Developers

Every method is a POST of a JSON body to /package.Service/Method on https://api.bulletmeta.app. That is the Connect protocol; the same endpoints speak gRPC and gRPC-Web.

curl https://api.bulletmeta.app/bulletmeta.api.v1.ServerService/GetLiveStatus \
  -H "Authorization: Bearer $BULLETMETA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"serverId": "…"}'

Streaming needs a real gRPC client — with buf curl:

buf curl --protocol grpc --http2-prior-knowledge \
  -H "Authorization: Bearer $BULLETMETA_API_KEY" \
  -d '{"serverId": "…"}' \
  https://api.bulletmeta.app/bulletmeta.api.v1.ServerService/WatchLiveStatus

Generated SDKs come from the schema on the Buf Schema Registry:

# Go
go get buf.build/gen/go/bulletmeta/api/connectrpc/go

# TypeScript
npm i @buf/bulletmeta_api.connectrpc_es

A key belongs to one organization and is created by its owner under Settings → API. The token bm_live_<prefix>_<secret> is shown once and only its SHA-256 is stored, so a lost key is replaced rather than recovered. Up to 25 active keys, expiry from 1 to 730 days, and a revocation takes effect within 60 seconds.

Authorization: Bearer bm_live_…

There is no organization parameter anywhere: a key acts on the organization it belongs to. Anything it may not see answers not_found, which is indistinguishable from something that does not exist.

10 requests a second per key, bursting to 100. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; over the limit is HTTP 429 with Retry-After in seconds.

for attempt in 1 2 3 4 5; do
  sleep $(( 2 ** attempt ))   # and honour Retry-After when it is larger
done

List methods take pageSize and answer with nextPageToken. Send it back as pageToken for the next page; an empty token is the end. Tokens are opaque keyset cursors — do not parse or build one.

Errors are Connect codes, with the HTTP status a Connect client maps them to:

Every write takes a requestId. Retrying with the same one returns the first response instead of writing again, for 24 hours — so a timeout you did not see the answer to is safe to repeat.

curl https://api.bulletmeta.app/bulletmeta.api.v1.OrgService/CreateWhitelistGrant \
  -H "Authorization: Bearer $BULLETMETA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"subject": "76561198000000000", "requestId": "seed-2026-09-16-01"}'

A write that was saved but could not be pushed to a game server answers with warnings and no error: the record exists, and retrying would write it twice. Every write is audited as your key, and shows in the console's audit log as "API key ‹name›".

The schema is bulletmeta.api.v1, published on buf.build/bulletmeta/api. Fields are added, never renumbered or removed — every change runs through buf breaking. A breaking change would be a new package, never an edit to v1.