Every action in the game is a request you can script. 173 endpoints on this server.
X-Api-Key./v1/... on this website. One request per second.success in the JSON. The server often answers HTTP 200 even when it refused the call.Try your own profile:
curl -s -H "X-Api-Key: pk_YOUR_KEY" "__ORIGIN__/v1/user?extras=true"
This website — Call /v1 here. Send header X-Api-Key. One request per second.
Accepts a contract by contract_key or key, or board_index or index, with mode solo or crew, and returns the accept_contract payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contract_key": "VALUE", "key": "VALUE", "board_index": "VALUE", "index": "VALUE", "mode": "VALUE", "solo_or_crew": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heist_accept"
Claims loot for heist run_id when the run is in the clean phase and returns the complete_run payload (or run if not ready).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"run_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heist_claim"
Returns the daily heist board, phases, active run, and history.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/heist_contracts"
Aborts heist run_id (or the active run) with optional reason and returns the fail_run payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"run_id": "VALUE", "reason": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heist_fail"
Joins a crew heist run_id and returns the join_run payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"run_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heist_join"
Returns the caller's active heist, or run_id if given, as run (or active null).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/heist_status?run_id=VALUE"
Advances heist run_id (or the active run) by step or phase and returns the advance_step payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"run_id": "VALUE", "step": "VALUE", "phase": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heist_step"
Lists open bounties as bounties, with open_count, min_post, and max_post.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/heat_bounties"
Cancels the caller's bounty_id (or id) and returns the cancel_player_bounty payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"bounty_id": "VALUE", "id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heat_bounty_cancel"
Claims bounty_id (or id) and/or target_id (or victim_user_id) and returns the claim_bounty payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"bounty_id": "VALUE", "id": "VALUE", "target_id": "VALUE", "victim_user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heat_bounty_claim"
Posts a bounty on target_id (or victim_user_id or user_id) for amount (or reward or crypto), with optional username, ip, and note, and returns the post_player_bounty payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"target_id": "VALUE", "victim_user_id": "VALUE", "user_id": "VALUE", "amount": "VALUE", "reward": "VALUE", "crypto": "VALUE", "username": "VALUE", "target": "VALUE", "name": "VALUE", "ip": "VALUE", "user_ip": "VALUE", "note": "VALUE", "message": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heat_bounty_post"
Returns bounty progress against target_id or victim_user_id.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/heat_bounty_progress?target_id=VALUE&victim_user_id=VALUE"
Activates a corp-spoof charge and returns the activate_corp_spoof payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/heat_corp_spoof"
Pays the fixer to clear heat, amount, or clear and returns the pay_fixer payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"heat": "VALUE", "amount": "VALUE", "clear": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heat_fixer"
Frames target_id or victim_user_id by shifting heat and returns the frame_player payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"target_id": "VALUE", "victim_user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/heat_frame"
Returns the caller's heat, band, effects, bounty, events, fixer, and corp_spoof.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/heat_status"
Accepts an invite to crew_id and returns the accept_invite payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_accept_invite"
Approves user_id's join request for crew_id and returns the approve_request payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_approve_request"
Lists bans for crew_id (query or body) and returns the list_bans payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crew_bans?crew_id=VALUE"
Creates a crew from name, tag, join_policy, and encryption_required and returns the create_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"encryption_required": "VALUE", "name": "VALUE", "tag": "VALUE", "join_policy": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_create"
Declines an invite to crew_id and returns the decline_invite payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_decline_invite"
Deletes crew_id when the caller leads it and returns the delete_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_delete"
Demotes user_id in crew_id and returns the demote payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_demote"
Denies user_id's join request for crew_id and returns the deny_request payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_deny_request"
Toggles crew chat encryption for crew_id and returns the toggle_encryption payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_encryption_toggle"
Invites user_id to crew_id and returns the invite payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_invite"
Invites username to crew_id and returns the invite_by_username payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "username": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_invite_username"
Lists crew invites waiting for the caller and returns the list_invites payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crew_invites"
Joins crew_id (or files a request if the policy requires it) and returns the join_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_join"
Lists join requests for crew_id (query or body; optional) and returns the list_join_requests payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crew_join_requests?crew_id=VALUE"
Kicks user_id from crew_id and returns the kick_member payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_kick_member"
Leaves crew_id (optional if the caller is in only one crew) and returns the leave_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_leave"
Searches crews with search, offset, and limit (query or body) and returns the list_crews payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crew_list?search=VALUE&offset=VALUE&limit=VALUE"
Returns the caller's crew hub as crews (crew, members, my_role) and max_crews.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crew_members"
