PHP API endpoint reference

Reference for the files delivered in Main_File. Documentation updated 22 September 2026. Examples use fictional IDs and balances; replace them with values from your installation.

Protocol, authentication and errors

Base URL is your configured public PHP origin/path, followed by /api/{controller}/{method}. For example https://api.example.com/api/room/index. Omit /index to call a controller's index method. Names below retain the case used by Flutter; the router normalizes routes to lowercase.

Use POST for every JSON API route below. Read operations also use POST. Send JSON with Content-Type: application/json or form data. Fields are body parameters, not query parameters. There is no REST PUT/PATCH/DELETE contract for these controllers. Some handlers do not reject other verbs, but that is not a supported integration contract.

Inspect the JSON code, not just HTTP status: the router returns HTTP 200 even when the body reports 400, 401, 403, 404 or 500. Success is code:200, err:null, msg:null, and endpoint-specific data. Empty data can become null. Error text may be localized by lang or Accept-Language. The room entry route also returns code 200 with data.state=bad_password or banned; check that state.

Header	When	Value
`API-KEY`	Send on every API request	Same value as backend API_KEY
`Auth-Token`	Mobile protected calls	Token from auth/index or auth/loginById; X-Auth-Token or Authorization: Bearer also accepted
`Admin-Token`	Admin protected calls	admin_token from admin/login; X-Admin-Token or admin cookie also accepted
`Content-Type`	JSON requests	`application/json`
`Accept-Language`	Optional	en or another supported language

Public client routes are auth/index, auth/loginById, helper/index and helper/config. admin/login needs admin credentials but no existing session. All other mobile calls should use a valid mobile token. An API key is an app identifier and is embedded in mobile builds; it is not an administrator credential. Implementation caveat: this router removes the api prefix before rechecking it, so its generic prefix-based authentication checks are not a reliable enforcement boundary. Individual controllers perform differing checks. These documented authentication requirements describe correct client use, not a security guarantee.

All calls can include optional lang:string and device_id:string. A device ID supplied with a mobile token must match its stored device. Do not pass the mobile token as body token to payment/pay: that field is the purchase receipt. Use Auth-Token there.

Field notation: ! means required for the intended operation; ? means optional with the stated default. An alternate identifier satisfies a required identifier. This is a client contract: legacy handlers do not validate every field. IDs in examples must be obtained from your own list responses. Nested objects in example responses are deliberately abbreviated projections; see the resource dictionary. These are source-derived examples, not recorded production responses.

curl -X POST "https://api.example.com/api/live/sendGift" \
  -H "API-KEY: YOUR_API_KEY" \
  -H "Auth-Token: YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"rid":7,"gift":1,"count":1,"toUsers":"43"}'

Resource dictionary

All timestamps stored as SQL date strings use UTC unless stated otherwise. SQL numeric values from uncast list rows can be strings; Flutter models accept them. Image resources are null or {"network":"https://…"}; avatars can also contain a frame.

Resource	Fields / interpretation
User	uid:int; name:string; pos,type,state,rule:int; avatar,bg,theme,entry,profile_frame:image\|null; comment,country:string; birthday,username,email,deviceId,fmcToken,created_at:string\|null; coins,diamond:int; dollar_earnings:number; total_points,gifter_points_total,anchor_points_total,recharge_points_total:int; followers_count,following_count,posts_count,gift_sent_count,gift_received_count,visiters_count,view_count,is_online,online_rid,banned:int; vip:VIP\|null; levels:map; medals:list; button:string; equipment fields and guild/room summaries. Retain original key spellings.
Room	id,uid,type,state,start,ts,usersCount,coin_number,total_points,isPassword,carizma,my_rule:int; title,created_at:string; bg,icon:image\|null; owner:User\|null; seats:Seat[]; red_box:Box[]; rocket_level:object\|null. Enter/start adds agora_channel:string, agora_uid:int, user_sw_token:string inside room.
Seat	pos:int (zero-based); score:int; isHost:bool; percentageSize:1; user:User\|null; mute,cam_state,state:int.
VIP	id,num,state,price,renewal_price,days,expire_at,active:int; expire_at is Unix seconds; icon,profile_frame,bg,entry_effect,name_entry_effect,frame,bubble,color:string; privileges:array of id/shop_item/icon/state/type/name. Package listing additionally includes ownership/remaining-time fields.
Level	lvl,nextLevelUp,progress,total:int; icon:string; user levels map contains consumption,gifter,charge,anchor.
Box	id,type,rid,liveuid,uid,coins,coins_remaining,people,people_claimed_count,usersCount,is_claimed,seconds,remaining_seconds:int; expired_at,created_at:string; user:User\|null; reward:int when claimed.
Message	id,chat_id,uid:int; content and uploaded media URL fields; state/target_state indicate local and recipient status; reactions:array; user:User. Read events identify messages with message_ids and state=2.
Store item	Catalog ID identifies what to buy; backpack inventory ID identifies what to equip. Item type follows store_items.type, with 0 frame and 2 entrance effect. Price, currency, duration and image/animation values come from the catalogue, not client input.
Raw management rows	admin/table returns database columns for the selected allowed table. Fields and edit permissions are listed in the management catalogue below. Do not expose admin responses or secret settings in a mobile UI.

