Introduction

The PRL API lets verified servers submit moderation events and query the shared reputation database. Base URL: https://lookup.crunchbyte.org/api

Write endpoints require a verified server with an API key and secret. Read endpoints (player lookup, search, stats) are public.

Authentication

Write endpoints require these headers on every request:

API keys and secrets are generated in Server Settings. The secret is never sent in requests - only used locally to compute the signature.

Reputation tiers

Players start at score 100. Events lower the score. Revocations restore the delta of the original event.

Score deltas: BAN -30, KICK -10, WARN -5.

Submit moderation event

Records a ban, kick, warn, or note against a player. Requires a verified server and HMAC auth.

Request body

POST /api/moderation/submit
X-Api-Key: prl_xxxxxxxxxxxx
X-Signature: <hmac-sha256-hex>
X-Nonce: a1b2c3d4-e5f6
Content-Type: application/json

{
  "player_id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "BAN",
  "reason": "Cheating - aimbot detected",
  "moderator_id": "123456789012345678",
  "identities": {
    "discord": "123456789012345678",
    "fivem_license": "license:abc123def456"
  }
}

{
  "success": true,
  "event_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "idempotent": false
}

Player lookup

Returns player profile by any known identifier. Public - no authentication required. Note: moderator_id fields are redacted in unauthenticated responses. Log in with Discord to see them.

Player search

Searches players by alias or FiveM license. Public. Discord IDs and hardware identifiers are not searchable to prevent enumeration. Identity values in results are partially masked. Returns up to 10 results.

Server info

Returns registration and verification status. Requires a Discord OAuth session.

Global stats

Returns public network-wide counters, cached for 60 seconds.

{
  "verified_servers": 12,
  "players_tracked": 8432,
  "moderation_events": 1621
}

HMAC signing

Compute HMAC-SHA256 over the raw JSON body using your API secret as the key. Hex-encode the result.

Node.js

const crypto = require('crypto');

function sign(secret, body) {
  const payload = typeof body === 'string' ? body : JSON.stringify(body);
  return crypto.createHmac('sha256', secret).update(payload).digest('hex');
}

headers['X-Signature'] = sign(apiSecret, requestBody);
headers['X-Nonce']     = crypto.randomUUID();

Python

import hmac, hashlib, json, uuid

def sign(secret, body):
    payload = json.dumps(body, separators=(',', ':'))
    return hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()

headers = {
    'X-Api-Key':   api_key,
    'X-Signature': sign(api_secret, body),
    'X-Nonce':     str(uuid.uuid4()),
}

Lua (FiveM)

-- prl-client handles this automatically via server/hmac.lua
-- Manual call:
local signature = PRL.HMAC(PRL.Config.ApiSecret, requestBody)

FiveM resource

The prl-client resource is the fastest integration path - it hooks txAdmin events automatically with zero extra code.

Installation

1. Download prl-client.rar from your dashboard
2. Extract to resources/prl-client/
3. Edit config.lua with your API key and secret
4. Add to server.cfg:   ensure prl-client
5. Restart and run /prltest in-game to confirm

Manual exports

exports['prl-client']:SubmitBan(playerId, reason, moderatorId)
exports['prl-client']:SubmitKick(playerId, reason, moderatorId)
exports['prl-client']:SubmitWarn(playerId, reason, moderatorId)