Promotes user_id in crew_id and returns the promote payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_promote"
Renames crew_id to name and returns the rename_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "name": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_rename"
Changes crew_id's tag and returns the retag_crew payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "tag": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_retag"
Sets crew_id's join_policy and returns the set_join_policy payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "join_policy": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_set_join_policy"
Transfers leadership of crew_id to new_leader_user_id or user_id and returns the transfer_leadership payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "new_leader_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_transfer_leadership"
Unbans user_id from crew_id and returns the unban_member payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"crew_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crew_unban"
After a bypass, returns the crew of victim_user_id via victim_crew.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_crew?victim_user_id=VALUE"
Adds emoji to post_id and returns the add_reaction payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"post_id": "VALUE", "emoji": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/add_reaction"
Accepts a pending request from contact_user_id or user_id and returns the accept_contact payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contact_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/contact_accept"
Sends a contact request to contact_user_id or user_id and returns the add_contact payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contact_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/contact_add"
Declines a pending request from contact_user_id or user_id and returns the decline_contact payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contact_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/contact_decline"
Lists the caller's accepted contacts as contacts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/contacts"
Lists incoming contact requests as contacts_pending and pending_contacts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/contacts_pending"
Opens a DM with contact_user_id, user_id, or other_user_id, or a crew thread with crew_id, and returns threads.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contact_user_id": "VALUE", "user_id": "VALUE", "other_user_id": "VALUE", "crew_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/create_message_thread?contact_user_id=VALUE&user_id=VALUE"
Returns whether Message Encryptor is owned and enabled (owned, enabled, encryption_enabled).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/message_encryption_status"
Toggles Message Encryptor for the caller and returns owned, enabled, and encryption_enabled.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/message_encryption_toggle"
Lists posts in thread_id, with limit and before_id or older_than, and returns posts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/message_posts?thread_id=VALUE&limit=VALUE&before_id=VALUE&older_than=VALUE"
Deletes thread_id for the caller and returns the delete_thread payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"thread_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/message_thread_delete"
Marks thread_id read for the caller and returns the mark_read payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"thread_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/message_thread_mark_read"
Lists message threads, optionally filtered by type or filter and paged with page and limit (query or body), returning threads.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/message_threads?type=VALUE&filter=VALUE&page=VALUE&limit=VALUE"
Returns has_unread plus dm_unread and admin_unread.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/message_threads_has_unread"
Returns crew_unread, dm_unread, admin_unread, and pending_contacts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/message_unread_counts"
Removes emoji from post_id and returns the remove_reaction payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"post_id": "VALUE", "emoji": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/remove_reaction"
Posts text (or message or body) into thread_id or id and returns the send_message payload (posts).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"thread_id": "VALUE", "id": "VALUE", "text": "VALUE", "message": "VALUE", "body": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/send_message"
Blocks blocked_user_id (or target_user_id or user_id) and returns the block_user payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"blocked_user_id": "VALUE", "target_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_block"
Checks whether target_user_id or user_id is blocked and returns blocked.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_block_check?target_user_id=VALUE&user_id=VALUE"
Lists users the caller has blocked as user_blocks, blocked_users, and blocks.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_blocks"
Unblocks blocked_user_id (or target_user_id or user_id) and returns the unblock_user payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"blocked_user_id": "VALUE", "target_user_id": "VALUE", "user_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_unblock"
Lists posts in thread_id on victim_user_id and returns posts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_message_posts?victim_user_id=VALUE&thread_id=VALUE"
Lists message threads visible on a bypassed victim_user_id and returns threads.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_message_threads?victim_user_id=VALUE"
Returns the caller's credit balance as credits and balance.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/credits_balance"
Buys an overclock pack_size (or size) with credits and returns pack_size, overclocks, overclocks_added, credits, and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"pack_size": "VALUE", "size": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/credits_buy_oc"
Pages credit ledger entries with limit and offset and returns history, transactions, has_more, and count.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/credits_history?limit=VALUE&offset=VALUE"
Spends crypto for credits_amount (or credits, or crypto_amount) and on success returns user, user_wallet, credits, hot, and cold.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"credits_amount": "VALUE", "credits": "VALUE", "crypto_amount": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/crypto_exchange"
