Managing Your Palworld Server with the REST API

Managing Your Palworld Server with the REST API

The REST API lets administrators manage a dedicated server from outside the game. It is the replacement for the older RCON protocol and supports a wide range of operations, from broadcasting messages to shutting down gracefully.

Enabling the REST API

Open PalWorldSettings.ini while the server is stopped. Set:

RESTAPIEnabled=True
RESTAPIPort=8212

Save the file and restart the server. The API will listen on TCP port 8212. Make sure this port is not already in use by another service.

Authentication

The REST API uses HTTP Basic Auth. The username is admin and the password is the value of AdminPassword in your configuration file. Anyone with this password can issue powerful commands, so keep it secret and use a long, random password.

Common endpoints

The API provides endpoints such as info, players, settings, announce, kick, ban, unban, save, shutdown, stop, and metrics. For example, to broadcast a message to all players:

curl -X POST -u admin:PASSWORD \
  -H "Content-Type: application/json" \
  -d '{"message":"Server will restart in 5 minutes."}' \
  http://IP:8212/v1/api/announce

Replace PASSWORD with your AdminPassword and IP with the server address. The settings endpoint lets you inspect current configuration, while players and info are the fastest ways to confirm the server is online.

PowerShell and automation

Windows administrators can call the REST API with PowerShell instead of curl:

$pair = "admin:PASSWORD"
$bytes = [System.Text.Encoding]::ASCII.GetBytes($pair)
$encoded = [System.Convert]::ToBase64String($bytes)
$headers = @{ Authorization = "Basic $encoded" }
Invoke-RestMethod -Uri "http://IP:8212/v1/api/info" -Headers $headers

The info endpoint returns server status, version, and player count. The players endpoint lists connected players with their IDs. The metrics endpoint provides performance data. The save endpoint writes the world to disk before a restart, while shutdown stops the server after a countdown and stop ends it immediately. Use announce first so players are not surprised.

Because the API has no built-in rate limiting, write scripts that sleep between requests and avoid hammering the server with unnecessary calls.

In-game admin commands

If you are logged into the server, you can also use chat commands. First authenticate:

/AdminPassword yourpassword

Then run commands such as /Shutdown, /DoExit, /Broadcast, /Save, /KickPlayer, /BanPlayer, /ShowPlayers, or /Info. These are useful for quick moderation without leaving the game.

Security warning

Do not expose port 8212 directly to the internet. Use a local network connection or a reverse proxy with authentication. RCON on TCP 25575 is deprecated and scheduled to stop functioning, so migrate any automation to the REST API. If you do not need remote management, leave RESTAPIEnabled=False. With the REST API enabled and properly secured, you can manage the server from anywhere on your local network or through a trusted proxy.