Admin

Challenge management, uploads, teams, verifications, submissions, settings, and admin bot service routes.

Last updated Jul 28, 2026

Route	Endpoint
Admin challenge list	`GET /api/[v2,v1]/admin/challs`
Admin challenge detail	`GET /api/[v2,v1]/admin/challs/:id`
Create or update challenge	`PUT /api/[v2,v1]/admin/challs/:id`
Delete a solve	`DELETE /api/v2/admin/challs/:challengeId/solves/:userId`
Delete a challenge	`DELETE /api/v1/admin/challs/:id`
Upload files	`POST /api/[v2,v1]/admin/upload`
Query uploads	`POST /api/[v2,v1]/admin/upload/query`
List teams	`GET /api/v2/admin/users`
Filter teams	`POST /api/v2/admin/users`
Team detail	`GET /api/v2/admin/users/:id`
Update team	`PUT /api/v2/admin/users/:id`
Delete team	`DELETE /api/v2/admin/users/:id`
Create team token	`POST /api/v2/admin/users/:id/token`
Pending verifications	`GET /api/v2/admin/user-verifications`
Complete verification	`POST /api/v2/admin/user-verifications/:id/complete`
Resend verification	`POST /api/v2/admin/user-verifications/:id/resend`
List submissions	`GET /api/v2/admin/submissions`
Filter submissions	`POST /api/v2/admin/submissions`
Read settings	`GET /api/v2/admin/settings`
Update settings	`PUT /api/v2/admin/settings`
Instancer schema	`GET /api/v2/admin/instancer/schema`
Admin bot status	`GET /api/v2/admin/admin-bot/status`
Pull admin bot job	`POST /api/v2/admin/admin-bot/jobs/pull`
Admin bot source	`GET /api/v2/admin/admin-bot/challenges/:id/source`
Complete admin bot job	`POST /api/v2/admin/admin-bot/jobs/:id/complete`
Fail admin bot job	`POST /api/v2/admin/admin-bot/jobs/:id/fail`
Admin bot queue depth	`GET /api/v2/admin/admin-bot/queue-depth`
List external-auth clients	`GET /api/v2/admin/external-auth/clients`
Create external-auth client	`POST /api/v2/admin/external-auth/clients`
Delete external-auth client	`DELETE /api/v2/admin/external-auth/clients/:id`
Delete all team solves	`DELETE /api/v2/admin/users/:userId/solves`

These admin API pages cover challenges, uploads, teams, email verification, submission logs, runtime settings, admin bot work, and external auth clients. Most user-facing routes require a user auth token with the listed permission bits. Admin bot service routes use the shared admin bot bearer token. See External auth for the user-facing half of the external auth flow.

Permissions, captcha actions, and rate limit conventions are documented in the API overview.

Permissions

Permission	Used by
`challsRead`	Reading admin challenge data, upload state, instancer schemas, admin bot status, and admin user solve history.
`challsWrite`	Updating challenges and uploading files.
`challsSolveWrite`	Removing solves.
`usersWrite`	Listing and editing teams, creating team tokens, managing pending verifications, and reading submission audit rows.
`settingsWrite`	Reading and updating runtime settings.

When a route lists more than one permission bit, the token needs every listed bit.

`GET` Admin challenge list

GET /api/[v2,v1]/admin/challs

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/challs" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminChallengesV2",
3
  "message": "The retrieval of challenges as admin was successful.",
4
  "data": [
5
    {
6
      "id": "baby-rev",
7
      "name": "baby-rev",
8
      "description": "A gentle introduction to reversing.",
9
      "category": "rev",
10
      "author": "es3n1n",
11
      "files": [
12
        {
13
          "name": "chall.zip",
14
          "url": "https://rctf.osec.io/uploads/chall.zip",
15
          "size": 2048
16
        }
17
      ],
18
      "points": {
19
        "min": 100,
20
        "max": 500
21
      },
22
      "flags": [
23
        {
24
          "provider": "flags/static",
25
          "config": {
26
            "flag": "rctf{baby_rev}"
27
          }
28
        }
29
      ],
30
      "tiebreakEligible": true,
31
      "sortWeight": null,
32
      "tags": [
33
        "beginner"
34
      ],
35
      "instancerConfig": {
36
        "challengeIntegrationId": "baby-rev",
37
        "instancer": "kubernetes",
38
        "config": null,
39
        "expose": [
40
          {
41
            "kind": "tcp",
42
            "hostPrefix": "baby-rev",
43
            "containerName": "main",
44
            "containerPort": 1337,
45
            "shouldDisplay": true,
46
            "title": "nc"
47
          }
48
        ],
49
        "timeoutMilliseconds": 600000,
50
        "extendable": true
51
      },
52
      "adminBotConfig": {
53
        "code": "admin-bot",
54
        "inputs": null,
55
        "revision": "v1",
56
        "timeoutMilliseconds": 30000,
57
        "requireInstancerInstancesRunning": false
58
      },
59
      "hidden": false,
60
      "releaseTime": null,
61
      "scoring": {
62
        "kind": "decay"
63
      },
64
      "solveCount": 12
65
    }
66
  ]
67
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

curl -sS "https://rctf.osec.io/api/v1/admin/challs" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminChallenges",
3
  "message": "The retrieval of challenges as admin was successful.",
4
  "data": [
5
    {
6
      "id": "baby-rev",
7
      "name": "baby-rev",
8
      "description": "A gentle introduction to reversing.",
9
      "category": "rev",
10
      "author": "es3n1n",
11
      "files": [
12
        {
13
          "name": "chall.zip",
14
          "url": "https://rctf.osec.io/uploads/chall.zip"
15
        }
16
      ],
17
      "points": {
18
        "min": 100,
19
        "max": 500
20
      },
21
      "flag": "rctf{baby_rev}",
22
      "tiebreakEligible": true,
23
      "sortWeight": 0
24
    }
25
  ]
26
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route shows every challenge with admin fields. Hidden and unreleased challenges are included so the admin panel can display the full challenge set.

For new clients, V2 is usually the best fit. It includes hidden state, release time, instancer config, admin bot config, and file sizes. V1 remains available for older admin tooling.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
files[].sizenumber | null: File size in bytes, or null when unknown.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flags[].providerstring: Flag validation provider that verifies this entry.
flags[].configRecord<string, any>: Provider-specific flag configuration.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber | null | undefined: Manual ordering weight, or null when unset.
tagsstring[] | null | undefined: Challenge tags, or null when unset.
instancerConfigobject | null | undefined: On-demand instancer (deployment) configuration, or null when the challenge has none.
adminBotConfigobject | null | undefined: Admin-bot configuration, or null when the challenge has no admin bot.
hiddenboolean: Whether the challenge is hidden from players.
releaseTimenumber | null | undefined: Scheduled release time as a Unix timestamp in milliseconds, or null.
scoring{ kind: "decay" } | { kind: "dynamic", source: object } | null | undefined: Scoring algorithm configuration, or null for the CTF default.
solveCountnumber | undefined: Total solves; only present on the single-challenge endpoint.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flagstring: The challenge flag.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber: Manual ordering weight, or null when unset.

V1 challenge entries do not include hidden, releaseTime, instancerConfig, adminBotConfig, or file size.

`GET` Admin challenge detail

GET /api/[v2,v1]/admin/challs/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/challs/challenge-id" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminChallengeV2",
3
  "message": "The retrieval of the challenge as admin was successful.",
4
  "data": {
5
    "id": "baby-rev",
6
    "name": "baby-rev",
7
    "description": "A gentle introduction to reversing.",
8
    "category": "rev",
9
    "author": "es3n1n",
10
    "files": [
11
      {
12
        "name": "chall.zip",
13
        "url": "https://rctf.osec.io/uploads/chall.zip",
14
        "size": 2048
15
      }
16
    ],
17
    "points": {
18
      "min": 100,
19
      "max": 500
20
    },
21
    "flags": [
22
      {
23
        "provider": "flags/static",
24
        "config": {
25
          "flag": "rctf{baby_rev}"
26
        }
27
      }
28
    ],
29
    "tiebreakEligible": true,
30
    "sortWeight": null,
31
    "tags": [
32
      "beginner"
33
    ],
34
    "instancerConfig": {
35
      "challengeIntegrationId": "baby-rev",
36
      "instancer": "kubernetes",
37
      "config": null,
38
      "expose": [
39
        {
40
          "kind": "tcp",
41
          "hostPrefix": "baby-rev",
42
          "containerName": "main",
43
          "containerPort": 1337,
44
          "shouldDisplay": true,
45
          "title": "nc"
46
        }
47
      ],
48
      "timeoutMilliseconds": 600000,
49
      "extendable": true
50
    },
51
    "adminBotConfig": {
52
      "code": "admin-bot",
53
      "inputs": null,
54
      "revision": "v1",
55
      "timeoutMilliseconds": 30000,
56
      "requireInstancerInstancesRunning": false
57
    },
58
    "hidden": false,
59
    "releaseTime": null,
60
    "scoring": {
61
      "kind": "decay"
62
    },
63
    "solveCount": 12
64
  }
65
}

1
{
2
  "kind": "badChallenge",
3
  "message": "The challenge could not be found."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

curl -sS "https://rctf.osec.io/api/v1/admin/challs/challenge-id" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminChallenge",
3
  "message": "The retrieval of the challenge as admin was successful.",
4
  "data": {
5
    "id": "baby-rev",
6
    "name": "baby-rev",
7
    "description": "A gentle introduction to reversing.",
8
    "category": "rev",
9
    "author": "es3n1n",
10
    "files": [
11
      {
12
        "name": "chall.zip",
13
        "url": "https://rctf.osec.io/uploads/chall.zip"
14
      }
15
    ],
16
    "points": {
17
      "min": 100,
18
      "max": 500
19
    },
20
    "flag": "rctf{baby_rev}",
21
    "tiebreakEligible": true,
22
    "sortWeight": 0
23
  }
24
}

1
{
2
  "kind": "badChallenge",
3
  "message": "The challenge could not be found."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route reads one challenge with admin fields. The admin panel uses it when someone opens the challenge editor.

