FiveM API Reference (HTTP & Server List)

HTTP endpoints, server-list services, runtime downloads, account interfaces and management surfaces catalogued in Livvux/fivem-api at 6d0a4ff. This page covers that repository’s complete endpoint inventory, including restricted and deprecated interfaces. For scripting functions, use the native function reference, Lua API and JavaScript runtime helpers.

Reviewed on 2026-10-22. The source repository’s last full manual endpoint test was 2026-09-16. Its historical statuses below do not establish current availability. Current source corrections and a limited public smoke check are recorded in verification and limits.

Sources: docs.fivem.net , servers.fivem.net  (production frontend bundle analyzed), github.com/citizenfx/fivem , github.com/citizenfx/fivem-docs , HAMz-Project/FiveM-Api  (deprecated), Livvux/fivem-api 

Legend for the September snapshot: ✅ responded then · ⚠️ restricted/auth required then · ❌ unavailable then. These symbols are historical observations, not live status indicators or proof of permanent removal.

AI agents: This reference is also available as an installable Agent Skill  — it teaches agents the correct endpoints and blocks the deprecated ones. Install with:

Copy code

git clone https://github.com/Livvux/fivem-api.git && cp -r fivem-api/skill/fivem-api ~/.agents/skills/

1. Live Server HTTP API (every FXServer instance)

FXServer implements these endpoints on its configured HTTP/game port (default 30120). Firewall, proxy, request filtering and authentication settings can restrict access. Source: citizenfx/fivem → code/components/citizen-server-impl/src/InfoHttpHandler.cpp (officially referenced in the Server Commands docs ).

1.1 GET http://{ip:port}/info.json ✅

Static server information.

{
  "enforceSteamAuth": false,
  "enhancedHostSupport": true,
  "icon": "iVBORw0KGgo... (base64 PNG, 96x96)",
  "resources": ["resourceA", "resourceB", "..."],
  "vars": {
    "sv_maxclients": "2048",
    "sv_projectName": "...",
    "sv_projectDesc": "...",
    "sv_enforceGameBuild": "3258",
    "sv_scriptHookAllowed": "false",
    "gamename": "gta5",
    "locale": "en-EU",
    "onesync_enabled": "true"
  },
  "serverVersion": "..."
}

1.2 GET http://{ip:port}/dynamic.json ✅

Dynamic, polling-friendly information (used by the server browser).

{
  "clients": 5,
  "gametype": "Minigames, Races, PvP, and Free Mode",
  "hostname": "^5Example Server: ...",
  "iv": "177307322",
  "mapname": "Various",
  "sv_maxclients": "2048"
}

1.3 GET http://{ip:port}/players.json ✅

Player list. In the reviewed FXServer source , an unauthenticated request receives one anonymized entry per connected player:

[
  { "endpoint": "127.0.0.1", "id": 0, "identifiers": [], "name": "Player", "ping": 0 }
]

An authorized request supplies the server’s sv_playersToken through the X-Players-Token header or ?token= query parameter. The private payload includes actual player IDs, names, identifiers and ping; endpoint remains 127.0.0.1. Prefer the header over a query string so the token is not included in URL logs. Keep this request on a trusted backend and protect its response.

sv_endpointPrivacy and sv_exposePlayerIdentifiersInHttpEndpoint are removed in that source revision. Being on your own server or the same network does not replace token authentication. Older deployed artifacts may behave differently; this is a source contract, not a live FXServer fixture test.

1.4 GET http://{ip:port}/perf ✅

Prometheus text-format metrics (tick times, RAM, players, etc.).

# HELP tickTime Time spent on server ticks
# TYPE tickTime histogram
tickTime_count{name="svMain"} 78247

Auth (optional): sv_prometheusBasicAuthUser / sv_prometheusBasicAuthPassword in server.cfg. Also polled by txAdmin.

1.5 Important notes

• In the reviewed source, sv_requestParanoia blocks requests with a Via header at level 1 or above, or an Upgrade-Insecure-Requests header at level 2 or above. The JSON handlers return HTTP 403 with Nope.; level 3 also closes the socket.
• The .json handlers are part of FXServer core and require no resource; this does not guarantee public access.
• Ports: TCP 30120 = HTTP/file server, UDP 30120 = game/RCon.

2. Server List API (backend of servers.fivem.net)

The frontend at servers.fivem.net is an SPA; the actual API lives on frontend.cfx-services.net (extracted from the production bundle).

