Export reference

Calling an export#

Call server exports from your resource's server scripts and client exports from its client scripts. The resource name contains a hyphen, so always use the bracket form exports['tosun-ac']. The form exports.tosun-ac is not valid Lua.

• Pass server ids as numbers. Several exports use the id directly as a table key.
• Some exports run a synchronous database query and yield. Call them from a thread or an event handler: getBans, getBanInfo, GetDetections, isAdmin and the other staff checks, IsExemptFromPunish, ForensicLinksOf and refreshPanelWhitelist. scanAllResources and scanSingleResource also yield.
• A guarded export that rejects your resource returns false, even if it normally returns nil.
• Some exports exist only when their feature is enabled (see Feature-dependent exports). Calling an export that is not registered raises an error, so wrap those calls in pcall.
• Several exports are missing from the export lists in fxmanifest.lua (for example MarkTeleport, punish and AllowWeapon). Those lists are informational only; the exports work.
• The tables below say Yes in the last column when the calling resource must be trusted. See Trusted resources.

-- server script in your own resource
local status = exports['tosun-ac']:GetIntegrationStatus()
if not status.trusted then
    print(status.hint) -- the server.cfg line to add
end

-- tell the AC about a teleport, then move the player
exports['tosun-ac']:MarkTeleport(src, 8000)
SetEntityCoords(GetPlayerPed(src), x, y, z)

-- client script in your own resource
exports['tosun-ac']:SetExempt(true, 60000, 'my_menu')

• Integration guide
• Server configuration

Trusted resources#

Exports marked Yes in the trust column change exemptions, staff rights, bans, player health, weapons or inventory, quarantine, resources and signatures, or the whole server. They only accept calls from a trusted resource. A rejected call does nothing and returns false.

A caller is trusted when it is the server console, tosun-ac itself, a resource listed in ts.ExportCallerWhitelist in the config, or a resource listed in the convar tosun_ac_trusted_resources. The default config list is qbx_core, qb-core, es_extended, ox_inventory and ox_lib.

Prefer the convar. It lives in server.cfg and survives AC updates, while edits to the config file can be lost when you update the AC. Separate names with commas or spaces. The trust list is cached for 10 seconds, so a change made at runtime applies within 10 seconds.

On the first rejection for each resource and export pair, the AC prints one warning to the server console with the exact server.cfg line to add, and writes one line to the panel logs. The panel log line is always in Turkish.

Audit mode: with ts.EnforceExportCallerWhitelist = false, untrusted calls run and each resource and export pair is printed once to the server console (no panel log line). The default is true. Use audit mode only during setup to see which scripts call what.

Run tosunac_integration in the server console to print the enforcement mode, the trusted resources with their source (config or convar) and the last 20 rejected calls. From a script, call GetIntegrationStatus().

Trust also removes the MarkTeleport budget: trusted resources can mark teleports without the per-player time limit.

Tosun AC also registers internal exports and net events for its own plumbing (panel bridge, signing, scanning, licensing, batching). They are not part of this reference and not a supported API. Some are protected by the trust check or an internal caller check. Do not call them.

# server.cfg
set tosun_ac_trusted_resources "my-housing,my-clothing"

• Server configuration
• Console commands

Integration and exemptions#

Server exports that tell the AC about legitimate actions in your scripts, and read whether a player is exempt.

Choosing an exemption#

Use the narrowest exemption that covers your script. Several exemptions share the same client exempt flag, so one can end another: ClearArea with an area name resets the flag that SetPlayerExempt, MarkTeleport and BypassDetection also set.

Staff and permissions#

Read and change who the AC treats as staff. Staff checks can query the database, so call them from a thread or an event handler.

isAdmin returns true for: a manual addAdmin grant; the ACEs txadmin, tx.admin, txadmin.menu, txadmin.advanced, command.txadmin, command.ts, command.ban, command.kick, tosun.admin, ts.admin and any in ts.AdminBypassAces; the principals group.admin, group.superadmin, group.moderator and group.god; command.kick/ban/resources/restart when ts.txAdminAuth is on; identifiers in admins.lua, ts.AdminMenu.allowedIds and ts.AdminBypassIdentifiers; and panel grants in the database. An ACE that is also granted to builtin.everyone does not count.

isAdmin and addAdmin are registered twice in the source. The versions in anticheat_server.lua load last and are the ones that run; this reference describes those.

