API overview

Everything the panel does is available over a REST API. The reference is generated from the running panel at every release, so each endpoint, field and permission matches the version you run.

Base URLhttps://YOUR-PANEL:PORT/api (the same address as the dashboard)

FormatJSON in, JSON out. Login uses a form body.

AuthBearer token from POST /api/admin/token

Specopenapi.json for Postman, Insomnia, Swagger or Redoc

Quick start

# 1. log in and keep the token
TOKEN=$(curl -s -X POST https://YOUR-PANEL/api/admin/token \
  -d 'username=ADMIN&password=PASSWORD' | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')

# 2. call anything
curl -s https://YOUR-PANEL/api/system -H "Authorization: Bearer $TOKEN"

# 3. create a user
curl -s -X POST https://YOUR-PANEL/api/user \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"username":"demo_user","proxies":{"vless":{}},"inbounds":{"vless":["VLESS TCP REALITY"]},"data_limit":53687091200,"expire":0}'

Who can call what

Each endpoint page shows a badge:

Badge	Meaning
Public	No token needed (login, subscription links).
Any admin	Any signed-in admin. Resellers only see and change their own users.
Sudo admin only	Panel-wide settings: nodes, cores, settings, backups, statistics.

Read Authentication & errors next, then pick an area from the sidebar.