Base URL: https://frontend.cfx-services.net/api/servers

2.1 All servers (master list) ✅

GET https://frontend.cfx-services.net/api/servers/streamRedir/
  → 302 redirect to:
GET https://frontend.cfx-services.net/api/servers/stream/{unixTimestamp}/
  → 200, ~20 MB response

• Format: Protobuf (no longer JSON!). Layout: repeated […4-byte LE length…][master.Server message].
• Schema see section 3.
• ⚠️ Scale: tens of thousands of servers, ~20 MB download. Not suitable for polling.
• ❌ The old URL https://servers-frontend.fivem.net/api/servers/streamRedir (no trailing slash, old host) returns 404.

2.2 Single server ✅

GET https://frontend.cfx-services.net/api/servers/single/{hashId}

{hashId} = short ID from the server list, identical to the cfx.re/join/{hashId} connect code (e.g. moyejq).

Illustrative response envelope. Data combines server-list fields; it is not identical to the direct info.json response. Fields and availability vary:

{
  "EndPoint": "moyejq",
  "Data": {
    "hostname": "^5Example Server: ...",
    "gametype": "...",
    "mapname": "...",
    "clients": 6,
    "sv_maxclients": 2048,
    "svMaxclients": 2048,
    "server": "FXServer-master v1.0.0.35945 linux",
    "enhancedHostSupport": true,
    "iconVersion": -1292580404,
    "vars": { "gamename": "gta5", "locale": "en-EU" },
    "connectEndPoints": ["79.127.215.11:30120"],
    "players": [ { "name": "Player", "identifiers": [], "ping": 0, "id": 0, "endpoint": "127.0.0.1" } ]
  }
}

Use a current join ID, not an ip:port address. The historical example moyejq returned 404 in the 2026-10-22 smoke check; an expired fixture does not prove removal of the endpoint.

2.3 Server icon ✅ (URL pattern from the frontend bundle)

GET https://frontend.cfx-services.net/api/servers/icon/{joinId}/{iconVersion}.png

iconVersion comes from Data.iconVersion (cache-busting int).

2.4 Featured / spotlight servers ✅

GET https://gss.cfx-services.net/v1/public/featured-servers/fivem

{
  "home_page_server": { "type": "collection", "name": "Example Collection", "hash_ids": ["moyejq", "7bb4dpe"] },
  "servers": [
    { "type": "single", "name": "FiveM Test Server", "hash_id": "y4lg95" },
    { "type": "collection", "name": "RSM Freeroam", "hash_ids": ["vjarme", "wqxomp"] }
  ]
}

Featured server criteria: docs.fivem.net/docs/server-manual/featured-server-list/  (handpicked, no applications accepted).

2.5 Tweets (displayed on the server list) ✅

GET https://gss.cfx-services.net/v1/public/tweets

2.6 Upvote API ⚠️

https://servers-frontend.fivem.net/api/upvote/   → 403 (requires Cfx.re session token)

Only usable from the game/frontend context with auth. Not a public endpoint.

3. Protobuf Schema (master)

Extracted from the servers.fivem.net production bundle (protobuf.js runtime).

syntax = "proto3";
package master;
 
message Player {
  string name = 1;
  repeated string identifiers = 2;
  string endpoint = 3;
  int32 ping = 4;
  int32 id = 5;
}
 
message ServerData {
  int32 svMaxclients = 1;
  int32 clients = 2;
  int32 protocol = 3;
  string hostname = 4;
  string gametype = 5;
  string mapname = 6;
  repeated string resources = 8;
  string server = 9;                 // e.g. "FXServer-master v1.0.0.35945 linux"
  repeated Player players = 10;
  int32 iconVersion = 11;
  map<string, string> vars = 12;
  bool enhancedHostSupport = 16;
  int32 upvotePower = 17;
  repeated string connectEndPoints = 18;
  int32 burstPower = 19;
}
 
message Server {
  string EndPoint = 1;               // hash ID or endpoint
  ServerData Data = 2;
  int32 id = 3;                      // internal list field (joinId)
}

Stream container format: u32 (LE) message length, followed by exactly that many bytes of Server message — repeated until end of stream.

4. Cfx.re Runtime & Infrastructure Endpoints

The endpoints below were catalogued as GET requests. Public runtime downloads are distinct from the user-policy service; availability and access rules can change.