Player whitelist and areas#

Server-id whitelist, identifier whitelist and named areas. The runtime lists live in memory only and are lost on restart; the panel whitelist is separate.

Punishments and bans#

Punish players through the AC pipeline, ban offline players and read bans. All write exports here need trust.

• Events

How punish() picks the punishment#

punish(), ban() and BanPlayerExt() share one pipeline. This is the order it follows.

1. Staff are skipped when ts.AdminBypassDetections is not false. Players with an active exemption or on the runtime or panel whitelist are skipped. ts.Debug turns these skips off. Skipped calls do nothing and log nothing.
2. The player must be online. Otherwise an error is printed to the server console and nothing happens.
3. Punishment: a valid punishment argument wins. Otherwise ts.DetectionPunishments[configKey], then its alias, then the detection key, then ts.punishType, then BAN.
4. Every outcome fires the server event ts_anticheat:playerBanned, posts a chat message when ts.chatMessages is on, adds a cloud violation and writes the AC log and live log.
5. LOG: sends the screenshot log to Discord.
6. KICK: checks staff again regardless of ts.AdminBypassDetections, so staff are never kicked. Then sends the screenshot log and drops the player.
7. BAN: inserts the ban with a length from ts.BanDurations in hours (configKey, alias, detection key, prefix, then default; 0 = permanent) and bannedBy 'anticheat:' plus the key. Fires ts_anticheat:banCommitted, notifies the panel and drops the player (retried after 3 s).

exports['tosun-ac']:punish(src, 'Money exploit', nil, 'my_shop_exploit', 'BAN')

Moderation of a single player#

Act on one player. Read the trust column carefully: several of these have no trust check.

Server-wide actions#

Actions that affect every player or every new connection.

Quarantine and payload protection#

Isolate a suspicious player, and protect your own net events from crash payloads and spam.

RegisterNetEvent('myres:buy', function(data)
    local src = source
    if not exports['tosun-ac']:RateLimit(src, 'myres:buy', 5, 10000) then return end
    if exports['tosun-ac']:crashGuardReject(src, data) then return end
    -- handle the purchase
end)

Players and detections#

Look up players, identifiers, bans by player, threat scores and linked accounts. Some results contain personal data such as IP addresses.

Notifications and language#

Send phone notifications and use the AC translation tables. phoneNotify and phoneNotifyAdmins exist only when ts.AdminMenu.enable is on.

Screenshots#

Request player screenshots for the panel. The AC's log-writing exports are internal and not listed here.

• Panel setup

Status and diagnostics#

Read AC state for dashboards and health checks.

Resource guard#

Read and change the approved resource baseline. All of these exports are registered even when the resource guard is disabled.

• Console commands

Signature, backdoor and event scans#

Run scans and manage signatures, false-positive exceptions and escrow skips. Scans can take time; run them from a thread.

Honeypot events#

Turn event names into traps or release them. Both write to ac_protected_events and reload from the database.

Feature-dependent exports#

These exports are registered only when their feature is on. If the feature is off, calling them raises an error.

• Config and performance

Client-side exports#

Call these from client scripts. Any client resource can call them; there is no trust check. They only affect checks on that client and never change server enforcement.

-- character selection
exports['tosun-ac']:SetSpawned(false)
-- ... player picks a character ...
exports['tosun-ac']:SetSpawned(true)

JavaScript exports#

Tosun AC registers a few JavaScript exports on the server for resource scanning and license verification. They are internal, not wrapped by the trusted-resource check, and not a supported API. Do not call them. There are no public JavaScript exports.

Bridge files: setup#

The optional bridge files in tosun-ac/bridge give your resource a global TosunAC table with short helpers. They call the exports inside pcall, so your script keeps running when the AC is stopped. The AC sees your resource as the caller.

1. Add the bridge to your resource's fxmanifest.lua: server_script '@tosun-ac/bridge/tosun_ac_server.lua' and, if needed, client_script '@tosun-ac/bridge/tosun_ac_client.lua'.
2. If the AC folder has another name, add setr tosun_ac_resource "folder-name" to server.cfg. Use setr: the client bridge reads this convar on the client.
3. Optional: set tosun_ac_bridge_server_ms (default 60000), set tosun_ac_bridge_cooldown_ms (default 750, 0 disables) and setr tosun_ac_bridge_client_ms (default 60000).
4. For full server exemptions, add your resource to tosun_ac_trusted_resources. Without trust, TosunAC.PlayerExempt falls back to a soft exemption and prints a one-time hint to the server console (the hint text is Turkish).

