Skip to content
RSXDocs
RSX · API · Reference

access v1

Controls who may install RSX applications and integrations, such as Roxy into a Discord server, and keeps the record of every decision.

Current
Base URL
https://api.rsx.group/access/v1
Self-grantable scopes
None. Every endpoint here needs a key issued by a platform admin.
Machine readable
openapi.json
01

admin

6 operations under /access/v1/admin.

GET/access/v1/admin/applications/list

List every registered application, with its install policy

Scope
access:admin:applications:list Admin-issued keys only.

Response 200Applications

Response of adminListApplications

  • datarequired
    Type
    array of AccessAdminApplication
    Description
  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • discordrequired
    Type
    AccessAdminDiscordView
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404Not called over the dashboard's service binding, or no such record

Example

curl
curl "https://api.rsx.group/access/v1/admin/applications/list" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": [
    {
      "id": "roxy",
      "name": "Roxy",
      "description": "The RSX Discord bot.",
      "environment": "production",
      "enabled": true,
      "installationTypes": [
        "discord_guild",
        "discord_user"
      ],
      "createdAt": "2026-10-10T12:00:00.000Z",
      "updatedAt": "2026-10-10T12:00:00.000Z",
      "installPolicy": {
        "requiredRole": "staff",
        "requiredScopes": [
          "access:roxy:install"
        ]
      },
      "discord": {
        "clientId": "1204583957623459881",
        "permissions": "277025508352",
        "secretName": "DISCORD_CLIENT_SECRET_ROXY",
        "secretConfigured": true,
        "redirectUri": "https://access.rsx.group/install/callback"
      }
    }
  ]
}
POST/access/v1/admin/applications/add

Register an application

Registers a new controlled application. It starts disabled unless enabled is set, because registering an application and opening it for installations are separate decisions.

discord is the public half of its Discord setup. The client secret is never sent here: it is the Worker secret named in the response's discord.secretName, and until it is set the application answers application-not-configured.

The install policy must name at least one RSX ID staff scope. A policy with none would admit every member of RSX staff, and being staff is not meant to be enough on its own.

Scope
access:admin:applications:add Admin-issued keys only.
Idempotency
Requires an Idempotency-Key header. Reusing the key within 24 hours returns the original response instead of creating a second record.

Request bodyapplication/json

Request body of adminAddApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
    1 to 100 characters
  • description
    Type
    string
    Description
    up to 500 characters
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • installationTypesrequired
    Type
    array of string
    Description
    at least 1 item
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items
  • discord
    Type
    AccessDiscordConfig
    Description
  • clientIdrequired
    Type
    string
    Description
    matches ^[0-9]{17,20}$
  • permissions
    Type
    string, or null
    Description
    matches ^[0-9]{1,20}$ · default null
  • enabled
    Type
    boolean
    Description
    default false

Response 200Application registered

Response of adminAddApplication

  • datarequired
    Type
    AccessAdminApplication
    Description
  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • discordrequired
    Type
    AccessAdminDiscordView
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404Not called over the dashboard's service binding, or no such record
  • 409The record's state does not permit this

Example

curl
curl -X POST https://api.rsx.group/access/v1/admin/applications/add \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Idempotency-Key: 5b8f2d1a-0c7e-4b1f-9a6d-3e2f1c0b9a8d" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "roxy",
  "name": "Roxy",
  "description": "The RSX Discord bot.",
  "environment": "production",
  "installationTypes": [
    "discord_guild"
  ],
  "installPolicy": {
    "requiredRole": "staff",
    "requiredScopes": [
      "access:roxy:install"
    ]
  },
  "discord": {
    "clientId": "1204583957623459881",
    "permissions": "277025508352"
  },
  "enabled": false
}'
200 response
{
  "data": {
    "id": "roxy",
    "name": "Roxy",
    "description": "The RSX Discord bot.",
    "environment": "production",
    "enabled": true,
    "installationTypes": [
      "discord_guild",
      "discord_user"
    ],
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "installPolicy": {
      "requiredRole": "staff",
      "requiredScopes": [
        "access:roxy:install"
      ]
    },
    "discord": {
      "clientId": "1204583957623459881",
      "permissions": "277025508352",
      "secretName": "DISCORD_CLIENT_SECRET_ROXY",
      "secretConfigured": true,
      "redirectUri": "https://access.rsx.group/install/callback"
    }
  }
}
POST/access/v1/admin/applications/update

Change an application

Open or close it for installations, rename it, change the target types it supports, change its install policy, or set its Discord client id and permissions (discord: null removes them). Every change is written to the audit trail with the value before and after, so a policy that admitted someone can always be read back as it stood at the time.

