          "apiLimiter",
          "authenticateJWT"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Body overrides matching query fields. x-observed-required-input identifies required input across both locations. Nested/raw payload schemas remain open.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/api/releases/client-installer": {
      "get": {
        "operationId": "anticheat_get__api_releases_client_installer",
        "tags": [
          "api/releases"
        ],
        "summary": "GET /api/releases/client-installer",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerCoreBeforeRoutes.js",
          "line": 317
        },
        "x-source-checks": [
          "limiters.clientLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/api/releases/extension-package": {
      "get": {
        "operationId": "anticheat_get__api_releases_extension_package",
        "tags": [
          "api/releases"
        ],
        "summary": "GET /api/releases/extension-package",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.aback",
          "file": "http/registerCoreBeforeRoutes.js",
          "line": 320
        },
        "x-source-checks": [
          "limiters.clientLimiter"
        ],
        "x-observed-required-input": [],
        "x-observed-errors": [],
        "x-feature-keys": [],
        "x-internal": false
      }
    }
  },
  "components": {
    "schemas": {
      "Success": {
        "type": "object",
        "required": [
          "status",
          "response"
        ],
        "properties": {
          "status": {
            "const": "success"
          },
          "response": {},
          "info": {
            "type": "object",
            "additionalProperties": true
          }
        },
        "additionalProperties": true
      },
      "Error": {
        "type": "object",
        "required": [
          "status",
          "error"
        ],
        "properties": {
          "status": {
            "const": "error"
          },
          "error": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string"
              },
              "message": {
                "type": "string"
              }
            },
            "required": [
              "name",
              "message"
            ],
            "additionalProperties": true
          }
        },
        "additionalProperties": true
      }
    },
    "securitySchemes": {
      "AccessToken": {
        "type": "apiKey",
        "in": "query",
        "name": "access_token",
        "description": "Legacy access_token request field. POST may carry it in the body instead; this is not an HTTP Bearer token."
      },
      "Bearer": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Only routes explicitly using JWT authentication."
      }
    }
  },
  "x-source-snapshot": {
    "repository": "ozl.ozprotect.aback",
    "commit": "668726b6ce7b2a704ce98b2f62b40c0278432bc4",
    "ref": "working-tree",
    "dirty": false
  }
}