For new clients, V2 is usually the best fit. V1 returns the older admin challenge fields and remains available for existing integrations.

Path parameters

id*string: Challenge ID.

Path parameters

id*string: Challenge ID.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
files[].sizenumber | null: File size in bytes, or null when unknown.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flags[].providerstring: Flag validation provider that verifies this entry.
flags[].configRecord<string, any>: Provider-specific flag configuration.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber | null | undefined: Manual ordering weight, or null when unset.
tagsstring[] | null | undefined: Challenge tags, or null when unset.
instancerConfigobject | null | undefined: On-demand instancer (deployment) configuration, or null when the challenge has none.
adminBotConfigobject | null | undefined: Admin-bot configuration, or null when the challenge has no admin bot.
hiddenboolean: Whether the challenge is hidden from players.
releaseTimenumber | null | undefined: Scheduled release time as a Unix timestamp in milliseconds, or null.
scoring{ kind: "decay" } | { kind: "dynamic", source: object } | null | undefined: Scoring algorithm configuration, or null for the CTF default.
solveCountnumber | undefined: Total solves; only present on the single-challenge endpoint.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flagstring: The challenge flag.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber: Manual ordering weight, or null when unset.

V1 challenge entries do not include hidden, releaseTime, instancerConfig, adminBotConfig, or file size.

`PUT` Create or update challenge

PUT /api/[v2,v1]/admin/challs/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/challs/challenge-id" \
  -X PUT \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "data": {
      "name": "web demo",
      "category": "web",
      "author": "organizers",
      "description": "Solve it.",
      "flags": [
        {
          "provider": "flags/static",
          "config": {
            "flag": "flag{example}"
          }
        }
      ],
      "points": {
        "min": 100,
        "max": 500
      },
      "tiebreakEligible": true,
      "files": [
        {
          "name": "dist.zip",
          "url": "/uploads/dist.zip",
          "size": 12345
        }
      ],
      "sortWeight": 10,
      "hidden": false,
      "releaseTime": null
    }
  }'

1
{
2
  "kind": "goodChallengeUpdateV2",
3
  "message": "Challenge successfully updated.",
4
  "data": {
5
    "id": "baby-rev",
6
    "name": "baby-rev",
7
    "description": "A gentle introduction to reversing.",
8
    "category": "rev",
9
    "author": "es3n1n",
10
    "files": [
11
      {
12
        "name": "chall.zip",
13
        "url": "https://rctf.osec.io/uploads/chall.zip",
14
        "size": 2048
15
      }
16
    ],
17
    "points": {
18
      "min": 100,
19
      "max": 500
20
    },
21
    "flags": [
22
      {
23
        "provider": "flags/static",
24
        "config": {
25
          "flag": "rctf{baby_rev}"
26
        }
27
      }
28
    ],
29
    "tiebreakEligible": true,
30
    "sortWeight": null,
31
    "tags": [
32
      "beginner"
33
    ],
34
    "instancerConfig": {
35
      "challengeIntegrationId": "baby-rev",
36
      "instancer": "kubernetes",
37
      "config": null,
38
      "expose": [
39
        {
40
          "kind": "tcp",
41
          "hostPrefix": "baby-rev",
42
          "containerName": "main",
43
          "containerPort": 1337,
44
          "shouldDisplay": true,
45
          "title": "nc"
46
        }
47
      ],
48
      "timeoutMilliseconds": 600000,
49
      "extendable": true
50
    },
51
    "adminBotConfig": {
52
      "code": "admin-bot",
53
      "inputs": null,
54
      "revision": "v1",
55
      "timeoutMilliseconds": 30000,
56
      "requireInstancerInstancesRunning": false
57
    },
58
    "hidden": false,
59
    "releaseTime": null,
60
    "scoring": {
61
      "kind": "decay"
62
    },
63
    "solveCount": 12
64
  }
65
}

1
{
2
  "kind": "badAdminBotConfig",
3
  "message": "Invalid admin bot configuration.",
4
  "data": {
5
    "error": "Unknown admin-bot config code."
6
  }
7
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badInstancerConfig",
3
  "message": "Invalid instancer configuration.",
4
  "data": {
5
    "error": "Missing expose configuration."
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

curl -sS "https://rctf.osec.io/api/v1/admin/challs/challenge-id" \
  -X PUT \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "data": {
      "name": "web demo",
      "category": "web",
      "author": "organizers",
      "description": "Solve it.",
      "flag": "flag{example}",
      "points": {
        "min": 100,
        "max": 500
      },
      "tiebreakEligible": true,
      "files": [
        {
          "name": "dist.zip",
          "url": "/uploads/dist.zip"
        }
      ],
      "sortWeight": 10
    }
  }'

1
{
2
  "kind": "goodChallengeUpdate",
3
  "message": "Challenge successfully updated.",
4
  "data": {
5
    "id": "baby-rev",
6
    "name": "baby-rev",
7
    "description": "A gentle introduction to reversing.",
8
    "category": "rev",
9
    "author": "es3n1n",
10
    "files": [
11
      {
12
        "name": "chall.zip",
13
        "url": "https://rctf.osec.io/uploads/chall.zip"
14
      }
15
    ],
16
    "points": {
17
      "min": 100,
18
      "max": 500
19
    },
20
    "flag": "rctf{baby_rev}",
21
    "tiebreakEligible": true,
22
    "sortWeight": 0
23
  }
24
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

Auth: Required
Gate: None
Permissions: challsWrite
Captcha: No captcha
Rate limit: No rate limit

This route creates a new challenge or updates an existing one. Fields left out of data keep their current values. Setting instancerConfig or adminBotConfig to null clears that integration config.

A challenge can have multiple flag entries; a submission solves the challenge when any entry validates. Each entry names a flag validation provider (flags/static when omitted, which compares the submitted flag against config.flag). Passing flags replaces the whole list. On V1, the single flag string maps to one flags/static entry: reads return the first static entry, and writes replace all entries. Extra entries created via V2 are dropped when updating through V1.

After a challenge changes, the leaderboard is recalculated. The active instancer provider validates instancerConfig, and the active admin bot provider validates adminBotConfig before saving a new revision.

Path parameters

id*string: Challenge ID.

Request body

data*object: Challenge fields to update.
data.authorstring: Challenge author.
data.categorystring: Challenge category.
data.descriptionstring: Challenge description in Markdown.
data.flagstring: Deprecated scalar flag compatibility field. Use flags instead.
data.flagsobject[]: Flag entries; a submission solves the challenge when any entry validates. Replaces the whole list.
data.flags[].providerstring: Flag validation provider that verifies this entry.
data.flags[].config*record: Provider-specific flag configuration.
data.namestring: Challenge name.
data.points.min*number: Minimum (floor) point value.
data.points.max*number: Maximum (initial) point value.
data.tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
data.files[].name*string: File name.
data.files[].url*string: File download URL.
data.files[].size*number: File size in bytes, or null when unknown.
data.sortWeightnumber: Manual ordering weight.
data.tagsstring[]: Free-form tags.
data.instancerConfigobject: On-demand instancer configuration, or null to remove it.
data.instancerConfig.challengeIntegrationIdstring: Challenge integration ID this config belongs to.
data.instancerConfig.instancerstring: Instancer to use, or the default when omitted.
data.instancerConfig.configrecord: Provider-specific instancer configuration.
data.instancerConfig.expose[].kind*"tcp" | "tcp-ssl" | "http" | "https" | "raw": Exposure protocol.
data.instancerConfig.expose[].hostPrefix*string: Subdomain/host prefix for the exposed service.
data.instancerConfig.expose[].containerName*string: Container to expose.
data.instancerConfig.expose[].containerPort*number: Container port to expose.
data.instancerConfig.expose[].shouldDisplayboolean: Whether to show the endpoint to players.
data.instancerConfig.expose[].titlestring: Short label for the endpoint, when present.
data.instancerConfig.timeoutMillisecondsnumber: Instance lifetime in milliseconds.
data.instancerConfig.extendableboolean: Whether the instance lifetime can be extended.
data.adminBotConfigobject: Admin-bot configuration, or null to remove it.
data.adminBotConfig.code*string: Admin-bot config code to attach.
data.hiddenboolean: Whether the challenge is hidden from players.
data.releaseTimenumber: Scheduled release time as a Unix ms timestamp, or null.
data.scoring{ kind: "decay" } | { kind: "dynamic", source: object }: Scoring algorithm configuration.

