Developers

Integration overview

How your own resources talk to Apex — exports, events, timing and the resource name.

Apex ships a small, stable API so your own scripts (jobs, shops, admin menus, medkits, garages…) can tell the anticheat that something is legitimate. Use it whenever your script does something that would otherwise look like a cheat: giving armour, healing, teleporting, spawning vehicles, giving weapons, or making a player invincible in a safe zone.

Allow legit actionsArmour, health, teleports, godmode, noclip — one server export. Spawning entitiesVehicles, peds and objects spawned by your scripts. Weapons (WeaponGuard)Which weapons a player is allowed to hold. Safe zonesClient-side exemptions for greenzones. Report to ApexSend your own detections into the Apex pipeline. API referenceEvery export and event in one table.

The resource name#

Exports always live under the folder name of the Apex resource on your server. The download is called ApexAC, so all examples use:

lua

exports['ApexAC']:allow(source, 'armour', 5000)

Renamed the folder?

If you renamed the resource folder (for example to apex), replace ApexAC in every example with your folder name — otherwise FiveM reports No such export.

Server-side first#

Everything that grants something (armour, health, teleports, spawns, weapons) is a server export or a server-only event. A cheater can't call those from their own client, so they can't abuse your whitelist. Always call them from the server script that performs the action — never from a client event a player could trigger.

Never expose these to clients

Don't make a client event like myshop:giveArmour that calls allow(...) for whoever triggers it. Do the check (job, money, item) on the server first, then call allow, then give the item.

Timing — wait until Apex is loaded#

Apex loads its code into memory a few seconds after the server starts (see How Apex works). Its exports exist only after that. If your resource starts before Apex has finished loading, a direct call fails with No such export. Wrap calls in a small helper:

lua

-- server.lua of YOUR resource
local function apexAllow(src, kind, ms)
    local ok = pcall(function()
        exports['ApexAC']:allow(src, kind, ms)
    end)
    return ok
end

Or use the event, which simply does nothing while Apex isn't loaded yet:

lua

TriggerEvent('apex:allow', source, 'armour', 5000)

Events vs. exports#

	Export	Event
Call	`exports['ApexAC']:allow(src, kind, ms)`	`TriggerEvent('apex:allow', src, kind, ms)`
Depends on the resource name	Yes	No
Errors if Apex isn't loaded	Yes (use `pcall`)	No (silently ignored)
Return value	`true` / `false`	none

Both are server-only: the events are registered with AddEventHandler, not RegisterNetEvent, so clients can't trigger them.

Admins are not immune#

There is no blanket immunity for staff — not even for the server owner. Admin tools inside the Apex in-game panel exempt themselves automatically while they're in use. For players or bots that must never be flagged, use the AC whitelist.