Windrose Plus RCON Dashboard Guide
How to open the Windrose Plus web dashboard, what its two tabs contain, and the HTTP API behind them.
Opening the dashboard
Go to the WindRose Plus tab in your server panel. With Windrose Plus enabled you get a "Live Dashboard" row with an "Open Dashboard" link and, beside it, the port it is on and the words "TLS-proxied".
Click that link. It opens the dashboard through the platform’s own HTTPS front door, which checks you are signed in and that the server is yours before relaying to it.
You cannot reach the dashboard by typing an address and port into a browser. Its HTTP port — your base port + 80 — is firewalled to the host itself, deliberately, so a plain-HTTP admin console is never exposed to the internet. The proxied link in the panel is the only route.
The dashboard does not ask you for a password. It opens already signed in: the platform relays it from the game host itself, through the host agent, and the dashboard treats that relay as a caller who has already been authenticated — which you have been, before anything is relayed.
Your GameGrid account is the gate instead. Anyone signed in with access to that server can open the dashboard and read it — the status panel, the RCON log, the Sea Chart. Anything that changes something — running a command from the console tab, a kick or a ban, a configuration write — additionally needs the permission that lets you change that server’s settings, so a view-only account can watch the dashboard but cannot act from it.
The RCON password has not gone away. It is what Windrose Plus itself uses. A random 16-character one is generated when you first enable Windrose Plus and shown to you once, in the message that confirms the install, and you can reveal it later with the eye icon beside the RCON Password field. It is what anything reaching the dashboard directly on the game host, rather than through the panel link, logs in with.
What is on it
Two tabs: CONSOLE and SEA CHART.
The console tab is the admin console. Type a command and it runs against the game; there is autocomplete and a command reference panel you can expand, and the commands themselves are covered in Windrose Admin Commands Reference.
Beside the console it shows the server’s name, the Windrose version, the Windrose Plus version, the game port, the invite code, whether a password is set, the player count against the maximum, the live player list, and the seven multipliers Windrose Plus currently has applied.
There is also an RCON log — every command run through the dashboard, with a count — and a "Repair character save" tool for uploading a character save zip when one has gone bad.
The SEA CHART tab is the live map. See Windrose Plus Live Map (Sea Chart) Guide.
What is NOT on it, despite what you may have read: there is no CPU or memory graph, no configuration viewer and no mod manager. For CPU and memory use the Resource Usage card on your server’s Overview tab, which shows your game process’s own figures refreshed every 10 seconds. For configuration, use the Windrose Plus tab in the panel.
The RCON settings
Both live on the Windrose Plus tab, under RCON / Admin Console.
Enable RCON (default true): the dashboard’s command channel. Turn it off and the dashboard has nothing to run commands with.
RCON Password: the mod’s own admin password, not something the panel link asks you for. Type a new one and press "Save Changes" to replace it; the field shows "Password is set" rather than the value until you press the eye icon. Saving a new password is flagged as needing a server restart.
Anyone with this password has full admin control of your game server through the dashboard. Treat it like the admin password it is, and do not reuse your GameGrid password for it.
The HTTP API
The dashboard is a small HTTP server and its own endpoints are available to anything that can reach it. In practice that means a script running on the same machine, or a request through the platform’s authenticated proxy — the port itself is not open to the internet.
Everything except /api/health is authenticated. Through the panel link that is your GameGrid session: a read goes through if your account can view the server, and the endpoints that change something — POST /api/rcon, POST /api/character-repair — need the permission that lets you change server settings. A caller reaching the dashboard directly on the game host logs in with the RCON password instead, which sets a session cookie that lasts 24 hours.
GET /api/health — no authentication. Status, version and timestamp.
GET /api/status — server name, version, player list, multipliers.
GET /api/livemap — live player, creature and resource-node positions.
GET /api/pois, GET /api/layout, GET /api/layout/runtime, GET /api/runtime-overlay, GET /api/mapinfo, GET /api/terrain_height — the map’s overlays, layout and coordinate metadata.
GET /api/config — the current Windrose Plus configuration, with the RCON password masked.
GET /api/commands — the command documentation the console autocompletes from.
GET /api/pak-status — whether the override PAK matches the current settings.
GET /api/rcon/log — the recent command audit log. POST /api/rcon — run a command.
POST /api/character-repair — the character-save repair tool.
There is no /api/mods endpoint. Earlier versions of this article listed one; it does not exist.
The /api/public/* family and /public-map serve the public map and are gated by the public-map setting rather than by the cookie — see the live map guide for what that does and does not currently allow.
Security
The dashboard is not on the public internet. It is reached through the platform’s HTTPS proxy, which requires a signed-in GameGrid account with access to that server. That account is the gate: access to the server to open the dashboard and read it, and the permission to change the server’s settings to run anything from the console.
The auto-generated password is 16 characters from an alphabet that leaves out the easily-confused ones. If you set your own, make it at least as strong; the dashboard will refuse an empty one and the mod’s shipped default.
The RCON password is never shown in Discord. The /windrose commands refuse password fields on purpose, because a Discord slash command publishes its options to the channel.
Check /api/rcon/log, or the log panel in the console tab, if you want to see what has been run and when.