Closing an application or tightening its policy affects new installations only. Existing ones are revoked individually, with admin/installations/remove.

Scope
access:admin:applications:update Admin-issued keys only.

Request bodyapplication/json

Request body of adminUpdateApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • name
    Type
    string
    Description
    1 to 100 characters
  • description
    Type
    string, or null
    Description
    up to 500 characters
  • enabled
    Type
    boolean
    Description
  • installationTypes
    Type
    array of string
    Description
    at least 1 item
  • installPolicy
    Type
    AccessInstallPolicy
    Description
  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items
  • discord
    Type
    object
    Description
  • clientIdrequired
    Type
    string
    Description
    matches ^[0-9]{17,20}$
  • permissions
    Type
    string, or null
    Description
    matches ^[0-9]{1,20}$ · default null

Response 200Application updated

Response of adminUpdateApplication

  • datarequired
    Type
    AccessAdminApplication
    Description
  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • discordrequired
    Type
    AccessAdminDiscordView
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404No such record, or not one you can see

Example

curl
curl -X POST https://api.rsx.group/access/v1/admin/applications/update \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Content-Type: application/json" \
  -d '{
  "id": "roxy",
  "name": "string",
  "description": "string",
  "enabled": true,
  "installationTypes": [
    "discord_guild"
  ],
  "installPolicy": {
    "requiredRole": "staff",
    "requiredScopes": [
      "access:roxy:install"
    ]
  },
  "discord": {
    "clientId": "1204583957623459881",
    "permissions": "277025508352"
  }
}'
200 response
{
  "data": {
    "id": "roxy",
    "name": "Roxy",
    "description": "The RSX Discord bot.",
    "environment": "production",
    "enabled": true,
    "installationTypes": [
      "discord_guild",
      "discord_user"
    ],
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "installPolicy": {
      "requiredRole": "staff",
      "requiredScopes": [
        "access:roxy:install"
      ]
    },
    "discord": {
      "clientId": "1204583957623459881",
      "permissions": "277025508352",
      "secretName": "DISCORD_CLIENT_SECRET_ROXY",
      "secretConfigured": true,
      "redirectUri": "https://access.rsx.group/install/callback"
    }
  }
}
GET/access/v1/admin/installations/list

List installations across every RSX ID

Newest first, narrowed by any combination of application, identity, target and status. applicationId + targetType + targetId answers "who installed this into that".

Scope
access:admin:installations:list Admin-issued keys only.

Query parameters

Query parameters of adminListInstallations

  • cursor
    Type
    string
    Description
  • limit
    Type
    integer
    Description
    1 to 100 · default 20
  • applicationId
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityId
    Type
    string, uuid
    Description
  • targetType
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetId
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • status
    Type
    string
    Description
    one of "active", "revoked"

Response 200Installations

Response of adminListInstallations

  • datarequired
    Type
    array of AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"
  • metarequired
    Type
    AccessPageMeta
    Description
  • cursorrequired
    Type
    string, or null
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404Not called over the dashboard's service binding, or no such record

Example

curl
curl "https://api.rsx.group/access/v1/admin/installations/list" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": [
    {
      "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
      "applicationId": "roxy",
      "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
      "targetType": "discord_guild",
      "targetId": "1204583957623459881",
      "status": "active",
      "createdAt": "2026-10-10T12:00:00.000Z",
      "updatedAt": "2026-10-10T12:00:00.000Z",
      "revokedAt": null,
      "revokedBy": null
    }
  ],
  "meta": {
    "cursor": null
  }
}
POST/access/v1/admin/installations/remove

Revoke any installation

The operator's revocation. Same effect as the owner revoking it, recorded as revoked-by-operator with the operator's name on the audit row. Like the owner's, it ends the Access relationship and does not remove the application from Discord.

Scope
access:admin:installations:remove Admin-issued keys only.

