HCP AC API

Authentication

Anti-Cheat resources keep their license key server-side and sign timestamp.nonce.rawBody with HMAC-SHA256. Scanner API keys are created in the panel and shown once.

POST https://hcp-ac.com/api_ac.php
Content-Type: application/json
X-HCP-License-Key: HCP-AC-...
X-HCP-Timestamp: 1782554400
X-HCP-Nonce: unique-16-char-value
X-HCP-Signature: hmac-sha256

Create PIN

An active Analytic or Complete license can create a Scanner PIN. Anti-Cheat-only licenses receive a product error.

POST /public_api.php
X-HCP-API-Key: hcpac_...

{"action":"create_pin","target":"Ticket DEMO-42","reason":"Staff review"}

{"success":true,"data":{"pin":"5071","status":"created","expires_in":1800}}

Check User

Returns identity, Discord intelligence, manual cheater state, active Anti-Cheat bans, global blocks, reports and evidence as separate datasets.

{"action":"check_user","discord_id":"123456789012345678"}

Discord Flags

Anti-Cheat API

Anti-Cheat and Complete licenses are accepted. Analytic-only licenses receive PRODUCT_NOT_ALLOWED. Every endpoint returns JSON.

{"action":"player.ban","player_id":"42","discord_id":"123456789012345678","reason":"Executor detected","confidence_percent":98}

{"ok":true,"success":true,"ban_id":"HCP-BAN-A1B2C3D4"}

Ban API

Create, list, inspect and revoke evidence-backed bans. Offline bans use the same active ban table and match identifiers on the next join.

{"action":"ban.list","status":"active"}
{"action":"ban.get","ban_id":"HCP-BAN-A1B2C3D4"}
{"action":"ban.evidence","ban_id":"HCP-BAN-A1B2C3D4"}

{"action":"player.unban","ban_id":"HCP-BAN-A1B2C3D4","reason":"Appeal accepted"}

Screenshot API

Queues a screenshot for an online player. The Resource uses the configured server-side provider and reports the stored evidence URL.

{"action":"screenshot.request","player_id":"42","reason":"Staff review"}

Watch API

Start or stop recurring evidence without exposing provider credentials.

{"action":"watch.start","player_id":"42","interval_seconds":10}
{"action":"watch.stop","watch_id":"WATCH-..."}

On-Screen Agent

When a configured player joins, the resource creates a one-time personal ZIP. Its native Windows client is bound to the player session and the first connecting device. After explicit consent it sends signed 15-second heartbeats and visibly maintains a five-second memory-only desktop buffer. A normal detection does not upload that buffer. A confirmed Anti-Cheat ban queues a signed agent task which stores one desktop screenshot and a five-second clip in the protected ban evidence view.

Config Pull

Pulls the saved Protection, Evidence, Enforcement and System configuration plus rule overrides.

{"action":"config.pull","server_identifier":"fivem-server-01","resource_version":"1.0"}

Resource Security Exports

Register sensitive server events through the HCP AC firewall. Validation runs before your handler and records rate, schema, authorization, ownership and replay violations in the normal HCP review pipeline.

exports.hcp_ac:RegisterProtectedEvent('job:claimReward', {
  burst = 2,
  refillPerSecond = 0.2,
  maxBytes = 512,
  maxDepth = 2,
  schema = function(payload, source)
    return type(payload) == 'table' and type(payload.job_id) == 'string'
  end,
  authorize = function(source, payload)
    return ServerCanClaimReward(source, payload.job_id)
  end
}, function(source, payload)
  GrantServerCalculatedReward(source, payload.job_id)
end)

exports.hcp_ac:RegisterWeaponInventoryAdapter(function(source, weaponHash)
  return FrameworkPlayerHasWeapon(source, weaponHash)
end)

local ok, reason = exports.hcp_ac:ValidateEconomyTransaction(source, {
  account = 'bank', delta = 2500,
  transaction_id = serverGeneratedId,
  context = { job = 'delivery' }
})

Framework and Context Adapters

ESX and QBCore are discovered when available and supply inventory, account and job context without creating a hard dependency. Economy checks are disabled by default. Every transaction passed to ValidateEconomyTransaction must contain a server-generated ID and server_authorized=true; client-provided reward amounts are rejected.

exports.hcp_ac:RegisterPlayerContextAdapter(function(source, rule)
  return {
    job = GetTrustedJob(source),
    state = GetTrustedPlayerState(source),
    exempt_rules = IsInScriptedScene(source) and {
      'freecam', 'spectate'
    } or {}
  }
end)

exports.hcp_ac:RegisterConnectionRiskProvider(function(endpoint, done)
  MyRiskProvider(endpoint, function(result)
    done({
      vpn = result.vpn == true,
      proxy = result.proxy == true,
      score = result.score
    })
  end)
end)

The connection provider is optional, cached and fail-open on errors or timeout. Configure exact endpoint allowlist entries in the panel. Provider mode defaults to observe; use deny only after measuring false positives.

Heartbeat

Updates server state, installed version and player count. A server disabled in the panel receives PROTECTION_DISABLED.

{"action":"heartbeat","server_identifier":"fivem-server-01","resource_version":"1.0","online_players":42}

Auto Updates

The updater compares the latest published semantic version, verifies SHA256 hashes and reports each state. Optional restart settings are applied only after every file passed verification.

{"action":"resource.update_check","current_version":"1.2.1","channel":"stable"}

{"ok":true,"latest_version":"1.0","update_required":true,"restart_required":true}

Management API

Management integrations use a server-side management key. Send it with X-HCP-Management-Key; do not place management keys in browser code.

POST /management_api.php
Content-Type: application/json
X-HCP-Management-Key: MANAGEMENT_KEY

{"action":"license.reset_binding","discord_id":"123456789012345678","reason":"Server moved"}
{"action":"ac.global_block.create","discord_id":"123456789012345678","license2_identifier":"license2:...","hwid_hash":"sha256...","reason":"Confirmed ban evasion"}
{"action":"transcript.encode","botghost_url":"https://transcripts.botghost.com/view/..."}

{"ok":true,"success":true,"data":{"binding_reset":true,"binding_reset_count":3}}
{"ok":true,"success":true,"data":{"created":true}}
{"ok":true,"success":true,"data":{"code":"hcp-transcript-...","transcript_url":"https://hcp-ac.com/transcript/hcp-transcript-..."}}

Webhooks

Enterprise webhooks can report scan, evidence and review events. Validate signatures server-side and rotate secrets in the panel.

{"event":"report.completed","created_at":"2026-06-27T12:00:00Z","data":{"report_id":42}}

Responses

{"success":true,"data":{}}

{"success":false,"error":{"code":"validation_error","message":"Invalid request."}}

Error Codes

Errors remain JSON and use stable codes with an actionable message.