Returns crypto-to-credits exchange_rate, min_credits, monthly_cap, monthly_used, and monthly_remaining.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crypto_exchange_info"
Pages the caller's crypto ledger with limit, offset, and type, tx_type, or filter, returning transactions, has_more, and count.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/crypto_history?limit=VALUE&offset=VALUE&type=VALUE&tx_type=VALUE&filter=VALUE"
Reads the caller's wallet and returns user_wallet, wallet, hot, cold, and wallet_shield_expires_at.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_wallet"
Reads a cracked victim_user_id wallet and returns user_wallet, wallet, hot, cold, and wallet_shield_expires_at.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_user_wallet?victim_user_id=VALUE"
Consumes a wallet-shield item (inventory type 103) and on success returns user, user_wallet, wallet, inventory, and credits.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/wallet_activate_shield"
Spends 50 credits to roll a new wallet address and returns address and credits.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/wallet_regenerate_address"
Moves amount of cold crypto back to hot and returns amount_transferred plus user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"amount": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/wallet_transfer_from_cold"
Steals amount from a cracked victim_user_id and returns amount_transferred, tax, gas_fee, and user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"victim_user_id": "VALUE", "amount": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/wallet_transfer_from_victim"
Moves amount of hot crypto into cold storage and returns amount_transferred plus user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"amount": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/wallet_transfer_to_cold"
Sends amount of hot crypto to contact_user_id (or user_id) and returns amount_transferred, amount_received, tax, and user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"contact_user_id": "VALUE", "user_id": "VALUE", "amount": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/wallet_transfer_to_contact"
Reports whether victim_user_id's password is cracked as password_cracked and cracked.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/is_password_cracked?victim_user_id=VALUE"
Looks up one target by user_ip or ip and returns scan_result, user, users, and scan_results.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_scan_ip?user_ip=VALUE&ip=VALUE"
Random-scans up to count targets (default 10, max 10) and returns scan_results, users, scan, and count.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_scan_random?count=VALUE"
Opens a bypassed victim_user_id device and returns user, user_software, user_wallet, user_device, user_network, user_log, and password_cracked.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_victim?victim_user_id=VALUE"
Lists viruses on a bypassed victim_user_id and returns viruses.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_viruses_on_victim?victim_user_id=VALUE"
Reads a bypassed victim_user_id device log and returns log, user_log, and log_locked.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_user_log?victim_user_id=VALUE"
Lists processes on a bypassed victim_user_id as victim_processes, processes, and user_processes.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_user_processes?victim_user_id=VALUE"
Lists software on victim_user_id (requires a foothold) as software and user_software.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/victim_user_software?victim_user_id=VALUE"
Tries to remove virus_id (or id) from the caller's device after an AV scan and returns removed and rep_restored.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"virus_id": "VALUE", "id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/virus_remove"
Starts an antivirus scan on the caller's own device and returns the process result plus user, user_software, user_wallet, and user_processes.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/virus_scan"
Fetches one of the caller's processes by process_id or id and returns process.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/process?process_id=VALUE&id=VALUE"
Starts a process: process_type_id is required, victim_user_id optional (0 for AV), plus software_id or software_type_id and optional level or backdoor/exploit flags; success adds user and user_processes.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"victim_user_id": "VALUE", "process_type_id": "VALUE", "software_id": "VALUE", "software_type_id": "VALUE", "type_id": "VALUE", "software_level": "VALUE", "level": "VALUE", "selected_level": "VALUE", "virus_level": "VALUE", "use_backdoor": "VALUE", "use_exploit_kit": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process"
Reports process-speed ads as unavailable (available false, watches_remaining 0).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/process_ad_available"
Deletes one process_id owned by the caller and returns process_deleted_ids.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process_delete"
Spends one overclock on running process_id (or id) and returns overclocks, overclocks_spent, completed, user, and process.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_id": "VALUE", "id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process_overclock"
Pauses a running process_id and returns process_id and paused.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process_pause"
Resumes a paused process_id and returns process_id and resumed.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process_resume"
Retries process_id in place and, on success, returns that result plus user and user_processes.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/process_retry"
Rejects a process ad watch because ads are disabled (watches_remaining 0).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/process_watched_ad"
Deletes each id in process_ids and returns process_deleted_ids.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"process_ids": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/processes_delete"
Lists the caller's processes (statuses 0-3) as processes and user_processes.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_processes"
Returns today's black-market rotation as items and black_market, plus credits, overclocks, sale, and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/black_market"
Buys item_type (or type or item), optionally checking expected_price, and returns item_type, price, credits, user, user_wallet, and inventory.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"item_type": "VALUE", "type": "VALUE", "item": "VALUE", "expected_price": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/black_market_buy"
