API

Base: dashboard Next.js Route Handlers.

Auth

| Method | Path | Auth |

|--------|------|------|

| POST | /api/auth/login | public |

| POST | /api/auth/logout | session |

| GET | /api/auth/me | session |

Servers

| Method | Path | Permission |

|--------|------|------------|

| GET | /api/servers | server.view |

| POST | /api/servers | servers.manage |

Dashboard

| Method | Path | Permission |

|--------|------|------------|

| GET | /api/dashboard/overview?serverId= | overview.view |

| GET | /api/dashboard/overview/history?serverId=&range= | overview.view |

| GET | /api/dashboard/players?serverId= | players.view |

| GET | /api/dashboard/players/profile?serverId=&steamId64= | players.view |

| GET | /api/dashboard/logs?serverId= | logs.view |

| GET/POST | /api/dashboard/commands?serverId= | view / enqueue (per-type RBAC) |

| GET | /api/dashboard/economy?serverId= | economy.view |

| GET | /api/dashboard/machines?serverId= | machines.view |

| GET | /api/dashboard/mining?serverId= | mining.view |

| GET | /api/dashboard/map?serverId= | map.view (+ staff/entities subsets) |

| GET | /api/dashboard/entities?serverId= | entities.view |

| GET | /api/dashboard/punishments?serverId= | punishments.view |

| GET/PATCH | /api/dashboard/staff?serverId= | staff.view / staff.manage |

| GET/PATCH/POST | /api/dashboard/configuration?serverId= | config.view / config.edit / config.rollback |

| GET | /api/dashboard/perks?serverId= | perks.view |

| GET | /api/dashboard/progression?serverId= | progression.view |

| GET | /api/dashboard/database?serverId= | database.view |

| GET | /api/dashboard/addons?serverId= | addons.view |

| GET | /api/dashboard/system?serverId= | system.view |

| GET | /api/dashboard/search?serverId=&q= | overview.view (+ per-resource RBAC) |

| GET/PATCH | /api/dashboard/notifications?serverId= | authenticated (type-filtered) |

| GET | /api/dashboard/detections?serverId= | detections.view |

| GET/PATCH | /api/dashboard/detections/:id | view / detections.review |

| GET/PATCH | /api/dashboard/modules?serverId= | modules (+ optional antiCheatEnabled toggle) |

| GET | /api/events/stream?serverId= | overview.view · SSE |

Allowlisted command types: ping, announce, kick, ban, unban, warn, map, restart, maintenance, entity_remove, entity_cleanup_player, entity_cleanup_class, config_apply.

Ban authority: SAM when present.

Agent

Headers: x-mdrp-server-id, x-mdrp-secret, optional HMAC.

| Method | Path |

|--------|------|

| POST | /api/agent/v1/heartbeat |

| POST | /api/agent/v1/events |

| POST | /api/agent/v1/gameplay |

| POST | /api/agent/v1/progression |

| GET | /api/agent/v1/commands |

| POST | /api/agent/v1/ack |

Never arbitrary Lua/shell/SQL from the browser.