Auth endpoints

POST /api/auth/index

Google account sign-in/registration

Headers: API-KEY; no prior session; Content-Type: application/json.

Request: provider:string! = google; googleid:string or email:string! (at least one); name:string?=''; auth_token:string?=''; device_id:string?=''; platform:string?=''

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "token": "SESSION_TOKEN",
    "web_token": "WEB_TOKEN",
    "appPrefix": "appchat",
    "socket_ip": "socket.example.com",
    "socket_port": 443,
    "coins": 0,
    "diamond": 0,
    "user": {
      "uid": 42,
      "name": "Demo"
    }
  }
}

Handler errors: unsupported_auth_provider. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/loginById

Headers: API-KEY; no prior session; Content-Type: application/json.

Request: id:string!; password:string!; device_id:string?=''; platform:string?=''

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "token": "SESSION_TOKEN",
    "web_token": "WEB_TOKEN",
    "appPrefix": "appchat",
    "socket_ip": "socket.example.com",
    "socket_port": 443,
    "coins": 0,
    "diamond": 0,
    "user": {
      "uid": 42,
      "name": "Demo"
    }
  }
}

Handler errors: login_error, login_required. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/tokenLogin

Refresh the authenticated session and Redis token mapping

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: device_id:string? (must match login device when supplied)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "token": "SESSION_TOKEN",
    "web_token": "WEB_TOKEN",
    "appPrefix": "appchat",
    "socket_ip": "socket.example.com",
    "socket_port": 443,
    "coins": 0,
    "diamond": 0,
    "user": {
      "uid": 42
    }
  }
}

Handler errors: invalid_token, user_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/update

Update the current profile and optionally password

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: name,avatar,bg,country,comment,birthday,username,profile_frame,entry,theme:string? (omitted fields unchanged; birthday YYYY-MM-DD); type:int?; new_password:string? (alias password, minimum 6 characters); old_password:string? (alias current_password, verified when supplied); confirm_password:string? (alias password_confirmation, must match when supplied)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "user": {
      "uid": 42,
      "name": "Demo"
    },
    "coins": 1000,
    "diamond": 0
  }
}

Handler errors: invalid_token, user_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/updateFcmToken

Set or clear push notification token

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: fcm_token:string?='' (alias fcmToken)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true
  }
}

Handler errors: invalid_token. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/logout

Revoke current mobile token

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "logout": true
  }
}

POST /api/auth/deleteAccount

Soft-delete current account and revoke tokens

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "deleted": true
  }
}

Handler errors: invalid_token. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/auth/changlanguage

Save language; spelling retained for compatibility

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: language:string?=en (alias lang)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true
  }
}

Helper endpoints

POST /api/helper/index

Alias of helper/config

Headers: API-KEY; no prior session; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "agora": "AGORA_APP_ID",
    "agora_token_ttl": 3600,
    "socket_ip": "socket.example.com",
    "socket_port": 443,
    "business": {}
  }
}

POST /api/helper/config

Fetch public client configuration

Headers: API-KEY; no prior session; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "agora": "AGORA_APP_ID",
    "agora_token_ttl": 3600,
    "socket_ip": "socket.example.com",
    "socket_port": 443,
    "business": {}
  }
}

POST /api/helper/getBanners

Read active banners

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "banners": []
  }
}

POST /api/helper/levels

Read level definitions

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: type:string?='' (empty all; consumption/gifter/charge/anchor); p:int?=1 (alias page); limit:int?=30 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/helper/globalUploadFile

Request an upload plan; does not upload bytes

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: extension:string?=jpg; filename:string? (default file_<timestamp>.<extension>); folder:string?=uploads