Request bodyapplication/json

Request body of adminRemoveInstallation

  • idrequired
    Type
    string, uuid
    Description

Response 200Installation revoked

Response of adminRemoveInstallation

  • datarequired
    Type
    AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404No such record, or not one you can see
  • 409The record's state does not permit this

Example

curl
curl -X POST https://api.rsx.group/access/v1/admin/installations/remove \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Content-Type: application/json" \
  -d '{
  "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b"
}'
200 response
{
  "data": {
    "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
    "applicationId": "roxy",
    "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
    "targetType": "discord_guild",
    "targetId": "1204583957623459881",
    "status": "active",
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "revokedAt": null,
    "revokedBy": null
  }
}
GET/access/v1/admin/audit/list

Read the audit trail

Every decision Access has made, allowed and denied, newest first. Operator-only by design: it names who tried what, and it is not a feed for the people it describes.

Scope
access:admin:audit:list Admin-issued keys only.

Query parameters

Query parameters of adminListAccessAudit

  • cursor
    Type
    string
    Description
  • limit
    Type
    integer
    Description
    1 to 100 · default 20
  • applicationId
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • actorId
    Type
    string
    Description
    1 to 320 characters
  • installationId
    Type
    string, uuid
    Description
  • action
    Type
    string
    Description
    one of "installation.authorize", "installation.add", "installation.remove", "application.add", "application.update"
  • decision
    Type
    string
    Description
    one of "allowed", "denied"

Response 200Audit events

Response of adminListAccessAudit

  • datarequired
    Type
    array of AccessAuditEvent
    Description
  • idrequired
    Type
    string, uuid
    Description
  • actionrequired
    Type
    string
    Description
    one of "installation.authorize", "installation.add", "installation.remove", "application.add", "application.update"
  • decisionrequired
    Type
    string
    Description
    one of "allowed", "denied"
  • reasonrequired
    Type
    string
    Description
    one of "permitted", "revoked-by-owner", "revoked-by-operator", "registered", "updated", "application-not-found", "application-disabled", "application-not-configured", "insufficient-role", "insufficient-scope", "installation-not-supported", "installation-target-invalid", "installation-state-invalid", "installation-exchange-failed", "installation-not-found", "installation-revoked", "access-dependency-unavailable", "invalid-token", "account-suspended", "account-terminated"
  • actorTyperequired
    Type
    string
    Description
    one of "account", "operator"
  • actorIdrequired
    Type
    string
    Description
  • applicationIdrequired
    Type
    string, or null
    Description
    The application as requested. On a denial this may name one that does not exist, which is the point: a probe for unregistered applications is worth being able to see.
  • installationIdrequired
    Type
    string, uuid, or null
    Description
  • targetTyperequired
    Type
    string, or null
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string, or null
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • requestIdrequired
    Type
    string, or null
    Description
  • correlationIdrequired
    Type
    string, or null
    Description
  • metadatarequired
    Type
    map of any, or null
    Description
    Written by this service only, from fields it already validated, and never copied from a caller's body. On an application change, the fields before and after.
  • {key}
    Type
    any
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • metarequired
    Type
    AccessPageMeta
    Description
  • cursorrequired
    Type
    string, or null
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing or wrong platform admin token
  • 404Not called over the dashboard's service binding, or no such record

Example

curl
curl "https://api.rsx.group/access/v1/admin/audit/list" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": [
    {
      "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
      "action": "installation.add",
      "decision": "denied",
      "reason": "insufficient-scope",
      "actorType": "account",
      "actorId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
      "applicationId": "roxy",
      "installationId": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
      "targetType": "discord_guild",
      "targetId": "1204583957623459881",
      "requestId": "string",
      "correlationId": "string",
      "metadata": {
        "key": null
      },
      "createdAt": "2026-10-10T12:00:00.000Z"
    }
  ],
  "meta": {
    "cursor": null
  }
}
02

applications

2 operations under /access/v1/applications.

GET/access/v1/applications/list

List the applications you can install or manage

Applications whose install policy your RSX ID satisfies, plus any you hold an active installation of, so an installation stays visible after the grant behind it is withdrawn. Each carries eligibility, your standing against it right now.

Not paginated: the registry is small and curated by RSX, and it is filtered per caller.

Scope
access:applications:list Admin-issued keys only.

