REST Quickstart

Total time is about five minutes if your token is ready, or ten minutes if you need to issue one first. You will need a Pro guild, owner access on that guild, and a terminal with curl installed.

Throughout the page, placeholders are written as <GUILD_ID>, <TOKEN_ID>, <TICKET_ID>, and so on. Replace them with real values from your dashboard before running each command. The token prefix is always arkpat_ followed by a base64url secret.

Tokens are minted from the dashboard. Open the Settings Panel from your sidebar, find the Developer Mode card (owner-only — the panel is gated to the Discord guild owner), and enable it. API & MCP then appears in your sidebar's Dashboard section. Open it, switch to the REST Tokens tab, and click Create token.

Developer Mode is a per-browser preference — enabling it on your laptop doesn't affect your staff or other devices. You only need to enable it once per browser.

For the rest of this quickstart, export the plaintext into your shell so the snippets stay copy-pasteable:

export ARK_TOKEN="arkpat_YOURPLAINTEXTHERE"
export GUILD_ID="100000000000000000"
export TOKEN_ID="01HXXXXXXXXXXXXXXXXXXXXXXX"

Read endpoints are the safest place to start. List the ten most recent strikes for the guild:

curl -s -H "Authorization: Bearer $ARK_TOKEN" \
  "https://api.arkanis.gg/api/public/v1/guilds/$GUILD_ID/strikes?limit=10"

The response is a paginated envelope: { data: [...strikes], next_cursor: "..." | null }. Each item carries the strike id, the target user, the severity, the issuing actor, and the timestamp. If the guild has no strikes yet, data is an empty array — not an error.

Reversible writes also skip the re-auth window. Claiming a ticket is the canonical example — it can be unclaimed with one more call, so the guard is not needed.

curl -s -X POST -H "Authorization: Bearer $ARK_TOKEN" \
  "https://api.arkanis.gg/api/public/v1/guilds/$GUILD_ID/tickets/<TICKET_ID>/claim"

A successful claim returns the updated ticket with claimed_by set to your Discord id (the token's issuer) and claimed_at set to the current time. If the ticket was already claimed by someone else, the response is 409 with code: "ALREADY_CLAIMED".

Destructive writes (strikes, bans, long mutes, mass purges, RCON commands) require two extra things: a deterministic sentinel value in the _confirmation field, and an open re-auth window for the token. Try the call first without the window to see the gate fire.

curl -s -X POST -H "Authorization: Bearer $ARK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "583912000000000000",
    "player_name": "PlayerName",
    "in_game_id": "76561198000000001",
    "reason": "spam",
    "category": "rule-violation",
    "severity": "minor",
    "_confirmation": "ADD STRIKE TO USER 583912000000000000 IN GUILD 100000000000000000 SEVERITY MINOR"
  }' \
  "https://api.arkanis.gg/api/public/v1/guilds/$GUILD_ID/strikes"

The response is a 403 with the error envelope:

{
  "code": "RE_AUTH_REQUIRED",
  "message": "An approved re-auth window is required for destructive actions.",
  "details": {
    "reauth_url": "https://arkanis.gg/dashboard/<GUILD_ID>/settings/api-mcp#approve"
  }
}

The re-auth window unlocks destructive writes for a token for a bounded period of fifteen minutes. Opening one from the API is meant for fully scripted workflows; interactive users can also click Approve window on the dashboard.

curl -s -X POST -H "Authorization: Bearer $ARK_TOKEN" \
  "https://api.arkanis.gg/api/api-tokens/$TOKEN_ID/reauth-window"

A successful open returns the window descriptor:

{
  "open": true,
  "window": {
    "window_id": "01HYYYYYYYYYYYYYYYYYYYYYY",
    "expires_at": "2026-05-12T20:15:00.000Z"
  }
}

You can poll the same path with GET to check whether a window is currently open without creating a new one. The response is { "open": false } if nothing is active.

Re-run the same strike request from Step 4. With an open window, the call now succeeds:

curl -s -X POST -H "Authorization: Bearer $ARK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "583912000000000000",
    "player_name": "PlayerName",
    "in_game_id": "76561198000000001",
    "reason": "spam",
    "category": "rule-violation",
    "severity": "minor",
    "_confirmation": "ADD STRIKE TO USER 583912000000000000 IN GUILD 100000000000000000 SEVERITY MINOR"
  }' \
  "https://api.arkanis.gg/api/public/v1/guilds/$GUILD_ID/strikes"

The response is 201 Created with the new strike summary: strike_id, user_id, severity, issued_by, and issued_at. The audit log records the action with actor_source=token and the token name from Step 1, so the row is traceable to this exact integration.

You have walked the full token lifecycle. A few useful follow-ups:

• Destructive Actions lists every destructive endpoint and the exact sentinel template each one expects.
• Rate Limits and Errors covers the per-token and per-IP limits, plus every error code your client should handle.
• Authentication explains capability inheritance, rotation, and revocation in depth.
• MCP Quickstart is the equivalent walkthrough for Claude Desktop and Claude Code through the MCP server.