Events — API endpoints

Base domains

• https://rewards.streamercatalyst.com
• https://events.streamercatalyst.com

The public Event Page is served on the apex domain, https://streamercatalyst.com/e/<login>, which the web Worker forwards here.

The StreamerCatalyst dashboard calls the session endpoints same-origin through https://streamercatalyst.com/m/rewards/* (for example /m/rewards/api/channels/:id/config reaches /api/channels/:id/config here). That proxy forwards the session cookie over a Cloudflare service binding and never forwards /internal/*.

Endpoints

Path	Method	Auth	Description
/e/:login	GET	Public	The public Event Page, at streamercatalyst.com/e/<login>. Off until the streamer publishes it.
/e/auth/*	GET	Public	Viewer sign-in on the Event Page (start, callback, signout): Twitch identity only, held in a signed cookie scoped to /e, never a dashboard session.
/widget/:channelId	GET	Widget token	Events widget page for an OBS browser source (?token=).
/api/widget/:channelId/data	GET	Widget token	Events widget data (?token=); /api/widget/:channelId/simulate returns sample data for previews.
/api/channels/:id/config	GET/PUT	Session cookie	Per-channel Events configuration.
/api/channels/:id/events	GET/POST	Session cookie	List or create events. Rules, running totals and leaderboards are scoped to an event.
/api/channels/:id/events/:eventId	PUT/DELETE	Session cookie	Update or delete one event.
/api/channels/:id/events/:eventId/*	GET/POST	Session cookie	Event actions: enable, disable, archive, unarchive, duplicate, recalculate, purge-out-of-range (“Trim to dates”) and adopt-in-range (“Pull in activity”). A GET on the last three previews without changing anything.
/api/channels/:id/rules	GET/POST	Session cookie	List or create reward rules.
/api/channels/:id/rules/:ruleId	PUT/DELETE	Session cookie	Update or delete a rule; POST …/duplicate copies it (the copy starts disabled).
/api/channels/:id/earned-rewards	GET	Session cookie	Rewards viewers have earned, and their fulfilment state.
/api/channels/:id/earned-rewards/*	POST/PATCH/PUT/DELETE	Session cookie	Grant a reward by hand (POST manual), update an earned reward (PATCH :earnId), and its fulfilment checklist (:earnId/checklist).
/api/channels/:id/stats	GET	Session cookie	Event stats.
/api/channels/:id/leaderboard	GET	Session cookie	Viewer leaderboard.
/api/channels/:id/reward-report	GET	Session cookie	Reward report.
/api/channels/:id/giveaways	GET/POST	Session cookie	List or create giveaways; GET …/giveaways/pending lists entries earned while no giveaway was open, held for the next one.
/api/channels/:id/giveaways/:giveawayId	PUT	Session cookie	Update a giveaway’s state.
/api/channels/:id/giveaways/:giveawayId/entries	GET	Session cookie	Giveaway entry list.
/api/channels/:id/event-page	GET/PUT	Session cookie	Event Page settings, including whether the public page is published.
/api/channels/:id/widget-token	GET/POST/DELETE	Session cookie	Read, create, or revoke the Events widget token.
/api/channels/:id/channel-rewards	GET	Session cookie	The channel’s Twitch channel-point rewards, for rule pickers.
/api/channels/:id/eventsub	GET	Session cookie	This channel’s live EventSub subscriptions, read from Twitch (the platform creates and deletes them).
/internal/eventsub	POST	Service binding (internal)	EventSub fan-out receiver (internal).
/internal/billing/downgrade	POST	Service binding (internal)	Tier-downgrade handler (internal).

Auth model

• Session cookie endpoints require an active StreamerCatalyst session (set at login via the platform Worker). A channel-scoped route (/api/channels/:id/…) answers only for the session’s own channel, and a read-only admin masquerade may read but not change anything.
• Widget token endpoints are what OBS browser sources and overlays call. The channel’s widget token, passed as ?token=, is the credential: the channel comes from the token, and a token that does not match the channel in the URL is refused. Treat a URL that carries it like a password; rotating the token from the dashboard invalidates every URL with the old one.
• Public endpoints require no authentication.
• Service binding endpoints are for other StreamerCatalyst Workers, called over Cloudflare service bindings with a shared internal token. They are not a public API.