Mizan API

Check every player who joins your server against every ban list Mizan reads, and add your own bans. JSON over HTTPS, one key per organization.

Base URLhttps://api.mizan.ac

Overview

Your server asks Mizan about each player as they connect. The answer says whether they're marked as a cheater, how many bans they have and from how many communities, and their full public record. What to do with it is your call: Mizan doesn't kick or ban anyone for you.

Check one player as they joinGET /v1/players/{player}
Check up to 100 players at once, such as everyone on a server after a restartPOST /v1/players/lookup
Add your own bans, or update one by sending it againPOST /v1/bans
End one of your bans after an unban or an appealDELETE /v1/bans/{ref}
Read the registry's size and every list it reads, with no keyGET /v1/stats

Every answer is JSON. A success holds its answer under data, and every time is an ISO 8601 string in UTC. The full machine-readable description is the OpenAPI document, which you can load into Postman, Insomnia or a client generator.

Authentication

Routes marked "Needs a key" take your organization's API key in the X-API-Key header. Keys made on mizan.ac start with mzn_. Keys made earlier on justified.gg start with jak_ and still work.

Keep the key on your game server or backend, never in anything players download. Whoever holds it can read records as your organization and, if your organization contributes, add bans in its name.

An approved organization can read records. Adding bans needs contributor status, which GET /v1/me reports along with your servers. A missing or revoked key gets 401; an organization still waiting for approval, or suspended, gets 403.

With a key

curl "https://api.mizan.ac/v1/me" \
  -H "X-API-Key: $MIZAN_API_KEY"

Rate Limits

Each limit counts requests over one minute.

Requests	A minute	Counted per
Public routes (stats and sources)	600	IP address
Public requests the edge cache can't answer	120	IP address
Requests with a missing or refused key	120	IP address
Routes that take a key	300	organization
Adding and ending bans	30	organization

Past a limit, the API answers 429 with the code RATE_LIMITED and a Retry-After header in seconds. Every answer names the limits it counts against in a RateLimit-Policy header.

Checking a full server? Send up to 100 players in one POST /v1/players/lookup rather than a request each. A player's answer can be up to 60 seconds old, so asking about the same player again sooner gains nothing.

Errors

A refusal has an HTTP status and a body with one error object. Branch on code, which is fixed; message is written for people and can change. When you report a problem, quote the X-Request-Id header from the answer.

400: The request is malformed: a bad player id, server key or body.
401: No key, or one that is unknown, disabled or revoked.
403: Your organization is waiting for approval or is suspended, or cannot add bans.
404: No such player, ban or route.
429: Rate limited. Wait a few seconds.
503: The data behind the route is unavailable right now.

Refusal

{
  "error": {
    "code": "INVALID_PLAYER_ID",
    "message": "A player id is the game's own id for the player, such as the SteamID64 76561197960276590, optionally as steam:76561197960276590.",
    "target": "player"
  }
}

Registry

The registry: its size, the lists it reads, a player's record, and your own bans.

Get the registry's size

GET/v1/statsNo key

How many ban lists the registry reads, the bans on them, how many are active, and the games they cover. Updated hourly.

Answer

data.listsinteger
data.bansinteger
data.activeBansinteger
data.gamesinteger

Can refuse with 429. What each means

curl "https://api.mizan.ac/v1/stats"

Answer

{
  "data": {
    "lists": 64,
    "bans": 437163,
    "activeBans": 301204,
    "games": 10
  }
}

Calls the live API from your browser. No key needed.

List the ban lists the registry reads

GET/v1/sourcesNo key

Largest first. state is reading, retrying (the list refused or failed its last reads, so it is read less often) or stopped. url is the list's public page, when it has one.

