Axis Documentation

When you buy something you get a receipt. If they overcharge you later, the receipt proves what you actually paid. Without it, it is your word against theirs.

Online, when you get banned, you get nothing.

What it is

A piece of paper saying what was decided, when and why — carrying proof that the decision was already written at that moment. Meaning nobody can invent it later, or change the reason after the fact.

Why it exists

In July 2026 Discord admitted it had wrongly banned around 8,200 accounts over two months. A bug skipped human review and kept the bans in place even after its own team cleared them.

Nobody could prove anything. Not the people affected, not Discord.

That is normal for moderation: a black box.

What it does NOT say

It does not say who moderated you. That is deliberate. A receipt carrying the name of whoever decided becomes a target, and that is why almost no platform says who decided.

It says what, when and why. That is enough to argue with.

How to use it

/receipt view <id> in Discord, or the link that arrives by DM. And the same receipt can be verified without us, on your own machine.

Someone joins your server, behaves badly, and you ban them. Ten minutes later they are back on another account.

How do you know it is the same person, if the name is different?

You don't know. You recognise.

Nobody can prove who is on the other side of a screen. What you can do is look at many things at once and see whether they tell the same story: which connection they come from, which device, which browser, what time their clock says.

None of those identifies anyone on its own. Millions of people share a browser. Together, they start to mean something.

Piece by piece, not all or nothing

It all used to be boiled down to a single mark: it either matched entirely or it matched not at all. The problem is that it changed by itself. The browser updates, you plug in a different monitor, and suddenly you no longer looked like yourself.

Now each thing is stored separately, and it can say "matches on 8 of 9".

That changes the cost of hiding. Before, changing something cheap was enough; now you have to change everything at once: another computer, another screen, another graphics card. That is not a click any more, it is money.

And not everything weighs the same. Millions of people share a time zone: it barely counts. The drawing your graphics card produces is nearly unique: that one weighs.

When the story doesn't add up

Here is the interesting part. A VPN changes the IP and nothing else.

The browser keeps telling the truth about its owner: the system clock, the language, the keyboard. If the connection says Amsterdam and the browser says a Madrid clock, Spanish, and answers in eight milliseconds, no VPN fixes that. Covering it would mean changing the settings of the whole machine.

And the operating system is never looked at. Never.

Using Linux is not suspicious: there are entire companies working on Linux. What stands out is the inconsistency, which is a behaviour, not a tool.

What it does NOT do

It does not say you are guilty. It is one signal that adds up with others, and several have to stack before anything happens. On its own it is never enough.

It does not accuse travellers or expats. A Spaniard living in the Netherlands has a Madrid clock, Spanish, and a Dutch IP — and their machine tells a coherent story. That costs nothing at all. What stands out is a machine that contradicts itself.

It stores nothing in the clear. Every piece is stored as an irreversible hash, just like the IP. The real values — your time, your language — exist for a few seconds in memory while the check runs, and leave with it. They never touch disk.

It is not a wall. Someone with money, time and determination can buy another computer. The goal was never "impossible": it is to make it cost more than it is worth.

It is three in the morning. Someone with permissions has deleted eighteen channels, dropped half the roles, and left.

Tomorrow the server has to open.

What happens almost everywhere

Someone starts recreating channels by hand. They remember the names, more or less. They do not remember who could write where — and that is where it turns ugly: a private channel recreated without its permissions is a public channel full of conversations that were not for everyone.

Two days later, things are still turning up missing.

There are three answers here, and they are not the same

It is not one button, it is three, and picking the right one matters.

1 · Undo — /backup undo

Rebuilds what was just broken, and only that. When someone deletes a channel, AXIS saves its whole structure at that very moment: the name, the category, the topic, and who could get in. So it comes back exactly as it was, permissions included.

The important part: it works even if that channel was in no backup at all. The channel you made yesterday afternoon comes back too.

It is the first thing to try after an attack.

2 · Restore — /backup restore

Recreates whatever is missing from a backup. Useful when the damage is older than the last 24 hours, or when so much is gone that starting from the whole snapshot is simpler.

It never deletes anything that is there. It only adds what is not.

3 · Restore in full mode

On top of creating what is missing, it overwrites what was left wrong: it fixes the permissions of channels that are still there and gives everyone back the roles they had. It is the most powerful one and the only one that can break something, so it asks for confirmation and tells you first how many people it will touch.

And the part nobody else has

Every security bot says it takes backups. None of them answers this:

Can your backup actually be restored, right now, on your server?

Because a backup is not a promise: it is a file. And between having it and it working there are things that break on their own, without anyone touching anything:

All of that gets discovered on the day of the disaster. When there is no room left.

/backup review walks your latest backup against the server as it is now and tells you what would be restored, what would not, and why. It touches nothing: it is a rehearsal, you can run it in the middle of a meeting.

And you do not have to remember to run it: it is checked automatically with every scheduled backup, and it warns you the day your recovery stops working. Not when you need it: the day it breaks.

What does NOT come back

Channels, roles, per-channel permissions, categories, emojis, stickers, server settings, webhooks, forum tags, the welcome screen, and who had which role.

Messages do NOT come back. A deleted channel takes its history with it and nobody can return that — not AXIS, not any other bot. The channel is rebuilt, not what was said inside it.

And one more thing, just in case: this does NOT stop you from being attacked. That is what the anti-nuke and the rest are for. This is what makes an attack stop being the end of the server and become a bad night instead.

Someone has been harassing a member of your server for months. You warned them three times, muted them twice, and in the end you banned them. Now that member wants to report it, and asks you for what you have.

What do you hand over? Forty screenshots?

The problem with screenshots

Anyone can fake a screenshot in two minutes. And whoever receives it knows that, so it is not worth much — not for a report, not for another server asking why you banned someone, not for the person themselves swearing it never happened.

