Wardogs Server Reference

Servers vary in what they enable. GET /v1/capabilities lists what a given one supports, so check there rather than assume.

Building with an AI assistant? Grab the copy-paste version for Claude or ChatGPT.

Requests go to the server's RCON host and port. The scheme depends on how the listener is bound:

// loopback listener (BindAddress=127.0.0.1) — plaintext allowed
http://<host>:<port>/v1/…

// network listener (BindAddress=0.0.0.0) — TLS required
https://<host>:<port>/v1/…

Any server you reach remotely is bound to the network, and a network-exposed RCON listener requires TLS (and a hashed password) to start. Plain HTTP is only for a loopback listener on the box itself. The default RCON port is 7776 (settable in config or with -RCONPort=).

Bodies and responses are JSON (Content-Type: application/json). The two config-document endpoints are the exception: they send and receive text/plain.

A browser page can call a TLS server directly. It can't call a plaintext loopback listener from an HTTPS page (mixed content is blocked), so for local/plaintext setups call from a server.

Send the RCON password as a bearer token on every request:

Authorization: Bearer <rcon-password>

There's no separate login step. To check a connection, call GET /v1/status; if it succeeds, the token is good.

Failures return a non-2xx status with a JSON body:

{ "error": { "code": string, "message": string } }

The config write endpoints return 412 when your revision is out of date (see Response shapes).

GET /v1/capabilities tells you which routes a server supports:

{ "routes": string[],   // e.g. "PATCH /v1/players/{id}"
  "config": { "writable": boolean } }

The admin panel uses exactly this: it shows "change team" only when PATCH /v1/players/{id} is in routes, and the config editor only when config.writable is true.

Call ISteamUser/GetPlayerSummaries with your own Steam Web API key, passing the steamId values from /v1/players. Batch them and cache the results, since names change rarely.

The admin panel does the same thing through a small proxy on its own host (GET /api/steam/profiles?ids=…, key in an X-Steam-Api-Key header, up to 32 ids per call, returning { "<steamId>": { name, avatar } }). That proxy isn't part of the game server API, so most tools just call Steam directly.

The RCON listener

This section decides whether, where, and how you can connect at all:

[/Script/WDRCON.WDRCONSettings]
bEnabled=true              // listener is OFF by default
BindAddress=127.0.0.1      // loopback = plaintext ok; 0.0.0.0 = all interfaces, needs TLS
Port=7776                 // default; or launch with -RCONPort=
Password=                 // plaintext; if empty, auto-generated to Saved/RCON/ADMIN-PASSWORD.txt
PasswordHash=""           // from `WardogsServer -GenerateRCONHash=`; wins over Password

A network-facing listener (0.0.0.0) will not start without a TLS cert and key, and uses PasswordHash. Loopback may use a plaintext Password. That is the whole auth model: the password (or the password behind the hash) is the bearer token.

Rotation entry format

+RotationEntries=(Map="Kavkazi",Experience="Bakurani_KOTH_01",Lighting="DayClear",ZoneAlternator="ZoneAlternator.Factory.Circle")
+RotationEntries=(Map="Europe",Experiences="Madrid_KOTH_01+KOTH_InfantryOnly",Lighting="DayLateGray")

Experience (singular) is one; Experiences (plural) joins several with +. ZoneAlternator is optional — omit it for the map's authored default.