Skip docs navigation
Public API Docs

Registry API Reference

Creator upload, reviewer approval, publish, and manifest retrieval flows documented from the same registry contract the shell already consumes.
Auth

Creator, reviewer, and admin endpoints use bearer auth. Public discovery and manifest routes stay unauthenticated.

Scope

This first public reference covers the current registry worker contract. Future Docusaurus pages can reuse the same checked-in OpenAPI source.

Coverage

The reference is anchored on the upload, review, publish, and manifest paths that already have shell and registry test coverage.

GET /gamesGET /games/{gameId}/manifestGET /private-games/resolvePOST /games/{gameId}/reviewsGET /creator/mePATCH /creator/meGET /creator/gamesPOST /creator/uploadsPUT /creator/games/{gameId}/visibilityGET /creator/games/{gameId}/reviewsGET /creator/payoutsGET /creator/api-keysPOST /creator/api-keysDELETE /creator/api-keys/{keyId}POST /auth/device/codePOST /auth/device/tokenPOST /creator/device-authorizations/lookupPOST /creator/device-authorizations/approvePOST /creator/device-authorizations/denyDELETE /creator/cli-sessionPATCH /creator/games/{gameId}POST /creator/games/{gameId}/archivePOST /creator/games/{gameId}/versions/{version}/submitPOST /creator/games/{gameId}/versions/{version}/publishPOST /creator/games/{gameId}/versions/{version}/unpublishDELETE /creator/games/{gameId}/versions/{version}GET /creator/games/{gameId}/analyticsGET /creator/games/{gameId}/analytics/exportPOST /analytics/eventsGET /reviewer/meGET /reviewer/gamesPOST /reviewer/games/{gameId}/versions/{version}/approvePOST /reviewer/games/{gameId}/versions/{version}/rejectPOST /reviewer/games/{gameId}/versions/{version}/publishPUT /reviewer/games/{gameId}/versions/{version}/metadataGET /admin/rolesPOST /admin/games/{gameId}/versions/{version}/unpublishGET /admin/analyticsGET /admin/reviewsGET /admin/payoutsGET /admin/payouts/exportPUT /admin/roles/{userId}
Checked-In OpenAPI Contract

Endpoint reference

This product-owned reference renders directly from docs/registry-openapi.json, so the public route stays fast, keyboard-friendly, and aligned with registry tests.

Discovery endpoints

Public endpoints for published games and manifests.

GET/games

List published games

Public
Operation ID
listPublishedGames
Request body
No request body

Parameters

  • sort (query, optional)

Responses

  • 200: Published games
GET/games/{gameId}/manifest

Fetch a published game manifest

Public
Operation ID
fetchPublishedManifest
Request body
No request body

Parameters

  • gameId (path, required)

Responses

  • 200: Published manifest
  • 404: Published game not found
GET/private-games/resolve

Resolve a private published game

Public
Operation ID
resolvePrivateGame
Request body
No request body

Parameters

  • x-tpg-private-game-code (header, required)

Responses

  • 200: Reviewed manifest with code-scoped asset URLs
  • 404: Private game not found
POST/games/{gameId}/reviews

Submit an anonymous review for a published game version

Public
Operation ID
submitGameReview
Request body
application/json: GameReviewSubmission

Parameters

  • gameId (path, required)

Responses

  • 200: An identical review identity was already recorded
  • 201: Review recorded
  • 400: Review submission is invalid
  • 404: Published game version not found

Creator endpoints

Authenticated creator endpoints for bundle upload and submission.

