Admin
Administrative endpoints requiring bearer token authentication
Grants credits to a user on an admin's behalf. Requires signed fetch from an address in READ_WRITE_ADMIN_ADDRESSES; that address is recorded as the granter.
Two shapes:
goal: the season goal reward, as a signed MANA credit.on-demand:creditsShop credits (1 credit = 10 cents) written to the USD balance. Nothing is signed, the credits do not expire, and the grant counts against a service-wide daily ceiling for USD grants. Refused while Shop USD credits are disabled, while no ceiling is configured, for wallets flagged for multi-accounting, and to the granting admin's own wallet.
On-demand MANA grants are retired: a body with amount, a MANA denomination or an expiresAt is a 400. An explicit null in any optional field is treated as omitted. credits, amount, denomination and expiresAt are refused on goal grants. In GET /credits, these grants carry credit_source = grant (filter with source=grant), have no MANA amount, and are left out by min_amount/max_amount.
Signed fetch authentication using @dcl/platform-crypto-middleware (ADR-44l). Requires auth chain headers (x-identity, x-signature, x-timestamp) for signature validation. See http://adr.decentraland.org/adr/ADR-44l for details.
User's Ethereum address
0x742d35Cc6634C0532925a3b844Bc9e7595f0bEbPattern: ^0x[a-fA-F0-9]{40}$Credits granted successfully
Bad request - a body that is not a JSON object, an invalid address, type or goalId, invalid credits, reason
or annotation, a retired MANA grant (amount or a MANA denomination), any other denomination, an
expiresAt, or any on-demand field on a goal grant
Unauthorized - the signer is not a read-write admin
On-demand grant to the granting admin's own wallet
On-demand grant requested while Shop USD credits are disabled
Duplicate goal credit, or an on-demand grant to a wallet flagged for multi-accounting
The on-demand grant would exceed the daily ceiling for USD grants
Internal server error
On-demand grant requested while no USD grant ceiling is configured
POST /users/{address}/credits HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 58
{
"type": "on-demand",
"credits": 250,
"reason": "Event winner"
}{
"signature": "text",
"expiresAt": 1,
"season": null,
"seasonId": null,
"creditId": "text"
}Restarts a user's progress in the current season. Only available in non-production environments. Requires bearer token authentication with API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
User's Ethereum address
^0x[a-fA-F0-9]{40}$Program restarted successfully
Bad request
Unauthorized - Invalid bearer token
POST /restart-program HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 55
{
"address": "0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb"
}{
"ok": true
}Sends a test email to verify email notification functionality. Only available in non-production environments. Requires bearer token authentication with API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
User's Ethereum address to send test email to
^0x[a-fA-F0-9]{40}$Test email sent successfully
Unauthorized - Invalid bearer token
POST /test-email HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 18
{
"address": "text"
}{
"ok": true
}Flags one or more users for multi-accounting detection or blacklisted addresses. This endpoint is designed for programmatic use by external systems. Requires bearer token authentication with PROGRAMMATIC_API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
IP address associated with the flagged users
List of Ethereum addresses linked to the same IP
Source of the flagging detection
Users flagged successfully
Bad request - Invalid addresses or missing required fields
Unauthorized - Invalid bearer token
POST /flag HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 71
{
"ip": "text",
"addressesLinked": [
"text"
],
"source": "ip_multi_accounting"
}{
"ok": true
}Removes flags from users for captcha or multi-account violations. Requires bearer token authentication with API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
List of Ethereum addresses to unflag
Type of flag to remove
Users unflagged successfully
Bad request - Invalid addresses
Unauthorized - Invalid bearer token
POST /unflag HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87
{
"addresses": [
"0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb"
],
"cacheType": "multi-account"
}{
"ok": true
}Retrieves all flagged wallets with their flagging details including timestamps, reasons, and associated IP addresses. Provides summary statistics. Requires bearer token authentication with API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
Flagged wallets retrieved successfully
Total number of flagged wallets
Unauthorized - Invalid bearer token
GET /admin/flagged-wallets HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"flaggedWallets": [
{
"address": "text",
"flagType": "captcha",
"flaggedAt": "2026-01-01T00:00:00.000Z",
"reason": {
"message": "text",
"ip": "text",
"linkedAddresses": [
"text"
]
},
"attempts": 1
}
],
"totalCount": 1,
"metadata": {
"captchaFlags": 1,
"multiAccountFlags": 1,
"retrievedAt": "2026-01-01T00:00:00.000Z"
}
}Manually triggers reminder email sending for users based on time window. Requires bearer token authentication with API_ADMIN_TOKEN.
Bearer token authentication for administrative endpoints. Use API_ADMIN_TOKEN for most admin endpoints or PROGRAMMATIC_API_ADMIN_TOKEN for /flag endpoint.
Optional day of week filter
Time window for sending emails
Emails triggered successfully
Bad request - Invalid day or dateTime
Unauthorized - Invalid bearer token
POST /trigger-emails HTTP/1.1
Host: credits.decentraland.org
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 37
{
"day": "friday",
"dateTime": "evening"
}{
"ok": true
}Last updated