All endpoints speak JSON over HTTPS with header-only authentication: X-Api-Token on every call, plus X-Game-Player-Token for player actions or X-Api-Private-Token for admin operations. The same contract backs every official SDK.
Two services back the API. The REST service (this host) is
the system of record: player accounts, rooms, matchmaking lobbies, leaderboards, friends,
JSON storage, moderation and bans. Every call is stateless — JSON in, JSON out, headers for
auth. The realtime relay
(realtime.michitai.com) is a separate
Node.js service for live in-room traffic: a WebSocket control lane for reliable ordered
messages plus a UDP datagram lane (MUR1) for high-frequency loss-tolerant state.
Flow: REST creates the room with realtime: true →
POST /api/realtime.php/token mints a
short-lived connection credential → the client opens the socket (and optionally binds UDP)
→ in-room traffic flows peer-to-peer through the relay while durable state still moves
through REST. Room membership and host rights are enforced server-side on both services.
This API is fully machine-readable: /openapi.json (OpenAPI 3.0), /llms-full.txt (complete reference), and an MCP endpoint at /mcp with read-only doc tools. Feed any of them to your assistant and it can write correct integration code.
Each endpoint family has its own page with request/response examples — pick a topic:
