API reference
The base URL is https://api.vrchatlegends.com/api. Responses are JSON unless the endpoint specifies HTML or plain text.
Public data
| Request | Result |
|---|---|
GET /players | Curated Legends, excluding community profiles |
GET /players/:id | A profile, subject to visibility rules |
GET /social/feed | Public social feed |
GET /groups | VRChat groups |
GET /worlds | Featured worlds |
GET /events | Group events |
GET /team | Site team |
GET /stats | Community statistics |
GET /site/context | Site overview for integrations |
GET /health | API health |
See permanent user IDs for account lookup, which is distinct from profile slug lookup.
Authenticated requests
Create an API key in Developer tools. Accounts can keep up to five keys. Keep the raw key secret; it is shown when created or regenerated. Send Authorization: Bearer vrcl_YOUR_API_KEY. Account and site-context routes also support X-API-Key, but use the bearer header for player routes. Never publish a key in a web page, iframe URL, or repository.
Common scopes include account:read, profile:read, profile:write, feed:read, feed:write, feed:delete, comments:read, comments:write, followers:read, followers:write, and media:write. Possessing a scope does not bypass ownership or patron entitlement checks.
legends:read and legends:write are retained for older integrations. Profile writes accept profile:write or legends:write. Upload routes check legends:write and its current aliases, including profile:write and media:write. Use the endpoint chapters for the permission checked by each action; scopes are not OAuth sign-in scopes.
| Chapter | Includes |
|---|---|
| Permanent user IDs | Account ID lookup, name search, privacy, pagination |
| Profiles and comments | Profile edits, uploads, comments, followers, invitations |
| Social posts | Timeline queries, posts, replies, likes, reposts, tier limits |
| Integrations | Site data, analytics, VRChat string loaders, examples |
| OAuth | Application registration, authorization code flow and revocation |
| Embeds | Read-only HTML cards, content sections and counters |
For personal exports use export:read; notifications use notifications:read. Extended site context accepts site:read. API keys cannot be used to manage other keys. Website session credentials remain subject to ownership, bans, visibility, and account restrictions.
Errors
Handle 400 for invalid input, 401 for missing/expired credentials, 403 for insufficient permission, 404 for unavailable resources, and 429 for rate limiting. Respect retry headers when supplied. Do not retry writes blindly: a lost response does not necessarily mean the action failed.
Uploads can return 413 for size limits, 422 for a detected audio match, or 503 when required screening is unavailable. Show the API's error message and retain the user's draft. A private resource may intentionally appear as 404.