Buys the next botnet tier with crypto and returns botnet, user, user_wallet, from_hot, from_cold, and xp_gained.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/botnet_purchase"
Returns botnet for the caller's tier and how many spam viruses occupy slots.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/botnet_status"
Private-server stub that returns empty products, subscriptions, and packs so no IAP catalog is listed.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/iap_products"
Uses a consumable by item_type_id, type_id, item_id, or item_type name and on success returns user, user_wallet, inventory, and credits.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"item_type_id": "VALUE", "type_id": "VALUE", "item_id": "VALUE", "item_type": "VALUE", "type": "VALUE", "name": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/inventory_use"
Returns the store catalog: software, devices, networks, consumables, credits_items, user, user_wallet, user_device, user_network, botnet, credits, and overclocks.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/store"
Returns store_config with oc_packs, wallpaper_packs, and exchange limits (subscriptions empty).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/store_config"
Buys software (software_type_id or type_id, optional levels), a device (device_type_id), a network (network_type_id), or a credit consumable (item_type) and returns user plus user_wallet, user_software, user_device, or inventory.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"software_type_id": "VALUE", "type_id": "VALUE", "device_type_id": "VALUE", "device_id": "VALUE", "network_type_id": "VALUE", "network_id": "VALUE", "item_type": "VALUE", "consumable": "VALUE", "levels": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/store_purchase"
Private-server stub that refuses IAP subscription purchase, restore, or refresh (active false, subscription null).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/subscription_refresh"
Private-server stub that returns empty subscription history and rewards.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/subscription_reward_history"
Private-server stub: subscriptions are disabled (active false, subscription null, products empty).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/subscription_status"
Discards locked software locked_id (or id or locked_software_id) and returns the discard_locked payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"locked_id": "VALUE", "id": "VALUE", "locked_software_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_discard_locked_software"
Unlocks locked software locked_id (or id or locked_software_id) with the keygen and returns the generate_key payload.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"locked_id": "VALUE", "id": "VALUE", "locked_software_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_generate_key"
Returns the caller's consumables as inventory and items, plus server_time and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_inventory"
Lists software drops waiting for a keygen as locked_software, software, and count.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_locked_software"
Buys wallpaper pack_id (or id) with credits and returns pack_id, wallpaper_packs, credits, and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"pack_id": "VALUE", "id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/wallpaper_pack_purchase"
Activates the proxy for duration_hours (or hours or duration), with optional force, and on success adds user, user_wallet, and game.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"duration_hours": "VALUE", "hours": "VALUE", "duration": "VALUE", "force": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/proxy_activate"
Returns proxy activation state: active, proxy_active_until, seconds_remaining, proxy_level, and game.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/proxy_status"
On this shard stealth means Proxy level >= 20 while proxy is active. Turning on succeeds only then. Turning off fails with error proxy_bound; deactivate proxy instead. No separate stealth reserve. Response includes stealth: {on, proxy_level}.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"on": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/stealth_toggle"
Marks the reboot reveal seen and returns that result plus user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/mark_reveal_seen"
Same eligibility check as reboot_eligibility: eligible, can_reboot, level, reboot_tier, and loadouts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/reboot_check"
Checks reboot eligibility and returns eligible, can_reboot, level, reboot_tier, and loadouts.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/reboot_eligibility"
Runs a reboot from the posted loadout and returns that result.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/reboot_execute"
Returns the reboot leaderboard page (limit, offset) as entries, my_reboot_rank, and visible.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/reboot_leaderboard?limit=VALUE&offset=VALUE"
Returns whether the reboot leaderboard tab is visible (visible, leaderboard_visible, veteran_leaderboard_visible).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/reboot_leaderboard_visible"
Marks the reboot ceremony seen and returns that result plus user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/reboot_mark_ceremony_seen"
Sets the reboot badge and on success includes user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"badge": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/reboot_set_badge"
Claims an ad reward_type (or type) and on success includes user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"reward_type": "VALUE", "type": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/ad_reward_claim"
Returns ad-reward watches remaining as rewards (and no_cooldowns).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/ad_reward_status"
Claims daily mission slot and returns missions, reward, user, and user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"slot": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/daily_mission_claim"
Returns today's daily missions.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/daily_missions"
Legacy daily-claim stub that always fails and tells the caller to use daily_missions or user_streak (claimed false, reward 0).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/daily_reward"
Returns the login-streak state from get_streak_api.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_streak"
Claims the login streak if it is due and, when a reward is paid, adds user and user_wallet.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/user_streak_update"