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "provider": "server",
    "path": "uploads/photo.jpg",
    "url": "https://example.com/server_upload.php/uploads/photo.jpg?expires=123&token=SIGNED",
    "upload_url": "https://example.com/server_upload.php/uploads/photo.jpg?expires=123&token=SIGNED",
    "headers": []
  }
}

User endpoints

POST /api/user/index

Fetch a profile; may record a profile visit

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int?=current user (aliases user_id,touid)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "user": {
      "uid": 42,
      "name": "Demo"
    },
    "profile": {
      "uid": 42,
      "name": "Demo"
    }
  }
}

Handler errors: user_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/user/search

Search users

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: search:string?=''; p:int?=1 (alias page); limit:int?=30 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/user/attention

Toggle following another user

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (aliases touid,user_id); cannot be current user

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "button": "follow",
    "following": false,
    "user": {
      "uid": 43
    }
  }
}

Handler errors: invalid_request. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/user/myMedals

List current user's medals

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "medals": []
  }
}

POST /api/user/useMedals

Equip one owned medal, clearing previous selection

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int?=0 (alias medal_id; 0 clears selection)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "user": {
      "uid": 42
    }
  }
}

POST /api/user/getProfileVisit

List profile visitors

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/user/getUsersAttention

List followers or following

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: state:string?=following (followers selects incoming follows)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

Room endpoints

POST /api/room/index

List/search rooms

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: p:int?=1 (alias page); limit:int?=50 (1–100); search:string?=''; followOnly:int?=0 (1 followed hosts)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "rooms": [],
    "list": []
  }
}

POST /api/room/createRoom

Create or return current user's room

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: title:string? (empty becomes Room <uid>); micLngs:int?=business.default_room_seats (fallback 9); type:int?=0; icon,bg:string?=''

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "room": {
      "id": 7,
      "uid": 42,
      "title": "Demo room",
      "seats": []
    }
  }
}

Handler errors: invalid_token. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/room/updateRoom

Update a managed room

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int! (alias id); title,bg,icon,password:string?; type,allow_messages,allow_mic,carizma:int?; omitted fields unchanged; password=delete removes password

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "room": {
      "id": 7,
      "title": "Demo room",
      "seats": []
    }
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/room/backgroundList

List room backgrounds

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: p:int?=1 (alias page); limit:int?=30 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/room/changeRoomSeatsLng

Set seat count for a managed room

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int! (alias id); micLngs:int?=9 (aliases lng,count; clamped 1–20)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "seats": []
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

Live endpoints

POST /api/live/startLive

Start current user's room; creates it on first call

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields; if no room exists first call returns createRoom response, then call again

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "room": {
      "id": 7,
      "agora_channel": "room_7",
      "agora_uid": 42,
      "user_sw_token": "AGORA_TOKEN"
    },
    "owner": {
      "uid": 42
    },
    "seats": [],
    "usersCount": 1,
    "coin_number": 0,
    "state": "ok"
  }
}

POST /api/live/enterRoom

Enter room and obtain Agora credentials

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; password:string?='' (required for password room unless manager)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "room": {
      "id": 7,
      "agora_channel": "room_7",
      "agora_uid": 42,
      "user_sw_token": "AGORA_TOKEN"
    },
    "owner": {
      "uid": 43
    },
    "seats": [],
    "usersCount": 2,
    "coin_number": 0,
    "state": "ok"
  }
}

Handler errors: room_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/leaveRoom

Leave room and release seat

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "left": true,
    "users_count": 1
  }
}

POST /api/live/giftList

Read gift groups and combo counts

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "gifts": [],
    "combo": [
      1,
      7,
      77,
      777,
      7777
    ]
  }
}

POST /api/live/giftBackpack

Read owned gifts

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "gifts": []
  }
}

POST /api/live/sendGift

Send a gift and debit balance/inventory

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; gift:int! (catalog gift ID); count:int?=1 (positive); toUsers:string! (comma-separated recipient IDs, e.g. 43,44); is_backpack:int?=0 (alias isBackpack, 1 uses inventory)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 990,
    "diamond": 0,
    "coinsBack": 0,
    "rocket": null
  }
}

Handler errors: invalid_count, invalid_request, not_enough_coins. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/seatTake

Take, request or leave a seat

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; seat:int?=0 (alias pos, zero-based); isUp:int?=0 (1 take; 0 leave); touid:int?=current user (alias uid; managing another user requires room manager)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "seats": []
  }
}

Handler errors: permission_denied, seat_busy, seat_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/seatRequestAccept

