API Privacy | Wynncraft | Documentation

Access Rules

Since the release of the user system in August 2025, players linked to a Wynncraft Account can manage API access with Access Rules.

Access Rules define who can read a player’s stats:

Rule Option	Description
Public	Everyone can access the data.
Friends	Only friended players can access the data. Friendship must be mutual.
Guild	Only players sharing the same guild can access the data.
Guild & Friends	Only players who are both in the same guild and mutual friends can access the data.
Private	Nobody can access the data except the player.

All linked players on the requesting Wynncraft Account are used when checking access. For example, if you request Player A whose rule is set to Friends, access is granted if any player linked to your account is mutual friends with Player A.

Player stat responses include a restrictions dictionary. Each key maps to an access rule used by the endpoint. A value of true means that field group is restricted for the requester.

1 {
2   "restrictions": {
3     "mainAccess": true,
4     "characterDataAccess": false
5   }
6 }

Rule List

Rule	Description	Default
`mainAccess`	Controls access to global data and featured stats.	Public
`characterListAccess`	Controls access to the character list.	Public
`characterDataAccess`	Controls access to character data.	Public
`characterBuildAccess`	Controls access to skill points and ability trees.	Public
`huntedCharacterAccess`	Controls access to characters using the hunted gamemode.	Guild & Friends
`onlineStatus`	Controls online status and last join visibility.	Public
`guildHistoryAccess`	Controls the access to your guild history.	Public

Character Skeleton Customization

Players can customize the skeleton of their character data. Removing a stat hides it from everyone except the player.

Character responses include removedStat, an array of hidden stats.

1 {
2   "removedStat": [
3     "contentCompletion",
4     "chestsFound"
5   ]
6 }

Leaderboard Visibility

Players can opt out of specific leaderboards. This does not remove their records entirely; instead, the record is anonymized and fields such as username, UUID, and character type can be replaced with redacted.

Leaderboard records expose this with the restricted key.

Using the API to save player stats is allowed, but it must not be used to bypass player access rules.