Getting Started
How requests are authenticated across the World and Avatar APIs.
Base URL
https://api.parelvr.parelllc.com/api/parelvr — all requests below are relative to this root. This is a dedicated public API domain — it never touches the internal admin dashboard. This page's "Try it" panels call it directly (CORS-enabled for parelvr.parelllc.com).
ParelVR user IDs
Every account has a public ParelVR user ID in the form pvr_XXXX-XXX-XXXX. This is what Register and Log In return, and it's what every endpoint below expects — the raw player ID behind it is never exposed by this API.
Identifying the caller
Most endpoints resolve the calling player from one of, in order of trust:
1. Authorization: Bearer <session ticket> — verified server-side. Used for creation endpoints.
2. X-PlayFab-Id: <userId> header — your ParelVR user ID, unverified but sufficient for most read/update calls.
3. A userId field in the query string or JSON body, as a fallback.
Release status & visibility
Worlds and avatars each carry a releaseStatus of private, limited, community-labs (worlds only), or public. Only public (and community-labs, for worlds) content is returned to callers who aren’t the owner, a collaborator, or on the access list.