GLOBAL Testbed API — server-authoritative economy

This is a reference implementation for security testing. The server owns all money, prices, and rewards — clients can only request actions.

▶ Play GLOBAL (web client) Staff admin panel

Status

● Service healthy — /healthz

Endpoints

Method	Path	Auth	Purpose
POST	/auth/register	none	Create account + character
POST	/auth/login	none	Get access + refresh tokens
POST	/auth/refresh	none	Rotate refresh token
POST	/auth/password	Bearer	Change password (revokes sessions)
POST	/auth/recover + /auth/recover/confirm	none	Password recovery (simulated email)
POST	/auth/verify-email + /auth/verify-email/confirm	Bearer/none	Email verification (simulated)
GET/DELETE	/auth/sessions[/:id]	Bearer	List / revoke own sessions
GET	/me	Bearer	Account + balance
POST	/me/delete	Bearer	Self-service account deletion
GET	/me/transactions	Bearer	Own ledger entries
GET	/me/properties	Bearer	Owned properties
GET	/economy/balance	Bearer	Read own balance
POST	/economy/transfer	Bearer	Send credits (idempotent, velocity-limited)
POST	/economy/purchase-property	Bearer	Buy at server-set price
POST	/economy/complete-job	Bearer	Server-decided reward
GET	/properties/available	none	List properties + prices
POST	/reports	Bearer	Report a player (rate-limited)
POST	/admin/grants	Bearer (admin)	Grant; large amounts need dual control
GET/POST	/admin/grants/pending, /admin/grants/:id/approve\|reject	Bearer (admin)	Approve/reject pending grants
GET	/admin/accounts[/:id]	Bearer (admin)	Account search + detail
POST	/admin/accounts/:id/status\|role	Bearer (admin)	Suspend/delete accounts, change roles
GET/POST	/admin/reports, /admin/reports/:id/resolve	Bearer (admin/mod)	Moderation queue
POST	/admin/reconcile	Bearer (admin)	Verify balances == ledger sums
GET	/admin/anomalies	Bearer (admin)	Anti-cheat detection output
GET	/admin/transactions	Bearer (admin)	Global ledger view
POST	/admin/grant	Bearer (admin)	Legacy grant (dual-control applies)
GET	/admin/audit	Bearer (admin/mod)	Read audit log
GET	/metrics	Bearer (admin)	Service metrics

Try it

curl -sS ${location.origin}/healthz

curl -sS -X POST ${location.origin}/auth/register -H 'content-type: application/json' -d '{"email":"you@example.com","password":"correct-horse-battery","name":"You"}'

Security properties enforced

Overdraw refused (409 insufficient_funds)
Idempotency-key replay does not double-spend
Concurrent same-key retries cannot duplicate money
Only one of two concurrent buyers wins a property
Purchase price is server-side — client-supplied price is ignored
Job reward is server-side — client cannot set it
Velocity limits: too many/too large transfers → 429 + anomaly record
Reconciliation: every balance must equal its ledger sum
Dual control: large grants need two different admins; self-approval is blocked
Moderator RBAC: mods see audit + reports, never currency or accounts
Suspend/delete an account → sessions revoked, economy access refused
Password change revokes all sessions
Recovery tokens expire in 1 hour and are single-use

⚠ Testbed note: recovery/verification tokens are returned in the API response instead of being emailed (simulated delivery) so the flows can be tested end-to-end.