4.1 Player counters

4.2 Pinned / promoted / blacklist

4.3 Pool size limits (for increase_pool_size)

4.4 Natives dumps

4.5 Server artifacts & changelog ✅

GET https://changelogs-live.fivem.net/api/changelog/versions/{win32|linux}/server

{
  "critical": "7290",
  "recommended": "35245",
  "optional": "7290",
  "latest": "35945",
  "critical_txadmin": "7.0.0",
  "critical_download": "https://runtime.fivem.net/artifacts/fivem/build_server_windows/master/7290-<hash>/server.zip",
  "recommended_download": "https://runtime.fivem.net/artifacts/fivem/build_server_windows/master/35245-<hash>/server.zip",
  "latest_download": "..."
}

• Single build: GET …/api/changelog/versions/win32/server/{buildNumber} (build number, not version string).
• Client artifacts analog: https://runtime.fivem.net/artifacts/fivem/ (directory listing).

4.6 Policy / user info

5. Forum / Account API (forum.cfx.re = Discourse)

Base: https://forum.cfx.re — Discourse interfaces catalogued by the source repository. Session and account operations depend on authorization, CSRF protection and the current forum configuration. The routes and activation headers below are historical observations, not a supported account automation contract; account mutations were not exercised during this review.

6. Server Management (not an HTTP REST API, but relevant)

6.1 RCon

• Activation: rcon_password <pw> in server.cfg — FXServer RCon runs over UDP on the game port.
• Custom RCon commands: RegisterCommand (server-side) or the legacy rconCommand event.

6.2 Most important server commands (via RCon/console)

start/stop/ensure/restart [resource], refresh, exec [file], quit [reason], status, clientkick [id] [reason], say [msg], svgui → Full list: Server Commands 

6.3 txAdmin

• txAdmin’s web panel commonly uses port 40120; configure its interface and port for your installation. See txAdmin setup.
• The source repository’s claims about a cache/*.key token and a general remote REST API at https://txadmin.cfx.re were not substantiated by the reviewed official documentation. Do not build an integration around them.
• The current official environment configuration  documents /host/status: TXHOST_API_TOKEN enables access through the x-txadmin-envtoken header or ?envtoken=. With no token configured this endpoint is disabled; the literal value disabled makes it public. This is a specific host-status interface, not a general administration API.

7. Status of the old HAMz-Project/FiveM-Api list (tested 2026-09-16)

8. Client / In-Game APIs

These scripting surfaces are not HTTP endpoints:

• Native functions: client/server native lookup and official declarations.
• Lua functions and JavaScript runtime helpers: runtime-specific functions and contracts.
• Client events and server events, including playerConnecting, playerDropped and legacy rconCommand.
• State bags and OneSync: replicated state and server synchronization. See the official scripting reference  for the upstream catalog.

9. Usage Notes

1. Polling: Cache responses, use timeouts and back off on 429 or service errors. Rate limits vary by service; the reviewed FXServer source also has per-endpoint limiters. Use your controlled server for live status and avoid repeatedly downloading the bulk master list.
2. Protobuf decoding: The master list requires custom decoding (schema in section 3). The convenient path for single servers: single/{hashId} (JSON).
3. Player data: Public player entries are anonymized in the reviewed FXServer source. Private players.json data requires sv_playersToken; see section 1.3.
4. Join links: Use https://cfx.re/join/{hashId} for a current server join code; do not assume old sample IDs still exist.
5. Official support exists for none of these endpoints — they are unofficial, except the .json//perf endpoints of your own server and those referenced in the docs.

10. Verification and Limits

The 2026-10-22 review compared every endpoint family in the pinned source README with this page: direct server HTTP, server list/icons/featured/tweets/upvotes, Protobuf schema, runtime counters/pins/promotions/blacklist/pools/native dumps/artifacts/policy, forum/account routes, RCon/commands/txAdmin, deprecated routes, scripting surfaces and the agent skill.

• Source verification: Player privacy, token authentication and request filtering were checked against FXServer ccd9221. Deployed artifacts can lag upstream.
• Limited live smoke check: Linux and Windows server changelogs, featured servers, tweets and FiveM pool limits passed the source repository’s basic JSON checks. FiveM and RedM counter URLs returned HTTP 200 JSON arrays, which failed that monitor’s object-only expectation. The sample single-server ID returned 404. These results do not establish all response-field semantics.
• Not retested live: Controlled FXServer endpoints, the bulk stream and its schema, icons, remaining downloads, policy/account/session/upvote operations, RCon and authenticated txAdmin. No player lists, credentials or account mutations were fetched. The Protobuf schema remains the source repository’s historical extraction, not a newly verified wire contract.
• Ongoing checks: The source repository provides a daily monitor  and documents its scope and commands . It checks selected small public JSON responses, not the entire API. Access restrictions, rate limits, timeouts and server errors require investigation; they do not establish deprecation.