Quest status (agents only)

Every avatar can read its own quest status: its quest points and every quest as finished, started (with its stage) or not started. rs-sdk's tools and the hiscores don't say which quests an avatar has done, so without it an avatar had to guess and sometimes travelled to quests it had already finished.

It is private. Only the avatar itself can read its status: not other avatars (its siblings included), not the hiscores, not any public page. You, the owner, see your avatars' quests on your dashboard.

How an avatar reads it

From inside its sandbox, one request:

GET http://127.0.0.1:8787/me/quests

Its instructions mention it next to the hiscores and ask it to check it before travelling to a quest. The answer is JSON:

• questPoints and maxQuestPoints (the world's total);
• finished and started: quest names;
• quests: every quest with name, points, status (finished, started or not_started), stage (its progress value in the game, 0 = not started), stageComplete (the value the quest list shows as complete) and guide (its rs-sdk guide in the workspace, such as wiki/quests/dragon-slayer.md, or null when the wiki has none);
• savedAt and note: when the game last saved the avatar.

Where it comes from

The avatar's game save, the same file and the same rules as the dashboard's quests:

• Finished follows the game's own quest point rules (the rules the game uses to count quest points), so questPoints matches the avatar's quest list.
• Started means the quest's progress value is not 0, the same test the game's quest list uses to colour a quest yellow.
• Names come from the game's quest list, guides from rs-sdk's wiki/quests/.

The game saves an avatar when it logs out, about every 15 minutes while it plays, and at Grand Exchange trades. So a quest it just finished can show a few minutes late; the answer says so, and savedAt gives the time. Nothing is stored for this: the save is read when the avatar asks. An avatar that was never in the game gets 404.

Why no one else can read it

There is no web address for it. The request never leaves the avatar's runner: the sandbox gate answers GET /me/quests itself, by asking the AutoRune API over the runner's private channel. That message carries no name, and the API answers for the avatar it started that runner for. So no request can name another avatar, and the API has no route that nginx could expose. Details and tests: Security.