A JSON data dump fixes nothing either: that is editable with a text editor too.

What a case file is

/casefile @someone gives you a file with the whole case for that person on your server: their warnings, their sanctions with reason and date, staff notes, and the log events that involve them.

So far, that is a dump. What changes everything is what comes with it:

Every event carries its proof. Not a promise that it was in the log: a mathematical proof, about sixteen hashes long, that that specific event was inside on the day it was signed. And the signature belongs to a key whose public half travels inside the file itself.

Which means whoever receives it can verify it without asking you for anything and without trusting you. Or us.

If someone changes a comma — the reason for a ban, a date, never mind adding a sanction that never happened — the signature stops adding up. It is not that you would notice: it is that you can prove it.

What it is actually for

What it does NOT carry, on purpose

Other people's data. A case file is about one person. Anyone else who shows up in the same events did not ask to be in it, so their identifiers are trimmed. If the reason for a ban was "raid alongside So-and-so", what comes out is "raid alongside [another person]".

No IPs and no device fingerprints, not even hashed. They are not needed to understand a case, and their place is the system — not a file that will end up in somebody's inbox.

Who moderated. Same as in the receipt, and for the same reason: a document carrying the name of whoever made the decision turns that person into a target. What comes out is what was decided, when, and why. That is enough to argue about.

What it does NOT prove

It proves what was decided, when, and that it was in the log. It does not prove the decision was right.

That difference matters, and it is written inside the file itself so it travels with it: whoever receives it must know what they are looking at without being told by the person handing it over.

One detail

The case file is verified before it is given to you, and the result is stated plainly. Handing over one that does not verify would be worse than handing over nothing: the recipient would trust something broken.

And exporting a case file goes on the record, with who did it and when. It is sensitive material; keeping count is part of treating it as such.

Almost everything AXIS does looks at people with suspicion: risk, evasion, sanctions. This is the opposite.

/profile pulls up a public card for a member. Their avatar, how long they have been around, whether they are verified, and the badges they have earned.

Hard rule: only the good stuff shows

The card is public — it is posted in the channel and anyone can see it. So it never carries warnings, sanctions, cases, or any risk score.

That is not an oversight or something still to do: it is the rule. Showing in a channel that someone has three warnings is pointing at a person in front of people they know, and no amount of pretty design fixes that. Moderation data stays in /user, /warnings and /history, which are for staff.

There is an automated test that blows up if moderation data ever leaks into the card. In all four languages.

The badges

They are earned on their own by what you do in the server. Nobody has to grant them:

/badges lists them all with what each one takes, and ticks the ones you already have. On the card, the ones you are missing appear dimmed: that way you can see at a glance that there is more, and how to get it.

The ones that can no longer be earned are not offered. Pioneer was for the server's first week and that week has passed; presenting it as pending would be misleading.

The credentials

Below there is a bar of five. It used to be called "trust" and nobody understood it: people expected it to measure popularity or how much someone talks, and a well-loved regular came out low.

It does not measure that. It measures what has been verified about the account, and now it says so with its five pieces in plain sight: verified, six months, one year, clean record, and vouched for. The lit ones are what you have; the dark ones, what is missing.

It is an honest label instead of a word that promised something else.

What it does NOT measure

It does NOT measure activity or popularity. Someone who has been posting daily for years, unverified, comes out low. That is not a bug: the bar talks about what can be checked, not about how much people like you.

It is NOT a ranking. There is no leaderboard and nobody competes with anybody.

When someone verifies

If you turn it on with /configure welcome, the card of whoever just verified is posted on its own in the channel you pick. It is the first thing that server says to someone who just arrived, and it says something good.

Picture a notebook where the bot writes down everything it does.

1. The pages are stitched together

Each page carries the fingerprint of the one before it. Tear one out and it shows: the next page points at something that is no longer there.

2. Every hour we take a signed photo

The photo says how many pages the notebook has and what its fingerprint is. It is signed, so it cannot be retouched.

3. The photos are kept in someone else's house

They are published somewhere that is not this server. Even if someone got in here and burned the notebook, the photos are still outside — and the dates on them were set by somebody else.

4. A SINGLE page can be proved

Without showing the whole notebook. That is what lets your receipt prove itself without carrying anybody else's sanctions inside it.

What it does NOT prove

How you check it

/integrity in Discord, and the same information published in the open so you can compare.

Almost every system like this shares data between customers: get blocked on one site, get shut out everywhere. It is sold as a feature.

Why not here

Because a stranger's mistake would shut you out of a place where you have never done anything. And because one moderator having a bad day on one server should not follow you to twenty others.

What happens on one server stays on that server.

How it is built

It is not a check somebody could forget to write. The customer's identifier goes inside the calculation: two servers seeing the same connection get different values.

Cross-referencing them is not forbidden — it simply yields nothing.

What this costs

It is a decision with a price, and that should be said: someone hopping from community to community starts from zero in each one. A shared system would catch them sooner.

That price is accepted. The alternative is worse.

ONYX is not a Discord bot. Discord is one of its connectors; the other one works for any site with accounts.

The question it answers

Your site asks one thing before letting somebody in:

is this visit the same person I already blocked?

And it returns a signed verdict: let them in, look at it yourself, or do not. You decide what to do with it — ONYX does not touch your site, and cannot.

The path, in four steps

1. You create a key with /keys create. Only the server owner can, and it is shown once.

2. Your server requests a check and receives a link.

3. You send the person there. Connection, browser and device get measured.

4. You ask for the result. It comes signed, with an expiry, and you can verify it without us.

What data crosses

What ONYX CANNOT do

What we do NOT have, and you should know first

This goes here and not buried, because it is what decides whether we are useful to you:

What we do have is written down with all its limits in the threat model.