Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.openapi.yaml	(revision 460)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.openapi.yaml	(revision 462)
@@ -42,30 +42,18 @@
             type: object
             properties:
-              x:
-                type: integer
+              bannedUntil:
+                type: string
+                format: date-time
+              banReason:
+                type: string
                 examples:
-                  - -43
-              y:
-                type: integer
+                  - Cheating not allowed!
+              name:
+                type: string
                 examples:
-                  - 842
-              icon:
-                type: string
-                format: uuid
-                examples:
-                  - https://upload.wikimedia.org/wikipedia/commons/thumb/1/11/Blue_question_mark_icon.svg/1200px-Blue_question_mark_icon.svg.png
+                  - TheFunPimp
             required:
-              - x
-              - y
+              - bannedUntil
       required: true
-
-
-  parameters:
-    UserIdPathParameter:
-      name: id
-      in: path
-      required: true
-      schema:
-        $ref: '#/components/schemas/TypeUserIdString'
 
 
@@ -80,5 +68,5 @@
       responses:
         200:
-          description: List of found markers
+          description: List of blacklist entries
           content:
             application/json:
@@ -93,4 +81,10 @@
                   - data
                   - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
 
 
@@ -119,15 +113,13 @@
       operationId: blacklist.post.id
       parameters:
-        - $ref: '#/components/parameters/UserIdPathParameter'
+        - $ref: './openapi.yaml#/components/parameters/UserIdPathParameter'
       requestBody:
         $ref: '#/components/requestBodies/BlacklistBodyIn'
       responses:
         201:
-          description: Marker with updated values
+          description: Blacklist entry created or updated
           $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
         400:
-          description: >-
-            Invalid request body, errorCode will be one of 'NO_OR_INVALID_X',
-            'NO_OR_INVALID_Y'
+          description: Invalid request body, errorCode will be 'NO_OR_INVALID_BANNED_UNTIL'
           $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
         403:
@@ -145,11 +137,11 @@
       operationId: blacklist.delete.id
       parameters:
-        - $ref: '#/components/parameters/UserIdPathParameter'
+        - $ref: './openapi.yaml#/components/parameters/UserIdPathParameter'
       responses:
         204:
-          description: Deleted marker
+          description: Deleted blacklist entry
           $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
         404:
-          description: Marker ID not found
+          description: User ID not found
           $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
         403:
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml	(revision 462)
@@ -0,0 +1,151 @@
+openapi: 3.1.0
+info:
+  title: Command Permissions
+  version: '1'
+
+components:
+  schemas:
+    TypeCommandName:
+      type: string
+      pattern: '^[a-zA-Z0-9_-]+$'
+      examples:
+        - listplayers
+      description: Name of the command. Can be any of the command name variants.
+    
+    CommandPermissionElement:
+      type: object
+      properties:
+        command:
+          $ref: '#/components/schemas/TypeCommandName'
+        permissionLevel:
+          type: integer
+          description: Permission level of the command
+      required:
+        - command
+        - permissionLevel
+
+    CommandPermissionList:
+      type: array
+      items:
+        $ref: '#/components/schemas/CommandPermissionElement'
+
+
+  requestBodies:
+    CommandPermissionBodyIn:
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              permissionLevel:
+                type: integer
+            required:
+              - permissionLevel
+      required: true
+
+
+  parameters:
+    CommandNamePathParameter:
+      name: command
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeCommandName'
+
+
+paths:
+  /api/commandpermission:
+    get:
+      tags:
+        - Permissions
+      summary: Command permission list
+      description: Fetch a list of all command permissions
+      operationId: commandpermission.get
+      responses:
+        200:
+          description: List of command permissions
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/CommandPermissionList'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/commandpermission/{command}:
+#    get:
+#      tags:
+#        - Permissions
+#      summary: Marker show
+#      description: Fetch a single defined map marker
+#      operationId: blacklist.get.id
+#      parameters:
+#        - $ref: '#/components/parameters/MarkerIdParameter'
+#      responses:
+#        200:
+#          description: Single found marker
+#          $ref: '#/components/responses/MarkersBodyOut'
+#        404:
