Levels

Public level operations

List levels

get

Retrieve a paginated, filterable list of levels.

Query parameters

pageinteger · min: 1OptionalDefault: 1

limitinteger · min: 1OptionalDefault: 10

sortstring · enumOptionalDefault: playsPossible values:

reversed_orderstring · enumOptionalDefault: falsePossible values:

authorstringOptional

Filter by author name (partial match)

is_waterstring · enumOptionalPossible values:

versionintegerOptional

tokenstringOptional

One-time token to fetch a specific level by ID. Ignores all other filters when provided.

Responses

200

Paginated list of levels

application/json

429

Too many requests

application/json

get

/api/levels

HTTPcURLJavaScriptPython

GET /api/levels HTTP/1.1
Host: backend.pvzm.net
Accept: */*

{
  "levels": [
    {
      "id": 1,
      "name": "text",
      "author": "text",
      "created_at": 1,
      "sun": 1,
      "is_water": true,
      "favorites": 1,
      "plays": 1,
      "difficulty": 1,
      "version": 1,
      "featured": 0,
      "featured_at": 1,
      "thumbnail": [
        [
          1
        ]
      ]
    }
  ],
  "pagination": {
    "total": 1,
    "page": 1,
    "limit": 1,
    "pages": 1
  }
}

Upload a level

post

Upload a new level in IZL3 binary format. Rate limited to 1 upload per 60 seconds per IP.

The request body must be sent as raw binary (Content-Type: application/octet-stream) containing the IZL3 level file.

Validation includes: IZL3 format check, name/author content moderation (OpenAI + bad-words filter), plant/zombie placement rules, and optional Turnstile CAPTCHA verification.

Query parameters

authorstring · max: 11Required

Author name (max 11 characters)

turnstileResponsestringOptional

Cloudflare Turnstile CAPTCHA token (required if Turnstile is enabled)

Responses

201

Level created successfully

application/json

400

Invalid input or validation failure

application/json

415

Unsupported media type (Content-Type must be application/octet-stream)

application/json

429

Too many requests

application/json

post

/api/levels

HTTPcURLJavaScriptPython

POST /api/levels?author=text HTTP/1.1
Host: backend.pvzm.net
Accept: */*

{
  "id": 1,
  "name": "text",
  "author": "text",
  "created_at": 1,
  "sun": 1,
  "is_water": true,
  "version": 1
}

Get a level by ID

get

Path parameters

idintegerRequired

Level ID

Responses

200

Level details

application/json

idintegerRequired

namestringRequired

authorstringRequired

created_atintegerRequired

Unix timestamp

sunintegerRequired

is_waterbooleanRequired

favoritesintegerRequired

playsintegerRequired

difficultyintegerRequired

versionintegerRequired

featuredinteger · enumRequiredPossible values:

featured_atinteger · nullableRequired

Unix timestamp

400

Invalid input or validation failure

application/json

404

Resource not found

application/json

get

/api/levels/{id}

HTTPcURLJavaScriptPython

GET /api/levels/{id} HTTP/1.1
Host: backend.pvzm.net
Accept: */*

{
  "id": 1,
  "name": "text",
  "author": "text",
  "created_at": 1,
  "sun": 1,
  "is_water": true,
  "favorites": 1,
  "plays": 1,
  "difficulty": 1,
  "version": 1,
  "featured": 0,
  "featured_at": 1,
  "thumbnail": [
    [
      1
    ]
  ]
}

Download a level file

get

Downloads the IZL3 level file. Increments the play count. Rate limited to 5 downloads per 5 seconds per IP.

Path parameters

idintegerRequired

Level ID

Responses

200

Level file download

application/octet-stream

Responsestring · binary

400

Invalid input or validation failure

application/json

404

Resource not found

application/json

429

Too many requests

application/json

get

/api/levels/{id}/download

HTTPcURLJavaScriptPython

GET /api/levels/{id}/download HTTP/1.1
Host: backend.pvzm.net
Accept: */*

binary

Report a level

post

Path parameters

idintegerRequired

Level ID

Body

application/json

reasonstringRequired

Description of why the level is being reported

Responses

200

Report submitted

application/json

successbooleanRequiredExample: true

404

Resource not found

application/json

post

/api/levels/{id}/report

HTTPcURLJavaScriptPython

POST /api/levels/{id}/report HTTP/1.1
Host: backend.pvzm.net
Content-Type: application/json
Accept: */*
Content-Length: 17

{
  "reason": "text"
}

{
  "success": true
}

Toggle favorite on a level

post

Toggles the favorite state for the requesting IP. Rate limited to 30 actions per 10 seconds per IP.

Path parameters

idintegerRequired

Level ID

Responses

200

Favorite toggled

application/json

successbooleanRequiredExample: true

400

Invalid input or validation failure

application/json

404

Resource not found

application/json

429

Too many requests

application/json

post

/api/levels/{id}/favorite

HTTPcURLJavaScriptPython

POST /api/levels/{id}/favorite HTTP/1.1
Host: backend.pvzm.net
Accept: */*

{
  "success": true,
  "level": {
    "id": 1,
    "name": "text",
    "author": "text",
    "favorites": 1
  }
}