FiveM API Reference (HTTP & Server List)

All known FiveM / Cfx.re API endpoints. Every endpoint listed here was tested live on 2026-09-16.

Sources: docs.fivem.net , servers.fivem.net  (production frontend bundle analyzed), github.com/citizenfx/fivem , github.com/citizenfx/fivem-docs , HAMz-Project/FiveM-Api  (deprecated), Livvux/fivem-api 

Legend: ✅ verified · ⚠️ alive, but restricted/needs auth · ❌ dead/unreachable

AI agents: This reference is also available as an installable Agent Skill  — it teaches agents the correct endpoints and blocks the deprecated ones. Install with:

git clone https://github.com/Livvux/fivem-api.git && cp -r fivem-api/skill/fivem-api ~/.agents/skills/

1. Live Server HTTP API (every FXServer instance)

Every running FXServer exposes these endpoints on its game port (default 30120). Source: citizenfx/fivem → code/components/citizen-server-impl/src/InfoHttpHandler.cpp (officially referenced in the Server Commands docs ).

1.1 GET http://{ip:port}/info.json ✅

Static server information.

{
  "enforceSteamAuth": false,
  "enhancedHostSupport": true,
  "icon": "iVBORw0KGgo... (base64 PNG, 96x96)",
  "resources": ["resourceA", "resourceB", "..."],
  "vars": {
    "sv_maxclients": "2048",
    "sv_projectName": "...",
    "sv_projectDesc": "...",
    "sv_enforceGameBuild": "3258",
    "sv_scriptHookAllowed": "false",
    "gamename": "gta5",
    "locale": "en-EU",
    "onesync_enabled": "true"
  },
  "serverVersion": "..."
}

1.2 GET http://{ip:port}/dynamic.json ✅

Dynamic, polling-friendly information (used by the server browser).

{
  "clients": 5,
  "gametype": "Minigames, Races, PvP, and Free Mode",
  "hostname": "^5Example Server: ...",
  "iv": "177307322",
  "mapname": "Various",
  "sv_maxclients": "2048"
}

1.3 GET http://{ip:port}/players.json ✅

Player list.

[
  { "endpoint": "1.2.3.4", "id": 1, "identifiers": ["license:...", "steam:...", "discord:..."], "name": "PlayerName", "ping": 45 },
  { "endpoint": "127.0.0.1", "id": 0, "identifiers": [], "name": "Player", "ping": 0 }
]

⚠️ The endpoint (IP) is hidden with sv_endpointPrivacy true. ❗ identifiers are only fully populated when querying your own server — the server list API strips/anonymizes them.

1.4 GET http://{ip:port}/perf ✅

Prometheus text-format metrics (tick times, RAM, players, etc.).

# HELP tickTime Time spent on server ticks
# TYPE tickTime histogram
tickTime_count{name="svMain"} 78247

Auth (optional): sv_prometheusBasicAuthUser / sv_prometheusBasicAuthPassword in server.cfg. Also polled by txAdmin.

1.5 Important notes

• sv_requestParanoia ≥ 2 blocks all .json endpoints for browser-like requests (response: "Nope.").
• The .json endpoints are part of the FXServer core — always available, no resource required.
• Ports: TCP 30120 = HTTP/file server, UDP 30120 = game/RCon.

2. Server List API (backend of servers.fivem.net)

The frontend at servers.fivem.net is an SPA; the actual API lives on frontend.cfx-services.net (extracted from the production bundle).

Base URL: https://frontend.cfx-services.net/api/servers

2.1 All servers (master list) ✅

GET https://frontend.cfx-services.net/api/servers/streamRedir/
  → 302 redirect to:
GET https://frontend.cfx-services.net/api/servers/stream/{unixTimestamp}/
  → 200, ~20 MB response

• Format: Protobuf (no longer JSON!). Layout: repeated […4-byte LE length…][master.Server message].
• Schema see section 3.
• ⚠️ Scale: tens of thousands of servers, ~20 MB download. Not suitable for polling.
• ❌ The old URL https://servers-frontend.fivem.net/api/servers/streamRedir (no trailing slash, old host) returns 404.

2.2 Single server ✅

GET https://frontend.cfx-services.net/api/servers/single/{hashId}

{hashId} = short ID from the server list, identical to the cfx.re/join/{hashId} connect code (e.g. moyejq).

Response shape (identical to info.json):

{
  "EndPoint": "moyejq",
  "Data": {
    "hostname": "^5Example Server: ...",
    "gametype": "...",
    "mapname": "...",
    "clients": 6,
    "sv_maxclients": 2048,
    "svMaxclients": 2048,
    "server": "FXServer-master v1.0.0.35945 linux",
    "enhancedHostSupport": true,
    "iconVersion": -1292580404,
    "vars": { "gamename": "gta5", "locale": "en-EU" },
    "connectEndPoints": ["79.127.215.11:30120"],
    "players": [ { "name": "...", "identifiers": ["..."], "ping": 0, "id": 0, "endpoint": "..." } ]
  }
}

GET …/single/{ip:port} with the legacy address form returns 404 Not Found — only hash IDs are accepted.