+#          description: Marker ID not found, errorCode will be 'ID_NOT_FOUND'
+#          $ref: '#/components/responses/HttpEmptyEnvelopedResponse'
+
+    post:
+      tags:
+        - Permissions
+      summary: Command permission create
+      description: Create or update a command permission override
+      operationId: commandpermission.post.id
+      parameters:
+        - $ref: '#/components/parameters/CommandNamePathParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/CommandPermissionBodyIn'
+      responses:
+        201:
+          description: Command permission override created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be one of 'NO_COMMAND' or 'NO_OR_INVALID_PERMISSION_LEVEL'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Specified command not found, errorCode will be 'INVALID_COMMAND'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: Command permission delete
+      description: Delete a single command permission override
+      operationId: commandpermission.delete.id
+      parameters:
+        - $ref: '#/components/parameters/CommandNamePathParameter'
+      responses:
+        204:
+          description: Deleted command permission override
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Command not found or no permission override defined so far
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.openapi.yaml	(revision 462)
@@ -0,0 +1,108 @@
+openapi: 3.1.0
+info:
+  title: Register User
+  version: '1'
+
+components:
+  schemas:
+    TypeRegisterUserName:
+      type: string
+    
+    RegisterUserElement:
+      type: object
+      properties:
+        playerName:
+          type: string
+          description: In-game user name who requested the registration
+        expirationSeconds:
+          type: number
+          format: double
+          description: Time until the registration token expires
+      required:
+        - playerName
+        - expirationSeconds
+
+
+  requestBodies:
+    RegisterUserBodyIn:
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              token:
+                type: string
+                format: password
+              username:
+                type: string
+              password:
+                type: string
+                format: password
+            required:
+              - token
+              - username
+              - password
+      required: true
+
+
+  parameters:
+    RegisterUserTokenPathParameter:
+      name: token
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeRegisterUserName'
+
+
+paths:
+  /api/registeruser:
+    post:
+      tags:
+        - Permissions
+      summary: Register user submit
+      description: Finish user registration process
+      operationId: RegisterUser.post
+      requestBody:
+        $ref: '#/components/requestBodies/RegisterUserBodyIn'
+      responses:
+        201:
+          description: User created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be one of 'MISSING_TOKEN', 'MISSING_USERNAME' or 'MISSING_PASSWORD'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        401:
+          description: Can not proceed due to invalid data, errorCode will be one of 'INVALID_OR_EXPIRED_TOKEN', 'INVALID_USERNAME', 'INVALID_PASSWORD' or 'DUPLICATE_USERNAME'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+  
+  
+  /api/registeruser/{token}:
+    get:
+      tags:
+        - Permissions
+      summary: Register user get data
+      description: Get data for user registration
+      operationId: RegisterUser.get.id
+      parameters:
+        - $ref: '#/components/parameters/RegisterUserTokenPathParameter'
+      responses:
+        200:
+          description: User registration data
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/RegisterUserElement'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        400:
+          description: Invalid request, errorCode will be 'NO_TOKEN'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Token not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/UserPermissions.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/UserPermissions.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/UserPermissions.openapi.yaml	(revision 462)
@@ -0,0 +1,271 @@
+openapi: 3.1.0
+info:
+  title: User Permissions
+  version: '1'
+
+components:
+  schemas:
+    UserPermissionElement:
+      type: object
+      properties:
+        name:
+          type: string
+          examples:
+            - TheFunPimp
+          description: Name of the player for display purposes. Can be empty.
+        userId:
+          $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+        permissionLevel:
+          type: integer
+      required:
+        - name
+        - userId
+        - permissionLevel
+
+    UserPermissionList:
+      type: array
+      items:
+        $ref: '#/components/schemas/UserPermissionElement'
+        
+    GroupPermissionElement:
+      type: object
+      properties:
+        name:
+          type: string
+          examples:
+            - Steam Universe
+          description: Name of the group for display purposes. Can be empty.