GET/creator/me

Fetch the authenticated creator profile

Bearer auth
Operation ID
fetchCreatorProfile
Request body
No request body

Responses

  • 200: Creator principal and TPG-owned account profile
  • 401: Authentication required
PATCH/creator/me

Update the authenticated creator profile

Bearer auth
Operation ID
updateCreatorProfile
Request body
application/json: CreatorProfileUpdateRequest

Responses

  • 200: Updated account profile
  • 400: Profile payload is invalid
  • 401: Authentication required
GET/creator/games

List the authenticated creator's registry records

Bearer auth
Operation ID
listCreatorGames
Request body
No request body

Responses

  • 200: Creator game records
POST/creator/uploads

Upload a game bundle archive

Bearer auth
Operation ID
uploadCreatorBundle
Request body
application/zip: string

Responses

  • 201: Draft record created from the uploaded bundle
  • 400: Archive could not be parsed or validated
PUT/creator/games/{gameId}/visibility

Change game visibility or replace a private link

Bearer auth
Operation ID
updateCreatorGameVisibility
Request body
application/json: object

Parameters

  • gameId (path, required)

Responses

  • 200: Visibility updated
  • 404: Owned game not found
GET/creator/games/{gameId}/reviews

List private reviews for a creator-owned game

Bearer auth
Operation ID
listCreatorGameReviews
Request body
No request body

Parameters

  • gameId (path, required)
  • limit (query, optional)
  • cursor (query, optional)

Responses

  • 200: Newest-first review page
  • 400: Pagination parameters are invalid
  • 403: Only the owner can view reviews for this game
  • 404: Game not found
GET/creator/payouts

Fetch creator-owned estimated payout summary

Bearer auth
Operation ID
fetchCreatorPayouts
Request body
No request body

Parameters

  • from (query, required)
  • to (query, required)
  • gameId (query, optional)
  • version (query, optional)

Responses

  • 200: Estimated payout summary
  • 400: Invalid payout period
GET/creator/api-keys

List creator API keys

Bearer auth
Operation ID
listCreatorApiKeys
Request body
No request body

Responses

  • 200: Redacted API keys for the authenticated creator account
  • 401: Authentication required
POST/creator/api-keys

Create a scoped creator API key

Bearer auth
Operation ID
createCreatorApiKey
Request body
application/json: CreateCreatorApiKeyRequest

Responses

  • 201: API key created with one-time secret
  • 400: Name or scopes are invalid
  • 401: Authentication required
  • 403: API keys cannot manage API keys
DELETE/creator/api-keys/{keyId}

Revoke a creator API key

Bearer auth
Operation ID
revokeCreatorApiKey
Request body
No request body

Parameters

  • keyId (path, required)

Responses

  • 200: Revoked API key metadata
  • 401: Authentication required
  • 404: API key not found
POST/auth/device/code

Start a CLI browser sign-in

Public
Operation ID
startCreatorDeviceAuthorization
Request body
application/json: DeviceAuthorizationStartRequest

Responses

  • 201: Short-lived browser authorization codes
  • 400: Invalid client, scope, or credential commitment
  • 429: Device authorization rate limit exceeded
POST/auth/device/token

Poll and activate a CLI browser sign-in

Public
Operation ID
exchangeCreatorDeviceAuthorization
Request body
application/json: DeviceAuthorizationTokenRequest

Responses

  • 200: Credential commitment activated
  • 202: Browser decision is still pending
  • 409: The credential was already activated or activation conflicted
  • 429: Polling faster than the required interval
POST/creator/device-authorizations/lookup

Look up a CLI sign-in request

Bearer auth
Operation ID
lookupCreatorDeviceAuthorization
Request body
application/json: DeviceAuthorizationDecisionRequest

Responses

  • 200: Redacted pending authorization metadata
  • 404: No active request matches the human code
POST/creator/device-authorizations/approve

Approve a CLI sign-in request

Bearer auth
Operation ID
approveCreatorDeviceAuthorization
Request body
application/json: DeviceAuthorizationDecisionRequest

Responses

  • 200: Authorization approved
  • 403: Interactive browser authentication or the configured shell origin is required
POST/creator/device-authorizations/deny

Deny a CLI sign-in request

Bearer auth
Operation ID
denyCreatorDeviceAuthorization
Request body
application/json: DeviceAuthorizationDecisionRequest

