RSM Web API

curl -H "Authorization: Bearer rsm_your_key_here" \
  http://your-server:3000/api/server/status

{
  "running": true,
  "pid": 4812,
  "startedAt": "2026-09-25T08:14:03.512Z",
  "rconConnected": true
}

curl -X POST -H "Authorization: Bearer rsm_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Server restart in 5 minutes"}' \
  http://your-server:3000/api/players/76561198000000000/kick

{ "error": "This API key needs manage access to players", "code": "FORBIDDEN" }

Whether the server process is running, its PID and start time, and whether RCON is connected.

Player count and FPS for the last hour, one point every few seconds.

Host CPU, memory and disk, the server process’s own CPU and memory, players and FPS for the last 24 hours, one point a minute.

Starts the server with its saved configuration.

Shuts the server down over RCON. If RCON isn’t connected, use kill.

Restarts the server after an in-game countdown.

Body countdown — seconds to warn players first (default 500)

Saves the world now.

Ends the server process immediately, without saving. Use only when stop does not work.

Runs a console command over RCON and returns its reply.

Body command — the command line, e.g. "status"

Renders a fresh map image for the live map. Takes up to 45 seconds; 409 while a render is already running.

Progress of the current or last install or update.

The installed Rust build and the latest one available.

Query branch — main (default) or staging

Installs or updates the server files with SteamCMD.

Body branch — main or staging; clean — true to validate every file

Stops a running install.

Clears a finished or failed install so a new one can start.

Server folder, refresh interval, CPU affinity and start-up options. The Steam and RustMaps API keys are only included for keys with settings manage.

Saves those settings.

Body serverPath (required), refreshInterval, steamApiKey, rustMapsApiKey, cpuAffinity (array of core numbers), startWithSystem, autoStartServer

Hostname, description, map, seed, world size, ports, max players and the rest. The RCON password is blank unless the key has config manage.

Changes any of those fields; send only the ones you want to change. Most take effect on the next restart.

A RustMaps preview for a procedural map. Needs a RustMaps API key in settings.

Query seed, size

Everyone connected right now.

Every player the server has seen, most recent first. Returns { total, players }.

Query search (name or Steam ID), online (true/false), limit (1–100, default 50), offset

Joins, leaves, deaths, kills, wounds, respawns and chat, newest first.

Query from, to (ISO dates), steamId, types (comma-separated: player_join, player_leave, player_death, player_wounded, player_respawn, player_chat, pve_kill), limit (1–500, default 200)

Kills, deaths and headshot counts for one player.

Fetches the player’s Steam profile and ban record again.

Kicks the player.

Body reason (optional)

Bans the player and records it in the ban history.

Body reason (optional), duration — minutes; 0 or omitted for permanent

Lifts the ban.

Mutes the player in chat.

Unmutes the player.

Moves a queued player to the front of the queue.

Teleports the player to another player. Both must be online and alive.

Body toSteamId

Sets the player’s in-game auth level.

Body level — 0 (none), 1 (moderator) or 2 (owner)

The ban history.

Query active — true for bans still in force

The server’s own ban list, read over RCON. While RCON is down, RSM Web’s ban records instead.

Just the Steam IDs that are banned right now.

One player’s ban history.

Searches the Rust item list.

Query search, limit (default 50)

Gives an item to an online player.

Body item — shortname such as rifle.ak; amount (default 1); skinId (default 0)

Saved loadouts.

Saves a loadout.

Body name, items — array of { shortname, name, amount, skinId }

Renames a loadout or replaces its items.

Deletes a loadout.

Gives every item in a loadout to an online player.

Every in-game team with its leader and members.

Removes a member from a team.

Body steamId

Makes a member the team leader.

Body steamId

Disbands the team.

Every clan with its roles, members and pending invites.

Removes a member from a clan.

Body steamId

Puts a member in one of the clan’s roles.

Body steamId, roleId

Withdraws an invitation.

Body steamId

Disbands the clan.

Chat messages, newest first.

Query steamId, search, channel (global, team, local, clan), from, to, limit (1–200, default 100), offset

Everyone who has said something, with a message count.

Kills, deaths, K/D and headshot percentage per player.

Query from, to, sort (kd default, kills, deaths, headshotPct), limit (1–500, default 100)

Reports, newest first. Returns { reports, total, open }.

Query status (open, in_progress, resolved, dismissed), kind (player, feedback), type (general, bug, cheat, abuse, idea, offensive, rules), targetId, limit, offset

One report.

The screenshot attached to a report, if it has one.

Changes a report’s status or note.

Body status, note

Deletes a report.

Which framework is installed and the state of any install in progress.

Installs a framework, or removes it.

Body framework — oxide, carbon or none; branch

Stops a running framework install.

Clears a finished or failed framework install.