Path parameters

id*string: Challenge ID.

Request body

data*object: Challenge fields to update.
data.authorstring: Challenge author.
data.categorystring: Challenge category.
data.descriptionstring: Challenge description in Markdown.
data.flagstring: The challenge flag.
data.namestring: Challenge name.
data.points.max*number: Maximum (initial) point value.
data.points.min*number: Minimum (floor) point value.
data.tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
data.files[].name*string: File name.
data.files[].url*string: File download URL.
data.sortWeightnumber: Manual ordering weight.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
files[].sizenumber | null: File size in bytes, or null when unknown.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flags[].providerstring: Flag validation provider that verifies this entry.
flags[].configRecord<string, any>: Provider-specific flag configuration.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber | null | undefined: Manual ordering weight, or null when unset.
tagsstring[] | null | undefined: Challenge tags, or null when unset.
instancerConfigobject | null | undefined: On-demand instancer (deployment) configuration, or null when the challenge has none.
adminBotConfigobject | null | undefined: Admin-bot configuration, or null when the challenge has no admin bot.
hiddenboolean: Whether the challenge is hidden from players.
releaseTimenumber | null | undefined: Scheduled release time as a Unix timestamp in milliseconds, or null.
scoring{ kind: "decay" } | { kind: "dynamic", source: object } | null | undefined: Scoring algorithm configuration, or null for the CTF default.
solveCountnumber | undefined: Total solves; only present on the single-challenge endpoint.

Response fields

idstring: Challenge ID.
namestring: Challenge name.
descriptionstring: Challenge description in Markdown.
categorystring: Challenge category.
authorstring: Challenge author.
files[].namestring: File name.
files[].urlstring: File download URL.
points.minnumber: Minimum (floor) point value.
points.maxnumber: Maximum (initial) point value.
flagstring: The challenge flag.
tiebreakEligibleboolean: Whether solves count toward tiebreak ordering.
sortWeightnumber: Manual ordering weight, or null when unset.

V1 does not include hidden state, scheduled release time, instancer config, admin bot config, or file sizes.

`DELETE` Delete a solve

DELETE /api/v2/admin/challs/:challengeId/solves/:userId

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/challs/challenge-id/solves/team-id" \
  -X DELETE \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodChallengeSolveDeleteV2",
3
  "message": "Challenge solve successfully deleted."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownSolveV2",
3
  "message": "The solve does not exist."
4
}

Auth: Required
Gate: None
Permissions: challsSolveWrite
Captcha: No captcha
Rate limit: No rate limit

This route removes one solve for a specific team and challenge. The challenge and team remain in place, and the leaderboard is recalculated after the solve is removed.

Path parameters

challengeId*string: Challenge ID.
userId*string: Team ID whose solve to delete.

Response

A successful request returns 200 goodChallengeSolveDeleteV2 with no data.

`DELETE` Delete a challenge

DELETE /api/v1/admin/challs/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v1/admin/challs/challenge-id" \
  -X DELETE \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodChallengeDelete",
3
  "message": "Challenge successfully deleted."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsWrite
Captcha: No captcha
Rate limit: No rate limit

This legacy V1 route removes a challenge and its solves. There is no V2 delete route. V2 admin clients remove solves directly and update challenge data through create or update challenge.

The leaderboard is recalculated after the challenge is removed.

Path parameters

id*string: Challenge ID.

Response

A successful request returns 200 goodChallengeDelete with no data.

`POST` Upload files

POST /api/[v2,v1]/admin/upload

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/upload" \
  -H "Authorization: Bearer <auth-token>" \
  -F "files=@dist.zip"

1
{
2
  "kind": "goodFilesUploadV2",
3
  "message": "The files were successfully uploaded.",
4
  "data": [
5
    {
6
      "name": "chall.zip",
7
      "url": "https://rctf.osec.io/uploads/chall.zip",
8
      "size": 2048
9
    }
10
  ]
11
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

curl -sS "https://rctf.osec.io/api/v1/admin/upload" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "files": [
      {
        "name": "dist.zip",
        "data": "data:application/zip;base64,..."
      }
    ]
  }'

1
{
2
  "kind": "goodFilesUpload",
3
  "message": "The files were successfully uploaded.",
4
  "data": [
5
    {
6
      "name": "chall.zip",
7
      "url": "https://rctf.osec.io/uploads/chall.zip"
8
    }
9
  ]
10
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badDataUri",
3
  "message": "A data URI provided was malformed."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: challsWrite
Captcha: No captcha
Rate limit: No rate limit

This route uploads challenge files. Files are deduplicated by SHA 256, so uploading the same bytes again returns the existing URL.

V2 sends multipart/form-data with one or more files fields. V1 accepts JSON with base64 data URIs and remains available for older admin clients.

Request body

files*custom[]: One or more files to upload (multipart form-data).

Request body

files[].name*string: Upload file name (1-255 chars, no path separators).
files[].data*string: File contents as a base64 data URI.

Response fields

namestring: File name.
urlstring: File download URL.
sizenumber | null: File size in bytes, or null when unknown.

Response fields

namestring: File name.
urlstring: File download URL.

V1 upload responses do not include file size.

`POST` Query uploads

POST /api/[v2,v1]/admin/upload/query

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/upload/query" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "uploads": [
      {
        "sha256": "<hex-digest>",
        "name": "dist.zip"
      }
    ]
  }'

1
{
2
  "kind": "goodUploadsQueryV2",
3
  "message": "The status of uploads was successfully queried.",
4
  "data": [
5
    {
6
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
7
      "name": "chall.zip",
8
      "url": "https://rctf.osec.io/uploads/chall.zip",
9
      "size": 2048
10
    }
11
  ]
12
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

curl -sS "https://rctf.osec.io/api/v1/admin/upload/query" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "uploads": [
      {
        "sha256": "<hex-digest>",
        "name": "dist.zip"
      }
    ]
  }'

1
{
2
  "kind": "goodUploadsQuery",
3
  "message": "The status of uploads was successfully queried.",
4
  "data": [
5
    {
6
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
7
      "name": "chall.zip",
8
      "url": "https://rctf.osec.io/uploads/chall.zip"
9
    }
10
  ]
11
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route lets the admin panel check whether files already exist by SHA 256 before uploading them. A null URL means the file has not been uploaded yet.

For new clients, V2 is usually the best fit because it also returns nullable file size. V1 only returns the nullable URL.

Request body

uploads[].sha256*string: SHA-256 hex digest of the file contents.
uploads[].name*string: Upload file name (1-255 chars, no path separators).

Request body

uploads*object[]: Files to look up by hash and name.
uploads[].sha256*string: SHA-256 hex digest of the file contents.
uploads[].name*string: Upload file name (1-255 chars, no path separators).

Response fields

sha256string: SHA-256 hash of the file contents.
namestring: File name.
urlstring | null: Download URL, or null when not uploaded.
sizenumber | null: File size in bytes, or null when unknown.

Response fields

sha256string: SHA-256 hash of the file contents.
namestring: File name.
urlstring | null: Download URL, or null when not uploaded.

`GET` List teams

GET /api/v2/admin/users

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users?limit=50&offset=0&search=otter&sortBy=score&sortOrder=desc" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUsersV2",
3
  "message": "The users were retrieved.",
4
  "data": {
5
    "total": 128,
6
    "users": [
7
      {
8
        "id": "team-1a2b3c",
9
        "name": "otter-sec",
10
        "email": "team@osec.io",
11
        "division": "open",
12
        "perms": 0,
13
        "banned": false,
14
        "score": 13370,
15
        "solveCount": 12,
16
        "avatarUrl": "https://rctf.osec.io/uploads/avatar.png",
17
        "countryCode": "US",
18
        "statusText": "Qualified",
19
        "createdAt": "2024-03-09T00:00:00.000Z"
20
      }
21
    ]
22
  }
23
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route shows teams for the admin panel. Query parameters control pagination, sorting, and name or email search.

Filter teams is available when a UI also needs status or division filters.

Query parameters

limit*number: Integer 1-100. Page size.
offset*number: Integer >= 0. Page offset.
searchstring: Free-text search over team name and email.
sortBy"createdAt" | "team" | "email" | "division" | "score" | "solves" | "status": Column to sort by.
sortOrder"asc" | "desc": Sort direction.

Response fields

totalnumber: Total number of teams matching the query.
users[].idstring: Team ID.
users[].namestring: Team name.
users[].emailstring | null: Team email, or null when unset.
users[].divisionstring: Team’s division.
users[].permsnumber: Permission bitmask.
users[].bannedboolean: Whether the team is banned.
users[].scorenumber: Team’s current score.
users[].solveCountnumber: Number of challenges solved.
users[].avatarUrlstring | null: Avatar URL, or null when unset.
users[].countryCodestring | null: ISO 3166-1 alpha-2 country code, or null.
users[].statusTextstring | null: Free-form status badge, or null.
users[].createdAtstring: Account creation time as an ISO 8601 string.

Each list item includes public profile fields, admin state, cached score data, and creation time.

