# Overthewire — Wrapped API

> **You are on:** `https://api.beta.paywithlocus.com/api` | [llms.txt](https://beta.paywithlocus.com/llms.txt) | [docs](https://docs.paywithlocus.com)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API | Docs |
> |---|---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com | docs.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com | docs.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com | docs.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Access structured data from the OverTheWire wargames platform, including the full list of wargames, per-level goals and instructions, SSH connection details, community rules, and the recommended progression order. Supports lookups by wargame name or level number across all available challenges.

**Category:** Developer Tools | **Website:** [overthewire.org/](https://overthewire.org/) | **Docs:** [parse.bot/marketplace/f298c1a2-a4ae-401f-a4dd-b6bf99ed52fb/overthewire-org-api](https://parse.bot/marketplace/f298c1a2-a4ae-401f-a4dd-b6bf99ed52fb/overthewire-org-api)

Pay-per-use API proxy for Locus Pro. Each call burns credits from your workspace balance.

## Access

**Base URL:** `https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/`
**Auth:** `Authorization: Bearer <LOCUS_CREDITS_SECRET_KEY>` (an `lcr_` secret key or a scoped `lcac_` agent credential)
**Required header:** `Idempotency-Key: <fresh UUID per call>`. A retry with the same key replays the stored result without a new charge.
**Response:** the provider response after any endpoint-specific normalization. `X-Locus-Credits-Charged` carries the charge and `X-Locus-Credits-Balance` the remaining balance. Insufficient credits return `402` before the provider is called.
**Pricing:** estimated costs below are USD. Locus debits the credit equivalent at your workspace rate.

Full call contract: https://docs.paywithlocus.com/api-reference/introduction

> Using a Pay With Locus wallet key (`claw_` prefix)? Wallet routes are documented separately: https://docs.paywithlocus.com/wrapped-apis/for-agents

## Endpoints

### Get all levels for wargame

Get detailed information for all levels of a specific wargame. Fetches each level page individually so may be slow for wargames with many levels. Returns the level count alongside the full level array.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `wargame_name` | string | Yes | The short name of the wargame (e.g. 'bandit', 'leviathan') |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-all-levels-for-wargame \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"wargame_name":"<string>"}'
```

### Get level info

Get information about a specific level within a wargame, including the goal text and instructions extracted from the level page. The goal text contains the full content of the level page including commands needed and helpful reading material.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `level_number` | integer | Yes | The level number (zero-indexed, e.g. 0 for the first level) |
| `wargame_name` | string | Yes | The short name of the wargame (e.g. 'bandit', 'natas', 'leviathan') |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-level-info \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"level_number":"<integer>","wargame_name":"<string>"}'
```

### Get natas level info

Get information for a specific Natas (web-based) level, including credentials and URL. Convenience endpoint equivalent to get_level_info with wargame_name='natas'. Natas levels are web-based challenges accessed via HTTP rather than SSH.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `level_number` | integer | Yes | The level number (zero-indexed, e.g. 0 for the first level) |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-natas-level-info \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"level_number":"<integer>"}'
```

### Get released wargame info

Get information about a released/offline wargame, including its full description and instructions extracted from the wargame page. Released wargames are no longer actively hosted but their materials may be available for download.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `wargame_name` | string | Yes | The short name of the released wargame (e.g. 'abraxas', 'hes2010', 'monxla', 'kishi') |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-released-wargame-info \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"wargame_name":"<string>"}'
```

### Get rules

Get the community rules for the OverTheWire platform as plain text. Includes general conduct rules, educator guidelines, and legal information.

**Estimated cost:** Metered

_No parameters required._

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-rules \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### Get ssh connection info

Get SSH connection details for a shell-based wargame, including hostname, port, and initial username. The username is typically the wargame name followed by 0 (e.g. bandit0). Returns null host for wargames without active SSH servers.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `wargame_name` | string | Yes | The short name of the wargame (e.g. 'bandit', 'leviathan', 'narnia') |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-ssh-connection-info \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"wargame_name":"<string>"}'
```

### Get wargame info

Get detailed information about a specific wargame, including SSH host, port, display title, and list of levels with URLs. The levels array contains one entry per level with title and direct URL. Host and port may be null for released/offline wargames without active servers.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `wargame_name` | string | Yes | The short name of the wargame as listed in the catalog (e.g. 'bandit', 'natas', 'leviathan', 'krypton', 'narnia', 'behemoth', 'utumno', 'maze', 'vortex', 'manpage', 'drifter', 'formulaone') |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-wargame-info \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"wargame_name":"<string>"}'
```

### Get wargame suggested order

Get the suggested play order for the wargames as a list describing the recommended progression path from beginner to advanced, starting with Bandit for Unix basics and progressing through web security, cryptography, and binary exploitation tracks.

**Estimated cost:** Metered

_No parameters required._

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-wargame-suggested-order \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### Get wargames list

Get a categorized list of all available wargames grouped by status (Online, Offline, Released). Each entry includes the wargame display name, short name, and URL. Returns the full catalog in a single response.

**Estimated cost:** Metered

_No parameters required._

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/overthewire/get-wargames-list \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'
```

## Next steps

- [All wrapped API providers](https://beta.paywithlocus.com/wapi/index.md): pick another provider.
- [Find and call tools](https://beta.paywithlocus.com/agent/tools.md): price ceilings, async results, and errors.
- [Credits and billing](https://beta.paywithlocus.com/agent/billing.md): what a call costs and how to add credits.
- [Agent docs index](https://beta.paywithlocus.com/agent/index.md): every Locus agent page.