Public API v1

Server-to-server only. Send Authorization: Bearer rl_live_…. There is no CORS and no write access. Get a key from the developer dashboard.

Endpoints

POST /api/v1/decks/check — one deck code
POST /api/v1/lineups/check — exactly three deck codes
GET /api/v1/format — published tags, rules, and version

Legality status

Use status, not only legal. needs_designation means an otherwise legal deck still needs an Expression choice. Do not count those as illegal for stats.

Successful responses include validationData. Compare its format, catalog digest, Origin membership, and legality-contract versions when deciding whether a cached result is still current.

Examples

curl -X POST "$ORIGIN/api/v1/decks/check" \
  -H "Authorization: Bearer rl_live_…" \
  -H "Content-Type: application/json" \
  -d '{"deckCode":"CEAAAAA"}'

curl -X POST "$ORIGIN/api/v1/lineups/check" \
  -H "Authorization: Bearer rl_live_…" \
  -H "Content-Type: application/json" \
  -d '{"deckCodes":["CODE1","CODE2","CODE3"]}'

curl "$ORIGIN/api/v1/format" \
  -H "Authorization: Bearer rl_live_…"

Machine-readable contract: OpenAPI 3.1. Privacy details are on the privacy page.