API Reference
The application provides several HTTP API endpoints. Most authenticated endpoints accept the standard
login cookie. Endpoints intended for the Foundry bridge module also accept an
Authorization: Bearer <token> header (token issued by POST /api/auth/foundry-login).
All endpoints are rate-limited: API 30/min, admin 5/min, and auth endpoints 5/min per IP.
| Endpoint | Auth | Description |
|---|---|---|
GET /api/character/{"{id}"} |
User | Returns computed character data as JSON (ability modifiers, AC, skill bonuses, spell save DC, attacks, senses, etc.). Warlock pact slots are under spellcasting.pactMagic, not spellcasting.slots; a subclass's always-prepared spells appear in spells with alwaysPrepared: true. |
GET /api/character/{"{id}"}/render?templateId=N |
User | Renders character with a Liquid template (uses default template if no templateId specified). Returns HTML. |
GET /api/characters/{"{id}"}/export |
User | Downloads the character as a FoundryVTT-shaped actor JSON with resolved names |
GET /api/characters/{"{id}"}/foundry-export |
User | Downloads the FoundryVTT actor JSON, with the lossless manager snapshot embedded in flags.dndmanager |
GET /api/characters/{"{id}"}/pdf |
User | Downloads the printable PDF character sheet |
GET /api/characters/{"{id}"}/spell-cards?spellIds= |
User | Downloads printable spell cards (2×4 per page) for the listed spells |
GET /health |
Public | Health check |
GET /api/admin/export/database |
Admin | Downloads the complete SQLite database file |
GET /api/admin/export/characters |
Admin | Downloads all characters from all users as a single JSON array |
POST /api/characters/foundry-import?characterId=N |
User | Import FoundryVTT actor JSON to sync session state (HP, XP, currency, spell slots, items). Optional characterId targets a specific character when the file lacks flags.dndmanager (native FVTT exports). |
POST /api/auth/foundry-login |
Public (rate-limited) | Foundry bridge module login. Body: {"{"}username, password, label?{"}"}. Returns a 30-day bearer token on success. Honors Identity lockout. |
GET /api/auth/foundry-tokens |
User (cookie) | List your active Foundry bridge tokens (id, label, created, last used, expires). |
DELETE /api/auth/foundry-tokens/{"{id}"} |
User (cookie) | Revoke a Foundry bridge token. Idempotent. |
GET /api/auth/whoami |
User (cookie or bearer) | Returns the current user. Used by the Foundry module to verify a stored token. |
GET /api/manual/pdf |
Public | Download styled PDF user manual (unique icons each generation) |