Responses

  • 200: Authorization denied
DELETE/creator/cli-session

Revoke the current CLI session

Bearer auth
Operation ID
revokeCreatorCliSession
Request body
No request body

Responses

  • 200: Current CLI API key revoked
  • 403: Only an API-key CLI session can revoke itself
PATCH/creator/games/{gameId}

Rename a creator-owned game project

Bearer auth
Operation ID
renameCreatorGameProject
Request body
application/json: RenameGameProjectRequest

Parameters

  • gameId (path, required)

Responses

  • 200: Updated game project
  • 400: Project payload is invalid
  • 401: Authentication required
  • 404: Game project not found
POST/creator/games/{gameId}/archive

Archive a creator-owned game project

Bearer auth
Operation ID
archiveCreatorGameProject
Request body
No request body

Parameters

  • gameId (path, required)

Responses

  • 200: Archived game project
  • 401: Authentication required
  • 404: Game project not found
POST/creator/games/{gameId}/versions/{version}/submit

Submit a specific creator-owned game version for review

Bearer auth
Operation ID
submitCreatorGameVersion
Request body
No request body

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Submitted version record
  • 401: Authentication required
  • 403: Only the owner can submit this version
  • 404: Game version not found
POST/creator/games/{gameId}/versions/{version}/publish

Publish a submitted creator-owned game version

Bearer auth
Operation ID
publishCreatorGameVersion
Request body
No request body

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Published version record
  • 401: Authentication required
  • 403: Only the owner can publish this version or API key scope is missing
  • 404: Game version not found
  • 409: Version must be submitted before publishing
POST/creator/games/{gameId}/versions/{version}/unpublish

Unpublish a creator-owned game version

Bearer auth
Operation ID
unpublishCreatorGameVersion
Request body
No request body

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Unpublished version record
  • 401: Authentication required
  • 403: Only the owner can unpublish this version or API key scope is missing
  • 404: Game version not found
DELETE/creator/games/{gameId}/versions/{version}

Delete an unpublished creator-owned game version

Bearer auth
Operation ID
deleteCreatorGameVersion
Request body
No request body

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Deleted draft version record
  • 401: Authentication required
  • 403: Only the owner can delete this version
  • 404: Game version not found
  • 409: Published versions cannot be hard-deleted

Analytics endpoints

Privacy-safe platform telemetry ingestion, creator-owned summaries, and admin platform reporting.

GET/creator/games/{gameId}/analytics

Fetch aggregate analytics for a creator-owned game

Bearer auth
Operation ID
fetchCreatorGameAnalytics
Request body
No request body

Parameters

  • gameId (path, required)

Responses

  • 200: Aggregate analytics summary for the game
  • 403: Only the owner can view analytics for this game
  • 404: Game not found
GET/creator/games/{gameId}/analytics/export

Export aggregate analytics for a creator-owned game

Bearer auth
Operation ID
exportCreatorGameAnalyticsCsv
Request body
No request body

Parameters

  • gameId (path, required)

Responses

  • 200: CSV analytics summary for the game
  • 403: Only the owner can export analytics for this game
  • 404: Game not found
POST/analytics/events

Ingest privacy-safe platform analytics events

Public
Operation ID
ingestPlatformAnalyticsEvents
Request body
application/json: AnalyticsEventsRequest

Parameters

  • x-tpg-analytics-source (header, required)
  • x-tpg-analytics-timestamp (header, required)
  • x-tpg-analytics-nonce (header, required)
  • x-tpg-analytics-signature (header, required)

Responses

  • 202: Accepted analytics events
  • 400: Invalid or non-privacy-safe analytics event payload
  • 401: Missing, invalid, expired, or future-dated ingestion credential
  • 404: Referenced game not found
  • 409: Ingestion credential nonce was already used
  • 429: Per-source analytics ingestion quota exceeded
  • 503: Analytics ingestion credentials are not configured

Reviewer endpoints

Authenticated reviewer endpoints for review queue actions.

