Palworld REST API Guide
What Palworld's REST API does on a GameGrid server, why you reach it through the Console tab rather than over the network, and the full endpoint list.
Why REST API
Pocketpair have deprecated RCON in favour of the REST API. The REST API uses HTTP Basic Auth, returns JSON, and does everything RCON does plus metrics and detailed player info.
On GameGrid it is also how the panel works. The live player count on your dashboard, the Dashboard tab of the Game Tools page and the Console tab all read this API.
On GameGrid It Is Already On - And Not Reachable From Outside
You do not enable it. The host agent force-enables the REST API on every start regardless of the RESTAPIEnabled switch in Settings, because the panel needs it. Turning that switch off does not turn the API off.
It listens on your server's allocated port + 2, bound to 127.0.0.1 only, with no firewall rule. That is deliberate: this API grants full control of a server to anyone holding its credential, and Pocketpair themselves warn against exposing it.
So there is nothing to connect to from your own machine. You cannot curl it from your laptop, and neither can anyone else.
The agent also writes an Administrator Password of its own if you have left that field blank, so the panel can authenticate. Set your own in Settings if you want to know what it is.
The way to USE the API on GameGrid is the Console tab, which sends the calls for you over the host's own loopback. See below.
If you are self-hosting rather than on GameGrid, set RESTAPIEnabled=True and an AdminPassword, restart, and reach the API over a VPN or an SSH tunnel - never by opening the port.
Using It From the Console Tab
The Console tab accepts a short list of commands and turns each one into the matching REST call. Type them WITHOUT a leading slash - "ShowPlayers", not "/ShowPlayers".
ShowPlayers (also "list" or "players") - the online players with their ids and ping.
Info (also "serverinfo") - server name, version, world GUID and description.
Metrics (also "stats" or "performance") - FPS, frame time, player count, uptime, in-game days and base camp count.
Settings (also "config") - the server's current settings as the server sees them.
Save - forces a world save.
Broadcast <message> (also "announce") - sends a message to everyone in game.
KickPlayer <id>, BanPlayer <id>, UnBanPlayer <id> - the player actions.
Shutdown - a graceful shutdown with a ten-second countdown.
Help (also "?" or "commands") - prints this list on the server.
Anything else is passed to the server's standard input as a fallback, which on the headless build produces no readable output. If a command returns nothing, that is why - it is not in the list above.
Authentication
The REST API uses HTTP Basic Auth. Username: admin. Password: the Administrator Password from Settings.
On GameGrid the Console tab handles this for you and there is no header for you to build.
For a self-hosted server, every request needs an Authorization header - e.g. Authorization: Basic YWRtaW46WW91clBhc3N3b3Jk, the base64 of admin:YourPassword.
API Endpoints
Base URL on a self-hosted server: http://127.0.0.1:<RESTAPIPort>/v1/api. On GameGrid this is loopback on the host and is not reachable from your machine at all.
GET /info - Server info: version, name, world GUID.
GET /settings - Current server settings.
GET /metrics - Server metrics: FPS, frame time, player count, uptime, days, base camp count.
GET /players - All connected players: name, ID, IP, ping, level, location.
GET /game-data - the GameData API world snapshot: Pals, base camps and guilds. Requires the -enable-gamedata-api launch flag, which GameGrid passes on every start. This is what feeds the Pals and base camps on the Live Map.
POST /kick - Kick a player. Body: {"userid": "player_id", "message": "reason"}.
POST /ban - Ban a player. Body: {"userid": "player_id", "message": "reason"}.
POST /unban - Unban a player. Body: {"userid": "player_id"}.
POST /announce - Broadcast a message. Body: {"message": "your text"}.
POST /save - Force save the world.
POST /shutdown - Graceful shutdown. Body: {"waittime": 60, "message": "Restarting"}.
POST /stop - Force immediate stop. The platform never uses this one; stopping a server from the panel goes through the graceful path.
Example Usage
On GameGrid, use the Console tab. Type Broadcast Server restarting in 5 minutes, or KickPlayer steam_76561198012345678, or Metrics - no curl, no scripts, no exposed port.
The curl examples below are for a SELF-HOSTED server reached over a tunnel. They will not work against a GameGrid server, because nothing outside the host can reach the port.
Broadcast a message: curl -X POST -u admin:YourPassword -H "Content-Type: application/json" -d '{"message": "Server restarting in 5 minutes"}' http://127.0.0.1:8212/v1/api/announce
Kick a player: curl -X POST -u admin:YourPassword -H "Content-Type: application/json" -d '{"userid": "steam_76561198012345678", "message": "AFK too long"}' http://127.0.0.1:8212/v1/api/kick
Get server metrics: curl -u admin:YourPassword http://127.0.0.1:8212/v1/api/metrics
If you want to drive your own GameGrid server programmatically, the Customer API is the supported route - not this one.