Response 200Applications

Response of listApplications

  • datarequired
    Type
    array of AccessApplication
    Description
  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • eligibilityrequired
    Type
    AccessEligibility
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation

Example

curl
curl "https://api.rsx.group/access/v1/applications/list" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": [
    {
      "id": "roxy",
      "name": "Roxy",
      "description": "The RSX Discord bot.",
      "environment": "production",
      "enabled": true,
      "installationTypes": [
        "discord_guild",
        "discord_user"
      ],
      "createdAt": "2026-10-10T12:00:00.000Z",
      "updatedAt": "2026-10-10T12:00:00.000Z",
      "eligibility": {
        "canInstall": false,
        "reason": "insufficient-scope",
        "requiredRole": "staff",
        "missingScopes": [
          "access:roxy:install"
        ]
      }
    }
  ]
}
GET/access/v1/applications/get

Fetch one application and your standing against it

Any registered application, whether or not you may install it. This is what an install page reads to tell a person why they are refused: eligibility names the missing role or scopes, which is what an installations/add refusal would say. The policy itself is not returned.

Scope
access:applications:get Admin-issued keys only.

Query parameters

Query parameters of getApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$

Response 200Application

Response of getApplication

  • datarequired
    Type
    AccessApplication
    Description
  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • eligibilityrequired
    Type
    AccessEligibility
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation
  • 404No such record, or not one you can see

Example

curl
curl "https://api.rsx.group/access/v1/applications/get?id=roxy" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": {
    "id": "roxy",
    "name": "Roxy",
    "description": "The RSX Discord bot.",
    "environment": "production",
    "enabled": true,
    "installationTypes": [
      "discord_guild",
      "discord_user"
    ],
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "eligibility": {
      "canInstall": false,
      "reason": "insufficient-scope",
      "requiredRole": "staff",
      "missingScopes": [
        "access:roxy:install"
      ]
    }
  }
}
03

installations

5 operations under /access/v1/installations.

POST/access/v1/installations/authorize

Start an installation

Decides whether your RSX ID may install an application, and if it may, answers with the Discord URL to send the browser to. Checked in order: the application exists, it is open and set up for Discord, your RSX ID satisfies its install policy, and it supports the kind of installation asked for. A personal installation also needs a Discord account verified on your RSX ID.

Nothing is installed yet. Discord sends the browser back with a code and a state, which installations/add turns into the installation. The state is single-use, bound to your RSX ID, and good for ten minutes.

Allowed and refused requests are both written to the audit trail.

Scope
access:installations:authorize Admin-issued keys only.

Request bodyapplication/json

Request body of authorizeInstallation

  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"

Response 200Where to send the browser

Response of authorizeInstallation

  • datarequired
    Type
    AccessInstallationAuthorization
    Description
  • authorizeUrlrequired
    Type
    string, uri
    Description
    Discord's authorisation page for this application. Send the browser here; Discord returns it to the Access callback with code and state.
  • expiresAtrequired
    Type
    string, date-time
    Description
    The state in the URL stops being accepted after this. Ten minutes from now.

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation
  • 404No such record, or not one you can see
  • 422Well-formed, but not a target this application can be installed into
  • 503A dependency could not provide a decision; nothing was changed

Example

curl
curl -X POST https://api.rsx.group/access/v1/installations/authorize \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Content-Type: application/json" \
  -d '{
  "applicationId": "roxy",
  "targetType": "discord_guild"
}'
200 response
{
  "data": {
    "authorizeUrl": "https://discord.com/oauth2/authorize?client_id=1204583957623459881&response_type=code&scope=bot+applications.commands",
    "expiresAt": "2026-10-10T12:00:00.000Z"
  }
}
POST/access/v1/installations/add

Finish an installation

Takes the code and state Discord put on the callback, and turns them into the installation. In order: the state must be one this RSX ID started and not yet used; the application must still be open and your RSX ID must still satisfy its policy, because either can change while you are at Discord; then the code is exchanged with Discord. For a server installation, that exchange is the moment the application joins the server, so a refusal before it means the application is never added.

What is recorded is what Discord reports was installed: the server named in the exchange, or for a personal installation the Discord account that authorised it, which must be the one verified on your RSX ID. The guild_id Discord also puts on the callback is not used.

If you already hold an active installation for that target, it is returned with meta.created false: Discord has re-added the application by then, and the existing approval covers it.

Allowed and refused requests are both written to the audit trail. Through the public API add needs an Idempotency-Key, like every add; the code and state are single-use regardless.

Scope
access:installations:add Admin-issued keys only.
Idempotency
Requires an Idempotency-Key header. Reusing the key within 24 hours returns the original response instead of creating a second record.

