Developer

Developer

Health checks, bot information, shards, website integration, OAuth2, and webhooks.

This page is for operators and developers integrating with Oxy Controller. HTTP routes listed here exist only if the current installation exposes them. Never embed bot tokens, Oxford server keys, OAuth client secrets, or API secrets in a website.

  • /healthBot health from Discord.
  • /pingCheck that Oxy is responding.
  • /aboutBot information.
  • /websiteLink to the public site.

API authentication

If your installation protects operator routes, send a token your operator issued. A common pattern is an Authorization bearer header. The exact scheme is installation-specific. Use a placeholder in examples; rotate anything that leaks.

cURL — placeholder token
curl -sS https://oxcontroller.app/v1/bot/info \
  -H "Authorization: Bearer YOUR_TOKEN_HERE"
JavaScript — placeholder token
const res = await fetch("https://oxcontroller.app/v1/bot/info", {
  headers: { Authorization: "Bearer YOUR_TOKEN_HERE" },
});
const data = await res.json();

Health checks

From Discord, run /health or /ping. From HTTP, GET /v1/health if enabled. Oxford’s own health is a different service: GET https://api.oxfd.re/v1/health.

Bot status

GET /v1/status, where enabled, is an aggregated snapshot. The public Status page on this site is a placeholder unless a status backend is wired. Do not treat the page as a live probe.

Shard information

GET /v1/bot/shards, where enabled, lists Discord gateway shards. A single-process bot may report one shard. Use this when diagnosing disconnects, not as a player-facing statistic.

Bot information

/about in Discord, and GET /v1/bot/info where enabled, expose version and identity fields the installation chooses to publish. They must not include tokens.

Template API

GET /v1/website/templates and GET /v1/website/templates/:slug feed the template platform and this website. Private templates must not be returned to unauthorised callers. See the API reference for example bodies.

Website integration

GET /v1/website/features can drive the feature catalogue. If the route is absent, this site uses its local catalogue instead. Either way, the frontend never receives secrets.

OAuth2 architecture

The Discord invite is an OAuth2 authorization URL with bot and applications.commands scopes. The application ID is public; the client secret and bot token are not. Template-platform login, if any, is a separate flow owned by that product and is not re-specified here.

Webhooks

Outbound webhooks are documented only where the installation supports them. If /settings does not mention a webhook URL, do not assume Oxy will POST events to your server. When webhooks exist, verify signatures if the implementation provides them, and never log raw secret headers.