Server Commands

Packets come down; commands go up. There are four mechanisms, they are not interchangeable, and picking the wrong one is a common mistake.

SendCMD — the socket, fire and forget

SendCMD("VESSEL-THROTTLE", value);
SendCMD("ALERT", "3");
SendCMD("WEAPON-GROUP-FIRE", groupId);

Sends a named command down the existing WebSocket. No response, no callback. This is what almost all gameplay uses, because gameplay is a stream of small changes where the result comes back as a packet anyway.

Use this for anything a player does at a console.

PostCMD — a command with an answer

PostCMD("PRE-FLIGHT-LOAD", "", (data) => { /* ... */ });

Posts a command over HTTP and gives you the reply. For the small number of operations where you need to know it worked, or where the payload is too large to be comfortable on the socket — launching a mission is the example.

PostData is the related form used by the editors for saving whole records, such as a mission or a vessel class.

CallAPI and GetAPI — reading content

CallAPI("missions", id, (data) => { /* ... */ });
CallAPI("components", "", (data) => { /* ... */ });

A plain HTTP GET against the REST API, which is how you read content — missions, vessel classes, components, factions, models, maps, dialogs. No authentication is required to read.

GetAPI is the module‑scoped form, for reading a named module's content rather than the merged result.

This is the right way to load a list of anything. It is not the way to read live game state — that comes down as packets.

WriteAPI — changing content

WriteAPI("PUT", "components", id, body, (res) => { if (!res.ok) alert(res.error); });
WriteAPI("DELETE", "components", oldId, null, cb);

REST writes, and the only one of the four that needs authentication: a bearer token on the request.

The token is fetched from api/auth/token, and the server answers that only for loopback callers — 127.0.0.1 or localhost. It is cached in the page and in local storage. Consoles served over the LAN have it injected server‑side; a browser on another machine has neither, which is why the editors read fine and fail to save when run remotely. See Modding With Hydra Studio.

Which to use

Writes are whole records

Worth repeating here because it bites hardest at this layer: no write path is a patch. A save replaces the record. If your code loaded a subset of a record, changed one field, and saved, the fields it never read are gone.

Round‑trip the whole record: read it, modify it, send it all back. Any editor or tool that writes a slice of something needs to be deliberate about it, and the ones in the base game that do — the in‑game renderer tuning panel writing a few environment fields, for instance — use an explicitly partial save path for that reason.

Names are keys

Content records are keyed by name. There is no rename operation: writing under a new name creates a new record, and the old one has to be deleted separately. The editors do this for you, and anything you write yourself has to as well.