Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Command.cs
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Command.cs	(revision 471)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Command.cs	(revision 485)
@@ -132,4 +132,12 @@
 
 		public override int DefaultPermissionLevel () => Constants.cDefaultUserPermissionLevel;
+
+		public override int[] DefaultMethodPermissionLevels() => new[] {
+			AdminWebModules.MethodLevelNotSupported,
+			AdminWebModules.PermissionLevelGuest,
+			AdminWebModules.MethodLevelInheritGlobal,
+			AdminWebModules.MethodLevelNotSupported,
+			AdminWebModules.MethodLevelNotSupported
+		};
 	}
 }
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.cs
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.cs	(revision 485)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.cs	(revision 485)
@@ -0,0 +1,64 @@
+using JetBrains.Annotations;
+using Utf8Json;
+using Webserver.Permissions;
+
+namespace Webserver.WebAPI.APIs.GameData {
+	[UsedImplicitly]
+	internal class EntityClass : AbsRestApi {
+		private static readonly byte[] jsonKeyName = JsonWriter.GetEncodedPropertyNameWithBeginObject ("name");
+		private static readonly byte[] jsonKeyId = JsonWriter.GetEncodedPropertyNameWithPrefixValueSeparator ("id");
+		private static readonly byte[] jsonKeyCommandIndex = JsonWriter.GetEncodedPropertyNameWithPrefixValueSeparator ("commandId");
+		private static readonly byte[] jsonKeyManualSpawnType = JsonWriter.GetEncodedPropertyNameWithPrefixValueSeparator ("manualSpawnType");
+
+		private readonly byte[] allClassesSerialized;
+
+		public EntityClass (Web _parent) {
+			JsonWriter writer = new JsonWriter ();
+			
+			writer.WriteBeginArray ();
+
+			int written = 0;
+			int iCommandIndex = 0;
+			foreach ((int id, global::EntityClass entityClass) in global::EntityClass.list.Dict) {
+				if (written > 0) {
+					writer.WriteValueSeparator ();
+				}
+
+				written++;
+
+				string name = entityClass.entityClassName;
+				global::EntityClass.UserSpawnType spawnType = entityClass.userSpawnType;
+				
+				writer.WriteRaw (jsonKeyName);
+				writer.WriteString (name);
+
+				writer.WriteRaw (jsonKeyId);
+				writer.WriteInt32 (id);
+
+				if (entityClass.userSpawnType != global::EntityClass.UserSpawnType.None) {
+					iCommandIndex++;
+			
+					writer.WriteRaw (jsonKeyCommandIndex);
+					writer.WriteInt32 (iCommandIndex);
+				}
+
+				writer.WriteRaw (jsonKeyManualSpawnType);
+				writer.WriteString (spawnType.ToStringCached ());
+				
+				writer.WriteEndObject ();
+			}
+
+			writer.WriteEndArray ();
+
+			allClassesSerialized = writer.ToUtf8ByteArray ();
+		}
+
+		protected override void HandleRestGet (RequestContext _context) {
+			PrepareEnvelopedResult (out JsonWriter writer);
+			writer.WriteRaw (allClassesSerialized);
+			SendEnvelopedResult (_context, ref writer);
+		}
+
+		public override int DefaultPermissionLevel () => AdminWebModules.PermissionLevelGuest;
+	}
+}
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.openapi.yaml	(revision 485)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/GameData/EntityClass.openapi.yaml	(revision 485)
@@ -0,0 +1,62 @@
+openapi: 3.1.0
+info:
+  title: EntityClass
+  version: '1'
+
+components:
+  schemas:
+    EntityClassElement:
+      type: object
+      properties:
+        name:
+          type: string
+          examples:
+            - zombieArlene
+        id:
+          type: integer
+          examples:
+            - -1440238285
+        commandId:
+          type: integer
+          examples:
+            - 1
+        manualSpawnType:
+          type: string
+          examples:
+            - None
+            - Console
+            - Menu
+      required:
+        - name
+        - id
+        - manualSpawnType
+
+    EntityClassList:
+      type: array
+      items:
+        $ref: '#/components/schemas/EntityClassElement'
+
+
+paths:
+  /api/entityclass:
+    get:
+      tags:
+        - GameData
+      summary: EntityClass list
+      description: Fetch a list of defined EntityClasses
+      operationId: entityclass.get
+      responses:
+        200:
+          description: List of EntityClasses
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    $ref: '#/components/schemas/EntityClassList'
+                  meta:
+                    $ref: './openapi.yaml#/components/schemas/ResultEnvelopeMeta'
+                required:
+                  - data
+                  - meta
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.cs
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.cs	(revision 471)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/Blacklist.cs	(revision 485)
@@ -100,5 +100,5 @@
 			}
 
-			if (PlatformUserIdentifierAbs.TryFromCombinedString (id, out _userId)) {
+			if (!PlatformUserIdentifierAbs.TryFromCombinedString (id, out _userId)) {
 				SendEmptyResponse (_context, HttpStatusCode.BadRequest, _jsonInputData, "INVALID_USER");
 				return false;
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml	(revision 471)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/CommandPermissions.openapi.yaml	(revision 485)
@@ -55,5 +55,5 @@
 
 paths:
-  /api/commandpermission:
+  /api/commandpermissions:
     get:
       tags:
@@ -85,5 +85,5 @@
 
 
-  /api/commandpermission/{command}:
+  /api/commandpermissions/{command}:
 #    get:
 #      tags:
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.cs
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.cs	(revision 471)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/RegisterUser.cs	(revision 485)
@@ -83,6 +83,6 @@
 				// Username already exists
 
-				if (!PlatformUserIdentifierAbs.Equals (existingMapping.PlatformUser, regData.PlatformUserId) ||
-				    !PlatformUserIdentifierAbs.Equals (existingMapping.CrossPlatformUser, regData.CrossPlatformUserId)) {
+				if (!Equals (existingMapping.PlatformUser, regData.PlatformUserId) ||
+				    !Equals (existingMapping.CrossPlatformUser, regData.CrossPlatformUserId)) {
 					// Username already in use by another player
 					SendEmptyResponse (_context, HttpStatusCode.Unauthorized, _jsonInputData, "DUPLICATE_USERNAME");
Index: TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml
===================================================================
--- TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml	(revision 471)
+++ TFP-WebServer/WebServer/src/WebAPI/APIs/Permissions/WebModules.openapi.yaml	(revision 485)
@@ -59,11 +59,22 @@
             type: object
             properties:
-              secret:
-                string
-              permissionLevel:
+              permissionLevelGlobal:
                 type: integer
+                description: Permission level for the overall module
+              permissionLevelPerMethod:
+                type: object
+                properties:
+                  GET:
+                    $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+                  POST:
+                    $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+                  PUT:
+                    $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+                  DELETE:
+                    $ref: '#/components/schemas/TypeWebMethodPermissionEntry'
+                description: Permission levels per HTTP method
             required:
-              - secret
-              - permissionLevel
+              - permissionLevelGlobal
+              - permissionLevelPerMethod
       required: true