API reference
These endpoints back the dashboard. They are not yet a public API — there are no API tokens, so everything session-authenticated requires a browser session and will not work from a script.
Conventions
- Success is
{ ok: true, ... }. Failure is{ error: string }with a non-2xx status. - 404 is returned for a server you cannot see — deliberately not 403, which would confirm it exists.
- 402 means your plan does not allow it, and carries an
upgradeobject naming the tier that would. - 429 carries
Retry-Afterin seconds. - Every mutation writes an audit-log entry. Secret values never appear in one.
Configuration
Session-authenticated. Every route is scoped to one server and fails closed.
POST/api/servers/{serverId}/settingsSession · adminChannels, prefix, commerce environment
GETPOST/api/servers/{serverId}/automodSession · adminList or create automod rules · Create is limited by plan
PATCHDELETE/api/servers/{serverId}/automod/{ruleId}Session · adminUpdate or remove a rule
POST/api/servers/{serverId}/verificationSession · adminVerification config, publishes the panel
GETPOST/api/servers/{serverId}/ticket-panelsSession · adminTicket panels
POST/api/servers/{serverId}/automationSession · adminAuto-roles, sticky, voice hubs, anti-nuke, role panels
GETPOST/api/servers/{serverId}/autorespondersSession · adminAutoresponders
GETPOST/api/servers/{serverId}/embedsSession · adminSaved embeds
POST/api/servers/{serverId}/messagesSession · adminWelcome/goodbye, snipe, analytics toggles
Commerce
Requires a plan that includes commerce. Keys are encrypted on write and never returned.
POST/api/servers/{serverId}/stripe-keysSession · adminStore Stripe credentials · Key is verified against Stripe before storage
POST/api/servers/{serverId}/sellauth-keysSession · adminStore SellAuth credentials · Pro and above
POST/api/servers/{serverId}/sellauth-syncSession · adminImport SellAuth products
GETPOST/api/servers/{serverId}/productsSession · adminCatalogue
POST/api/servers/{serverId}/orders/{orderId}/refundSession · ownerRefund an order
Billing
Your subscription to poi-bot, on our Stripe account.
POST/api/servers/{serverId}/billingSession · ownerStart checkout or open the billing portal
Webhooks
No session. A valid signature is the authentication.
POST/api/webhooks/stripe/{serverId}Stripe signatureTenant Stripe events · Verified against that server's stored secret
POST/api/webhooks/sellauth/{serverId}HMAC signatureTenant SellAuth events
POST/api/webhooks/platformPlatform Stripe signatureSubscription lifecycle
GET/api/bot/config/{serverId}HMAC signatureBot configuration poll
Example: a plan-limited response
HTTP/1.1 402 Payment Required
{
"error": "You have reached the Starter limit of 25 products. Upgrade to Pro for more.",
"upgrade": { "currentTier": "STARTER", "requiredTier": "PRO", "limit": 25 }
}