+        groupId:
+          type: string
+          examples:
+            - '103582791434672565'
+        permissionLevelMods:
+          type: integer
+          examples:
+            - 10
+          description: Permission levels that mods of the group get assigned
+        permissionLevelNormal:
+          type: integer
+          examples:
+            - 500
+          description: Permission levels that regular members of the group get assigned
+      required:
+        - name
+        - groupId
+        - permissionLevelMods
+        - permissionLevelNormal
+
+    GroupPermissionList:
+      type: array
+      items:
+        $ref: '#/components/schemas/GroupPermissionElement'
+    
+    UserPermissionsObject:
+      type: object
+      properties:
+        users:
+          $ref: '#/components/schemas/UserPermissionList'
+        groups:
+          $ref: '#/components/schemas/GroupPermissionList'
+      required:
+        - users
+        - groups
+
+    TypeGroupIdString:
+      type: string
+      examples:
+        - '103582791434672565'
+          
+    UserPermissionPostBodyUserObject:
+      type: object
+      properties:
+        permissionLevel:
+          type: integer
+        name:
+          type: string
+      required:
+        - permissionLevel
+
+    UserPermissionPostBodyGroupObject:
+      type: object
+      properties:
+        permissionLevelMods:
+          type: integer
+          examples:
+            - 10
+        permissionLevelNormal:
+          type: integer
+          examples:
+            - 500
+        name:
+          type: string
+          examples:
+            - Steam Universe
+      required:
+        - permissionLevelMods
+        - permissionLevelNormal
+
+
+  parameters: 
+    UserIdParameter:
+      name: id
+      in: path
+      required: true
+      schema:
+        $ref: './openapi.yaml#/components/schemas/TypeUserIdString'
+
+    GroupIdParameter:
+      name: id
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeGroupIdString'
+
+
+  requestBodies:
+    UserPermissionBodyIn:
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/UserPermissionPostBodyUserObject'
+      required: true
+
+    GroupPermissionBodyIn:
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/UserPermissionPostBodyGroupObject'
+      required: true
+
+
+paths:
+  /api/userpermissions:
+    get:
+      tags:
+        - Permissions
+      summary: User permission list
+      description: Fetch a list of all user / group permissions
+      operationId: userpermissions.get
+      responses:
+        200:
+          description: List of user permissions
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/UserPermissionsObject'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/userpermissions/user/{id}:
+    post:
+      tags:
+        - Permissions
+      summary: User permission create
+      description: Create or update a user permission
+      operationId: userpermissions.post.user.id
+      parameters:
+        - $ref: '#/components/parameters/UserIdParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/UserPermissionBodyIn'
+      responses:
+        201:
+          description: User permission created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP', 'INVALID_USER' or 'NO_OR_INVALID_PERMISSION_LEVEL'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: User permission delete
+      description: Delete a single user permission
+      operationId: userpermissions.delete.user.id
+      parameters:
+        - $ref: '#/components/parameters/UserIdParameter'
+      responses:
+        204:
+          description: Deleted user permission
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP' or 'INVALID_USER'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: User ID not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+
+  /api/userpermissions/group/{id}:
+    post:
+      tags:
+        - Permissions
+      summary: Group permission create
+      description: Create or update a group permission
+      operationId: userpermissions.post.group.id
+      parameters:
+        - $ref: '#/components/parameters/GroupIdParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/GroupPermissionBodyIn'
+      responses:
+        201:
+          description: Group permission created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP', 'INVALID_GROUP', 'NO_OR_INVALID_PERMISSION_LEVEL_MODS' or 'NO_OR_INVALID_PERMISSION_LEVEL_NORMAL'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: Group permission delete
+      description: Delete a single group permission
+      operationId: userpermissions.delete.group.id
+      parameters:
+        - $ref: '#/components/parameters/GroupIdParameter'
+      responses:
+        204:
+          description: Deleted group permission
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP', 'INVALID_GROUP'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Group ID not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebApiTokens.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebApiTokens.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebApiTokens.openapi.yaml	(revision 462)
@@ -0,0 +1,150 @@
+openapi: 3.1.0
+info:
+  title: WebAPI Tokens
+  version: '1'
+
+components:
+  schemas:
+    TypeWebApiTokenName:
+      type: string
+    
+    WebApiTokenElement:
+      type: object
+      properties:
+        name:
+          $ref: '#/components/schemas/TypeWebApiTokenName'
+        secret:
+          type: string
+        permissionLevel:
+          type: integer
