One REST API for your whole Discord security stack
RestoreCord puts backups, verified members, firewall rules and analytics behind a single JSON API at /api/v3. Script the boring parts, wire events into your own tools and keep every key scoped to one job.
Every plan includes API keys, Free too. Each account can keep five active at once.
Terminal
status-check key · READ_SERVERS
curl https://restorecord.com/api/v3/servers \
-H "Authorization: Bearer $RESTORECORD_KEY"What came back
Key accepted
Caller IP inside 203.0.113.0/24
"success": true
Servers you own or share, as JSON
Three surfaces, one integration
Keys decide what a script may touch, endpoints do the work and signed events tell your systems what just happened. Flip between them to see how they fit.
Permissions you can read at a glance
Each key gets a name, an expiry and only the permission bits its job needs. Lose the secret and you simply revoke and replace that one key.
- Twelve named permissions
- Optional IPv4, IPv6 or CIDR allowlist
- Secret displayed only at creation
release-backup
Account · API Keys · permissions
CREATE_BACKUPS
Start a snapshot before each release
READ_SERVERS
Look up the internal server ID
RESTORE_BACKUPS
Kept on a separate recovery key
SERVER_PULL
Never needed by a pipeline
Facts to build your client around
Small, stable facts that save a round of trial and error when you write the first wrapper.
Credentials
From the API Keys tab
- Header
- Authorization: Bearer
- Active keys
- Up to 5 per account
- Allowlist
- IPs or CIDR ranges
Wire format
What responses look like
- Success
- success: true
- Failure
- error.code + error.message
- Throttled
- 429 RATE_LIMITED
- Path IDs
- Internal server ID, not guild ID
- Member pull
- Server-Sent Events
Webhook logs or webhook events?
Both are called webhooks in the dashboard, but they solve different problems. Pick logs for people and events for programs.
| Webhook logs | Webhook events | |
|---|---|---|
| Delivered to | A Discord channel | Your HTTPS endpoint |
| Format | Readable messages | JSON body |
| HMAC-SHA256 signature | — | |
| Built for | Moderators | Code |
| Available on | Every plan | Enterprise |
Before you point production at it
A short preflight that catches most integration bugs before your members ever notice them.
One key per job
Separate keys for reporting, CI and firewall sync mean one revoke never breaks the others.
Secrets in a vault
Environment variables or a secret manager only, never a repo, a bundle or a Discord message.
Server IDs cached
Fetch internal server IDs once with GET /servers and store them next to your config.
401 pages a human
An expired or revoked key will not fix itself, so alert instead of retrying.
429 backs off
Wait with jitter, then retry a few times before giving up on the request.
Raw body for signatures
Hash the exact bytes received before any JSON parser touches them.
Developer guides
Long-form walkthroughs with copy-ready code for the jobs teams automate first.
Scope API keys
Map permissions to jobs, add allowlists and handle 401 versus 403.
Verify webhook signatures
A Node.js receiver that checks X-Signature-256 before trusting anything.
Snapshot from CI
Take a labelled backup in your pipeline before every deploy.
Firewall rules as code
Keep verification rules in Git and sync them through the API.
Need events today?
Webhook events ship with Enterprise. Compare plans and see what else unlocks with it.
Questions before you integrate
Ship the integration this afternoon
Sign up free, create a key with one permission and make your first request in minutes.