Discord — API endpoints

Base domain

• https://discord.streamercatalyst.com

The StreamerCatalyst dashboard calls the session endpoints same-origin through https://streamercatalyst.com/m/discord/* (for example /m/discord/api/guilds reaches /api/guilds here). That proxy forwards the session cookie over a Cloudflare service binding and never forwards /internal/*.

Endpoints

Path	Method	Auth	Description
/interactions	POST	Discord Ed25519 signature	Slash commands and button clicks from Discord (HTTP interactions).
/auth/discord/install	GET	Session cookie	Add the bot to a Discord server: starts Discord’s install flow for your channel. Refused for a read-only masquerade.
/auth/discord/install/callback	GET	OAuth state	Discord returns here after the install; records the server-to-channel link.
/api/guilds	GET	Session cookie	Discord servers linked to your channel, each with its name, icon, member count and what it has configured.
/api/guilds/:guildId	DELETE	Session cookie	Unlink a server. The bot stops posting there at once and stays in the server until an admin removes it; its settings are kept for a re-add.
/api/announcements	GET	Session cookie	Everything the Announcements page needs in one request (?guild=): server list, that server’s channels, roles, config and Hype Train settings.
/api/button-roles	GET	Session cookie	Everything the Button roles page needs in one request (?guild=): server list, channels, roles and panels.
/api/guilds/:guildId/config	GET/PUT	Session cookie	Per-server announcement settings: channels, toggles, role pings and custom messages.
/api/guilds/:guildId/hype-config	GET/PUT	Session cookie	Hype Train announcement settings, per train type.
/api/guilds/:guildId/channels	GET	Session cookie	The server’s text channels, for the pickers.
/api/guilds/:guildId/roles	GET	Session cookie	The server’s roles, for the ping and button-role pickers.
/api/guilds/:guildId/snapshot	GET	Session cookie	Live server stats (members, online, channels, roles, boosts, scheduled events).
/api/guilds/:guildId/engagement	GET	Session cookie	Announcements sent, commands run, and the 7-day member change, once event logging is on.
/api/guilds/:guildId/button-roles	GET/PUT	Session cookie	The server’s button-role panels, or create/update a panel draft.
/api/guilds/:guildId/button-roles/:panelId	DELETE	Session cookie	Remove a panel and its Discord message; POST …/post publishes or updates it in Discord.
/api/register-commands	POST	Session cookie	Re-register the bot’s slash commands. ?guild= registers for one server instantly; global registration can take about an hour. Rate-limited.
/internal/eventsub	POST	Service binding (internal)	EventSub fan-out receiver (internal, from eventsub-router): go-live, sub, cheer, raid and Hype Train posts.
/internal/release-published	POST	Service binding (internal)	A new StreamerCatalyst release, pushed by the platform and posted to servers that opted in (internal).

Auth model

• Session cookie endpoints require an active StreamerCatalyst session (set at login via the platform Worker). A channel-scoped route (/api/channels/:id/…) answers only for the session’s own channel, and a read-only admin masquerade may read but not change anything.
• OAuth state endpoints are the return leg of a sign-in or account-link redirect. They are accepted only with the state value issued when that flow started.
• Signature-verified endpoints accept only requests signed by Discord; anything unsigned or altered is refused.
• Service binding endpoints are for other StreamerCatalyst Workers, called over Cloudflare service bindings with a shared internal token. They are not a public API.