ServerAPI

First public release.

A REST API that lets websites, Discord bots and dashboards read live data from your Minecraft server. Every data category is its own endpoint, all served on one HTTP port, and the response is always JSON.

curl http://localhost:8080/api/v1/status

{
  "ok": true,
  "data": { "online": ["40094f2f-…"], "minecraft": 2, "discord": 3400 },
  "meta": { "version": "v1", "updatedAt": 1784300000000, "cachedAt": 1784299700000 }
}

What's in it

16 endpoints — status, player, server, performance, worlds, gamerules, entities, spawnlimits, punishments, bans, operators, whitelist, plugins, placeholders, network, constants. GET /api/v1 lists whichever ones you have enabled.

Requests never touch the main thread. Anything that is only safe to read on the main thread is snapshotted there on a timer; HTTP requests only ever read the cache, so traffic cannot drag down TPS.

Access control in three layers. Per endpoint, per field (hide op, banned and discord on an otherwise public /player), and a 404-instead-of-401 mode so a probe cannot tell that anything protected is there at all.

Rate limiting — token bucket, 120 requests per minute per IP with a burst of 30. Behind Cloudflare or Nginx it resolves the real client IP, and proxy headers are only trusted when the connection itself comes from a range you listed.

Punishments kept permanently — bans, IP bans, tempbans, kicks, warnings, mutes and jails stay in the history after they are lifted, with their status updated. Suits a public punishment lookup page.

Storage — SQLite, MySQL or MariaDB. Redis is optional: reads prefer it, and if it goes down the plugin falls back to the database without interruption and backfills on reconnect.

Multi-server — several servers share one Redis and database, separated by server-id. Servers on the same cluster-id find each other and /network aggregates the lot.

Fully bilingual — English and Traditional Chinese across config comments, console output, command replies and API responses. Switch at runtime with /serverapi lang en_US; your settings are preserved.

Optional integrations — LuckPerms, CMI, Vault, DiscordSRV and PlaceholderAPI, all soft dependencies. Missing ones simply leave their fields null.

No runtime dependencies — the HTTP layer is the JDK's built-in server and JSON is serialised in-house.

Before you expose it to the internet

• Change auth.api-key. It ships as change-me, and the plugin warns on every startup until you do.
• Check http.port. The default 8080 clashes with a lot of other software.
• Everything requires a key by default except the index, /status, /player and the docs page. /player additionally hides op, banned and discord.
• The whitelist and network endpoints are off by default.
• All three HTML pages — /api/docs, /punishments?view=html, /placeholders?list=true — are off by default. They lay their content out in full for anyone who can open them.

Requirements

Paper 26.1 and Java 21 or newer. Spigot and Bukkit cannot load this — it uses Paper's plugin loader and command APIs.

The first launch needs network access: Paper's plugin loader fetches the database drivers (HikariCP, the JDBC drivers, Jedis) from Maven. Later starts work offline.

Links

• Documentation — https://cloudxact.com/wiki/serverapi/
• Source and issues — https://github.com/Kevin28576/ServerAPI
• Discord — https://discord.gg/JyQPpVrhsk

Free for non-commercial use; commercial servers need a separate licence.