Docs

API and webhooks

The Modhelm API for your own tools (/api/v1) and the Roblox right to erasure webhook.

API tokens

Create a token in Settings → Team & API. It starts with mh_ and is shown only once, so store it safely. Each server can have up to 20 active tokens, and each token has scopes:

Scope	Allows
`players:read`	Read players and reports
`players:erase`	Delete the data of a player

Send the token in the Authorization: Bearer header. Each token can make 120 requests per minute.

The API is meant for your own tools and websites. Your game servers do not need it, and a token never belongs into a Roblox game.

Endpoints

Method	Path	Description
GET	`/api/v1/players/{robloxUserId}`	Player overview: profile, reports, bans, notes, active ban
GET	`/api/v1/cases?status=open`	Reports of your server, filtered by `open`, `actioned`, `acquitted` or `all`
DELETE	`/api/v1/players/{robloxUserId}`	Delete everything your server stores about a player
GET	`/api/v1/health`	Status of the API

curl

# Player overview (profile, reports, bans, notes)
curl -H "Authorization: Bearer mh_your_token" \
  https://modhelm.com/api/v1/players/156

# Open reports of your server
curl -H "Authorization: Bearer mh_your_token" \
  "https://modhelm.com/api/v1/cases?status=open"

# Delete everything your server stores about a player
curl -X DELETE -H "Authorization: Bearer mh_your_token" \
  https://modhelm.com/api/v1/players/156

Errors come as JSON { "error": { "code", "message" } } with a matching HTTP status, for example 401 for a wrong token and 429 when the limit is reached.

Roblox right to erasure webhook

Each server has its own webhook URL and secret for the Roblox right to erasure notification (see Data protection). Modhelm checks the Roblox-Signature header with HMAC SHA-256, accepts only notifications that are at most 10 minutes old and ignores duplicates. Then it deletes the data of that player on your server.