Accept/reject the pending request on a seat

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; seat:int?=0 (alias pos); accept:int?=9 (alias state; 0 rejects, nonzero accepts); manager required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "target": 43
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/seatState

Change seat availability

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; seat:int?=0 (alias pos); state:int?=0 (alias mute, clamped 0–2); seat occupant or manager authorization applies

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "seats": []
  }
}

POST /api/live/seatMic

Change microphone state

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; seat:int?=0 (alias pos); state:int?=0 (alias mute, clamped 0–2); 2 is manager-locked and only manager can unlock

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "seats": []
  }
}

POST /api/live/onlineUsers

List Redis room presence

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "users": [],
    "list": []
  }
}

POST /api/live/getMembersList

List room members by role or online users

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; rule:int? (alias role; absent delegates onlineUsers); p:int?=1 (alias page); limit:int?=50 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/live/sendMessage

Send room text through PHP then broadcast

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; msg:string?='' (display text); message:string?='' (alias content, separate legacy msg output). Send msg for the Flutter room UI

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "message": {
      "type": "normal",
      "text": "Hello",
      "msg": "",
      "person": {
        "uid": 42,
        "name": "Demo"
      }
    }
  }
}

Handler errors: muted. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/emojiList

List seat emojis

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/live/sendEmoji

Broadcast a seat emoji

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; seat:int?=0; name:string?='' (catalog emoji name)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "sent": true
  }
}

POST /api/live/clearChat

Clear displayed room chat for listeners

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; manager required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "cleared": true
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/clearRoomGifts

Reset room gift counters and notify listeners

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "cleared": true
  }
}

POST /api/live/userAction

Change target's room role

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int!; touid:int! (alias user_id); rule:int?=5 (alias role); hours:int?=0 (expiry stored only for roles 0,1,2); manager required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "uid": 43,
    "rule": 5,
    "expires_at": null
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/live/ranking

Compute ranking from transaction records

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: time:string?=daily (week/month supported); type:string?=gifter (anchor/rooms supported); rid:int?=0 (all rooms); limit:int?=50 (1–50); p:int?=1 (alias page)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

Livebox endpoints

POST /api/livebox/send

Create a timed room coin box

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: liveuid:int! (alias rid, room ID); coins:int!>0; people:int?=1; minutes:int?=10 (minimum 1); type:int?=1 (2 broadcasts across rooms)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "done": 1,
    "box": {
      "id": 5,
      "rid": 7,
      "coins": 100
    },
    "red": {
      "id": 5,
      "rid": 7,
      "coins": 100
    },
    "coins": 900
  }
}

Handler errors: not_enough_coins, room_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/livebox/use

Claim a box once eligible; coins in this response means remaining box coins

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: box_id:int! (alias id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "done": 1,
    "reward": 10,
    "coins": 90,
    "rid": 7,
    "people": 1
  }
}

Chat endpoints

POST /api/chat/index

List private conversations

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: p:int?=1 (alias page); limit:int?=20 (1–50)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "chats": [],
    "list": [],
    "page": 1,
    "limit": 20
  }
}

POST /api/chat/getMessages

Read a conversation and update read states

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: chat_id:int (alias id) or touid:int (aliases uid2,user_id), one required; p:int?=1 (alias page); limit:int?=20 (1–50)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "messages": [],
    "list": [],
    "chat_id": 8,
    "page": 1,
    "limit": 20
  }
}

Handler errors: invalid_chat. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/chat/sendMessage

Create a private message

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: chat_id:int or touid:int (aliases target_uid,user_id), one required; content:string?='' (alias message); image_url,video_url,voice_url:string?=''; provide text or uploaded media URL

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "isReadNow": false,
    "message": {
      "id": 10,
      "chat_id": 8,
      "uid": 42,
      "content": "Hello"
    },
    "chat_id": 8
  }
}

Handler errors: invalid_chat. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/chat/delete

Delete own message and update conversation preview

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (aliases msgID,messageID)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "deleted": true,
    "messageID": 10,
    "chat_id": 8,
    "last_message": {
      "id": 9,
      "chat_id": 8
    }
  }
}

POST /api/chat/addReaction

Add/remove reaction

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias message_id); emoji:string?=''; isDelete:int?=0 (alias delete, 1 removes)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "reactions": [],
    "chat": {
      "id": 10,
      "chat_id": 8
    }
  }
}

Handler errors: message_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/chat/openOnlineChat

