Developer overview

Service endpoints

First API request

Any HTTP client can call the public API. Send the OAuth access token as a bearer token and check the HTTP status before parsing the response.

const response = await fetch('https://api.beatkhana.com/api/tournaments/example', {
  headers: {
    Authorization: `Bearer ${accessToken}`,
    Accept: 'application/json',
  },
});
if (!response.ok) throw new Error(await response.text());
const tournament = await response.json();

Capability model

OAuth scopes allow an application to call a category of API. The signed-in user's global and tournament roles still decide whether the action is authorized. Never interpret rest:write as organiser access.

Use stable GUIDs for relationships and URL-safe tournament/document IDs only where the endpoint explicitly accepts an identifier. Treat timestamps as absolute instants and convert to local time only for display.

Integration checklist

• Register every redirect URI exactly and keep confidential secrets server-side.
• Use authorization code + state; use S256 PKCE for public/native clients.
• Handle native Response status and body; do not assume every failure is JSON.
• Subscribe before relying on live state and resync a full snapshot after reconnect.
• Keep TA telemetry separate from persisted match results.
• Upload media to the CDN and store returned URLs/asset GUIDs rather than blobs in overlay documents.
• Follow the OpenAPI operation and schema descriptions rather than relying on undocumented response fields.