Palworld REST API: Kick, Ban, Announce and Save Remotely

Once a dedicated server is up, the host eventually needs a few things: kick someone who's griefing, warn the server before a restart, force a save without stopping. Palworld's official interface for all of that is the REST API. RCON — the thing older guides walk you through — is deprecated, and the developers have said it will stop working; skip any guide still built on it.

This covers how to enable the API, how to call it, what it can do, and one security rule that must not be broken. Setting up the server itself is the complete setup guide.

Why not RCON anymore

RCON has three practical problems on Palworld, and the deprecation isn't arbitrary:

• Multi-byte characters get truncated. Player names in Chinese, Japanese or Korean regularly make RCON commands fail or garble the log.
• Weak authentication. The password crosses the network in the clear; an exposed port is AdminPassword sitting on the open internet.
• It returns a string. Want player count or frame rate for monitoring? You're parsing text.

REST is HTTP plus JSON and solves all three.

Enabling it

Add three options to that one long line in PalWorldSettings.ini (the editing pitfalls are in every option explained), then restart the server:

RESTAPIEnabled=True
RESTAPIPort=8212
AdminPassword="a-long-password"

AdminPassword isn't only the API password — it's also the password for in-game admin commands. Make it long, and don't reuse ServerPassword: the server password gets handed to friends, the admin password doesn't.

Authentication is HTTP Basic: the username is always admin, the password is the one above.

The rule that must not be broken

Never open port 8212 to the internet. The developers' own words, in the official REST API reference, are that these APIs "are not designed to be exposed directly to the Internet" and doing so "may result in unauthorized manipulation of the server." It can shut the server down, kick players and change plenty else, and its entire defense is one Basic-auth password.

The right posture: the API listens on localhost only, and scripts call it from the same machine. If you genuinely need remote management, go through an SSH tunnel, or put a reverse proxy in front with HTTPS and a source-IP allowlist. A security group with 8212 open to 0.0.0.0/0 is a misconfiguration.

The endpoints

All under http://127.0.0.1:8212/v1/api/; writes are POST with a JSON body:

The ones you'll use most, straight from curl:

PW='a-long-password'
API='http://127.0.0.1:8212/v1/api'

# who's online
curl -s -u "admin:$PW" "$API/players"

# announce to everyone
curl -s -u "admin:$PW" -X POST "$API/announce" \
     -H 'Content-Type: application/json' \
     -d '{"message":"Server restarts in 5 minutes"}'

# force a save
curl -s -u "admin:$PW" -X POST "$API/save"

# graceful shutdown in 60 seconds, announced automatically
curl -s -u "admin:$PW" -X POST "$API/shutdown" \
     -H 'Content-Type: application/json' \
     -d '{"waittime":60,"message":"Server is going down in 60 seconds"}'

Kick and ban work on userId, not names

Kicks and bans target a player's userId, not the name shown in game — names can be changed any time, the userId can't. So it's two steps: GET /players to find the person's userId, then hand it to /kick or /ban:

# look them up
curl -s -u "admin:$PW" "$API/players"
# then ban
curl -s -u "admin:$PW" -X POST "$API/ban" \
     -H 'Content-Type: application/json' \
     -d '{"userid":"steam_7656119xxxxxxxxxx","message":"Banned for griefing"}'

This matters more on a crossplay server: Xbox and PS5 players have no Steam ID, so the old KickPlayer <SteamID> command can't touch them, while userId is the one identifier shared across every platform.

Kick versus ban: a kick only drops this connection and they can come straight back; a ban keeps them out until /unban.

What to build on it

The API's real value isn't typing curl by hand — it's scripts:

• Scheduled restarts that don't lose the save: announce, save, shutdown, start, chained in one cron job. The whole recipe is in memory leak and scheduled restarts.
• Flush before backing up: POST /save before copying the save directory, so what you copy is complete (backup and restore).
• Frame-rate monitoring: poll /metrics; server FPS sitting under 20 for long stretches is the signal to restart.

Common questions

How do I kick or ban someone on a Palworld dedicated server?

Enable the REST API and set AdminPassword, look up the player's userId with /players, then pass it to /kick or /ban. It has to be the userId — display names can be changed, so they don't count.

Does Palworld RCON still work?

It's officially deprecated and slated to stop working in a future build, and it truncates non-ASCII player names. New servers should go straight to the REST API; don't spend time on RCON.

Can I open the REST API port so a friend can help administer?

Not to the internet. Its only protection is a password, and it can shut the server down, kick players and change the world. Use an SSH tunnel, or a reverse proxy with an IP allowlist, for remote access.

How do I force a save without stopping the server?

POST /save. It makes the server write the in-memory world to disk immediately; copy the save directory afterwards. It lowers the odds of catching a write in progress but doesn't remove them — a stopped server is still the safest backup.

On hosting you never touch the API

Every step above becomes a button in the Console on a hosted server. On a dedicated Palworld server from KeepWorlds, My servers has a Players online panel listing who's in; Kick or Ban the griefer directly, no userId lookup, and lift bans any time from Banned. The save is flushed through the API before every automatic backup, the admin password is managed for you, and the API itself isn't reachable from the internet.