Palworld REST API: the Complete Command Reference
Published 2026-07-26 · SameOS Tools
The Palworld dedicated server ships with a REST API (commands sent as web requests - callable from a browser, script, or anything else) that lets you control the server without joining the game. Announcements, kicks, world saves, graceful shutdowns - all of it goes through this channel. Our own server's automatic backups and browser admin page run entirely on top of it. This article is the whole command set in one table.
Enabling it
Add RESTAPIEnabled=True inside OptionSettings in PalWorldSettings.ini and restart the server; the API opens on port 8212 (changeable via RESTAPIPort). Authentication is HTTP Basic (the simplest scheme - username and password sent along with the request): the username is admin and the password is your AdminPassword setting.
One warning: never expose this port directly to the internet. A single password gates everything up to shutting the server down, and the official docs forbid public exposure. Call it from the same machine (127.0.0.1) or your home network only - if you need it from outside, put an authenticated server in between, like the admin page we built in Part 3.
All 12 endpoints
Every path hangs off http://server:8212/v1/api/. GET reads, POST acts.
| Method | Path | What it does | Body (JSON) |
|---|---|---|---|
| GET | /v1/api/info |
Server name & version | - |
| GET | /v1/api/players |
Online player list | - |
| GET | /v1/api/settings |
Read server settings | - |
| GET | /v1/api/metrics |
Health numbers (FPS, players, uptime) | - |
| GET | /v1/api/game-data |
World actor snapshot (recent addition) | - |
| POST | /v1/api/announce |
Broadcast a message | message |
| POST | /v1/api/kick |
Kick a player | userid, message |
| POST | /v1/api/ban |
Ban a player | userid, message |
| POST | /v1/api/unban |
Lift a ban | userid |
| POST | /v1/api/save |
Save the world | - |
| POST | /v1/api/shutdown |
Announced, saving shutdown | waittime, message |
| POST | /v1/api/stop |
Instant force stop (no save!) | - |
The userid is the steam_-prefixed value exactly as it appears in the players list. Always shut down with shutdown, not stop - stop cuts the process without saving, which recreates the lost-progress accident we covered in Part 2.
Try it now
# Broadcast (username admin, password = your AdminPassword)
curl -u admin:password -H "Content-Type: application/json" \
-d '{"message": "Server restarting in 10 minutes"}' \
http://127.0.0.1:8212/v1/api/announce
# Save, then shut down safely with a 60-second warning
curl -u admin:password -X POST http://127.0.0.1:8212/v1/api/save
curl -u admin:password -H "Content-Type: application/json" \
-d '{"waittime": 60, "message": "Restarting shortly"}' \
http://127.0.0.1:8212/v1/api/shutdownThose two calls (save, then announced shutdown) are also the heart of our automatic backups. Turning the API into browser buttons is Part 3; the things REST cannot do - settings editing and power-on - are Part 4.