Request bodyapplication/json

Request body of addInstallation

  • staterequired
    Type
    string
    Description
    16 to 256 characters
  • coderequired
    Type
    string
    Description
    1 to 512 characters

Response 200Installed, or already installed

Response of addInstallation

  • datarequired
    Type
    AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"
  • metarequired
    Type
    AccessCompleteInstallationMeta
    Description
  • createdrequired
    Type
    boolean
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation
  • 404No such record, or not one you can see
  • 422Well-formed, but not a target this application can be installed into
  • 502Discord refused to complete the installation; nothing was installed
  • 503A dependency could not provide a decision; nothing was changed

Example

curl
curl -X POST https://api.rsx.group/access/v1/installations/add \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Idempotency-Key: 5b8f2d1a-0c7e-4b1f-9a6d-3e2f1c0b9a8d" \
  -H "Content-Type: application/json" \
  -d '{
  "state": "p3Vh1tVb9o1r3yq0p7x0sQ",
  "code": "NhhvTDYsFcdgNLnnLijcl7Ku7bEEeee"
}'
200 response
{
  "data": {
    "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
    "applicationId": "roxy",
    "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
    "targetType": "discord_guild",
    "targetId": "1204583957623459881",
    "status": "active",
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "revokedAt": null,
    "revokedBy": null
  },
  "meta": {
    "created": true
  }
}
GET/access/v1/installations/get

Fetch one of your installations

Yours only. An installation that belongs to another RSX ID is installation-not-found, the same answer as one that does not exist.

Scope
access:installations:get Admin-issued keys only.

Query parameters

Query parameters of getInstallation

  • idrequired
    Type
    string, uuid
    Description

Response 200Installation

Response of getInstallation

  • datarequired
    Type
    AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation
  • 404No such record, or not one you can see

Example

curl
curl "https://api.rsx.group/access/v1/installations/get?id=0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": {
    "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
    "applicationId": "roxy",
    "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
    "targetType": "discord_guild",
    "targetId": "1204583957623459881",
    "status": "active",
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "revokedAt": null,
    "revokedBy": null
  }
}
GET/access/v1/installations/list

List your installations

Yours only, newest first, active and revoked alike unless status narrows it. Reading your own installations needs no grant: they are a record of what you did.

Scope
access:installations:list Admin-issued keys only.

Query parameters

Query parameters of listInstallations

  • cursor
    Type
    string
    Description
  • limit
    Type
    integer
    Description
    1 to 100 · default 20
  • applicationId
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • status
    Type
    string
    Description
    one of "active", "revoked"

Response 200Installations

Response of listInstallations

  • datarequired
    Type
    array of AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"
  • metarequired
    Type
    AccessPageMeta
    Description
  • cursorrequired
    Type
    string, or null
    Description

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation

Example

curl
curl "https://api.rsx.group/access/v1/installations/list" \
  -H "Authorization: Bearer rsx_live_..."
200 response
{
  "data": [
    {
      "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
      "applicationId": "roxy",
      "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
      "targetType": "discord_guild",
      "targetId": "1204583957623459881",
      "status": "active",
      "createdAt": "2026-10-10T12:00:00.000Z",
      "updatedAt": "2026-10-10T12:00:00.000Z",
      "revokedAt": null,
      "revokedBy": null
    }
  ],
  "meta": {
    "cursor": null
  }
}
POST/access/v1/installations/remove

Revoke one of your installations

Ends the Access relationship: the installation becomes revoked and stays on record. It does not remove the application from Discord, which is the integration's own business.

Needs no grant. Withdrawing something you installed only ever reduces access, so a person whose install scope has since been removed can still revoke what they installed.

Scope
access:installations:remove Admin-issued keys only.

Request bodyapplication/json

Request body of removeInstallation

  • idrequired
    Type
    string, uuid
    Description

Response 200Installation revoked

Response of removeInstallation

  • datarequired
    Type
    AccessInstallation
    Description
  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"

Errors

Each is an RFC 7807 problem document whose type URL is a page in the error reference.

