AZ
Ten years of iOS privacy protection plugins
AZ TUTORIALS · API reference

Thor · API reference

Thor is controlled through a local HTTP API. Scripts can clean, switch, rename and query backup records remotely.

AZ tutorialsRead on siteUpdated 2026-11-01
ItemValue
HTTP base URLhttp://127.0.0.1:8090
MethodAlways GET
Command format/cmd?fun=command¶ms
Bundle IDcom.superdev.Thor
Result file/var/mobile/ThorResult.txt

Before you call anything

Thor must be running in the foreground before every command:

lua
runApp("com.superdev.Thor")
mSleep(3 * 1000)  -- First launch verifies the license online; waiting 3 seconds is safe

Return values

Every command returns JSON. The key field is status:

ValueMeaning
1Success, the operation completed
0Failure: bad parameters, not licensed, or refused
2In progress. This is an internal state that a script normally never sees

The status of the most recent command is also written to /var/mobile/ThorResult.txt, which you can read directly.

Endpoint list

FunctionCommandParameters
Start cleanup (reset)newrecord—
Switch to a specific backupactiverecordrecord
Switch to the next backupnextrecord—
Rename the current backuprenamecurrentrecordname
Delete a specific backupdeleterecordrecord
Enable / disable a backupdisablerecordrecord
Get every backup namegetallrecords—
Get the current backup namegetcurrentrecord—

Endpoint details

Start cleanup

GET http://127.0.0.1:8090/cmd?fun=newrecord

Generates a fresh device identity and runs the cleanup — the same as tapping Start cleanup on the app's main screen.

Failure cases:

  • No apps selected
  • The device is not licensed
  • The command timed out

Switch to a specific backup

GET http://127.0.0.1:8090/cmd?fun=activerecord&record=backup-record-name
ParameterRequiredNotes
recordYesBackup record name. URL-encode it if it contains non-ASCII characters

Switches to an existing backup record and restores the device parameters it holds.

Switch to the next backup

GET http://127.0.0.1:8090/cmd?fun=nextrecord

Moves to the next available backup automatically, skipping disabled backups and the original backup. This is the one you want for account rotation.

Failure cases:

  • There are no backup records at all
  • Nothing to switch to (all disabled, or only the current one exists)

Rename the current backup

GET http://127.0.0.1:8090/cmd?fun=renamecurrentrecord&name=new-name
ParameterRequiredNotes
nameYesNew name, cannot be empty. Non-ASCII characters and spaces must be URL-encoded

Failure cases:

  • The name is empty
  • There is no active backup record
  • The current record is the original backup, which is protected and cannot be renamed

Delete a specific backup

GET http://127.0.0.1:8090/cmd?fun=deleterecord&record=backup-record-name
ParameterRequiredNotes
recordYesBackup record name

You cannot delete the backup currently in use. Deletion cannot be undone.

Enable / disable a backup

GET http://127.0.0.1:8090/cmd?fun=disablerecord&record=backup-record-name
ParameterRequiredNotes
recordYesBackup record name

This is a toggle: an enabled backup becomes disabled and vice versa. Disabled backups are skipped by nextrecord. You cannot disable the backup currently in use.

Get every backup name

GET http://127.0.0.1:8090/cmd?fun=getallrecords

Example response:

json
{ "status": 1, "records": ["Original backup", "2026-05-05-17-32-10-56", "custom name"] }
FieldNotes
recordsNames of all backup records, including the built-in original backup

Get the current backup name

GET http://127.0.0.1:8090/cmd?fun=getcurrentrecord

Example response:

json
{ "status": 1, "current": "2026-05-05-17-32-10-56" }
FieldNotes
currentName of the active backup; an empty string when no backup is active

Lua example (TouchSprite)

lua
local sz = require("sz")
local http = require("szocket.http")

local BASE = "http://127.0.0.1:8090/cmd?fun="

-- URL encoding (needed for non-ASCII names)
function urlEncode(s)
    s = string.gsub(s, "([^%w%.%- ])", function(c)
        return string.format("%%%02X", string.byte(c))
    end)
    return string.gsub(s, " ", "+")
end

-- Unified call: parsed JSON on success, nil on failure
function Thor(query)
    local res, code = http.request(BASE .. query)
    if code == 200 then
        return sz.json.decode(res)
    end
end

-- Launch Thor (required before any command)
runApp("com.superdev.Thor")
mSleep(3 * 1000)

-- 1. Start cleanup (reset)
local r = Thor("newrecord")
if r and r.status == 1 then
    toast("Cleanup complete", 2)
end

-- 2. Rename the current backup
Thor("renamecurrentrecord&name=" .. urlEncode("138xxxx John"))

-- 3. Check the current backup
local cur = Thor("getcurrentrecord")
if cur then toast("Current backup: " .. cur.current, 2) end

-- 4. Switch to a specific backup
Thor("activerecord&record=" .. urlEncode("Wechat001"))

-- 5. Account rotation: walk through every available backup
local all = Thor("getallrecords")
if all then
    for i = 1, #all.records do
        local r = Thor("nextrecord")
        if not r or r.status ~= 1 then break end
        -- ... your own logic here ...
    end
end

For usage, see the Thor user guide.

Note

The interface and supported systems may change with updates. Back up important data before cleaning, resetting or deleting anything.