Answer

data[].keystring
data[].namestring
data[].urlstring or null
data[].gamesarray of strings
data[].bansinteger
data[].activeBansinteger
data[].statestring: One of reading, retrying, stopped.
data[].changedAtdate-time or null

Can refuse with 429. What each means

curl "https://api.mizan.ac/v1/sources"

Answer

{
  "data": [
    {
      "key": "external:blackwonder",
      "name": "BlackWonder.TF",
      "url": "https://bans.blackwonder.tf",
      "games": [
        "tf2"
      ],
      "bans": 62060,
      "activeBans": 61871,
      "state": "reading",
      "changedAt": "2026-10-26T18:17:42.000Z"
    }
  ],
  "total": 64
}

Calls the live API from your browser. No key needed.

Check one player

GET/v1/players/{player}Needs a key

The player's summary and public record: every list's bans on them, with Mizan's own marks.

Path

playerstringRequired: Any game's player: provider:id (steam, minecraft, fivem, epic, xbox, discord), or without a prefix a Steam id in any form (SteamID64, SteamID2 STEAM_0:0:11101, SteamID3 [U:1:22202], the account id 22202, a steamcommunity.com/profiles/ link), a Minecraft UUID with or without dashes, or a FiveM license: hash. With server, a bare id is read the way that server's game names players. URL-encode SteamID3's brackets.

Query

serverstring: One of your servers, by its key.

Answer

data.playerobject
data.player.providerstring
data.player.idstring
data.profilestring
data.cheaterboolean: Caught cheating by Mizan's anti-cheat, or banned for cheating by any organization.
data.mingeboolean: Has a conduct ban (RDM, NITRP, prop abuse, toxicity and the like) from any organization that is in force or was issued in the last year, or Mizan marked them as a minge.
data.bansobject
data.bans.totalinteger
data.bans.activeinteger
data.bans.sourcesinteger: How many organizations' lists name them.
data.bans.conductinteger: Bans for conduct, of any age.
data.bans.categoriesarray of strings
data.bans.gamesarray of strings: The games of the bans that name one.
data.bans.lastAtdate-time or null
data.recordobject or null

Can refuse with 400, 401, 403, 404, 429, 503. What each means

curl "https://api.mizan.ac/v1/players/76561197960287930" \
  -H "X-API-Key: $MIZAN_API_KEY"

Answer

{
  "data": {
    "player": {
      "provider": "steam",
      "id": "76561197960287930"
    },
    "profile": "https://mizan.ac/players/steam/76561197960287930",
    "cheater": false,
    "minge": false,
    "bans": {
      "total": 0,
      "active": 0,
      "sources": 0,
      "conduct": 0,
      "categories": [
        "MRDM"
      ],
      "games": [
        "garrysmod"
      ],
      "lastAt": "2026-10-09T21:40:00.000Z"
    },
    "record": null
  }
}

Check up to 100 players

POST/v1/players/lookupNeeds a key

For a server checking everyone on it. Each player appears once, in the order sent. Any game's player: provider:id (steam, minecraft, fivem, epic, xbox, discord), or without a prefix a Steam id in any form (SteamID64, SteamID2 STEAM_0:0:11101, SteamID3 [U:1:22202], the account id 22202, a steamcommunity.com/profiles/ link), a Minecraft UUID with or without dashes, or a FiveM license: hash. With server, a bare id is read the way that server's game names players.

Body

playersarray of stringsRequired: At most 100.
serverstring: One of your servers, by its key.

Answer

data[].playerobject
data[].player.providerstring
data[].player.idstring
data[].profilestring
data[].cheaterboolean: Caught cheating by Mizan's anti-cheat, or banned for cheating by any organization.
data[].mingeboolean: Has a conduct ban (RDM, NITRP, prop abuse, toxicity and the like) from any organization that is in force or was issued in the last year, or Mizan marked them as a minge.
data[].bansobject
data[].bans.totalinteger
data[].bans.activeinteger
data[].bans.sourcesinteger: How many organizations' lists name them.
data[].bans.conductinteger: Bans for conduct, of any age.
data[].bans.categoriesarray of strings
data[].bans.gamesarray of strings: The games of the bans that name one.
data[].bans.lastAtdate-time or null

Can refuse with 400, 401, 403, 404, 429, 503. What each means

curl -X POST "https://api.mizan.ac/v1/players/lookup" \
  -H "X-API-Key: $MIZAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"server":"darkrp-1","players":["76561197960287930","STEAM_0:1:19867137","[U:1:22202]"]}'