2.3 Server icon ✅ (URL pattern from the frontend bundle)

GET https://frontend.cfx-services.net/api/servers/icon/{joinId}/{iconVersion}.png

iconVersion comes from Data.iconVersion (cache-busting int).

2.4 Featured / spotlight servers ✅

GET https://gss.cfx-services.net/v1/public/featured-servers/fivem

{
  "home_page_server": { "type": "collection", "name": "Example Collection", "hash_ids": ["moyejq", "7bb4dpe"] },
  "servers": [
    { "type": "single", "name": "FiveM Test Server", "hash_id": "y4lg95" },
    { "type": "collection", "name": "RSM Freeroam", "hash_ids": ["vjarme", "wqxomp"] }
  ]
}

Featured server criteria: docs.fivem.net/docs/server-manual/featured-server-list/  (handpicked, no applications accepted).

2.5 Tweets (displayed on the server list) ✅

GET https://gss.cfx-services.net/v1/public/tweets

2.6 Upvote API ⚠️

https://servers-frontend.fivem.net/api/upvote/   → 403 (requires Cfx.re session token)

Only usable from the game/frontend context with auth. Not a public endpoint.

3. Protobuf Schema (master)

Extracted from the servers.fivem.net production bundle (protobuf.js runtime).

syntax = "proto3";
package master;
 
message Player {
  string name = 1;
  repeated string identifiers = 2;
  string endpoint = 3;
  int32 ping = 4;
  int32 id = 5;
}
 
message ServerData {
  int32 svMaxclients = 1;
  int32 clients = 2;
  int32 protocol = 3;
  string hostname = 4;
  string gametype = 5;
  string mapname = 6;
  repeated string resources = 8;
  string server = 9;                 // e.g. "FXServer-master v1.0.0.35945 linux"
  repeated Player players = 10;
  int32 iconVersion = 11;
  map<string, string> vars = 12;
  bool enhancedHostSupport = 16;
  int32 upvotePower = 17;
  repeated string connectEndPoints = 18;
  int32 burstPower = 19;
}
 
message Server {
  string EndPoint = 1;               // hash ID or endpoint
  ServerData Data = 2;
  int32 id = 3;                      // internal list field (joinId)
}

Stream container format: u32 (LE) message length, followed by exactly that many bytes of Server message — repeated until end of stream.

4. Cfx.re Runtime & Infrastructure Endpoints

All GET, public, no auth.

4.1 Player counters

4.2 Pinned / promoted / blacklist

4.3 Pool size limits (for increase_pool_size)

4.4 Natives dumps

4.5 Server artifacts & changelog ✅

GET https://changelogs-live.fivem.net/api/changelog/versions/{win32|linux}/server

{
  "critical": "7290",
  "recommended": "35245",
  "optional": "7290",
  "latest": "35945",
  "critical_txadmin": "7.0.0",
  "critical_download": "https://runtime.fivem.net/artifacts/fivem/build_server_windows/master/7290-<hash>/server.zip",
  "recommended_download": "https://runtime.fivem.net/artifacts/fivem/build_server_windows/master/35245-<hash>/server.zip",
  "latest_download": "..."
}

• Single build: GET …/api/changelog/versions/win32/server/{buildNumber} (build number, not version string).
• Client artifacts analog: https://runtime.fivem.net/artifacts/fivem/ (directory listing).

4.6 Policy / user info

5. Forum / Account API (forum.cfx.re = Discourse)

Base: https://forum.cfx.re — standard Discourse API endpoints. Without login cookies, session endpoints return 404/403.

6. Server Management (not an HTTP REST API, but relevant)

6.1 RCon

• Activation: rcon_password <pw> in server.cfg — FXServer RCon runs over UDP on the game port.
• Custom RCon commands: RegisterCommand (server-side) or the legacy rconCommand event.

6.2 Most important server commands (via RCon/console)

start/stop/ensure/restart [resource], refresh, exec [file], quit [reason], status, clientkick [id] [reason], say [msg], svgui → Full list: Server Commands 

6.3 txAdmin

• Local web API at http://localhost:40120/ (token in txData/txAdmin/cache/*.key).
• Remote REST API: https://txadmin.cfx.re (only with the server’s txAdmin token).

7. Status of the old HAMz-Project/FiveM-Api list (tested 2026-09-16)

8. Usage Notes

1. Rate limits: Cfx.re does not publish documented public limits, but aggressive polling (especially of the 20 MB stream endpoint) leads to IP blocks. For live status: always poll info.json/dynamic.json directly on the target server, never the master list.
2. Protobuf decoding: The master list requires custom decoding (schema in section 3). The convenient path for single servers: single/{hashId} (JSON).
3. Player data in the master list: players[].identifiers are anonymized/empty there — full identifiers only via your own server (players.json on-site).
4. cfx.re/join/{hashId} resolves to the server (200 ✅) — usable for connect buttons in your own tools.
5. Official support exists for none of these endpoints — they are unofficial, except the .json//perf endpoints of your own server and those referenced in the docs.