  • 400The request did not match the endpoint's schema
  • 401Missing credential, a platform API key, or a token not issued for RSX Access
  • 403Sign-in is not configured, or the account is not permitted this operation
  • 404No such record, or not one you can see
  • 409The record's state does not permit this

Example

curl
curl -X POST https://api.rsx.group/access/v1/installations/remove \
  -H "Authorization: Bearer rsx_live_..." \
  -H "Content-Type: application/json" \
  -d '{
  "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b"
}'
200 response
{
  "data": {
    "id": "0198f3c4-7d2b-7e1f-8a2b-3c4d5e6f7a8b",
    "applicationId": "roxy",
    "identityId": "0198f2b1-6c2a-7c9e-9d3a-1e2f3a4b5c6d",
    "targetType": "discord_guild",
    "targetId": "1204583957623459881",
    "status": "active",
    "createdAt": "2026-10-10T12:00:00.000Z",
    "updatedAt": "2026-10-10T12:00:00.000Z",
    "revokedAt": null,
    "revokedBy": null
  }
}
04

Schemas

Every named shape in this reference, as the operations above refer to it.

AccessInstallPolicy

AccessInstallPolicy

  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items

AccessAdminDiscordView

AccessAdminDiscordView

  • clientIdrequired
    Type
    string, or null
    Description
  • permissionsrequired
    Type
    string, or null
    Description
  • secretNamerequired
    Type
    string
    Description
  • secretConfiguredrequired
    Type
    boolean
    Description
  • redirectUrirequired
    Type
    string, or null
    Description

AccessAdminApplication

AccessAdminApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items
  • discordrequired
    Type
    AccessAdminDiscordView
    Description
  • clientIdrequired
    Type
    string, or null
    Description
  • permissionsrequired
    Type
    string, or null
    Description
  • secretNamerequired
    Type
    string
    Description
  • secretConfiguredrequired
    Type
    boolean
    Description
  • redirectUrirequired
    Type
    string, or null
    Description

Problem

Problem

  • typerequired
    Type
    string
    Description
  • titlerequired
    Type
    string
    Description
  • statusrequired
    Type
    integer
    Description
  • detail
    Type
    string
    Description
  • instance
    Type
    string
    Description
  • requestId
    Type
    string
    Description

AccessDiscordConfig

AccessDiscordConfig

  • clientIdrequired
    Type
    string
    Description
    matches ^[0-9]{17,20}$
  • permissions
    Type
    string, or null
    Description
    matches ^[0-9]{1,20}$ · default null

AccessCreateApplication

AccessCreateApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
    1 to 100 characters
  • description
    Type
    string
    Description
    up to 500 characters
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • installationTypesrequired
    Type
    array of string
    Description
    at least 1 item
  • installPolicyrequired
    Type
    AccessInstallPolicy
    Description
  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items
  • discord
    Type
    AccessDiscordConfig
    Description
  • clientIdrequired
    Type
    string
    Description
    matches ^[0-9]{17,20}$
  • permissions
    Type
    string, or null
    Description
    matches ^[0-9]{1,20}$ · default null
  • enabled
    Type
    boolean
    Description
    default false

AccessUpdateApplication

AccessUpdateApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • name
    Type
    string
    Description
    1 to 100 characters
  • description
    Type
    string, or null
    Description
    up to 500 characters
  • enabled
    Type
    boolean
    Description
  • installationTypes
    Type
    array of string
    Description
    at least 1 item
  • installPolicy
    Type
    AccessInstallPolicy
    Description
  • requiredRolerequired
    Type
    string
    Description
    Minimum RSX ID staff role. Downward-closed: an admin satisfies a staff requirement.one of "staff", "admin"
  • requiredScopesrequired
    Type
    array of string
    Description
    RSX ID staff scopes the account must hold, all of them. An RSX admin holds every scope.1 to 16 items
  • discord
    Type
    object
    Description
  • clientIdrequired
    Type
    string
    Description
    matches ^[0-9]{17,20}$
  • permissions
    Type
    string, or null
    Description
    matches ^[0-9]{1,20}$ · default null

AccessInstallation

AccessInstallation

  • idrequired
    Type
    string, uuid
    Description
  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • identityIdrequired
    Type
    string, uuid
    Description
    The RSX ID account that installed it.
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • statusrequired
    Type
    string
    Description
    one of "active", "revoked"
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • revokedAtrequired
    Type
    string, date-time, or null
    Description
  • revokedByrequired
    Type
    string, or null
    Description
    one of "owner", "operator"