+          description: Permission level of the token
+      required:
+        - name
+        - secret
+        - permissionLevel
+
+    WebApiTokenList:
+      type: array
+      items:
+        $ref: '#/components/schemas/WebApiTokenElement'
+
+
+  requestBodies:
+    WebApiTokenBodyIn:
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              secret:
+                string
+              permissionLevel:
+                type: integer
+            required:
+              - secret
+              - permissionLevel
+      required: true
+
+
+  parameters:
+    WebApiTokenNamePathParameter:
+      name: apiTokenName
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeWebApiTokenName'
+
+
+paths:
+  /api/webapitokens:
+    get:
+      tags:
+        - Permissions
+      summary: WebAPI token list
+      description: Fetch a list of all WebAPI tokens
+      operationId: WebApiTokens.get
+      responses:
+        200:
+          description: List of API tokens
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/WebApiTokenList'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/webapitokens/{apiTokenName}:
+#    get:
+#      tags:
+#        - Permissions
+#      summary: Marker show
+#      description: Fetch a single defined map marker
+#      operationId: blacklist.get.id
+#      parameters:
+#        - $ref: '#/components/parameters/MarkerIdParameter'
+#      responses:
+#        200:
+#          description: Single found marker
+#          $ref: '#/components/responses/MarkersBodyOut'
+#        404:
+#          description: Marker ID not found, errorCode will be 'ID_NOT_FOUND'
+#          $ref: '#/components/responses/HttpEmptyEnvelopedResponse'
+
+    post:
+      tags:
+        - Permissions
+      summary: WebAPI token create
+      description: Create or update a WebAPI token
+      operationId: WebApiTokens.post.id
+      parameters:
+        - $ref: '#/components/parameters/WebApiTokenNamePathParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/WebApiTokenBodyIn'
+      responses:
+        201:
+          description: Token created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be one of 'NO_NAME', 'NO_OR_INVALID_SECRET' or 'NO_OR_INVALID_PERMISSION_LEVEL'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: WebAPI token delete
+      description: Delete a single WebAPI token
+      operationId: WebApiTokens.delete.id
+      parameters:
+        - $ref: '#/components/parameters/WebApiTokenNamePathParameter'
+      responses:
+        204:
+          description: Deleted token
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Token not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml	(revision 462)
@@ -0,0 +1,172 @@
+openapi: 3.1.0
+info:
+  title: Web Modules
+  version: '1'
+
+components:
+  schemas:
+    TypeWebModuleName:
+      type: string
+      
+    TypeWebMethodPermissionEntry:
+      oneOf:
+        - type: integer
+          description: Explicit per method permission level
+        - type: string
+          const: 'inherit'
+          description: Inherit the module's global permission level
+    
+    WebModuleElement:
+      type: object
+      properties:
+        module:
+          $ref: '#/components/schemas/TypeWebModuleName'
+        permissionLevelGlobal:
+          type: integer
+          description: Permission level for the overall module
+        permissionLevelPerMethod:
+          type: object
+          properties:
+            GET:
+              $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+            POST:
+              $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+            PUT:
+              $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+            DELETE:
+              $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+          description: Permission levels per HTTP method
+        isDefault:
+          type: boolean
+          description: Whether this module uses the module's default permissions or the shown values are a user defined override
+      required:
+        - module
+        - permissionLevelGlobal
+        - permissionLevelPerMethod
+        - isDefault
+
+    WebModuleList:
+      type: array
+      items:
+        $ref: '#/components/schemas/WebModuleElement'
+
+
+  requestBodies:
+    WebModuleBodyIn:
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              secret:
+                string
+              permissionLevel:
+                type: integer
+            required:
+              - secret
+              - permissionLevel
+      required: true
+
+
+  parameters:
+    WebModuleNamePathParameter:
+      name: moduleName
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeWebModuleName'
+
+
+paths:
+  /api/webmodules:
+    get:
+      tags:
+        - Permissions
+      summary: Web modules permission list
+      description: Fetch a list of all web module permissions
+      operationId: WebModules.get
+      responses:
+        200:
+          description: List of web modules
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/WebModuleList'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/webmodules/{moduleName}:
+#    get:
+#      tags:
+#        - Permissions
+#      summary: Marker show
+#      description: Fetch a single defined map marker
+#      operationId: blacklist.get.id
+#      parameters:
+#        - $ref: '#/components/parameters/MarkerIdParameter'
+#      responses:
+#        200:
+#          description: Single found marker
+#          $ref: '#/components/responses/MarkersBodyOut'
+#        404:
