Infinite Assassin

Mission Store API

Identity, mission storage, versioning and discovery. REST/JSON over HTTPS, bearer access tokens, optimistic concurrency on every save, and an OpenAPI 3.1 contract the Godot client can generate against.

Interactive docsopenapi.jsonHealth

Base URL

https://<host>/api/public/v1

The hosting platform reserves /api/public/* for unauthenticated external callers, so the spec's /v1/... paths are served under that prefix. Health lives at /api/public/health.

Endpoints

  • POST/auth/registerCreate an account (username + email + password)
  • POST/auth/loginSign in, returns access + refresh tokens
  • POST/auth/refreshRotate the refresh token
  • POST/auth/logoutRevoke the session
  • GET/meCurrent user profile
  • GET/me/missionsMy Missions (summaries, no mission_data)
  • POST/missionsCreate a mission
  • GET/missionsBrowse public missions
  • GET/missions/searchSearch public missions
  • GET/missions/{id}Retrieve a mission with mission_data
  • PUT/missions/{id}Save/update with revision concurrency
  • DELETE/missions/{id}Soft delete (owner only)
  • PATCH/missions/{id}/visibilityPublish / unpublish
  • POST/missions/{id}/playsRecord a play start
  • POST/missions/{id}/completionsRecord a completion
  • POST/missions/{id}/downloadsRecord a download and return the mission package
  • GET/missions/sharedMissions shared with you for collaboration
  • GET/missions/{id}/collaboratorsList collaborators (owner only)
  • POST/missions/{id}/collaboratorsInvite an editor (owner only)
  • DELETE/missions/{id}/collaborators/{user_id}Revoke collaborator access (owner only)
  • GET/users/searchFind accounts to invite
  • PUT/missions/{id}/favouriteFavourite (DELETE to remove)
  • PUT/missions/{id}/ratingRate 1-5 (DELETE to remove)
  • GET/users/{username}/missionsPublic missions by author
  • GET/configClient bootstrap limits and versions

Concurrency

Saves carry the mission revision (body field or If-Match). A stale revision returns 409 MISSION_REVISION_CONFLICT with the current revision — autosave never silently overwrites another machine.

Privacy

Private missions 404 for everyone but their owner, are excluded at the query level from browse and search, and no endpoint can enumerate another player's private library.

Mission data

mission_data stays opaque. The cloud owns metadata, ownership, revisions and publication; the game owns gameplay. Envelope validation is strict, mission sanity checks are deliberately loose (1 MB, depth, finite numbers, no prototype keys).

Idempotency

Creation and telemetry endpoints accept Idempotency-Key; retries replay the original response instead of creating duplicates.