API reference
Invites
Every path is relative to https://api.palloo.app/v1.
Send a bot token as Authorization: Bearer palloo_bot_... unless the operation says otherwise; see Authentication.
Try it
Send real requests to https://api.palloo.app/v1 from this page. Open Try it under an operation, fill in its fields and send it.
A bot token is a password.
Anyone who has it can act as your bot. Use a test bot in a test server, never a production bot. The token stays in this tab's memory only: it is not saved, and it goes to the API and nowhere else. Reloading or leaving the page forgets it.
Starts with palloo_bot_. People's tokens are refused here.
On this page
List invites
/communities/{id}/invites
Bot token: Call it with a bot token (people can call it too).
A community's active (unexpired, not used up) invites. Requires Manage Community.
Required permissions
Requires Manage Community.
Try it: GET /communities/{id}/invites
Sends the bot token from the top of this page.
Request
GET https://api.palloo.app/v1/communities/{id}/invitescurl command
Response
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| id Required | path | string |
Community ID. |
Responses
- 200
-
The active invites, oldest first.
Body: InviteList
Example response (200) { "invites": [ { "code": "string", "community_id": "01J9ZQ3V5K8M2N4P6R8T0W2Y4A", "created_by": "01J9ZQ3V5K8M2N4P6R8T0W2Y4A", "uses": 0, "max_uses": 1, "expires_at": "2026-10-15T09:00:00Z", "created_at": "2026-10-15T09:00:00Z" } ] } - 401
-
unauthenticated: the bearer token is missing, invalid or expired.Body: Error
WWW-Authenticateheader. - 403
-
missing_permission: the caller is a member but lacks the permission.Body: Error
- 404
-
community_not_found: no such community, or the caller is not a member. The two cases are indistinguishable on purpose.Body: Error
- 429
-
rate_limited: too many attempts. Every operation a bot calls is also limited per bot (50 at once, then 50 per second), so any authenticated operation can answer this to a bot. Changes to a community's structure (creating or changing the community, channels, roles, member roles, overwrites, invites, kicks, bans, timeouts, report updates and actions, and bots) are also limited per caller (30 at once, then 1 per second) and per community (60 at once, then 1 per second), and creating communities per caller (10 at once, then 1 every 5 minutes).Body: Error
Retry-Afterheader. - 500
-
internal: an unexpected server error. Details are only in server logs.Body: Error
Create invite
/communities/{id}/invites
Bot token: Call it with a bot token (people can call it too).
Create an invite link. Requires Create Invites.
A community can have at most 1000 active (unexpired, not used up) invites, and each member at most 100 of them.
Required permissions
Requires Create Invites.
Try it: POST /communities/{id}/invites
Sends the bot token from the top of this page.
Prefilled from the example above. Replace the placeholder values; unknown fields are refused.
Request
POST https://api.palloo.app/v1/communities/{id}/invitescurl command
Response
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| id Required | path | string |
Community ID. |
Request body
application/json:
CreateInviteRequest
(required)
| Field | Type | Description |
|---|---|---|
| max_uses | integer or null | Omit or null for unlimited uses. at least 1; at most 1000 |
| expires_in_seconds | integer | Defaults to 7 days. 0 means never. At most 30 days. at least 0; at most 2592000; default 604800 |
{
"max_uses": 1,
"expires_in_seconds": 604800
}Responses
- 201
-
Created.
Body: Invite
Example response (201) { "code": "string", "community_id": "01J9ZQ3V5K8M2N4P6R8T0W2Y4A", "created_by": "01J9ZQ3V5K8M2N4P6R8T0W2Y4A", "uses": 0, "max_uses": 1, "expires_at": "2026-10-15T09:00:00Z", "created_at": "2026-10-15T09:00:00Z" } - 400
-
invalid_body,invalid_max_usesorinvalid_expiry.Body: Error
- 401
-
unauthenticated: the bearer token is missing, invalid or expired.Body: Error
WWW-Authenticateheader. - 403
-
missing_permission: the caller is a member but lacks the permission.Body: Error
- 404
-
community_not_found: no such community, or the caller is not a member. The two cases are indistinguishable on purpose.Body: Error
- 409
-
invite_limit_reached: the community, or the caller in it, has the maximum number of active invites.Body: Error
- 429
-
rate_limited: too many attempts. Every operation a bot calls is also limited per bot (50 at once, then 50 per second), so any authenticated operation can answer this to a bot. Changes to a community's structure (creating or changing the community, channels, roles, member roles, overwrites, invites, kicks, bans, timeouts, report updates and actions, and bots) are also limited per caller (30 at once, then 1 per second) and per community (60 at once, then 1 per second), and creating communities per caller (10 at once, then 1 every 5 minutes).Body: Error
Retry-Afterheader. - 500
-
internal: an unexpected server error. Details are only in server logs.Body: Error
Preview invite
/invites/{code}
Bot token: Call it with a bot token (people can call it too).
What an invite leads to, so the client can ask before joining. Rate limited per user.
Try it: GET /invites/{code}
Sends the bot token from the top of this page.
Request
GET https://api.palloo.app/v1/invites/{code}curl command
Response
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| code Required | path | string |
Responses
- 200
-
The invite's community.
Body: InvitePreview
Example response (200) { "code": "string", "community_id": "01J9ZQ3V5K8M2N4P6R8T0W2Y4A", "community_name": "string", "icon": "string", "icon_dark": "string", "banner": "string", "member_count": 0, "vanity": false } - 401
-
unauthenticated: the bearer token is missing, invalid or expired.Body: Error
WWW-Authenticateheader. - 404
-
invite_not_found: the code is unknown, expired, used up or revoked. The cases are indistinguishable on purpose.Body: Error
- 429
-
rate_limited: too many attempts. Every operation a bot calls is also limited per bot (50 at once, then 50 per second), so any authenticated operation can answer this to a bot. Changes to a community's structure (creating or changing the community, channels, roles, member roles, overwrites, invites, kicks, bans, timeouts, report updates and actions, and bots) are also limited per caller (30 at once, then 1 per second) and per community (60 at once, then 1 per second), and creating communities per caller (10 at once, then 1 every 5 minutes).Body: Error
Retry-Afterheader. - 500
-
internal: an unexpected server error. Details are only in server logs.Body: Error
Revoke invite
/invites/{code}
Bot token: Call it with a bot token (people can call it too).
Revoke an invite. Allowed for its creator and for members with Manage Community.
Try it: DELETE /invites/{code}
Sends the bot token from the top of this page.
Request
DELETE https://api.palloo.app/v1/invites/{code}curl command
Response
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| code Required | path | string |
Responses
- 204
-
Revoked.
- 401
-
unauthenticated: the bearer token is missing, invalid or expired.Body: Error
WWW-Authenticateheader. - 403
-
missing_permission: the caller is a member but lacks the permission.Body: Error
- 404
-
invite_not_found. Also returned when the caller is not a member of the invite's community.Body: Error
- 429
-
rate_limited: too many attempts. Every operation a bot calls is also limited per bot (50 at once, then 50 per second), so any authenticated operation can answer this to a bot. Changes to a community's structure (creating or changing the community, channels, roles, member roles, overwrites, invites, kicks, bans, timeouts, report updates and actions, and bots) are also limited per caller (30 at once, then 1 per second) and per community (60 at once, then 1 per second), and creating communities per caller (10 at once, then 1 every 5 minutes).Body: Error
Retry-Afterheader. - 500
-
internal: an unexpected server error. Details are only in server logs.Body: Error