API Reference
REST API for the VDS Pro Unity SDK and integration partners. All endpoints require a Bearer token in the
Authorization header.
Spec
The full OpenAPI 3.0 spec is hosted as a static file. Drop the URL into Insomnia, Postman, Swagger Editor, or any tooling that imports OpenAPI:
Authentication
Every request needs an Authorization: Bearer <token> header.
Tokens are issued by Cognito (web/Hub login) or as server-signed JWTs for Steam users via
/api/login/start.
Tokens expire in 1 hour. Use a refresh token via /api/refresh rather than re-prompting the user.
Endpoint Index
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/health | Liveness probe (no auth) |
| POST | /api/v1/session/start | Acquire a concurrent-session slot |
| POST | /api/v1/session/heartbeat | Keep the session alive (every ~60s) |
| POST | /api/v1/session/end | Release the session slot |
| POST | /api/v1/saves | Upload a cloud save |
| GET | /api/v1/saves/{productId} | Fetch latest save |
| GET | /api/v1/saves/{productId}/list | List save slots |
| DELETE | /api/v1/saves/{productId}/{slot} | Delete a save slot |
| GET | /api/v1/capabilities | Resolve subscription, trial, and purchased content |
| POST | /api/v1/progress | Record a module attempt with optional Unity evidence |
| GET | /api/v1/progress | Aggregate progress across products |
| GET | /api/v1/progress/{productId} | Per-product progress events |
| GET | /api/v1/assessments | List assigned assessments |
| GET | /api/v1/assessments/{assessmentId} | Get one assessment |
| POST | /api/v1/assessments/{assessmentId}/start | Mark in-progress |
| POST | /api/v1/assessments/{assessmentId}/submit | Submit scores |
| GET | /api/v1/certificates | List pass certificates |
| POST | /api/v1/link-steam | Link a Steam ID |
Webhooks
Enterprise-tier organisations can subscribe to webhooks for events like assessment passed, certificate issued, or seat added.
Configure them at /org/<orgId>/webhooks.
Each delivery is signed with HMAC-SHA256 using your secret. Verify the
X-VDS-Signature header before trusting the body.
The signature is the hex-encoded HMAC of the raw JSON body. Other
delivery headers: X-VDS-Event (event type),
X-VDS-Delivery (a unique delivery id, useful for idempotency).
Support
Email support@vdspro.net with questions or to report a bug. Production status is at /api/health?deep=true.