API Privacy

Access Rules

Since the release of the user system in August 2025, players linked to a Wynncraft Account can manage API access with Access Rules.

Access Rules define who can read a player’s stats:

All linked players on the requesting Wynncraft Account are used when checking access. For example, if you request Player A whose rule is set to Friends, access is granted if any player linked to your account is mutual friends with Player A.

Player stat responses include a restrictions dictionary. Each key maps to an access rule used by the endpoint. A value of true means that field group is restricted for the requester.

1
{
2
  "restrictions": {
3
    "mainAccess": true,
4
    "characterDataAccess": false
5
  }
6
}

Rule List

OAuth2

OAuth2 applications can only bypass access rules when the user explicitly granted permission for it.

That bypass is limited to the authorizing user’s own linked player profiles. It does not let the application bypass another player’s access rules just because one of the user’s profiles would normally be eligible to view that player.

Character Skeleton Customization

Players can customize the skeleton of their character data. Removing a stat hides it from everyone except the player.

Character responses include removedStat, an array of hidden stats.

1
{
2
  "removedStat": [
3
    "contentCompletion",
4
    "chestsFound"
5
  ]
6
}

Leaderboard Visibility

Players can opt out of specific leaderboards. This does not remove their records entirely; instead, the record is anonymized and fields such as username, UUID, and character type can be replaced with redacted.

Leaderboard records expose this with the restricted key.