`POST` Filter teams

POST /api/v2/admin/users

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users?limit=50&offset=0&search=otter&sortBy=score&sortOrder=desc" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "status": {
      "include": [
        "active"
      ]
    },
    "division": {
      "include": [
        "open"
      ]
    }
  }'

1
{
2
  "kind": "goodAdminUsersV2",
3
  "message": "The users were retrieved.",
4
  "data": {
5
    "total": 128,
6
    "users": [
7
      {
8
        "id": "team-1a2b3c",
9
        "name": "otter-sec",
10
        "email": "team@osec.io",
11
        "division": "open",
12
        "perms": 0,
13
        "banned": false,
14
        "score": 13370,
15
        "solveCount": 12,
16
        "avatarUrl": "https://rctf.osec.io/uploads/avatar.png",
17
        "countryCode": "US",
18
        "statusText": "Qualified",
19
        "createdAt": "2024-03-09T00:00:00.000Z"
20
      }
21
    ]
22
  }
23
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route lists teams with richer filters than the GET route can carry comfortably. The query string still controls pagination, sorting, and text search.

Filter objects can include nullable include and exclude arrays. A field can be omitted when that filter does not apply.

Query parameters

limit*number: Integer 1-100. Page size.
offset*number: Integer >= 0. Page offset.
searchstring: Free-text search over team name and email.
sortBy"createdAt" | "team" | "email" | "division" | "score" | "solves" | "status": Column to sort by.
sortOrder"asc" | "desc": Sort direction.

Request body

statusobject: Include/exclude filter on team status.
status.include("active" | "banned" | "admin")[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
status.exclude("active" | "banned" | "admin")[]: Drop rows matching any of these values; omitted or null applies no denylist.
divisionobject: Include/exclude filter on division.
division.includestring[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
division.excludestring[]: Drop rows matching any of these values; omitted or null applies no denylist.

Response fields

totalnumber: Total number of teams matching the query.
users[].idstring: Team ID.
users[].namestring: Team name.
users[].emailstring | null: Team email, or null when unset.
users[].divisionstring: Team’s division.
users[].permsnumber: Permission bitmask.
users[].bannedboolean: Whether the team is banned.
users[].scorenumber: Team’s current score.
users[].solveCountnumber: Number of challenges solved.
users[].avatarUrlstring | null: Avatar URL, or null when unset.
users[].countryCodestring | null: ISO 3166-1 alpha-2 country code, or null.
users[].statusTextstring | null: Free-form status badge, or null.
users[].createdAtstring: Account creation time as an ISO 8601 string.

`GET` Team detail

GET /api/v2/admin/users/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users/team-id" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUserV2",
3
  "message": "The user was retrieved.",
4
  "data": {
5
    "id": "team-1a2b3c",
6
    "name": "otter-sec",
7
    "email": "team@osec.io",
8
    "division": "open",
9
    "perms": 0,
10
    "banned": false,
11
    "score": 13370,
12
    "solveCount": 12,
13
    "avatarUrl": "https://rctf.osec.io/uploads/avatar.png",
14
    "countryCode": "US",
15
    "statusText": "Qualified",
16
    "createdAt": "2024-03-09T00:00:00.000Z",
17
    "solves": [
18
      {
19
        "challengeId": "baby-rev",
20
        "challengeName": "baby-rev",
21
        "challengeCategory": "rev",
22
        "createdAt": "2024-03-09T00:00:00.000Z"
23
      }
24
    ]
25
  }
26
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownUser",
3
  "message": "The user does not exist."
4
}

Auth: Required
Gate: None
Permissions: challsRead, usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route shows full team details for the admin panel, including solve history. The token needs both usersWrite and challsRead because the response includes challenge solve data.

Path parameters

id*string: Team ID.

Response fields

idstring: Team ID.
namestring: Team name.
emailstring | null: Team email, or null when unset.
divisionstring: Team’s division.
permsnumber: Permission bitmask.
bannedboolean: Whether the team is banned.
scorenumber: Team’s current score.
solveCountnumber: Number of challenges solved.
avatarUrlstring | null: Avatar URL, or null when unset.
countryCodestring | null: ISO 3166-1 alpha-2 country code, or null.
statusTextstring | null: Free-form status badge, or null.
createdAtstring: Account creation time as an ISO 8601 string.
solves[].challengeIdstring: Challenge ID.
solves[].challengeNamestring: Challenge name.
solves[].challengeCategorystring: Challenge category.
solves[].createdAtstring: Solve time as an ISO 8601 string.

Private account fields appear here, so this route belongs in trusted admin views.

`PUT` Update team

PUT /api/v2/admin/users/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users/team-id" \
  -X PUT \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "data": {
      "banned": true
    }
  }'

1
{
2
  "kind": "goodAdminUserUpdateV2",
3
  "message": "The user was updated."
4
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badKnownName",
3
  "message": "An account with this name already exists."
4
}

1
{
2
  "kind": "badName",
3
  "message": "The name should only use english letters, numbers, and symbols."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownUser",
3
  "message": "The user does not exist."
4
}

1
{
2
  "kind": "badUserPrivileged",
3
  "message": "The user is privileged and cannot be modified."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route changes admin controlled team state. The current route supports banning and unbanning teams.

Banning removes the team from leaderboard output after recalculation without deleting solves. Unbanning restores its rank after the leaderboard is recalculated. Admin users are protected from changes through this route.

Path parameters

id*string: Team ID.

Request body

data*object: Team fields to update.
data.bannedboolean: Whether the team is banned.
data.namestring: 2-64 printable ASCII characters.
data.divisionstring: Team’s division.
data.countryCode"AF" | "AX" | "AL" | "DZ" | "AS" | "AD" | "AO" | "AI" | "AQ" | "AG" | "AR" | "AM" | "AW" | "AC" | "AU" | "AT" | "AZ" | "BS" | "BH" | "BD" | "BB" | "BY" | "BE" | "BZ" | "BJ" | "BM" | "BT" | "BO" | "BA" | "BW" | "BV" | "BR" | "IO" | "VG" | "BN" | "BG" | "BF" | "BI" | "KH" | "CM" | "CA" | "IC" | "CV" | "BQ" | "KY" | "CF" | "EA" | "TD" | "CL" | "CN" | "CX" | "CP" | "CC" | "CO" | "KM" | "CK" | "CR" | "HR" | "CU" | "CW" | "CY" | "CZ" | "DK" | "DG" | "DJ" | "DM" | "DO" | "CD" | "EC" | "EG" | "SV" | "GQ" | "ER" | "EE" | "SZ" | "ET" | "EU" | "FK" | "FO" | "FJ" | "FI" | "FR" | "GF" | "PF" | "TF" | "GA" | "GM" | "GE" | "DE" | "GH" | "GI" | "GR" | "GL" | "GD" | "GP" | "GU" | "GT" | "GG" | "GN" | "GW" | "GY" | "HT" | "HM" | "HN" | "HK" | "HU" | "IS" | "IN" | "ID" | "IR" | "IQ" | "IE" | "CQ" | "IM" | "IL" | "IT" | "CI" | "JM" | "JP" | "JE" | "JO" | "KZ" | "KE" | "KI" | "XK" | "KW" | "KG" | "LA" | "LV" | "LB" | "LS" | "LR" | "LY" | "LI" | "LT" | "LU" | "MO" | "MG" | "MW" | "MY" | "MV" | "ML" | "MT" | "MH" | "MQ" | "MR" | "MU" | "YT" | "MX" | "FM" | "MD" | "MC" | "MN" | "ME" | "MS" | "MA" | "MZ" | "MM" | "NA" | "NR" | "NP" | "NL" | "NC" | "NZ" | "NI" | "NE" | "NG" | "NU" | "NF" | "KP" | "MK" | "MP" | "NO" | "OM" | "PK" | "PW" | "PS" | "PA" | "PG" | "PY" | "PE" | "PH" | "PN" | "PL" | "PT" | "PR" | "QA" | "CG" | "RE" | "RO" | "RU" | "RW" | "BL" | "SH" | "KN" | "LC" | "MF" | "PM" | "VC" | "WS" | "SM" | "ST" | "SA" | "SN" | "RS" | "SC" | "SL" | "SG" | "SX" | "SK" | "SI" | "SB" | "SO" | "ZA" | "GS" | "KR" | "SS" | "ES" | "LK" | "SD" | "SR" | "SJ" | "SE" | "CH" | "SY" | "TW" | "TJ" | "TZ" | "TH" | "TL" | "TG" | "TK" | "TO" | "TT" | "TA" | "TN" | "TR" | "TM" | "TC" | "TV" | "UG" | "UA" | "AE" | "GB" | "UN" | "US" | "UM" | "VI" | "UY" | "UZ" | "VU" | "VA" | "VE" | "VN" | "WF" | "EH" | "YE" | "ZM" | "ZW": ISO 3166-1 alpha-2 country code, or null.
data.statusTextstring: Free-form status badge, or null.

Response

A successful request returns 200 goodAdminUserUpdateV2 with no data.