-- fxmanifest.lua of your resource
server_script '@tosun-ac/bridge/tosun_ac_server.lua'
client_script '@tosun-ac/bridge/tosun_ac_client.lua'

# server.cfg
setr tosun_ac_resource "tosun-ac"
set tosun_ac_trusted_resources "my-resource"

-- server script
local ok, mode = TosunAC.PlayerExempt(src, 'long', 'clothing')
-- mode is 'full' (trusted) or 'soft' (movement only, max 15 s)

• Integration guide
• Server configuration

Bridge: server helpers#

Defined by bridge/tosun_ac_server.lua inside your resource. Presets: SHORT 30000, MEDIUM 60000, LONG 120000, XL 180000 ms (TosunAC.Presets). TosunAC.Version is '1.2'.

Bridge: client helpers#

Defined by bridge/tosun_ac_client.lua inside your resource. They wrap the client SetExempt export, so they give client-side relief only.

Exports any resource can call#

These exports have no trust check and have side effects. Every server resource can call them. Run only resources you trust; note that any server resource can already kick players or trigger client events through FiveM natives.

• MarkTeleport: movement exemption, limited by the per-player budget.
• spectatePlayer: teleports a player and grants an unbudgeted 15 s movement exemption on every call.
• NoteCloudViolation: raises a player's threat score and can report the license to the cross-server threat database.
• warnPlayer and mutePlayer: write warning and mute records.
• freezePlayer and slayPlayer: act on a player directly.
• crashGuardReject: adds strikes that can kick or ban.
• screenCapture, v6ScreenWatchRequest and RequestShieldScreenshot: request screenshots.
• rescanResources, scanAllResources, scanSingleResource, tsScanBackdoors and tsScanEvents: start scans. scanAllResources can block and tsScanBackdoors can stop resources when auto-block or auto-quarantine is on.
• applyWeatherWithFramework and applyTimeWithFramework: change weather and time for everyone.
• invalidateSignatureCache, reloadSignatureExceptions, reloadSignatureScanCaches and refreshPanelWhitelist: reload caches.
• setPlayerLocale and unmutePlayer: change player state.
• phoneNotify and phoneNotifyAdmins: send phone or chat messages to players.

Legacy and misleading names#

These exports still work, but their names or older documentation suggest something they do not do.

• Older guides (INTEGRATION.md for 9.6.6, CONFIG-EXPORTS-MULTILANG.md for 8.6.1, and the TOSUN-AC-EXPORTS.md redirect stub) are out of date. Where they differ, this reference matches the 9.6.15 code.
• SetPlayerExempt, PausePlayerDetections, PauseAllDetections, BypassDetection, AddWhitelist, RemoveWhitelist, WhitelistArea, ClearArea, addAdmin, fakeTriggerTrap and fakeTriggerWhitelist need a trusted resource, although CONFIG-EXPORTS-MULTILANG.md lists them without that requirement.
• The default trusted list is qbx_core, qb-core, es_extended, ox_inventory and ox_lib. INSTALLER-READY.md omits qb-core and es_extended.
• GetIntegrationStatus() also returns a version field.
• punish, ban, BanPlayerExt, KickPlayer, offlineBan and offlineBanByLicense need a trusted resource.
• ban() and BanPlayerExt() follow ts.punishType and ts.BanDurations['default'], so they are not always permanent.
• KickPlayer does not check exemptions. In the punish pipeline, KICK always spares staff, while BAN and LOG follow ts.AdminBypassDetections.
• During a client exemption most client checks are skipped entirely. Only detections that still reach the ban path become LOG entries tagged [exempt].
• NoteCloudViolation blocks later joins only with ts.cloudBridge.threatIntelAction = 'kick'.
• With the client bridge, the convars tosun_ac_resource and tosun_ac_bridge_client_ms must be set with setr, not set.
• The MarkTeleport per-call cap (ts.Integration.markTeleportMaxMs) applies to trusted callers too. Only the 180 s per 10 minutes budget is for untrusted callers.