API Reference
The application provides several HTTP API endpoints. Most authenticated endpoints accept the standard
login cookie. Endpoints intended for the Foundry bridge module also accept an
Authorization: Bearer <token> header (token issued by POST /api/auth/foundry-login).
All endpoints are rate-limited; auth endpoints are per-IP rate-limited (5/min).
| Endpoint | Auth | Description |
|---|---|---|
GET /api/character/{"{id}"} |
User | Returns computed character data as JSON (ability modifiers, AC, skill bonuses, spell save DC, attacks, etc.) |
GET /api/character/{"{id}"}/render?templateId=N |
User | Renders character with a Liquid template (uses default template if no templateId specified). Returns HTML. |
GET /api/characters/{"{id}"}/export |
User | Downloads character as self-contained JSON file with resolved entity names |
GET /api/admin/export/database |
Admin | Downloads the complete SQLite database file |
GET /api/admin/export/characters |
Admin | Downloads all characters from all users as a single JSON array |
POST /api/characters/foundry-import?characterId=N |
User | Import FoundryVTT actor JSON to sync session state (HP, XP, currency, spell slots, items). Optional characterId targets a specific character when the file lacks flags.dndmanager (native FVTT exports). |
POST /api/auth/foundry-login |
Public (rate-limited) | Foundry bridge module login. Body: {"{"}username, password, label?{"}"}. Returns a 30-day bearer token on success. Honors Identity lockout. |
GET /api/auth/foundry-tokens |
User (cookie) | List your active Foundry bridge tokens (id, label, created, last used, expires). |
DELETE /api/auth/foundry-tokens/{"{id}"} |
User (cookie) | Revoke a Foundry bridge token. Idempotent. |
GET /api/auth/whoami |
User (cookie or bearer) | Returns the current user. Used by the Foundry module to verify a stored token. |
GET /api/manual/pdf |
Public | Download styled PDF user manual (unique icons each generation) |