> ## Documentation Index
> Fetch the complete documentation index at: https://developers.papelship.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Staff URL

> Create a time-limited or scoped moderator dashboard URL with explicit capability permissions.



## OpenAPI

````yaml /api-reference/openapi/qpapel.json post /staff-urls
openapi: 3.0.3
info:
  title: qPapel Protection Web API
  version: 1.0.0
  description: >
    qPapel Protection API provides developer-grade license validation, remote
    software configuration, staff URL delegation, client anti-cheat heuristics,
    and Discord community integration for desktop applications and loaders.
  contact:
    name: PapelShip Developer Support
    url: https://papelship.com
servers:
  - url: https://app.papelship.com/api/qpapel/v1
    description: Production Server
security:
  - BearerAuth: []
  - ApiKeyHeader: []
  - ApiKeyHeaderLegacy: []
tags:
  - name: License Keys
    description: >-
      Programmatic management of customer license keys, hardware ID bindings,
      activations, and bans.
  - name: Reseller Keys
    description: >-
      Multi-seat reseller key creation, extension, duration freeze, and license
      allocation.
  - name: Remote Settings
    description: >-
      Secure remote runtime configuration mapping, build SHA-256 verification,
      and dynamic values.
  - name: Staff Management
    description: Temporary and scope-limited web portal URLs for support moderators.
  - name: Discord Integrations
    description: >-
      Guild linkage, anti-cheat event channel streaming, and role-based bot
      permissions.
  - name: Client Security & Anti-Cheat
    description: >-
      Device fingerprint monitoring, process blacklists, window title filters,
      and server-side protected strings/files.
paths:
  /staff-urls:
    post:
      tags:
        - Staff Management
      summary: Create Staff URL
      description: >-
        Create a time-limited or scoped moderator dashboard URL with explicit
        capability permissions.
      operationId: createStaffUrl
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - title
                - description
                - permissions
              properties:
                title:
                  type: string
                  description: Descriptive label for the staff link.
                  example: Tier 1 Support - Reset Access
                description:
                  type: string
                  description: Detailed reason or assigned moderator notes.
                  example: Temporary support staff for weekend event
                permissions:
                  type: array
                  description: Action permissions granted to this portal session.
                  items:
                    type: string
                    enum:
                      - create_key
                      - delete_key
                      - reset_hwid
                      - ban_key
                      - freeze_key
                  example:
                    - reset_hwid
                allowed_product_ids:
                  type: array
                  description: Restrict actions to specific product IDs.
                  items:
                    type: integer
                  example:
                    - 12
                usage_limit:
                  type: integer
                  description: Maximum allowed portal accesses before revocation.
                  example: 10
                expires_at:
                  type: string
                  format: date-time
                  description: Absolute expiration timestamp.
                  example: '2026-06-30T00:00:00.000Z'
                url_path:
                  type: string
                  description: Optional custom URL segment (auto-generated if omitted).
                  example: staff-cs2-mod-abc
                access_key:
                  type: string
                  description: Optional secret access token (auto-generated if omitted).
      responses:
        '200':
          description: Staff URL created.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  message:
                    type: string
                    example: Staff URL created successfully
                  url:
                    $ref: '#/components/schemas/StaffUrl'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
components:
  schemas:
    StaffUrl:
      type: object
      properties:
        id:
          type: integer
          example: 8
        title:
          type: string
          example: Moderator URL
        description:
          type: string
          example: Keys resetting access for CS2
        permissions:
          type: array
          items:
            type: string
          example:
            - reset_hwid
        allowed_product_ids:
          type: array
          items:
            type: integer
          example:
            - 12
        usage_limit:
          type: integer
          nullable: true
          example: 10
        expires_at:
          type: string
          format: date-time
          nullable: true
          example: '2026-06-30T00:00:00.000Z'
        url_path:
          type: string
          example: abcde123
        access_key:
          type: string
          example: some_secure_access_key
        is_active:
          type: integer
          example: 1
    StandardErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        error:
          type: string
          example: Invalid parameters provided
  responses:
    BadRequestError:
      description: Invalid request body or query parameter structure.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/StandardErrorResponse'
          example:
            success: false
            error: Missing required field or invalid value
    UnauthorizedError:
      description: Authentication failed. Missing or invalid developer API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/StandardErrorResponse'
          example:
            success: false
            error: Unauthorized access. Valid API key required.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API_KEY
      description: >-
        Standard HTTP Bearer token authentication header (e.g. `Authorization:
        Bearer pk_live_...`).
    ApiKeyHeader:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Custom header API key authentication parameter (`x-api-key:
        pk_live_...`).
    ApiKeyHeaderLegacy:
      type: apiKey
      in: header
      name: api-key
      description: >-
        Legacy custom header API key fallback parameter (`api-key:
        pk_live_...`).

````