API Reference
REST API v1.1
All endpoints accept and return JSON. Errors return a stable code field — see the error reference.
Initialize
POST
/api/v1.1/initOpens a session for your application using the owner ID and app secret.
Request body
| Field | Type | Description |
|---|---|---|
| owner_id | string | Your Atheryx owner ID. |
| app_name | string | The application name from your dashboard. |
| version | string | Client version string. |
| secret | string | Application secret (App Settings → Secrets). |
| hash | string (opt) | Client build hash for tamper checks. |
| hwid | string (opt) | Hardware ID to bind to the session. |
Sessions expire after 7 days of active use or 72 hours of inactivity.
Login
POST
/api/v1.1/loginAuthenticates a user with credentials. Password verified with bcrypt.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| username | string | Account username. |
| password | string | Account password (never stored in plaintext). |
| hwid | string (opt) | Hardware ID; must match the account's bound HWID if one exists. |
| ip | string (opt) | Client IP for audit logging. |
Returns a short-lived token plus the user's roles, tags, and licenses.
Register
POST
/api/v1.1/registerRegisters a new user against an existing, unused license key.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| username | string | Desired username (must be unique). |
| password | string | Desired password, hashed with bcrypt (cost 12). |
| key | string | A valid, unused license key for this app. |
| string (opt) | User email. | |
| hwid | string (opt) | Hardware ID to bind at registration. |
The license key is marked as used and bound to the new user.
Validate License
POST
/api/v1.1/licensesActivates or validates a license key and binds the caller's HWID.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| license_key | string | The license key to validate. |
| hwid | string (opt) | Hardware ID; must match the license's bound HWID if set. |
| ip | string (opt) | Client IP for audit logging. |
Expired licenses are marked EXPIRED; returning clients get LIC_EXPIRED until renewed.
Refresh Session
POST
/api/v1.1/session/refreshRotates the session token using a refresh token, extending active life.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Current session token. |
| refresh_token | string | Refresh token issued at login/init. |
Use this to keep long-running clients alive past inactivity limits.
Read Variable
POST
/api/v1.1/variablesFetches a server-side variable by key for feature flags or remote config.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| var_key | string | Variable key to read. |
Variables are per-application and updated from the dashboard.
Set Variable
POST
/api/v1.1/variables/setWrites a server-side variable value (e.g. remote config updates).
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| var_key | string | Variable key to write. |
| var_value | string | New variable value. |
Values are sanitized and limited to 5000 characters.
Report Logs
POST
/api/v1.1/logsSends client-side log events to your application's activity feed.
Request body
| Field | Type | Description |
|---|---|---|
| session_id | string | Session token from /init. |
| event | string | Log message or event name. |
Sanitized server-side; check the dashboard under App → Logs.
Want language examples?
See the guides for C++, C#, and JavaScript.