Anti-Cheat Integration API

The Data API is read-only, and so is the rest of the public API — tournament and match management stay dashboard- and player-authenticated actions. The anti-cheat integration API is the one exception: a small, deliberately write-capable surface for third-party integrators — typically operators of their own game servers — to report anti-cheat activity into a project.

If you're integrating your own server infrastructure with TournamentSuite's anti-cheat pipeline rather than just reading tournament data, this is the surface you want.

What it's for

This API lets a third-party integrator:

• Start and end an anti-cheat monitoring session for a match running on their own infrastructure
• Retrieve the anti-cheat detections raised for their project
• Request a presigned URL to upload evidence (screenshots, logs, or other artifacts) tied to a session

It does not create or manage tournaments or matches — a session is associated with a matchId, but nothing on this surface can create, start, or resolve a match itself. If you need those actions, see Matches; the tournament/match write endpoints described there require an organizer or player session token, not an API key, and no API key — anti-cheat or otherwise — can perform them.

Authentication and project scoping

Like every public API-key surface, requests authenticate with X-API-Key. Every anti-cheat endpoint resolves the project from the key itself — you never pass a projectId in the request body or query string, and any value you did pass would be ignored. A session, its detections, and its evidence are only ever visible to keys belonging to the project that started it.

Scopes

Three dedicated scopes gate this surface — they aren't shared with any Data API scope:

Grant only the scope(s) an integration needs — a server that only forwards session start/end events has no reason to hold anticheat:evidence.write.

Plan entitlement

Starting and ending a session additionally requires your project's plan to include the anti-cheat capability — a key with anticheat:session.write on a plan without it still receives a 403 Forbidden from those two endpoints. The detections and evidence endpoints are gated by scope only.

Starting a session

POST /api/v1/anti-cheat/sessions
X-API-Key: YOUR_API_KEY
Content-Type: application/json

{
  "game": "cs2",
  "matchId": "match-uuid",
  "participants": [
    { "userId": "user-uuid-1" },
    { "userId": "user-uuid-2" }
  ]
}

game identifies which title's anti-cheat client to expect (cs2, valorant, apex, dota2, or rl). matchId is optional — omit it and the API generates one for you. participants lists the users the session should monitor; only participants who already have an enrolled, non-revoked anti-cheat client for your project are actually wired into the session, so the response may cover fewer clients than you requested.

{
  "sessionId": "match-uuid",
  "matchId": "match-uuid"
}

Ending a session

POST /api/v1/anti-cheat/sessions/:sessionId/end
X-API-Key: YOUR_API_KEY
Content-Type: application/json

{
  "reason": "match_completed"
}

reason is optional free text describing why the session ended. The endpoint targets whichever active session in your project matches the given id; if no matching session row exists yet, the end request is still forwarded and is a no-op if there's nothing to end.

Listing detections

GET /api/v1/anti-cheat/detections?limit=50&unreviewedOnly=true
X-API-Key: YOUR_API_KEY

Returns detections for your project's sessions, newest first. limit is optional (capped at 200; defaults to 50); unreviewedOnly=true restricts the list to detections that haven't yet received a verdict. Each item includes the detection's rule, severity, whether an AI verdict has been recorded, how many evidence items are attached, and whether it's been reviewed — but not the evidence content itself.

Uploading evidence

Evidence upload is a two-step, presign-then-upload flow — the API never accepts file bytes directly.

POST /api/v1/anti-cheat/evidence/presign
X-API-Key: YOUR_API_KEY
Content-Type: application/json

{
  "sessionId": "session-uuid",
  "kind": "screenshot",
  "contentType": "image/png",
  "sizeBytes": 245678,
  "sha256": "…"
}

{
  "uploadUrl": "https://...",
  "mediaFileId": "media-uuid",
  "key": "anti-cheat-evidence/...",
  "expiresAt": "2026-07-23T12:05:00.000Z"
}

Upload the artifact's bytes directly to uploadUrl with a PUT request whose Content-Type and body match what you declared — the upload is checksum-locked to the sha256 you supplied, so a mismatched payload is rejected. The URL expires five minutes after issuance, so request it immediately before uploading.

The read-side complement: webhooks

This API's two writes — session lifecycle and evidence — are one direction of the integration. To be notified when TournamentSuite's anti-cheat pipeline raises a detection or finishes processing a session you started, subscribe to the corresponding webhook events rather than polling detections on a timer:

See Webhooks for subscription setup and signature verification.

Where to go next

• Data API — the read-only surface for tournament, match, and player data
• Scopes — the full scope catalog, including these three
• Webhooks — subscribe to anti-cheat detection and session events
• Matches — how matches and their lifecycle actually work