Wardogs Server Reference

Servers vary in what they enable, and in what build they run. GET /v1/capabilities lists the routes a given one actually serves, so check there rather than assume.

Changed 2026-09-14 (build ++Wardogs+Live-CL-501228): eight write endpoints were removed. Reserved slots, rotation editing, the score period and the sponsor banner are now edits to the config document instead. They are still listed below, marked removed, because plenty of servers are on older builds.

Building with an AI assistant? Grab the copy-paste version for Claude or ChatGPT.

Requests go to the server's RCON host and port, over plain HTTP:

http://<host>:<port>/v1/…

There is no TLS on the RCON listener. An earlier version of this page said a network-bound listener required a certificate; that is wrong, and we have corrected it — the official console hard-codes http://, and a live server confirms it: HTTP answers, HTTPS refuses the connection outright. The default port is 7776 (settable in config or with -RCONPort=).

So the password crosses the wire in the clear. Treat the port as something to keep off the internet: bind it to loopback and reach it through a VPN or an SSH tunnel, or put a reverse proxy that does terminate TLS in front of it. Anyone who can read the traffic has full control of the server.

Bodies and responses are JSON (Content-Type: application/json). The two config-document endpoints are the exception: they send and receive text/plain.

A browser page served over HTTPS cannot call a plain-HTTP server at all — mixed content is blocked — which is why the official console is itself served over HTTP, and why anything you build should make the call from a server rather than the page.

Send the RCON password as a bearer token on every request:

Authorization: Bearer <rcon-password>

There's no separate login step. To check a connection, call GET /v1/status; if it succeeds, the token is good.

Failures return a non-2xx status with a JSON body:

{ "error": { "code": string, "message": string } }

The config write endpoints return 412 when your revision is out of date (see Response shapes).

GET /v1/capabilities tells you which routes a server supports:

{ "routes": string[],   // e.g. "PATCH /v1/players/{id}"
  "config": { "writable": boolean } }

The admin panel uses exactly this: it shows "change team" only when PATCH /v1/players/{id} is in routes, and the config editor only when config.writable is true.

Call ISteamUser/GetPlayerSummaries with your own Steam Web API key, passing the steamId values from /v1/players. Batch them and cache the results, since profile names change rarely.

The admin panel does the same thing through a small proxy on its own host (GET /api/steam/profiles?ids=…, key in an X-Steam-Api-Key header, up to 32 ids per call, returning { "<steamId>": { name, avatar } }). That proxy isn't part of the game server API, so most tools just call Steam directly.

Editing it over the API

Since the 2026-09-14 build this file is the write API for reserved slots, the rotation, the score period and the sponsor banner. Three things to know before you write to it:

1. PUT /v1/config replaces the whole document. Sections you leave out are removed, not left alone — a validate of a one-section fragment reports every other section as going away. Always GET /v1/config, edit that exact text, and send it back.

2. The leading punctuation on array keys is Unreal's config operators, not decoration. A live document looks like this:

[/Script/WDGame.WDServerMapRotationSettings]
!RotationEntries=ClearArray          // empty the array the game already has
.RotationEntries=(Map="Kavkazi")     // then append this entry

!Key=ClearArray is an instruction, not a member of the array. Count it as one and every rotation index you compute is off by one.

3. Every value is revalidated on every apply, including ones you did not touch. One stale value — a sponsor URL whose host has since dropped off the server's ImageURLWhitelist, say — fails the whole write with 422 and nothing is applied, blocking edits to unrelated keys until it is fixed. The response's errors[] names the section and key, so show it rather than a status code.

Send the revision you read as If-Match: "<revision>" so two admins editing at once get a conflict instead of one quietly overwriting the other, and dry-run with POST /v1/config/validate, which runs the same validation and writes nothing.

The RCON listener

This section decides whether, where, and how you can connect at all:

[/Script/WDRCON.WDRCONSettings]
bEnabled=true              // listener is OFF by default
BindAddress=127.0.0.1      // loopback; 0.0.0.0 = every interface
Port=7776                 // default; or launch with -RCONPort=
Password=                 // plaintext; if empty, auto-generated to Saved/RCON/ADMIN-PASSWORD.txt
PasswordHash=""           // from `WardogsServer -GenerateRCONHash=`; wins over Password

That is the whole auth model: the password — or the password behind PasswordHash — is the bearer token, and it authorizes everything. There is no per-key permission and no second factor.

The listener serves plain HTTP either way, so binding it to 0.0.0.0 puts a full-access password on the wire in clear text. Leave it on 127.0.0.1 and reach it through a tunnel, a VPN, or a TLS-terminating proxy.

Rotation entry format

+RotationEntries=(Map="Kavkazi",Experience="Bakurani_KOTH_01",Lighting="DayClear",ZoneAlternator="ZoneAlternator.Factory.Circle")
+RotationEntries=(Map="Europe",Experiences="Madrid_KOTH_01+KOTH_InfantryOnly",Lighting="DayLateGray")

Experience (singular) is one; Experiences (plural) joins several with +. ZoneAlternator is optional — omit it for the map's authored default.