Mark active conversation and acknowledge unread messages

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: chat_id:int (alias id) or touid:int (aliases uid2,user_id), one required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "opened": true,
    "chat_id": 8,
    "message_ids": [],
    "unread_count": 0
  }
}

Handler errors: invalid_chat. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/chat/closeOnlineChat

Clear active private conversation presence

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: chat_id:int?=0 (alias id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "closed": true,
    "chat_id": 8
  }
}

Post endpoints

POST /api/post/index

Read recent posts

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: touid:int?=0 (all users)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "posts": [],
    "list": []
  }
}

POST /api/post/add

Create a post

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: title,description,url:string?='' (provide meaningful content and an uploaded URL for media)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "post": {
      "id": 5,
      "uid": 42,
      "title": "Hello"
    }
  }
}

POST /api/post/like

Toggle a post like

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias post_id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "like": 1
  }
}

POST /api/post/getComments

Read comments

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias post_id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "comments": [],
    "list": []
  }
}

POST /api/post/comment

Add a comment

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias post_id); comment:string?='' (alias content)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "comment": {
      "id": 6,
      "post_id": 5,
      "uid": 42,
      "content": "Hello"
    }
  }
}

POST /api/post/commentLike

Toggle a comment like

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias comment_id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "like": 1
  }
}

POST /api/post/deleteComment

Soft-delete own comment

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "deleted": true
  }
}

Gift endpoints

POST /api/gift/index

Compatibility gift/sticker listing

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: type:string?=''

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "gifts": [],
    "coins": 1000
  }
}

Shop endpoints

POST /api/shop/index

Read available store items

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: type:int? (absent all types)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/shop/backpack

Read owned store inventory

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: type:int? (absent all types)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/shop/buying

Buy store item with coins

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias item_id); touid:int?=current user (alias to_uid, gift recipient)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 900,
    "item": {
      "id": 2,
      "name": "Frame"
    },
    "user": {
      "uid": 42
    }
  }
}

Handler errors: item_not_found, not_enough_coins. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/shop/activeItem

Equip or unequip inventory

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias inventory_id; use owned inventory ID, not catalog ID); active:int?=0 (1 equip)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "user": {
      "uid": 42
    }
  }
}

Handler errors: item_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/shop/sendFromBackpack

Compatibility stub: returns success without transferring an item

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No fields consumed; no inventory mutation implemented

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "sent": true
  }
}

POST /api/shop/vipList

Read packages and ownership

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "vip": []
  }
}

POST /api/shop/vipBuying

Buy VIP for self or another user

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int (alias vip_id) or num:int, one required; touid:int?=current user (alias to_uid)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 500,
    "vip": {
      "id": 1,
      "num": 1,
      "active": 1
    },
    "user": {
      "uid": 42
    }
  }
}

Handler errors: not_enough_coins. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/shop/vipChangeActive

Activate/deactivate an owned unexpired VIP

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int (alias vip_id) or num:int, one required; active:int?=1 (0 deactivate)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "user": {
      "uid": 42
    },
    "vip": null,
    "list": []
  }
}

Handler errors: auth_required, vip_not_found. See protocol for the error envelope; downstream/database errors can also occur.

Cash endpoints

POST /api/cash/index

Read wallet balances and exchange settings

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 1000,
    "diamond": 0,
    "votes": 0,
    "total": 0,
    "dollar": 0,
    "dollar_earnings": 0,
    "cash_min": 1,
    "cash_rate": 15000,
    "exchange_rate": 15000,
    "diamond_rate": 6,
    "cash_start": 1,
    "cash_end": 31,
    "cash_max_times": 10,
    "you_cash_count": 0,
    "types": [],
    "business": {}
  }
}

POST /api/cash/sendCoins

Convert earnings balance into coins for another user

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: to_uid:int! (aliases touid,uid; cannot be self); coins:int!>0 (alias amount)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 1000,
    "diamond": 0,
    "total": 0,
    "dollar": 0,
    "dollar_earnings": 0
  }
}

Handler errors: invalid_rate, no_user. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/cash/exchangeDiamond

Exchange diamonds to coins

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: diamond:int!>0 (alias amount)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "coins": 1006,
    "diamond": 0,
    "votes": 0,
    "total": 0,
    "dollar": 0,
    "dollar_earnings": 0
  }
}

Handler errors: not_enough_diamond. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/cash/add_request

Legacy withdrawal request handler; not a recharge purchase

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: amount:number!>0 (alias money); accountId:int?=0 (alias account_id); agency_id:int?=0 (alias agencyId); currency:string?=coins; note:string? (defaults account:<id> when account supplied)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "id": 12,
    "created": true,
    "coins": 1000,
    "diamond": 0,
    "dollar_earnings": 0
  }
}

Handler errors: invalid_amount, no_user. See protocol for the error envelope; downstream/database errors can also occur.