+#          description: Marker ID not found, errorCode will be 'ID_NOT_FOUND'
+#          $ref: '#/components/responses/HttpEmptyEnvelopedResponse'
+
+    post:
+      tags:
+        - Permissions
+      summary: Web modules permission create
+      description: Create or update a web module permission override
+      operationId: WebModules.post.id
+      parameters:
+        - $ref: '#/components/parameters/WebModuleNamePathParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/WebModuleBodyIn'
+      responses:
+        201:
+          description: Permission override created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be one of 'NO_MODULE', 'INVALID_MODULE', 'INVALID_PERMISSION_LEVEL_GLOBAL', 'INVALID_PERMISSION_LEVEL_PER_METHOD_PROPERTY', 'INVALID_METHOD_NAME', 'UNSUPPORTED_METHOD', 'INVALID_PERMISSION_STRING', 'INVALID_PERMISSION_VALUE' or 'INVALID_PERMISSION_VALUE_TYPE'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: Web modules permission delete
+      description: Delete a single web module permission override
+      operationId: WebModules.delete.id
+      parameters:
+        - $ref: '#/components/parameters/WebModuleNamePathParameter'
+      responses:
+        204:
+          description: Deleted permission override
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Module not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebUsers.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebUsers.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebUsers.openapi.yaml	(revision 462)
@@ -0,0 +1,155 @@
+openapi: 3.1.0
+info:
+  title: Web Users
+  version: '1'
+
+components:
+  schemas:
+    TypeWebUserName:
+      type: string
+    
+    WebUserElement:
+      type: object
+      properties:
+        name:
+          $ref: '#/components/schemas/TypeWebUserName'
+        platformUserId:
+          $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+        crossplatformUserId:
+          $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+      required:
+        - name
+        - platformUserId
+        - crossplatformUserId
+
+    WebUserList:
+      type: array
+      items:
+        $ref: '#/components/schemas/WebUserElement'
+
+
+  requestBodies:
+    WebUserBodyIn:
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              password:
+                type: string
+                format: password
+              platformUserId:
+                $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+              crossplatformUserId:
+                $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+            required:
+              - password
+              - platformUserId
+      required: true
+
+
+  parameters:
+    WebUserNamePathParameter:
+      name: userName
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeWebUserName'
+
+
+paths:
+  /api/webusers:
+    get:
+      tags:
+        - Permissions
+      summary: Web user list
+      description: Fetch a list of all web users
+      operationId: WebUsers.get
+      responses:
+        200:
+          description: List of web users
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/WebUserList'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/webusers/{userName}:
+    #    get:
+    #      tags:
+    #        - Permissions
+    #      summary: Marker show
+    #      description: Fetch a single defined map marker
+    #      operationId: blacklist.get.id
+    #      parameters:
+    #        - $ref: '#/components/parameters/MarkerIdParameter'
+    #      responses:
+    #        200:
+    #          description: Single found marker
+    #          $ref: '#/components/responses/MarkersBodyOut'
+    #        404:
+    #          description: Marker ID not found, errorCode will be 'ID_NOT_FOUND'
+    #          $ref: '#/components/responses/HttpEmptyEnvelopedResponse'
+    
+    post:
+      tags:
+        - Permissions
+      summary: Web user create
+      description: Create or update a web user
+      operationId: WebUsers.post.id
+      parameters:
+        - $ref: '#/components/parameters/WebUserNamePathParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/WebUserBodyIn'
+      responses:
+        201:
+          description: User created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be one of 'NO_USERNAME', 'NO_OR_INVALID_PASSWORD', 'NO_PLATFORM_USER_ID', 'INVALID_PLATFORM_USER_ID' or 'INVALID_CROSSPLATFORM_USER_ID'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+    
+    delete:
+      tags:
+        - Permissions
+      summary: Web user delete
+      description: Delete a single web user
+      operationId: WebUsers.delete.id
+      parameters:
+        - $ref: '#/components/parameters/WebUserNamePathParameter'
+      responses:
+        204:
+          description: Deleted user
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request body, errorCode will be 'NO_USERNAME'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: User not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Whitelist.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Whitelist.openapi.yaml	(revision 462)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Whitelist.openapi.yaml	(revision 462)
@@ -0,0 +1,226 @@
+openapi: 3.1.0
+info:
+  title: Whitelist
+  version: '1'
+
+components:
+  schemas:
+    WhitelistUserElement:
+      type: object
+      properties:
+        name:
+          type: string
+          examples:
+            - TheFunPimp
+          description: Name of the banned player for display purposes. Can be empty.
