Public API v1

Rate limits are per IP. Reports from the public API are filed as Anonymous unless submitted through the RaiderRep website while logged in. Optional header: X-App-Name: YourApp for attribution in logs.

Quick start

// Look up trust score
fetch('https://www.raiderrep.com/api/v1/player/RAIDER-1234')
  .then(r => r.json())
  .then(console.log);

// List incident types
fetch('https://www.raiderrep.com/api/v1/types')
  .then(r => r.json())
  .then(console.log);

// Submit a report
fetch('https://www.raiderrep.com/api/v1/report', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-App-Name': 'MyApp' },
  body: JSON.stringify({
    targetName: 'RAIDER#1234',
    type: 'Toxic',
    description: 'What happened…',
    captchaToken: '…', // required when Turnstile is enabled
  }),
}).then(r => r.json()).then(console.log);

GET /api/v1/player/[id] — Trust score lookup

60 requests/minute per IP. Use hyphen format in the URL: NAME-1234

GET https://www.raiderrep.com/api/v1/player/RAIDER-1234

{
  "embarkId": "RAIDER#1234",
  "optedOut": false,
  "trustScore": 115,
  "badge": { "label": "RELIABLE OPERATIVE", "color": "#4ade80" },
  "reportCount": 3,
  "vouchCount": 2,
  "lastReportAt": "2026-04-01T12:00:00Z",
  "incidentSummary": [
    { "type": "Friendly Raider", "count": 2 },
    { "type": "Toxic", "count": 1 }
  ],
  "formula": "100 + sum(report points) + (vouches × 2)",
  "profileUrl": "https://www.raiderrep.com/player/RAIDER-1234"
}

GET /api/v1/types — Incident types

30 requests/minute per IP. Returns all report types with point values.

GET https://www.raiderrep.com/api/v1/types

POST /api/v1/report — Submit a report

10 reports/hour per IP. Same validation as the RaiderRep website.

POST https://www.raiderrep.com/api/v1/report
Content-Type: application/json

{
  "targetName": "RAIDER#1234",
  "type": "Toxic",
  "description": "Required. Max 2000 characters.",
  "videoLink": "https://…",
  "captchaToken": "…"
}

{
  "success": true,
  "targetName": "RAIDER#1234",
  "type": "Toxic",
  "points": -10,
  "trustScoreAfter": 90,
  "reportId": null
}

CAPTCHA: When Turnstile is enabled on RaiderRep, captchaToken is required. Embed the Cloudflare Turnstile widget in your UI and pass the token on submit. Server-only bots cannot submit reports while CAPTCHA is active.

Opt-out: Players who opted out return 403 on submit and optedOut: true on lookup.

CORS: Browser apps on other domains can call /api/v1/* directly. Native apps and server-side bots do not need CORS.