Legacy route present in the delivered source. This documents its existence, not a supported cash-redemption product flow. Do not describe this handler as a wallet recharge integration or assume it is disabled without checking the deployed code.

POST /api/cash/my_cash_accounts

List legacy payout accounts

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/cash/charge_agency

List active agencies

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/cash/cash_request_list

Read current user's legacy withdrawal requests

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/cash/add_cash_account

Create a legacy payout account

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: type,name,account:string?='' (provide all three for usable record)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "id": 1,
    "account": {
      "id": 1,
      "name": "Demo"
    }
  }
}

POST /api/cash/delete_cash_account

Delete own legacy payout account

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "deleted": true
  }
}

Payment endpoints

POST /api/payment/index

Read recharge products for the platform billing UI

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "packages": [],
    "plans": [],
    "recharge_open": 1
  }
}

POST /api/payment/pay

Verify platform purchase and credit once

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: provider:string?=google (alias type; apple for iOS); product_id:string! (alias android_product_id); token:string! (alias purchaseToken; Play purchase token or Apple receipt base64)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "id": 12,
    "order_id": "EXAMPLE_ORDER",
    "coins": 1100,
    "diamond": 0,
    "user": {
      "uid": 42
    }
  }
}

Handler errors: invalid_payment_order, invalid_request, no_charge_rule, repeated_charge. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/payment/userLog

Read current user's payment history

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

Guild endpoints

POST /api/guild/index

List agencies or read one agency and its statistics

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int?=0 (alias guild_id, 0 lists agencies); uid:int?=current user (membership lookup for single agency)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "guilds": []
  }
}

Handler errors: agency_not_found. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/guild/usersList

Read agency members

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias guild_id); p:int?=1 (alias page); limit:int?=50 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/guild/requestUsersList

Read agency join requests

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias guild_id); p:int?=1 (alias page); limit:int?=50 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/guild/rooms

Read agency rooms

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias guild_id); p:int?=1 (alias page); limit:int?=50 (1–100)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "rooms": [],
    "list": []
  }
}

POST /api/guild/search

Search agencies

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: search:string?='' (alias name)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/guild/addRequest

Request agency membership

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int! (alias guild_id)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "requested": true,
    "user": {
      "uid": 42
    }
  }
}

POST /api/guild/requestState

Update membership request

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: request_id:int (alias id) or touid:int (aliases uid,user_id) with guild_id:int (alias agency_id; absent resolves owned agency); state:int?=9 (9 accepts a request, 0 removes membership; other states recorded on the request)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true
  }
}

POST /api/guild/update

Update an agency owned by current user

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: id:int? (alias agency_id, absent resolves owned agency); name,notice,description,icon:string? (omitted unchanged)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "agency": {
      "id": 3,
      "name": "Demo agency"
    }
  }
}

Handler errors: permission_denied. See protocol for the error envelope; downstream/database errors can also occur.

Rocket endpoints

POST /api/rocket/index

Read Rocket tiers, current progress and reset countdown

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int?=0 (alias liveuid; room ID, fallback owner UID lookup)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "levels": [],
    "list": [],
    "myLevel": null,
    "rocket_level": null,
    "live": null,
    "sec": 3600
  }
}

POST /api/rocket/ranking

Read current day's Rocket contributors

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: rid:int?=0 (alias liveuid; 0 all rooms)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "sec": 3600
  }
}

Notification endpoints

POST /api/notification/index

Read notifications and mark returned personal records read

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: p:int?=1 (alias page); limit:int?=20 (1–50); type:string or array? (alias types; comma-separated string or actual array of supported notification types, not a JSON-encoded string)

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "page": 1,
    "limit": 20,
    "unread_count": 0
  }
}

POST /api/notification/settings

Read push preferences

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "settings": {
      "live_started": true,
      "new_follower": true,
      "post_interaction": true,
      "store_item_or_vip": true,
      "private_message": true
    }
  }
}

POST /api/notification/unreadCount

Read notification badge count

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "unread_count": 0
  }
}

POST /api/notification/updateSettings

Update push preferences

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: settings:object? (or JSON string or top-level fields); keys live_started,new_follower,post_interaction,store_item_or_vip,private_message; values 0/1 or boolean; omitted unchanged