Answer

{
  "data": [
    {
      "player": {
        "provider": "steam",
        "id": "76561197960287930"
      },
      "profile": "https://mizan.ac/players/steam/76561197960287930",
      "cheater": false,
      "minge": false,
      "bans": {
        "total": 0,
        "active": 0,
        "sources": 0,
        "conduct": 0,
        "categories": [
          "MRDM"
        ],
        "games": [
          "garrysmod"
        ],
        "lastAt": "2026-10-09T21:40:00.000Z"
      }
    }
  ]
}

Add or update your bans

POST/v1/bansNeeds a key

Contributor organizations only. Up to 100 bans, each from one of your servers; each shows on the player's public record under your organization's name.

Body

bansarray of objectsRequired: At most 100.
bans[].playerstringRequired: Any game's player: provider:id (steam, minecraft, fivem, epic, xbox, discord), or without a prefix a Steam id in any form (SteamID64, SteamID2 STEAM_0:0:11101, SteamID3 [U:1:22202], the account id 22202, a steamcommunity.com/profiles/ link), a Minecraft UUID with or without dashes, or a FiveM license: hash. With server, a bare id is read the way that server's game names players.
bans[].serverstringRequired: The server it was issued on, by the key you listed it under. It gives the ban its game and mode.
bans[].refstringRequired: Your own id for the ban. Sending it again updates the ban.
bans[].reasonstringRequired: At most 500 characters.
bans[].categoriesarray of strings: From MRDM RDM NITRP LTAP CNTAP CTAP FAILRP NLR MNLR RDA PROPBLOCK PTOX PRIORS CHEATING EXPLOIT HATE EVASION. Read from the reason when left out.
bans[].createdAtdate-time or null: ISO 8601 or epoch seconds. Now when left out.
bans[].expiresAtdate-time or null: Null or left out for a permanent ban.
bans[].playerNamestring: At most 64 characters.

Answer

data.receivedinteger
data.insertedinteger
data.updatedinteger
data.endedinteger

Can refuse with 400, 401, 403, 404, 429, 503. What each means

curl -X POST "https://api.mizan.ac/v1/bans" \
  -H "X-API-Key: $MIZAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"bans":[{"player":"76561197960276590","server":"darkrp-1","ref":"ban-1042","reason":"Mass RDM"}]}'

Answer

{
  "data": {
    "received": 0,
    "inserted": 0,
    "updated": 0,
    "ended": 0
  }
}

End one of your bans

DELETE/v1/bans/{ref}Needs a key

An unban or a successful appeal. The record keeps the ban as ended.

Path

refstringRequired

Answer

data.endedinteger

Can refuse with 400, 401, 403, 404, 429, 503. What each means

curl -X DELETE "https://api.mizan.ac/v1/bans/ban-1042" \
  -H "X-API-Key: $MIZAN_API_KEY"

Answer

{
  "data": {
    "ended": 0
  }
}

Organization

The organization a key belongs to, with its servers.

Who the key is for

GET/v1/meNeeds a key

Answer

data.idstring
data.namestring
data.statusstring: One of reader, contributor.
data.contributeboolean
data.sourcestring
data.serversarray of objects
data.servers[].keystring
data.servers[].namestring
data.servers[].gamestring
data.servers[].modestring or null
data.servers[].addressstring or null
data.servers[].regionstring or null
data.servers[].identitystring or null

Can refuse with 400, 401, 403, 404, 429, 503. What each means

curl "https://api.mizan.ac/v1/me" \
  -H "X-API-Key: $MIZAN_API_KEY"

Answer

{
  "data": {
    "id": "string",
    "name": "string",
    "status": "reader",
    "contribute": false,
    "source": "string",
    "servers": [
      {
        "key": "string",
        "name": "string",
        "game": "string",
        "mode": "string",
        "address": "play.example.com:27015",
        "region": "eu",
        "identity": "string"
      }
    ]
  }
}