Guide/Developers/REST API
REST API — Discord Bot Guide
The HTTP API the dashboard runs on: authentication, the main routes, limits and error shape, for your own integrations.
Quick answer
Read settings and flip strict mode
curl -H "Authorization: Bearer $TOKEN" https://api.example/guilds/123/security
curl -X PATCH -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
https://api.example/guilds/123/security -d '{"antinuke":{"strictPrivileged":true}}'Ask the guide
Step by step
The same API the dashboard uses is available to your tools. Base URL is your bot's API_PORT; keep it on a private network and put TLS in front if you expose it.
Authentication
| Token | Access |
|---|---|
Service token (API_TOKEN) | Every guild, every route. Server-to-server only; never ship it to a browser. |
Discord OAuth2 user access token (identify guilds) | Only guilds where that user has Manage Server, and only routes whose permission key that user holds (see Who can do what). |
curl -H "Authorization: Bearer $TOKEN" https://api.example/guilds/123/security
curl -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
-X PATCH https://api.example/guilds/123/security -d '{"antinuke":{"strictPrivileged":true}}'Routes
| Area | Routes |
|---|---|
Security | GET/PATCH /guilds/{id}/security · POST …/security/automod · GET/POST/DELETE …/security/webhooks · GET …/logs · POST …/logs/search · GET …/incidents · GET …/cases · GET/POST …/backups · POST …/backups/{id}/restore · GET/POST/DELETE …/whitelist · GET/POST …/permissions · GET/POST …/cohorts/{id} |
Configuration | GET/PATCH /guilds/{id}/settings/{section} · GET/PATCH …/features/{key} · GET …/commands · GET/POST/PATCH/DELETE …/command-overrides · GET/POST/PATCH/DELETE …/embeds · GET/POST/PATCH/DELETE …/counters (+ /test, /refresh) · GET …/ai/status |
Automation | GET/POST/PATCH/DELETE /guilds/{id}/autoresponders (+ /test) · …/variables · …/stickies · …/schedules (+ /run) · …/feeds |
Community | GET/PATCH /guilds/{id}/leveling · …/appeals · …/tickets/panels · …/giveaways · …/reactionroles · …/greetings/{event} · POST …/joindm/test · …/temporary-voice |
Lookups | GET /guilds/{id}/channels · GET …/roles · POST …/resolve (ids → names) · GET /me · GET /me/guilds · GET /openapi.json |
Writes are validated: unknown keys are dropped, wrong types and out-of-range ids get a 400 with a reason. Errors are { "error": "…", "code": "bad_request" | "forbidden" | "not_found" | "rate_limited" }. Requests are rate limited per token (60/min), bodies capped at 256 KB, page sizes at 200. The OpenAPI document at /openapi.json lists every route with schemas.
Copy and try
Read settings and flip strict mode
curl -H "Authorization: Bearer $TOKEN" https://api.example/guilds/123/security
curl -X PATCH -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
https://api.example/guilds/123/security -d '{"antinuke":{"strictPrivileged":true}}'Good to know
- 30 writes per minute per user; every write is audited in the guild log.
- A user token only reaches guilds where that user has Manage Server and holds the route's key.
Still stuck? Ask in the support server.