Developers
API Reference
The xiflow REST API lets you build, manage, and share lineups programmatically.
Last updated · July 3, 2026
Coming soon
The public API ships with the backend. The contract below is the target we're building against — endpoints, shapes, and errors may change before release. Follow the changelog for the announcement.
Overview
The API is RESTful and returns JSON. All write and read endpoints for private resources require authentication. Public shared lineups can be fetched without a token.
Base URL: https://api.xiflow.app/v1
Content-Type: application/json
Authentication
Authenticated requests carry a bearer token in the Authorization header:
Authorization: Bearer <token>
Auth endpoints
| Method | Path | Description |
|---|---|---|
POST | /api/auth/register | Register a new user |
POST | /api/auth/login | Log in and receive a token |
GET | /api/auth/user | Get the current user profile |
POST | /api/auth/logout | Invalidate the current session |
Lineups
A lineup describes a formation and the players assigned to each slot. The caller may only read, update, and delete their own lineups.
| Method | Path | Description |
|---|---|---|
GET | /api/lineups | List the caller's lineups |
GET | /api/lineups/:id | Get a single lineup |
POST | /api/lineups | Create a lineup |
PUT | /api/lineups/:id | Update a lineup |
DELETE | /api/lineups/:id | Delete a lineup |
POST | /api/lineups/:id/duplicate | Duplicate a lineup |
A lineup payload includes the formation id, a name, and a players map of slot id to player:
{
"id": "ln_1abc",
"name": "Away vs City",
"formation": "4-3-3",
"players": {
"lw": { "name": "...", "role": "FWD", "rating": 85 },
// ...
}
}
Teams
Teams group players under a club or squad so lineups can be built from a known roster.
| Method | Path | Description |
|---|---|---|
GET | /api/teams | List the caller's teams |
POST | /api/teams | Create a team |
GET | /api/teams/:id | Get a team |
PUT | /api/teams/:id | Update a team |
DELETE | /api/teams/:id | Delete a team |
Errors
Errors return a JSON body with an errorfield describing what went wrong.
| Status | Name | Meaning |
|---|---|---|
| 400 | Bad request | Missing or invalid fields |
| 401 | Unauthorized | Missing or invalid token |
| 403 | Forbidden | Not the owner of this resource |
| 404 | Not found | The resource does not exist |
| 429 | Rate limited | Too many requests, slow down |
| 500 | Server error | Something broke on our side |