`DELETE` Delete team

DELETE /api/v2/admin/users/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users/team-id" \
  -X DELETE \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUserDeleteV2",
3
  "message": "The user was deleted."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownUser",
3
  "message": "The user does not exist."
4
}

1
{
2
  "kind": "badUserPrivileged",
3
  "message": "The user is privileged and cannot be modified."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route deletes a team account. Admin users are protected from deletion here.

This operation removes the team rather than hiding it from standings. Update team is the better fit when the intent is to ban a team while keeping its record.

Path parameters

id*string: Team ID.

Response

A successful request returns 200 goodAdminUserDeleteV2 with no data.

`POST` Create team token

POST /api/v2/admin/users/:id/token

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users/team-id/token" \
  -X POST \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodCreateUserTokenV2",
3
  "message": "The creation of user token was successful.",
4
  "data": {
5
    "token": "<user-token>"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownUser",
3
  "message": "The user does not exist."
4
}

1
{
2
  "kind": "badUserPrivileged",
3
  "message": "The user is privileged and cannot be modified."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route creates a fresh team token. It helps organizers recover access for a team that has lost its original credential.

The returned token is a credential. This route does not issue tokens for admin users.

Path parameters

id*string: Team ID.

Response fields

tokenstring: Newly created user API token.

`GET` Pending verifications

GET /api/v2/admin/user-verifications

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/user-verifications" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUserVerificationsV2",
3
  "message": "The pending user verifications were retrieved.",
4
  "data": {
5
    "verifications": [
6
      {
7
        "id": "verif-1a2b3c",
8
        "name": "otter-sec",
9
        "email": "team@osec.io",
10
        "division": "open",
11
        "createdAt": 1710000000000,
12
        "expiresAt": 1710003600000
13
      }
14
    ]
15
  }
16
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route shows teams that registered with email verification but have not completed the verification step yet.

Pending verification rows include the team name, email, division, creation time, and expiration time. Admins can complete or resend these rows through the related endpoints.

Response fields

verifications[].idstring: Pending verification ID.
verifications[].namestring: Team name.
verifications[].emailstring: Team email.
verifications[].divisionstring: Team’s division.
verifications[].createdAtnumber: Creation time as a Unix timestamp in milliseconds.
verifications[].expiresAtnumber: Expiry time as a Unix timestamp in milliseconds.

`POST` Complete verification

POST /api/v2/admin/user-verifications/:id/complete

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/user-verifications/verification-id/complete" \
  -X POST \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUserVerificationCompleteV2",
3
  "message": "The pending user verification was completed.",
4
  "data": {
5
    "userId": "team-1a2b3c"
6
  }
7
}

1
{
2
  "kind": "badKnownEmail",
3
  "message": "An account with this email already exists."
4
}

1
{
2
  "kind": "badKnownName",
3
  "message": "An account with this name already exists."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownVerification",
3
  "message": "The verification request does not exist."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route lets an organizer complete a pending email verification manually and create the team. It is useful when the registration has already been verified outside the normal email flow.

Duplicate email and duplicate name checks still apply.

Path parameters

id*string: Pending verification ID.

Response fields

userIdstring: ID of the verified team.

`POST` Resend verification

POST /api/v2/admin/user-verifications/:id/resend

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/user-verifications/verification-id/resend" \
  -X POST \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminUserVerificationResendV2",
3
  "message": "The pending user verification email was resent.",
4
  "data": {
5
    "id": "verif-1a2b3c"
6
  }
7
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badUnknownVerification",
3
  "message": "The verification request does not exist."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route sends another verification email for an outstanding pending verification row.

If email delivery is not configured, the route returns 404 badEndpoint because there is no provider available to send the message.

Path parameters

id*string: Pending verification ID.

Response fields

idstring: ID of the pending verification.

`GET` List submissions

GET /api/v2/admin/submissions

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/submissions?limit=50&offset=0&sortBy=createdAt&sortOrder=desc&challengeSearch=baby&teamSearch=otter" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminSubmissions",
3
  "message": "The submissions were retrieved successfully.",
4
  "data": {
5
    "total": 128,
6
    "submissions": [
7
      {
8
        "id": "sub-1a2b3c",
9
        "kind": "flag",
10
        "challengeId": "baby-rev",
11
        "challengeName": "baby-rev",
12
        "challengeCategory": "rev",
13
        "userId": "team-1a2b3c",
14
        "userName": "otter-sec",
15
        "userDivision": "open",
16
        "userAvatarUrl": "https://rctf.osec.io/uploads/avatar.png",
17
        "userCountryCode": "US",
18
        "userStatusText": "Qualified",
19
        "userBanned": false,
20
        "ip": "203.0.113.7",
21
        "result": "correct",
22
        "cheatedFromId": null,
23
        "cheatedFromName": null,
24
        "details": {},
25
        "relatedId": null,
26
        "createdAt": "2024-03-09T00:00:00.000Z"
27
      }
28
    ]
29
  }
30
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead, usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route shows submission audit rows. The table records flag submissions and admin bot job submissions for review and abuse investigation.

Query parameters control pagination, sorting, and lightweight challenge or team search. Filter submissions adds category, division, kind, result, team status, and time filters.

Query parameters

limit*number: Integer 1-100. Page size.
offset*number: Integer >= 0. Page offset.
sortBy"createdAt" | "challenge" | "team" | "ip" | "kind" | "result": Column to sort by.
sortOrder"asc" | "desc": Sort direction.
challengeSearchstring: Free-text search over challenge name.
teamSearchstring: Free-text search over team name.

Response fields

totalnumber: Total number of submissions matching the query.
submissions[].idstring: Submission ID.
submissions[].kind"flag" | "admin_bot": Kind of submission.
submissions[].challengeIdstring: Challenge ID.
submissions[].challengeNamestring: Challenge name.
submissions[].challengeCategorystring: Challenge category.
submissions[].userIdstring: Submitting team ID.
submissions[].userNamestring: Submitting team name.
submissions[].userDivisionstring: Submitting team division.
submissions[].userAvatarUrlstring | null: Team avatar URL, or null when unset.
submissions[].userCountryCodestring | null: ISO 3166-1 alpha-2 country code, or null.
submissions[].userStatusTextstring | null: Free-form status badge, or null.
submissions[].userBannedboolean: Whether the team is banned.
submissions[].ipstring: Source IP of the submission.
submissions[].result"correct" | "cheated" | "incorrect" | "already_solved" | "queued" | "active_job" | "invalid_input" | "bad_instancer_state": Outcome of the submission.
submissions[].cheatedFromIdstring | null: For cheated results, the team ID the flag was created for; null otherwise.
submissions[].cheatedFromNamestring | null: For cheated results, the team name the flag was created for; null when the team was deleted.
submissions[].detailsRecord<string, any>: Result-specific details.
submissions[].relatedIdstring | null: Related entity ID (e.g. admin-bot job), or null.
submissions[].createdAtstring: Submission time as an ISO 8601 string.

Each row includes challenge metadata, team metadata, the source IP address, result details, and creation time.

`POST` Filter submissions

POST /api/v2/admin/submissions

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/submissions?limit=50&offset=0&sortBy=createdAt&sortOrder=desc&challengeSearch=baby&teamSearch=otter" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "challenge": {
      "include": [
        "challenge-id"
      ]
    },
    "team": {
      "include": [
        "team-id"
      ]
    },
    "kind": {
      "include": [
        "flag"
      ]
    },
    "result": {
      "exclude": [
        "incorrect"
      ]
    },
    "teamStatus": {
      "include": [
        "not_banned"
      ]
    },
    "category": {
      "include": [
        "web"
      ]
    },
    "division": {
      "include": [
        "open"
      ]
    },
    "createdAfter": "2026-05-05T09:30:00.000Z",
    "createdBefore": "2026-05-05T10:30:00.000Z"
  }'

1
{
2
  "kind": "goodAdminSubmissions",
3
  "message": "The submissions were retrieved successfully.",
4
  "data": {
5
    "total": 128,
6
    "submissions": [
7
      {
8
        "id": "sub-1a2b3c",
9
        "kind": "flag",
10
        "challengeId": "baby-rev",
11
        "challengeName": "baby-rev",
12
        "challengeCategory": "rev",
13
        "userId": "team-1a2b3c",
14
        "userName": "otter-sec",
15
        "userDivision": "open",
16
        "userAvatarUrl": "https://rctf.osec.io/uploads/avatar.png",
17
        "userCountryCode": "US",
18
        "userStatusText": "Qualified",
19
        "userBanned": false,
20
        "ip": "203.0.113.7",
21
        "result": "correct",
22
        "cheatedFromId": null,
23
        "cheatedFromName": null,
24
        "details": {},
25
        "relatedId": null,
26
        "createdAt": "2024-03-09T00:00:00.000Z"
27
      }
28
    ]
29
  }
30
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: challsRead, usersWrite
Captcha: No captcha
Rate limit: No rate limit

This route lists submission audit rows with richer filters. The query string still controls pagination, sorting, and lightweight text search.

Filter objects can include nullable include and exclude arrays. Date filters are parsed as ISO timestamps, and createdAfter needs to be earlier than createdBefore when both are provided.

