> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.wynncraft.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.wynncraft.com/_mcp/server.

# API Privacy

## Access Rules

Since the release of the user system in August 2025, players linked to a Wynncraft Account can manage API access with Access Rules.

Access Rules define who can read a player's stats:

| Rule Option     | Description                                                                         |
| --------------- | ----------------------------------------------------------------------------------- |
| Public          | Everyone can access the data.                                                       |
| Friends         | Only friended players can access the data. Friendship must be mutual.               |
| Guild           | Only players sharing the same guild can access the data.                            |
| Guild & Friends | Only players who are both in the same guild and mutual friends can access the data. |
| Private         | Nobody can access the data except the player.                                       |

All linked players on the requesting Wynncraft Account are used when checking access. For example, if you request `Player A` whose rule is set to Friends, access is granted if any player linked to your account is mutual friends with `Player A`.

Player stat responses include a `restrictions` dictionary. Each key maps to an access rule used by the endpoint. A value of `true` means that field group is restricted for the requester.

```json
{
  "restrictions": {
    "mainAccess": true,
    "characterDataAccess": false
  }
}
```

## Rule List

| Rule                    | Description                                              | Default         |
| ----------------------- | -------------------------------------------------------- | --------------- |
| `mainAccess`            | Controls access to global data and featured stats.       | Public          |
| `characterListAccess`   | Controls access to the character list.                   | Public          |
| `characterDataAccess`   | Controls access to character data.                       | Public          |
| `characterBuildAccess`  | Controls access to skill points and ability trees.       | Public          |
| `huntedCharacterAccess` | Controls access to characters using the hunted gamemode. | Guild & Friends |
| `onlineStatus`          | Controls online status and last join visibility.         | Public          |
| `guildHistoryAccess`    | Controls the access to your guild history.               | Public          |

## OAuth2

OAuth2 applications can only bypass access rules when the user explicitly granted permission for it.

That bypass is limited to the authorizing user's own linked player profiles. It does not let the application bypass another player's access rules just because one of the user's profiles would normally be eligible to view that player.

## Character Skeleton Customization

Players can customize the skeleton of their character data. Removing a stat hides it from everyone except the player.

Character responses include `removedStat`, an array of hidden stats.

```json
{
  "removedStat": [
    "contentCompletion",
    "chestsFound"
  ]
}
```

## Leaderboard Visibility

Players can opt out of specific leaderboards. This does not remove their records entirely; instead, the record is anonymized and fields such as username, UUID, and character type can be replaced with `redacted`.

Leaderboard records expose this with the `restricted` key.

> **Warning**
>
> Using the API to save player stats is allowed, but it must not be used to bypass player access rules.