The installed Oxide build and the latest release.

oxide.config.json.

Replaces oxide.config.json with the body.

Carbon’s built-in modules.

One Carbon module’s config.

Replaces that config with the body.

Installed plugins.

Query framework

Which installed plugins have a newer version.

Query framework

Searches uMod.

Query q, page, sort, tag

The most common uMod tags.

One uMod plugin’s details.

Searches Codefling.

Query q, sortBy

Codefling plugins the connected account owns.

Query q, sortBy

Whether a Codefling account is connected.

Installs a plugin from uMod or Codefling.

Body framework, source (umod or codefling), id, filename, version, and downloadUrl for uMod

Updates an installed plugin to its latest version.

Body framework, filename

Uploads a .cs plugin (multipart form, 10 MB max).

Form file, framework, source (umod, codefling or manual)

Removes a plugin.

Query framework

A plugin’s config file.

Query framework

Replaces a plugin’s config with the body.

Query framework

The scheduled wipe: when it runs and what it wipes.

Changes the schedule; send only the fields you want to change.

Checks that a backup folder can be written to.

Body path

Runs the scheduled wipe now. Returns the automation run id.

Past wipes.

Every automation that includes a wipe.

What happens on Facepunch’s monthly forced wipe.

Changes the forced-wipe options.

Map lists that wipes can pick the next map from.

Creates a map list.

Body name, mode (random or rotate), entries

Replaces a map list.

Deletes a map list. 409 while an automation still uses it.

Every automation, with its next run.

One automation.

That automation’s recent runs.

Upcoming scheduled runs across all automations that are switched on.

The triggers, conditions and actions available, and which actions this key may use.

Ready-made automations.

Creates an automation.

Body name, description, enabled, definition — the easiest way to get a valid definition is to build one in RSM Web and read it back with GET

Changes an automation. Send back the version you read; 409 if someone changed it since.

Switches an automation on or off.

Body enabled — true or false

Runs it now.

Puts a built-in automation back to its defaults.

Deletes an automation you made. Built-ins can only be switched off or reset.

The chat-command prefix and the tag in front of every Say.

Changes them.

Body chatPrefix, sayPrefix

Recent runs across every automation.

One run, step by step.

Cancels a run in progress.

Auto-update and auto-restart settings.

Changes them; send only the fields you want to change.

Everything automation has done to the server.

Query limit

Whether the bot is connected, and to which server.

The bot’s settings. The bot token is blank unless the key has discord manage.

Changes the bot’s settings; send only the fields you want to change.

Checks the bot token and connection.

Sets the bot’s avatar (multipart form: PNG, JPEG, GIF or WEBP).

Channels on the connected Discord server.

Members of the Discord server and the RSM group each one is in.

RSM groups a member can be put in.

Puts a Discord member in an RSM group, or takes them out.

Body groupId — a group id, or null

The two locations and whether each is available.

A folder’s contents.

Query root, path

A text file’s content, with modifiedAt and lineEnding. Refuses binary and very large files.

Query root, path

Follows a growing file (a log, say) as a stream of newline-delimited JSON: {"type":"append","text":"…"}, {"type":"reset"} when the file is truncated, and {"type":"ping"} to keep the connection open.

Query root, path

Prepares a download and returns a ticket. Fetch GET /api/files/download?ticket=… within a minute to get the file, or a zip when you selected several items or a folder. Each ticket works once.

Body root, paths — array of paths

Saves a text file.

Body root, path, content, and optionally expectedModifiedAt (the modifiedAt you read — 409 if the file changed since) and lineEnding (lf or crlf)

Uploads files into a folder (multipart form). An existing file is only replaced with overwrite=1.

Query root, path, overwrite

Creates an empty file.

Body root, path (the folder), name

Creates a folder.

Body root, path, name

Renames a file or folder.

Body root, path, name (the new name)

Copies or moves items into a folder, in either location.

Body sourceRoot, paths, destRoot, destPath, mode (copy or move), overwrite

Extracts a .zip into a folder named after it.

Body root, path, overwrite

Deletes files and folders.

Body root, paths

Every note page.

Creates a note.

Body title, category, content (Markdown)

Changes a note; send only the fields you want to change.

Deletes a note.

Dashboard views: the key creator’s own, plus public ones.

One view and its layout.

Creates a view owned by the key’s creator.

Body name, visibility (private or public)

Changes a view.

Body name, visibility, layout, sortOrder

Deletes a view.

The installed RSM Web version, the latest release, the state of any update in progress, and whether the Rust server is running.

The last lines of the most recent update’s log.

Query limit (1–50, default 20)

Checks for an update now.

Installs the update and restarts RSM Web. The Rust server must be stopped first (409 SERVER_RUNNING).

Goes back to the version before the last update.