+        userId:
+          $ref: './openapi.yaml#/components/schemas/TypeUserIdObject'
+      required:
+        - name
+        - userId
+
+    WhitelistUserList:
+      type: array
+      items:
+        $ref: '#/components/schemas/WhitelistUserElement'
+
+    WhiteListGroupElement:
+      type: object
+      properties:
+        name:
+          type: string
+          examples:
+            - Steam Universe
+          description: Name of the group for display purposes. Can be empty.
+        groupId:
+          type: string
+          examples:
+            - '103582791434672565'
+      required:
+        - name
+        - groupId
+
+    WhiteListGroupList:
+      type: array
+      items:
+        $ref: '#/components/schemas/WhiteListGroupElement'
+    
+    UserPermissionsObject:
+      type: object
+      properties:
+        users:
+          $ref: '#/components/schemas/WhitelistUserList'
+        groups:
+          $ref: '#/components/schemas/WhiteListGroupList'
+      required:
+        - users
+        - groups
+
+    TypeGroupIdString:
+      type: string
+      examples:
+        - '103582791434672565'
+    
+    UserPermissionPostBodyObject:
+      type: object
+      properties:
+        name:
+          type: string
+  
+  
+  parameters:
+    UserIdParameter:
+      name: id
+      in: path
+      required: true
+      schema:
+        $ref: './openapi.yaml#/components/schemas/TypeUserIdString'
+
+    GroupIdParameter:
+      name: id
+      in: path
+      required: true
+      schema:
+        $ref: '#/components/schemas/TypeGroupIdString'
+
+
+  requestBodies:
+    WhitelistBodyIn:
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/UserPermissionPostBodyObject'
+      required: true
+
+
+paths:
+  /api/whitelist:
+    get:
+      tags:
+        - Permissions
+      summary: Whitelist list
+      description: Fetch a list of all whitelisted users / groups
+      operationId: Whitelist.get
+      responses:
+        200:
+          description: List of whitelist entries
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/UserPermissionsObject'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: [ ]
+          apiTokenSecret: [ ]
+        - sessionCookie: [ ]
+
+
+  /api/whitelist/user/{id}:
+    post:
+      tags:
+        - Permissions
+      summary: Whitelist user create
+      description: Create or update a whitelist user
+      operationId: Whitelist.post.user.id
+      parameters:
+        - $ref: '#/components/parameters/UserIdParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/WhitelistBodyIn'
+      responses:
+        201:
+          description: Whitelist user created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP' or 'INVALID_USER'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: Whitelist user delete
+      description: Delete a single whitelist user
+      operationId: Whitelist.delete.user.id
+      parameters:
+        - $ref: '#/components/parameters/UserIdParameter'
+      responses:
+        204:
+          description: Deleted whitelist user
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP' or 'INVALID_USER'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: User ID not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+
+  /api/whitelist/group/{id}:
+    post:
+      tags:
+        - Permissions
+      summary: Whitelist group create
+      description: Create or update a whitelist group
+      operationId: Whitelist.post.group.id
+      parameters:
+        - $ref: '#/components/parameters/GroupIdParameter'
+      requestBody:
+        $ref: '#/components/requestBodies/WhitelistBodyIn'
+      responses:
+        201:
+          description: Whitelist group created or updated
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP' or 'INVALID_GROUP'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []
+
+    delete:
+      tags:
+        - Permissions
+      summary: Whitelist group delete
+      description: Delete a single whitelist group
+      operationId: Whitelist.delete.group.id
+      parameters:
+        - $ref: '#/components/parameters/GroupIdParameter'
+      responses:
+        204:
+          description: Deleted whitelist group
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        400:
+          description: Invalid request, errorCode will be one of 'NO_USER_OR_GROUP', 'INVALID_GROUP'
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        404:
+          description: Group ID not found
+          $ref: './openapi.yaml#/components/responses/HttpEmptyEnvelopedResponse'
+        403:
+          $ref: './openapi.yaml#/components/responses/Unauthorized'
+      security:
+        - apiTokenName: []
+          apiTokenSecret: []
+        - sessionCookie: []