Public liveness check before any player is required: returns success, maintenance, message, and private_server (this branch does not filter HTTP method).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/"
Play-session login only. The game gateway passes the signed-in account and gets api_key, auth_token, ci_session, user, user_software, user_wallet, credits, and overclocks. Script /v1 with no play session returns 401 script_auth and does not create a player or return a key.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"username": "VALUE", "email": "VALUE", "account": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/auth"
Signed-in copy of the maintenance flag (success, maintenance, message, private_server); handle() already answers this key before auth, so this branch never runs.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/check_server_maintenance"
Stub email-link check that returns linked false.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/email_auth_check"
No-op stub for OAuth and user_report (and non-POST auth); returns success, stub, and a null field named after the route key. This branch does not filter HTTP method.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/google_auth"
Returns success, api_key, header "X-Api-Key", base_path "/v1", and docs_path "/api-docs". Does not rotate. Empty key returns success false and error no_api_key.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_api_key"
New key is pk_ + 32 hex chars (secrets.token_hex(16)). Updates api_key only. Does not change session_token, so the browser stays signed in. Old key stops working.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/user_api_key_rotate"
HTML page of the same catalog, public, private game host only.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/api-docs"
Public, no key. Returns this catalog.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/api_docs"
Returns gameplay tuning as constants, also spread onto the top-level object.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/game_constants"
Returns monthly and quarterly leaderboard pages (page, limit) as curr_month_entries, prev_month_entries, quarterly_entries, and my_curr_rank.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/leaderboards?page=VALUE&limit=VALUE"
Returns how many players are on this server.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/users_count"
Returns the caller's stats dossier: profile, wallet, and career.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/player_stats"
Returns whether the first-login private welcome should show (show, seen, title, bullets).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/private_welcome"
Marks the private welcome seen and returns show false, seen true, and message.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/private_welcome_ack"
Stub that returns an empty push prefs object.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/push_prefs"
Stub that accepts a push-prefs update and returns success only.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/push_prefs_update"
Stub that accepts feedback and returns success and a thank-you message.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/send_feedback"
Resets the tip tour acknowledgement and returns tips.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/tips_reset"
Acknowledges the tip tour and returns tips.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/tips_seen"
Stub that accepts a Firebase token and returns success only.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/update_firebase_token"
Loads the signed-in profile; optional extras=1 adds user_device and user_network, and the payload always includes user, user_wallet, user_software, credits, overclocks, and game.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user?extras=VALUE"
Saves apps_layout or layout and returns apps_layout and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"apps_layout": "VALUE", "layout": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_apps_layout"
Acknowledges a language preference and echoes lang (not persisted).
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"lang": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_lang_pref"
Reads the caller's device log and returns user_log and log.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_log"
Writes or clears a device log: text on the caller, or victim_user_id plus text after a bypass, and returns user_log.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"victim_user_id": "VALUE", "text": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_log?victim_user_id=VALUE"
Reads the caller's notepad and returns text and notepad.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_notepad"
Saves notepad text and returns text.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_notepad"
Lists the caller's installed rootkits under rootkit, including defense_debuff.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_rootkit"
Lists the caller's installed siphons under siphon, with earning_rate_hr and total_siphoned.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_siphon"
Lists the caller's installed software as software, user_software, and user.software.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_software"
Lists the caller's installed spam viruses with earning_rate_hr and total_earnings under spam, plus botnet when relevant.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_spam"
Deletes an uploaded virus_id the caller owns and returns success.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"virus_id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_virus_uploaded_remove"
Lists viruses the caller owns or is infected by and returns viruses.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_viruses"
Lists viruses installed on the caller's own device as viruses.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/user_viruses_on_device"
Sets wallpaper_id (or wallpaper or id) and returns wallpaper_id, wallpaper, user, and unlocked.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"wallpaper_id": "VALUE", "wallpaper": "VALUE", "id": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/user_wallpaper"
Sets a new username and on success returns username, message, and user.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"username": "VALUE"}' \
-X POST \
"__ORIGIN__/v1/username_change"
Returns whether the caller can rename: can_change, cooldown_seconds, cost_credits, and first_change.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ "__ORIGIN__/v1/username_change_info"
Acknowledges the generic welcome flag and returns welcome_shown 1.
curl -s -H "X-Api-Key: pk_YOUR_KEY" \ -X POST \ "__ORIGIN__/v1/welcome_shown"