GET/reviewer/me

Fetch the authenticated reviewer principal

Bearer auth
Operation ID
fetchReviewerPrincipal
Request body
No request body

Responses

  • 200: Reviewer principal
GET/reviewer/games

List reviewer queue records

Bearer auth
Operation ID
listReviewerGames
Request body
No request body

Parameters

  • status (query, optional)

Responses

  • 200: Reviewer queue records
POST/reviewer/games/{gameId}/versions/{version}/approve

Approve a submitted game version

Bearer auth
Operation ID
approveReviewerGameVersion
Request body
application/json: ReviewDecisionRequest

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Approved registry record
POST/reviewer/games/{gameId}/versions/{version}/reject

Reject a submitted game version

Bearer auth
Operation ID
rejectReviewerGameVersion
Request body
application/json: ReviewDecisionRequest

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Rejected registry record
POST/reviewer/games/{gameId}/versions/{version}/publish

Publish an approved game version

Bearer auth
Operation ID
publishReviewerGameVersion
Request body
No request body

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Published registry record
PUT/reviewer/games/{gameId}/versions/{version}/metadata

Correct structured game version metadata before publish

Bearer auth
Operation ID
updateReviewerGameVersionMetadata
Request body
application/json: GameMetadataUpdateRequest

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Updated registry record with corrected metadata
  • 400: Metadata did not satisfy the manifest taxonomy
  • 409: Published metadata requires a new version

Admin endpoints

Admin-only role management and platform reporting endpoints.

GET/admin/roles

List reviewer and admin role assignments

Bearer auth
Operation ID
listRoleAssignments
Request body
No request body

Responses

  • 200: Role assignments
POST/admin/games/{gameId}/versions/{version}/unpublish

Take down a published game version

Bearer auth
Operation ID
takeDownGameVersion
Request body
application/json: object

Parameters

  • gameId (path, required)
  • version (path, required)

Responses

  • 200: Unpublished registry record
  • 403: Admin role required
  • 404: Game version not found
GET/admin/analytics

Fetch platform-wide analytics summaries

Bearer auth
Operation ID
fetchAdminAnalytics
Request body
No request body

Parameters

  • from (query, optional)
  • to (query, optional)
  • gameId (query, optional)
  • creatorId (query, optional)
  • version (query, optional)
  • status (query, optional)

Responses

  • 200: Platform analytics summary
  • 400: Invalid filter
  • 401: Missing authentication
  • 403: Admin role required
GET/admin/reviews

List private game reviews

Bearer auth
Operation ID
listAdminGameReviews
Request body
No request body

Parameters

  • gameId (query, optional)
  • limit (query, optional)
  • cursor (query, optional)

Responses

  • 200: Newest-first review page
  • 400: Pagination parameters are invalid
  • 401: Missing authentication
  • 403: Admin role required
GET/admin/payouts

Fetch estimated payout summaries

Bearer auth
Operation ID
fetchAdminPayouts
Request body
No request body

Parameters

  • from (query, required)
  • to (query, required)
  • gameId (query, optional)
  • creatorId (query, optional)
  • version (query, optional)

Responses

  • 200: Estimated payout summary
  • 400: Invalid payout period
  • 403: Admin role required
GET/admin/payouts/export

Export estimated payout summaries

Bearer auth
Operation ID
exportAdminPayoutsCsv
Request body
No request body

Parameters

  • from (query, required)
  • to (query, required)
  • gameId (query, optional)
  • creatorId (query, optional)
  • version (query, optional)

Responses

  • 200: CSV estimated payout summary
  • 403: Admin role required
PUT/admin/roles/{userId}

Replace a user's managed role assignments

Bearer auth
Operation ID
updateRoleAssignment
Request body
application/json: object

Parameters

  • userId (path, required)

Responses

  • 200: Updated role assignment