Query parameters

limit*number: Integer 1-100. Page size.
offset*number: Integer >= 0. Page offset.
sortBy"createdAt" | "challenge" | "team" | "ip" | "kind" | "result": Column to sort by.
sortOrder"asc" | "desc": Sort direction.
challengeSearchstring: Free-text search over challenge name.
teamSearchstring: Free-text search over team name.

Request body

challengeobject: Include/exclude filter on challenge ID.
challenge.includestring[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
challenge.excludestring[]: Drop rows matching any of these values; omitted or null applies no denylist.
teamobject: Include/exclude filter on team ID.
team.includestring[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
team.excludestring[]: Drop rows matching any of these values; omitted or null applies no denylist.
kindobject: Include/exclude filter on submission kind.
kind.include("flag" | "admin_bot")[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
kind.exclude("flag" | "admin_bot")[]: Drop rows matching any of these values; omitted or null applies no denylist.
resultobject: Include/exclude filter on result.
result.include("correct" | "cheated" | "incorrect" | "already_solved" | "queued" | "active_job" | "invalid_input" | "bad_instancer_state")[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
result.exclude("correct" | "cheated" | "incorrect" | "already_solved" | "queued" | "active_job" | "invalid_input" | "bad_instancer_state")[]: Drop rows matching any of these values; omitted or null applies no denylist.
teamStatusobject: Include/exclude filter on team ban status.
teamStatus.include("banned" | "not_banned")[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
teamStatus.exclude("banned" | "not_banned")[]: Drop rows matching any of these values; omitted or null applies no denylist.
categoryobject: Include/exclude filter on category.
category.includestring[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
category.excludestring[]: Drop rows matching any of these values; omitted or null applies no denylist.
divisionobject: Include/exclude filter on division.
division.includestring[]: Keep only rows matching one of these values; omitted or null applies no allowlist.
division.excludestring[]: Drop rows matching any of these values; omitted or null applies no denylist.
createdAfterstring: Only include submissions at or after this date.
createdBeforestring: Only include submissions at or before this date.

Response fields

totalnumber: Total number of submissions matching the query.
submissions[].idstring: Submission ID.
submissions[].kind"flag" | "admin_bot": Kind of submission.
submissions[].challengeIdstring: Challenge ID.
submissions[].challengeNamestring: Challenge name.
submissions[].challengeCategorystring: Challenge category.
submissions[].userIdstring: Submitting team ID.
submissions[].userNamestring: Submitting team name.
submissions[].userDivisionstring: Submitting team division.
submissions[].userAvatarUrlstring | null: Team avatar URL, or null when unset.
submissions[].userCountryCodestring | null: ISO 3166-1 alpha-2 country code, or null.
submissions[].userStatusTextstring | null: Free-form status badge, or null.
submissions[].userBannedboolean: Whether the team is banned.
submissions[].ipstring: Source IP of the submission.
submissions[].result"correct" | "cheated" | "incorrect" | "already_solved" | "queued" | "active_job" | "invalid_input" | "bad_instancer_state": Outcome of the submission.
submissions[].cheatedFromIdstring | null: For cheated results, the team ID the flag was created for; null otherwise.
submissions[].cheatedFromNamestring | null: For cheated results, the team name the flag was created for; null when the team was deleted.
submissions[].detailsRecord<string, any>: Result-specific details.
submissions[].relatedIdstring | null: Related entity ID (e.g. admin-bot job), or null.
submissions[].createdAtstring: Submission time as an ISO 8601 string.

`GET` Read settings

GET /api/v2/admin/settings

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/settings" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminSettings",
3
  "message": "The retrieval of settings was successful.",
4
  "data": {
5
    "overrides": {
6
      "ctfName": "rCTF",
7
      "homeContent": "# Welcome",
8
      "startTime": 1710000000000,
9
      "endTime": 1710864000000,
10
      "sponsors": [
11
        {
12
          "name": "osec",
13
          "icon": "https://rctf.osec.io/sponsors/osec-light.png",
14
          "iconLight": "https://rctf.osec.io/sponsors/osec-light.png",
15
          "iconDark": "https://rctf.osec.io/sponsors/osec-dark.png",
16
          "description": "Security research.",
17
          "url": "https://osec.io"
18
        }
19
      ],
20
      "meta": {
21
        "description": "A jeopardy-style CTF.",
22
        "imageUrl": "https://rctf.osec.io/preview.png"
23
      },
24
      "faviconUrl": "https://rctf.osec.io/favicon.ico",
25
      "logoLightUrl": "https://rctf.osec.io/logo-light.png",
26
      "logoDarkUrl": "https://rctf.osec.io/logo-dark.png"
27
    },
28
    "defaults": {
29
      "ctfName": "rCTF",
30
      "homeContent": "# Welcome",
31
      "startTime": 1710000000000,
32
      "endTime": 1710864000000,
33
      "sponsors": [
34
        {
35
          "name": "osec",
36
          "icon": "https://rctf.osec.io/sponsors/osec-light.png",
37
          "iconLight": "https://rctf.osec.io/sponsors/osec-light.png",
38
          "iconDark": "https://rctf.osec.io/sponsors/osec-dark.png",
39
          "description": "Security research.",
40
          "url": "https://osec.io"
41
        }
42
      ],
43
      "meta": {
44
        "description": "A jeopardy-style CTF.",
45
        "imageUrl": "https://rctf.osec.io/preview.png"
46
      },
47
      "faviconUrl": "https://rctf.osec.io/favicon.ico",
48
      "logoLightUrl": "https://rctf.osec.io/logo-light.png",
49
      "logoDarkUrl": "https://rctf.osec.io/logo-dark.png"
50
    }
51
  }
52
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: settingsWrite
Captcha: No captcha
Rate limit: No rate limit

This route shows runtime setting overrides and config defaults side by side. Runtime overrides come from the database. Defaults come from config files and environment variables.

Update settings can change or clear runtime overrides without restarting the server.

Response fields

overridesobject: Operator-set values overriding the defaults.
overrides.ctfNamestring | undefined: Name of the CTF.
overrides.homeContentstring | undefined: Markdown content shown on the home page.
overrides.startTimenumber | undefined: CTF start time as a Unix timestamp in milliseconds.
overrides.endTimenumber | undefined: CTF end time as a Unix timestamp in milliseconds.
overrides.sponsors[].namestring: Sponsor name.
overrides.sponsors[].iconstring | undefined: Deprecated. Mirrors iconLight (or iconDark when only it is set) for old clients.
overrides.sponsors[].iconLightstring | undefined: Sponsor icon URL for light mode; may be absent on data from older versions.
overrides.sponsors[].iconDarkstring | undefined: Sponsor icon URL for dark mode; may be absent on data from older versions.
overrides.sponsors[].descriptionstring: Sponsor description.
overrides.sponsors[].urlstring | undefined: Sponsor link, when present.
overrides.meta.descriptionstring | undefined: Meta description used for link previews.
overrides.meta.imageUrlstring | undefined: Preview image URL.
overrides.faviconUrlstring | undefined: Favicon URL.
overrides.logoLightUrlstring | undefined: Light-theme logo URL.
overrides.logoDarkUrlstring | undefined: Dark-theme logo URL.
defaultsobject: Built-in default values.
defaults.ctfNamestring | undefined: Name of the CTF.
defaults.homeContentstring | undefined: Markdown content shown on the home page.
defaults.startTimenumber | undefined: CTF start time as a Unix timestamp in milliseconds.
defaults.endTimenumber | undefined: CTF end time as a Unix timestamp in milliseconds.
defaults.sponsors[].namestring: Sponsor name.
defaults.sponsors[].iconstring | undefined: Deprecated. Mirrors iconLight (or iconDark when only it is set) for old clients.
defaults.sponsors[].iconLightstring | undefined: Sponsor icon URL for light mode; may be absent on data from older versions.
defaults.sponsors[].iconDarkstring | undefined: Sponsor icon URL for dark mode; may be absent on data from older versions.
defaults.sponsors[].descriptionstring: Sponsor description.
defaults.sponsors[].urlstring | undefined: Sponsor link, when present.
defaults.meta.descriptionstring | undefined: Meta description used for link previews.
defaults.meta.imageUrlstring | undefined: Preview image URL.
defaults.faviconUrlstring | undefined: Favicon URL.
defaults.logoLightUrlstring | undefined: Light-theme logo URL.
defaults.logoDarkUrlstring | undefined: Dark-theme logo URL.

