OmniGame API

Health

API: Up · 1s
Database: Connected · 285 ms
Checked: Fri, 16 Oct 2026 15:35:29 GMT

Machine-readable: GET /api/health (200 healthy, 503 degraded).

Conventions

JSON in and out. Send Content-Type: application/json with request bodies.
Errors are { "error": string, "details"?: object } with a matching HTTP status.
Room mutations are authorized by the x-gm-token header, the capability token returned once when the room is created.
Rate-limited endpoints return 429 with a Retry-After header (seconds).

System

GET/api/healthService health: API uptime and a database round-trip.

Responses

200 { status: "ok", version, uptimeSeconds, timestamp, database: { ok, latencyMs } }
503 same shape with status: "degraded" when the database is unreachable

Rooms

GET/api/roomsPublic lobby: up to 100 active, non-private rooms in waiting or playing status, newest first.

Responses

200 Room[] — Room = { id, campaignId, name, description, gmId, gmName, isActive, isPrivate, hasPassword, maxPlayers, currentPlayers, status, createdAt, lastActivity }

POST/api/roomsCreate a room. The response includes a one-time gmToken; store it, it is never shown again.

Rate limit

10 per minute per IP

Body

{ name (1–100), gmId, gmName?, description? (≤500), password? (4–200), isPrivate?, maxPlayers? (1–50, default 8) }

Responses

201 Room & { gmToken }
400 validation failed
403 GM id or IP is banned
429 too many requests

GET/api/rooms/:idFetch a single room by id (including private rooms).

Responses

200 Room
404 room not found

PATCH/api/rooms/:idUpdate room settings. Only the listed fields are accepted.

Auth

x-gm-token header (the gmToken returned on create)

Body

{ name?, description?, status? (waiting|playing|paused|finished), isActive?, isPrivate?, maxPlayers? }

Responses

200 Room
400 validation failed
401 missing token
403 invalid token
404 room not found

DELETE/api/rooms/:idDelete a room and its game saves.

Auth

x-gm-token header

Responses

204 deleted
401 missing token
403 invalid token
404 room not found

POST/api/rooms/:id/joinTake a seat. Verifies the password (if set) and capacity atomically.

Rate limit

10 per minute per IP per room

Body

{ password? }

Responses

200 Room
403 incorrect password, or IP is banned
404 room not found or closed
409 room is full
429 too many requests

POST/api/rooms/:id/leaveRelease a seat. Idempotent: never drops the player count below zero.

Responses

204 left

Assets

GET/api/tokensCharacter token images bundled with the API, with race and class inferred from file names and an optional rigged .glb model sharing the image's base name.

Responses

200 { tokens: { id, name, url, race?, klass?, modelUrl? }[] }