AccessPageMeta

AccessPageMeta

  • cursorrequired
    Type
    string, or null
    Description

AccessRemoveInstallation

AccessRemoveInstallation

  • idrequired
    Type
    string, uuid
    Description

AccessAuditEvent

AccessAuditEvent

  • idrequired
    Type
    string, uuid
    Description
  • actionrequired
    Type
    string
    Description
    one of "installation.authorize", "installation.add", "installation.remove", "application.add", "application.update"
  • decisionrequired
    Type
    string
    Description
    one of "allowed", "denied"
  • reasonrequired
    Type
    string
    Description
    one of "permitted", "revoked-by-owner", "revoked-by-operator", "registered", "updated", "application-not-found", "application-disabled", "application-not-configured", "insufficient-role", "insufficient-scope", "installation-not-supported", "installation-target-invalid", "installation-state-invalid", "installation-exchange-failed", "installation-not-found", "installation-revoked", "access-dependency-unavailable", "invalid-token", "account-suspended", "account-terminated"
  • actorTyperequired
    Type
    string
    Description
    one of "account", "operator"
  • actorIdrequired
    Type
    string
    Description
  • applicationIdrequired
    Type
    string, or null
    Description
    The application as requested. On a denial this may name one that does not exist, which is the point: a probe for unregistered applications is worth being able to see.
  • installationIdrequired
    Type
    string, uuid, or null
    Description
  • targetTyperequired
    Type
    string, or null
    Description
    one of "discord_guild", "discord_user"
  • targetIdrequired
    Type
    string, or null
    Description
    1 to 128 characters · matches ^[A-Za-z0-9._:-]+$
  • requestIdrequired
    Type
    string, or null
    Description
  • correlationIdrequired
    Type
    string, or null
    Description
  • metadatarequired
    Type
    map of any, or null
    Description
    Written by this service only, from fields it already validated, and never copied from a caller's body. On an application change, the fields before and after.
  • {key}
    Type
    any
    Description
  • createdAtrequired
    Type
    string, date-time
    Description

AccessEligibility

AccessEligibility

  • canInstallrequired
    Type
    boolean
    Description
  • reasonrequired
    Type
    string
    Description
    one of "permitted", "application-disabled", "application-not-configured", "insufficient-role", "insufficient-scope"
  • requiredRole
    Type
    string
    Description
    Present when the reason is insufficient-role.one of "staff", "admin"
  • missingScopes
    Type
    array of string
    Description
    Present when the reason is insufficient-scope: the grants to ask an RSX admin for.

AccessApplication

AccessApplication

  • idrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • namerequired
    Type
    string
    Description
  • descriptionrequired
    Type
    string, or null
    Description
  • environmentrequired
    Type
    string
    Description
    one of "production", "non-production"
  • enabledrequired
    Type
    boolean
    Description
    Whether the application accepts new installations. Existing ones are unaffected.
  • installationTypesrequired
    Type
    array of string
    Description
  • createdAtrequired
    Type
    string, date-time
    Description
  • updatedAtrequired
    Type
    string, date-time
    Description
  • eligibilityrequired
    Type
    AccessEligibility
    Description
  • canInstallrequired
    Type
    boolean
    Description
  • reasonrequired
    Type
    string
    Description
    one of "permitted", "application-disabled", "application-not-configured", "insufficient-role", "insufficient-scope"
  • requiredRole
    Type
    string
    Description
    Present when the reason is insufficient-role.one of "staff", "admin"
  • missingScopes
    Type
    array of string
    Description
    Present when the reason is insufficient-scope: the grants to ask an RSX admin for.

AccessInstallationAuthorization

AccessInstallationAuthorization

  • authorizeUrlrequired
    Type
    string, uri
    Description
    Discord's authorisation page for this application. Send the browser here; Discord returns it to the Access callback with code and state.
  • expiresAtrequired
    Type
    string, date-time
    Description
    The state in the URL stops being accepted after this. Ten minutes from now.

AccessAuthorizeInstallation

AccessAuthorizeInstallation

  • applicationIdrequired
    Type
    string
    Description
    1 to 63 characters · matches ^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$
  • targetTyperequired
    Type
    string
    Description
    one of "discord_guild", "discord_user"

AccessCompleteInstallationMeta

AccessCompleteInstallationMeta

  • createdrequired
    Type
    boolean
    Description

AccessCompleteInstallation

AccessCompleteInstallation

  • staterequired
    Type
    string
    Description
    16 to 256 characters
  • coderequired
    Type
    string
    Description
    1 to 512 characters