`PUT` Update settings

PUT /api/v2/admin/settings

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/settings" \
  -X PUT \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "data": {
      "ctfName": "Example CTF",
      "homeContent": "# Welcome",
      "startTime": 1770000000000,
      "endTime": 1770100000000,
      "sponsors": [
        {
          "name": "Example",
          "icon": "https://example.com/icon.png",
          "description": "Sponsor",
          "url": "https://example.com"
        }
      ],
      "meta": {
        "description": "Example CTF",
        "imageUrl": "https://example.com/card.png"
      },
      "faviconUrl": null,
      "logoLightUrl": null,
      "logoDarkUrl": null
    }
  }'

1
{
2
  "kind": "goodAdminSettingsUpdate",
3
  "message": "Settings successfully updated.",
4
  "data": {
5
    "overrides": {
6
      "ctfName": "rCTF",
7
      "homeContent": "# Welcome",
8
      "startTime": 1710000000000,
9
      "endTime": 1710864000000,
10
      "sponsors": [
11
        {
12
          "name": "osec",
13
          "icon": "https://rctf.osec.io/sponsors/osec-light.png",
14
          "iconLight": "https://rctf.osec.io/sponsors/osec-light.png",
15
          "iconDark": "https://rctf.osec.io/sponsors/osec-dark.png",
16
          "description": "Security research.",
17
          "url": "https://osec.io"
18
        }
19
      ],
20
      "meta": {
21
        "description": "A jeopardy-style CTF.",
22
        "imageUrl": "https://rctf.osec.io/preview.png"
23
      },
24
      "faviconUrl": "https://rctf.osec.io/favicon.ico",
25
      "logoLightUrl": "https://rctf.osec.io/logo-light.png",
26
      "logoDarkUrl": "https://rctf.osec.io/logo-dark.png"
27
    },
28
    "defaults": {
29
      "ctfName": "rCTF",
30
      "homeContent": "# Welcome",
31
      "startTime": 1710000000000,
32
      "endTime": 1710864000000,
33
      "sponsors": [
34
        {
35
          "name": "osec",
36
          "icon": "https://rctf.osec.io/sponsors/osec-light.png",
37
          "iconLight": "https://rctf.osec.io/sponsors/osec-light.png",
38
          "iconDark": "https://rctf.osec.io/sponsors/osec-dark.png",
39
          "description": "Security research.",
40
          "url": "https://osec.io"
41
        }
42
      ],
43
      "meta": {
44
        "description": "A jeopardy-style CTF.",
45
        "imageUrl": "https://rctf.osec.io/preview.png"
46
      },
47
      "faviconUrl": "https://rctf.osec.io/favicon.ico",
48
      "logoLightUrl": "https://rctf.osec.io/logo-light.png",
49
      "logoDarkUrl": "https://rctf.osec.io/logo-dark.png"
50
    }
51
  }
52
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: settingsWrite
Captcha: No captcha
Rate limit: No rate limit

This route updates runtime setting overrides. A nullable field set to null clears that override and lets the configured default take effect again.

Changing startTime or endTime also queues a leaderboard recalculation so standings match the updated event window.

Request body

data*object: Settings fields to update.
data.ctfNamestring: Public CTF name.
data.homeContentstring: Home page content in Markdown.
data.startTimenumber: CTF start time as a Unix ms timestamp.
data.endTimenumber: CTF end time as a Unix ms timestamp.
data.sponsorsobject[]
data.meta.descriptionstring: Site meta description.
data.meta.imageUrlstring: Social preview image URL.
data.faviconUrlstring: Favicon URL.
data.logoLightUrlstring: Light-theme logo URL.
data.logoDarkUrlstring: Dark-theme logo URL.

Response fields

overridesobject: Operator-set values overriding the defaults.
overrides.ctfNamestring | undefined: Name of the CTF.
overrides.homeContentstring | undefined: Markdown content shown on the home page.
overrides.startTimenumber | undefined: CTF start time as a Unix timestamp in milliseconds.
overrides.endTimenumber | undefined: CTF end time as a Unix timestamp in milliseconds.
overrides.sponsors[].namestring: Sponsor name.
overrides.sponsors[].iconstring | undefined: Deprecated. Mirrors iconLight (or iconDark when only it is set) for old clients.
overrides.sponsors[].iconLightstring | undefined: Sponsor icon URL for light mode; may be absent on data from older versions.
overrides.sponsors[].iconDarkstring | undefined: Sponsor icon URL for dark mode; may be absent on data from older versions.
overrides.sponsors[].descriptionstring: Sponsor description.
overrides.sponsors[].urlstring | undefined: Sponsor link, when present.
overrides.meta.descriptionstring | undefined: Meta description used for link previews.
overrides.meta.imageUrlstring | undefined: Preview image URL.
overrides.faviconUrlstring | undefined: Favicon URL.
overrides.logoLightUrlstring | undefined: Light-theme logo URL.
overrides.logoDarkUrlstring | undefined: Dark-theme logo URL.
defaultsobject: Built-in default values.
defaults.ctfNamestring | undefined: Name of the CTF.
defaults.homeContentstring | undefined: Markdown content shown on the home page.
defaults.startTimenumber | undefined: CTF start time as a Unix timestamp in milliseconds.
defaults.endTimenumber | undefined: CTF end time as a Unix timestamp in milliseconds.
defaults.sponsors[].namestring: Sponsor name.
defaults.sponsors[].iconstring | undefined: Deprecated. Mirrors iconLight (or iconDark when only it is set) for old clients.
defaults.sponsors[].iconLightstring | undefined: Sponsor icon URL for light mode; may be absent on data from older versions.
defaults.sponsors[].iconDarkstring | undefined: Sponsor icon URL for dark mode; may be absent on data from older versions.
defaults.sponsors[].descriptionstring: Sponsor description.
defaults.sponsors[].urlstring | undefined: Sponsor link, when present.
defaults.meta.descriptionstring | undefined: Meta description used for link previews.
defaults.meta.imageUrlstring | undefined: Preview image URL.
defaults.faviconUrlstring | undefined: Favicon URL.
defaults.logoLightUrlstring | undefined: Light-theme logo URL.
defaults.logoDarkUrlstring | undefined: Dark-theme logo URL.

`GET` Instancer schema

GET /api/v2/admin/instancer/schema

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/instancer/schema" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodInstancerSchema",
3
  "message": "The instancer configuration schemas were retrieved successfully.",
4
  "data": {
5
    "defaultInstancer": "kubernetes",
6
    "instancers": [
7
      {
8
        "name": "kubernetes",
9
        "schema": {
10
          "type": "object"
11
        },
12
        "defaults": {},
13
        "canStop": true,
14
        "canExtend": true
15
      }
16
    ]
17
  }
18
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route provides the active instancer provider JSON schema and defaults. The challenge editor uses this response to validate instancerConfig before saving a challenge.

When no instancer provider is configured, the route returns 404 badEndpoint.

Response fields

defaultInstancerstring: Name of the instancer used by default.
instancers[].namestring: Instancer name.
instancers[].schemaRecord<string, unknown>: JSON Schema describing the instancer config fields.
instancers[].defaultsRecord<string, unknown>: Default config values for the instancer.
instancers[].canStopboolean: Whether instances can be stopped.
instancers[].canExtendboolean: Whether instance lifetimes can be extended.

`GET` Flag providers

GET /api/v2/admin/flags/providers

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/flags/providers" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodFlagProviders",
3
  "message": "The flag provider schemas were retrieved successfully.",
4
  "data": {
5
    "defaultProvider": "flags/static",
6
    "providers": [
7
      {
8
        "name": "flags/static",
9
        "schema": {
10
          "type": "object"
11
        }
12
      }
13
    ]
14
  }
15
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route lists the available flag validation providers along with a JSON schema for each provider’s flag entry config. The challenge editor uses this response to build and validate the flags entries before saving a challenge.

Entries that omit provider use defaultProvider.

Response fields

defaultProviderstring: Name of the provider used when a flag entry omits one.
providers[].namestring: Flag validation provider name.
providers[].schemaRecord<string, unknown>: JSON Schema describing the provider config fields of a flag entry.

`GET` Admin bot status

GET /api/v2/admin/admin-bot/status

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/status" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminBotStatus",
3
  "message": "The admin bot status was retrieved successfully.",
4
  "data": {
5
    "enabled": true,
6
    "configLanguage": "javascript"
7
  }
8
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsRead
Captcha: No captcha
Rate limit: No rate limit

This route shows whether the admin bot provider is enabled and which source language the configured provider expects.

When no admin bot provider is configured, the route returns 404 badEndpoint.

Response fields

enabledboolean: Whether the admin bot is enabled.
configLanguagestring: Scripting language used for admin-bot configs.

`POST` Pull admin bot job

POST /api/v2/admin/admin-bot/jobs/pull

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/jobs/pull" \
  -X POST \
  -H "Authorization: Bearer <admin-bot-token>"

1
{
2
  "kind": "goodAdminBotJobPull",
3
  "message": "The admin bot job was pulled successfully.",
4
  "data": {
5
    "job": {
6
      "id": "job-1a2b3c",
7
      "challengeId": "baby-rev",
8
      "configRevision": "v1",
9
      "userId": "team-1a2b3c",
10
      "submittedAt": "2024-03-09T00:00:00.000Z",
11
      "flags": [
12
        {
13
          "provider": "flags/static",
14
          "flag": "rctf{baby_rev}"
15
        }
16
      ],
17
      "flag": "rctf{baby_rev}",
18
      "inputs": {
19
        "url": "https://example.com"
20
      },
21
      "instancerInstances": [
22
        {
23
          "type": "tcp",
24
          "host": "baby-rev.rctf.osec.io",
25
          "port": 1337,
26
          "title": "nc"
27
        }
28
      ]
29
    }
30
  }
31
}

Auth: Service
Gate: None
Permissions: No extra permissions
Captcha: No captcha
Rate limit: No rate limit

The admin bot worker calls this service route when it is ready for more work. It receives the oldest queued job. When nothing is waiting, the response has job set to null.