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "settings": {
      "live_started": true,
      "new_follower": true,
      "post_interaction": true,
      "store_item_or_vip": true,
      "private_message": false
    }
  }
}

Media endpoints

POST /api/media/videoCreate

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: description:string?=''; url:string?='' (alias video); thum,gif:string?=''; multi_url:string?='[]' (JSON-encoded array); duration:number?=0; width,height:int?=0

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "video": {
      "id": 5,
      "uid": 42,
      "url": "https://example.com/video.mp4",
      "state": 1
    }
  }
}

POST /api/media/videoUploadPlan

Get upload locations for video variants and thumbnail

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No endpoint-specific fields; this does not transcode video

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "provider": "server",
    "qualities": [
      {
        "quality": "360p",
        "path": "videos/42/123/360p.mp4",
        "url": "https://example.com/server_upload.php/videos/42/123/360p.mp4?expires=123&token=SIGNED"
      }
    ],
    "thumbnail_path": "videos/42/123/thumb.jpg",
    "thumbnail_url": "https://example.com/server_upload.php/videos/42/123/thumb.jpg?expires=123&token=SIGNED",
    "headers": []
  }
}

Cp endpoints

POST /api/cp/ranking

Compatibility stub: empty result

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No fields consumed

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/cp/changeCpState

Compatibility stub: no relationship state changes

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No fields consumed

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true
  }
}

POST /api/cp/useCard

Compatibility stub: no card use implemented

Headers: API-KEY; Auth-Token; Content-Type: application/json.

Request: No fields consumed

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "used": true
  }
}

Admin endpoints

POST /api/admin/login

Create separate admin session

Headers: API-KEY; no prior session; Content-Type: application/json.

Request: email:string!; password:string!

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "admin": {
      "id": 2,
      "name": "Moderator",
      "email": "moderator@example.com",
      "roles": [],
      "permissions": [
        "dashboard.view"
      ]
    },
    "admin_token": "ADMIN_SESSION_TOKEN"
  }
}

Handler errors: invalid_admin_credentials. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/admin/logout

Revoke the cookie-backed admin session

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: No endpoint-specific fields; preserve session cookie from login

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "logout": true
  }
}

POST /api/admin/me

Read admin identity and permissions

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: No endpoint-specific fields; dashboard.view required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "admin": {
      "id": 2,
      "name": "Moderator",
      "permissions": [
        "dashboard.view"
      ]
    }
  }
}

POST /api/admin/index

Dashboard counters

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: No endpoint-specific fields; dashboard.view required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "users": 0,
    "rooms": 0,
    "active_rooms": 0,
    "vip_users": 0,
    "store_items": 0,
    "recent_transactions": [],
    "recent_reports": []
  }
}

POST /api/admin/table

Read an allowed management table

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: table:string!; p:int?=1 (alias page); limit:int? (table-specific default, max 200); see table catalogue for permission

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": [],
    "rows": [],
    "page": 1,
    "limit": 50
  }
}

Handler errors: invalid_table. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/admin/saveTable

Create/update an allowed management record

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: table:string!; id:int?=0 (0 inserts); permitted table fields only, listed below; table permission required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "id": 5,
    "saved": true
  }
}

Handler errors: empty_payload, invalid_inventory_item_type, invalid_level_type, invalid_rocket_reward_type, invalid_table, invalid_user_position. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/admin/deleteTable

Delete or disable an allowed record

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: table:string!; id:int!; table-specific permission required; agencies requires agencies.delete

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "deleted": true
  }
}

Handler errors: comment_not_found, invalid_table. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/admin/settings

Read application settings

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: No endpoint-specific fields; settings.view required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "list": []
  }
}

POST /api/admin/saveSetting

Save application setting

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: setting_key:string!; setting_value:string?=''; group_key:string?=app; is_secret:int?=0; settings.manage required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "saved": true
  }
}

Handler errors: invalid_image_storage_driver, method_not_allowed. See protocol for the error envelope; downstream/database errors can also occur.

POST /api/admin/rechargeState

Legacy withdrawal review despite the route name

Headers: API-KEY; admin session / Admin-Token; Content-Type: application/json.

Request: id:int!; status:int?=9 (valid 0,1,2,3,9); transactions.manage required

Example success response

{
  "code": 200,
  "msg": null,
  "err": null,
  "data": {
    "updated": true,
    "request": {
      "id": 12
    }
  }
}

Admin management field catalogue

For saveTable, fields omitted on update remain unchanged; insert records must satisfy database required columns and foreign keys. State accepts 0,1,2,3,9. Level type accepts consumption,gifter,charge,anchor; Rocket reward type accepts coins,gift,equipment,vip,diamonds; inventory item_type is store or gift. rooms_background maps to media_assets with type=room_bg. This table catalogue excludes legacy database-game configuration. GamePix categories and blocks are documented in the GamePix guide.

table	Write permission	Writable fields
`users`	`users.edit`	name, username, email, country, birthday, comment, avatar, type, pos, state, coins, diamond
`rooms`	`rooms.edit`	title, type, state, icon, bg, password, seat_count, is_live, allow_messages, allow_mic, carizma
`vip_packages`	`vip.manage`	num, state, icon, profile_frame, bg, entry_effect, name_entry_effect, frame, bubble, price, renewal_price, days, color, sort_order
`vip_privileges`	`vip.manage`	vip_id, shop_item, icon, state, type, name, sort_order
`store_items`	`store.manage`	name, img, animation, type, type_state, state, days, price, price_type, sort_order
`gifts`	`store.manage`	name, type, mark, coins, icon, anim, is_all_notify, is_cp, global_notify_lvl, state, sort_order
`user_inventory`	`store.manage`	uid, item_type, item_id, quantity, active, expires_at, state
`reports`	`reports.manage`	status, reason
`posts`	`posts.manage`	title, description, url, state
`comments`	`posts.manage`	content, state
`agencies`	`agencies.edit`	uid, name, icon, badge, notice, description, percentage, level, state
`agency_members`	`agencies.members.edit`	agency_id, uid, role, state
`banners`	`content.manage`	title, image, url, state, sort_order
`rooms_background`	`content.manage`	name, url, state, sort_order
`media_assets`	`content.manage`	type, name, url, state, sort_order
`emojis`	`content.manage`	name, icon, state, sort_order
`levels`	`content.manage`	type, lvl, points, icon, privileges
`medals`	`content.manage`	name, icon, time, target, target_type, target_id, type, sort_order, sort, lvl, level_id, state
`recharge_packages`	`content.manage`	android_product_id, ios_product_id, name, coins, diamonds, usd_price, state, sort_order
`rocket_levels`	`content.manage`	lvl, name, score, icon, global, anim, icon_anim, state
`rocket_rewards`	`content.manage`	level_id, lvl, title, reward_type, item_id, quantity, days, state

admin/table read permissions: users → users.view; rooms/room_members/room_seats → rooms.view; vip_packages/vip_privileges/user_vips → vip.view; store_items/user_inventory/gifts → store.view; agencies → agencies.view; agency_members/agency_requests → agencies.members.view; posts/comments → posts.view; reports/conversations/messages → reports.view; recharge_requests/wallet_transactions/payment_logs/gift_transactions → transactions.view; medals/levels/recharge_packages/rocket_levels/rocket_rewards/rooms_background → content.view; app_settings → settings.view; admin_roles/admin_permissions/admin_users → roles.view; admin_activity_logs → audit.view. A table writable by saveTable is not necessarily available via table.

Uploads and inherited compatibility routes

helper/globalUploadFile returns an upload plan. For server storage, PUT raw bytes to the exact signed upload_url; preserve its query string. Success is HTTP 200 with plain-text OK. Expired/invalid signatures return HTTP 403 with Invalid upload token. GET on the saved URL serves the file. Maximum upload size is 26,214,400 bytes (25 MiB); extensions: jpg,jpeg,png,gif,webp,svg,svga,mp4. For Bunny storage, the plan contains a relative upload path and AccessKey header; use the configured Bunny storage endpoint and display the CDN URL, never the storage key. This binary upload is separate from JSON controller POST requests.

Live, Livebox, Guild and Rocket inherit public Room methods. Gift inherits Live methods and its inherited Room methods. Their inherited createRoom/updateRoom/backgroundList/changeRoomSeatsLng (and index where not overridden) use the same contracts; Gift's inherited live actions follow the corresponding /api/live entries. Integrations should use the canonical /api/room and /api/live routes above. Constructors and internal helper methods are not API endpoints. GamePix configuration is documented separately in the GamePix API and setup guide; these 110 entries cover non-game controllers.

Reconciliation: after reconnect, re-read room, wallet, messages and inventory through PHP. Socket broadcasts are transient notifications, not transaction receipts. Never retry purchases or gifts blindly after an ambiguous timeout; inspect payment/userLog or transaction records first.