The request is authenticated with the shared admin bot bearer token from adminBot.provider.options.secretKey in rctf.d/.

Response fields

job.idstring: Admin-bot job ID.
job.challengeIdstring: Challenge ID the job targets.
job.configRevisionstring: Admin-bot config revision used.
job.userIdstring: Team ID that submitted the job.
job.submittedAtstring: Submission time as an ISO 8601 string.
job.flags[].providerstring: Flag provider that produced this flag.
job.flags[].flagstring: Flag value minted for the team.
job.flagstring: Deprecated: the first entry of flags, kept for backwards compatibility. Empty when no flags are configured.
job.inputsRecord<string, string>: Submitted input values keyed by field name.
job.instancerInstances[].typestring: Instance exposure type.
job.instancerInstances[].hoststring: Instance host.
job.instancerInstances[].portnumber: Instance port.
job.instancerInstances[].titlestring | undefined: Short label for the instance, when present.

`GET` Admin bot source

GET /api/v2/admin/admin-bot/challenges/:id/source

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/challenges/challenge-id/source" \
  -H "Authorization: Bearer <admin-bot-token>"

1
{
2
  "kind": "goodAdminBotChallengeSource",
3
  "message": "The admin bot challenge source was retrieved successfully.",
4
  "data": {
5
    "sourceCode": "await page.goto(url)",
6
    "configRevision": "v1"
7
  }
8
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

Auth: Service
Gate: None
Permissions: No extra permissions
Captcha: No captcha
Rate limit: No rate limit

The admin bot worker calls this service route to read the source code saved for a challenge config revision.

The request is authenticated with the shared admin bot bearer token from adminBot.provider.options.secretKey in rctf.d/.

Path parameters

id*string: Challenge ID.

Response fields

sourceCodestring: Admin-bot script source code.
configRevisionstring: Config revision the source belongs to.

`POST` Complete admin bot job

POST /api/v2/admin/admin-bot/jobs/:id/complete

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/jobs/job-id/complete" \
  -H "Authorization: Bearer <admin-bot-token>" \
  --json '{
    "logs": "newline-delimited log data"
  }'

1
{
2
  "kind": "goodAdminBotJobUpdate",
3
  "message": "The admin bot job was updated successfully.",
4
  "data": {
5
    "ok": true
6
  }
7
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

Auth: Service
Gate: None
Permissions: No extra permissions
Captcha: No captcha
Rate limit: No rate limit

The admin bot worker calls this service route after a job finishes successfully. The request can include logs so organizers can review what happened later.

Logs are optional. When included, the server accepts up to 1048576 characters.

Path parameters

id*string: Admin-bot job ID.

Request body

logsstring: Captured job logs.

Response fields

okboolean: Whether the update was applied.

`POST` Fail admin bot job

POST /api/v2/admin/admin-bot/jobs/:id/fail

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/jobs/job-id/fail" \
  -H "Authorization: Bearer <admin-bot-token>" \
  --json '{
    "logs": "newline-delimited log data"
  }'

1
{
2
  "kind": "goodAdminBotJobUpdate",
3
  "message": "The admin bot job was updated successfully.",
4
  "data": {
5
    "ok": true
6
  }
7
}

1
{
2
  "kind": "badEndpoint",
3
  "message": "The request endpoint could not be found."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

Auth: Service
Gate: None
Permissions: No extra permissions
Captcha: No captcha
Rate limit: No rate limit

The admin bot worker calls this service route when a job cannot complete successfully. The request can include logs so organizers can inspect the failure.

Logs are optional. When included, the server accepts up to 1048576 characters.

Path parameters

id*string: Admin-bot job ID.

Request body

logsstring: Captured job logs.

Response fields

okboolean: Whether the update was applied.

`GET` Admin bot queue depth

GET /api/v2/admin/admin-bot/queue-depth

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/admin-bot/queue-depth" \
  -H "Authorization: Bearer <admin-bot-token>"

1
{
2
  "kind": "goodAdminBotQueueDepth",
3
  "message": "The admin bot queue depth was retrieved successfully.",
4
  "data": {
5
    "depth": 4
6
  }
7
}

Auth: Service
Gate: None
Permissions: No extra permissions
Captcha: No captcha
Rate limit: No rate limit

The admin bot worker can call this service route to check how many jobs are waiting in the queue.

The request is authenticated with the shared admin bot bearer token from adminBot.provider.options.secretKey in rctf.d/.

Response fields

depthnumber: Number of jobs currently queued.

`GET` List external-auth clients

GET /api/v2/admin/external-auth/clients

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/external-auth/clients" \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminExternalAuthClients",
3
  "message": "External-auth clients listed.",
4
  "data": [
5
    {
6
      "id": "client-1a2b3c",
7
      "name": "osec-dashboard",
8
      "redirectUri": "https://app.osec.io/callback",
9
      "createdAt": "2024-03-09T00:00:00.000Z",
10
      "createdBy": "admin-1a2b3c"
11
    }
12
  ]
13
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

Returns every registered external-auth client. Client secrets are never returned by this route - they are shown exactly once at creation time by Create external-auth client and cannot be retrieved afterward.

See External auth for the user-facing routes and External apps for the operator setup.

Response fields

idstring: OAuth client ID.
namestring: Client display name.
redirectUristring: Registered redirect URI.
createdAtstring: Creation time as an ISO 8601 timestamp.
createdBystring | null: ID of the admin who created the client, or null.

`POST` Create external-auth client

POST /api/v2/admin/external-auth/clients

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/external-auth/clients" \
  -H "Authorization: Bearer <auth-token>" \
  --json '{
    "name": "Dynamic scoring backend",
    "redirectUri": "https://my-service.example.com/auth/rctf/callback"
  }'

1
{
2
  "kind": "goodAdminExternalAuthClientCreate",
3
  "message": "External-auth client created. Store the secret now - it cannot be retrieved later.",
4
  "data": {
5
    "id": "client-1a2b3c",
6
    "name": "osec-dashboard",
7
    "redirectUri": "https://app.osec.io/callback",
8
    "createdAt": "2024-03-09T00:00:00.000Z",
9
    "createdBy": "admin-1a2b3c",
10
    "secret": "<client-secret>"
11
  }
12
}

1
{
2
  "kind": "badBody",
3
  "message": "The request body does not meet requirements.",
4
  "data": {
5
    "reason": "name: Required"
6
  }
7
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

1
{
2
  "kind": "badJson",
3
  "message": "The request JSON body is malformed."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

Registers a new external-auth client. rCTF generates a UUID id and a 32-byte base64url secret. The redirect URI is stored exactly as supplied and is matched byte-for-byte at authorize time - no wildcards, no path normalization.

Warning (The secret is shown exactly once)

The response is the only place where the client secret is ever returned. Store it immediately somewhere the integrator can retrieve it. If it gets lost the client must be deleted and re-created.

Request body

name*string: Display name for the OAuth client.
redirectUri*string: Allowed OAuth redirect URI.

Response fields

idstring: OAuth client ID.
namestring: Client display name.
redirectUristring: Registered redirect URI.
createdAtstring: Creation time as an ISO 8601 timestamp.
createdBystring | null: ID of the admin who created the client, or null.
secretstring: Client secret. Shown once - store it now.

`DELETE` Delete external-auth client

DELETE /api/v2/admin/external-auth/clients/:id

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/external-auth/clients/11111111-2222-3333-4444-555555555555" \
  -X DELETE \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAdminExternalAuthClientDelete",
3
  "message": "External-auth client deleted."
4
}

1
{
2
  "kind": "badExternalAuthRequest",
3
  "message": "External-auth request rejected."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: usersWrite
Captcha: No captcha
Rate limit: No rate limit

Removes an external-auth client. After this returns, POST /api/v2/external-auth/token exchanges with that clientId always fail with 400 badExternalAuthRequest.

Deleting a client does not revoke access tokens it already issued. Rotating the global tokenKey invalidates them, but also invalidates every other rCTF token.

Unknown client IDs return 400 badExternalAuthRequest.

Path parameters

id*string: OAuth client ID.

Response

A successful request returns 200 goodAdminExternalAuthClientDelete with no data.

`DELETE` Delete all team solves

DELETE /api/v2/admin/users/:userId/solves

Edit this page View Markdown

Last updated Jul 28, 2026

curl -sS "https://rctf.osec.io/api/v2/admin/users/team-id/solves" \
  -X DELETE \
  -H "Authorization: Bearer <auth-token>"

1
{
2
  "kind": "goodAllChallengeSolvesDeleteV2",
3
  "message": "All solves for this team were revoked."
4
}

1
{
2
  "kind": "badPerms",
3
  "message": "The user does not have the required permissions."
4
}

1
{
2
  "kind": "badToken",
3
  "message": "The token provided is invalid."
4
}

Auth: Required
Gate: None
Permissions: challsSolveWrite
Captcha: No captcha
Rate limit: No rate limit

This route removes every solve for a specific team. Challenges and team remain in place, and the leaderboard is recalculated after the solves are removed.

If the team has no solves, the request succeeds without making any changes.

Path parameters

userId*string: Team ID whose solves to delete.

Response

A successful request returns 200 goodAllChallengeSolvesDeleteV2 with no data.