Secure Programmable Router API (1.1.13)

Download OpenAPI specification:Download

Introduction

The API service exists for communication between service containers and to support external requests from the web front end or CLI tools.

The internal APIs run over unix sockets and rely on filesystem namespaces for authentication.

Currently there are four internal APIs:

Support for the wifid service accepting stations
Support for dynamic networking configuration with DHCP
Wireguard
DHCP Tiny Subnets

The external API runs over port :80 or can optionally be configured to run over SSL on port :443.

⇨ View the code

Authentication

Configuration

On the device, the following files contain credentials for access.

config/auth/auth_users.json is a JSON file with a dictionary for username, password pairs
configs/auth/auth_tokens.json is a JSON file with a list of authentication tokens
configs/auth/otp_settings.json is a JSON file with OTP user configuration.

OTP Notes

Certain privileged operations require a valid OTP JWT. The OTP code is there to provide additional security hardening.
A user can also require OTP codes for all operations.
The default period is 1 hour for the JWT and can be customized

basicAuth

The API supports Basic Authentication based on the auth_users file, using the Basic Schema.

To implement this, a client should include an "Authorization: Basic" header with the credentials formatted as base64(username:password). For a javascript example, see the frontend's Api.js.

Security Scheme Type: HTTP

HTTP Authorization Scheme: basic

bearerAuth

The API also supports Bearer Tokens, based on the auth_tokens file.

To implement this, a client should include an "Authorization: Bearer" token. See Swagger's page for more examples.

Security Scheme Type: HTTP

HTTP Authorization Scheme: bearer

OTPAuth

A valid JWT proving the OTP was validated recently via the /otp_validate endpoint

Security Scheme Type: API Key

Header parameter name: X-JWT-OTP

API Plugins

API extensions operate through a reverse proxy into a unix socket. They allow for hosting extensions to the API on the same web origin while running in a different process or container.

Extensions are configured in configs/base/api.json

This example shows the mapping of unix://state/dns/dns_block_plugin to http://APIHOST/plugins/dns/block/

{
  "Plugins" : [{
    "Name": "dns block extension",
    "URI": "dns/block",
    "UnixPath": "/state/dns/dns_block_plugin"
  }]
}

See the API documentation for plugins here

Devices

Manage Device Wifi Authentication and Network Access

Get Devices

Returns a map of registered devices, indexed by MAC address

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/devices"

Response samples

200

Content type

application/json

{"11:22:33:44:55:61": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
},
"11:22:33:44:55:62": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}
}

Sync Devices

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Map of devices to sync, indexed by MAC address

additional property

object (DeviceEntry)

Name	string Client Name
MAC	string HW address
WGPubKey	string PubKey
VLANTag	string VLANTag
RecentIP	string RecentIP
	object (PSKEntry)
Policies	Array of strings Policies for Device
Groups	Array of strings Interconnected Groups of Devices
DeviceTags	Array of strings Tags for Device

Responses

Request samples

Payload
CLI

Content type

application/json

{"11:22:33:44:55:61": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
},
"11:22:33:44:55:62": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}
}

Delete Devices

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Array of device identities to delete

Array

string

Responses

Request samples

Payload
CLI

Content type

application/json

["11:22:33:44:55:66"
]

Response samples

200

Content type

application/json

{"deleted": ["11:22:33:44:55:66"
],
"count": 1
}

Get Device including PSK

Get a Device specified by the MAC address in the identity parameter. Requires OTP Code

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

path Parameters

identity

required

string

Example: 11:22:33:44:55:61

MAC address

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE -H "X-JWT-OTP:..." \
  "http://192.168.2.1/device?identity=11:22:33:44:55:66"

Response samples

200

Content type

application/json

{"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}

Update Device

Update information specified by the MAC address in the identity parameter. All fields are optional. If a PSKEntry.PskType is set and a PSKEntry.Psk is not set, one will be generated and returned. To create a wildcard PSK for adding a new device, use the string "pending" for the identity.

Authorizations:

basicAuthbearerAuth

path Parameters

identity

required

string

Example: 11:22:33:44:55:61

MAC address

Request Body schema: application/json
required

Device object

Name	string Client Name
MAC	string HW address
WGPubKey	string PubKey
VLANTag	string VLANTag
RecentIP	string RecentIP
	object (PSKEntry)
Policies	Array of strings Policies for Device
Groups	Array of strings Interconnected Groups of Devices
DeviceTags	Array of strings Tags for Device

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}

Response samples

200

Content type

application/json

{"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}

Delete Device

Delete a Device specified by the MAC address in the identity parameter

Authorizations:

basicAuthbearerAuth

path Parameters

identity

required

string

Example: 11:22:33:44:55:61

MAC address

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/device?identity=11:22:33:44:55:66"

Bulk Update Devices

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Identities plus groups/tags/policies to add

Identities	Array of strings Device identities to update (MAC address or WireGuard public key)
Groups	Array of strings Groups to add to each device
Tags	Array of strings Tags to add to each device
Policies	Array of strings Policies to add to each device (must be bulk-settable)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Identities": ["11:22:33:44:55:66"
],
"Groups": ["dns",
"wan"
],
"Tags": ["lab"
],
"Policies": ["lan"
]
}

Response samples

200

Content type

application/json

{"updated": ["11:22:33:44:55:66"
],
"count": 1
}

Groups

Groups are used to manage device connectivity and firewall rules

Get all Groups

Return all available groups

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/groups"

Response samples

200

Content type

application/json

[{"Name": "vpn",
"Disabled": false,
"GroupTags": [["private"
]
]
}
]

Add Group

If the group does not exist, it will be created. If it exists it will be updated. Fields are optional.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Group object

Name	string Unique Group Name
Disabled	boolean If Group is disabled
GroupTags	Array of strings Tags for Group

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "vpn",
"Disabled": false,
"GroupTags": [["private"
]
]
}

Delete Group

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Group object

Name	string Unique Group Name
Disabled	boolean If Group is disabled
GroupTags	Array of strings Tags for Group

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "vpn",
"Disabled": false,
"GroupTags": [["private"
]
]
}

Network Information

Operations about Network, NFTable, IP Address information

IP Address Information

Returns the output of ip -j addr

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/ip/addr"

Response samples

200

Content type

application/json

[{"ifindex": 1,
"ifname": "eth0",
"flags": ["BROADCAST"
],
"mtu": 1550,
"qdisc": "mq",
"operstate": "UP",
"group": "default",
"txqlen": 1000,
"link_type": "ether",
"address": "11:22:33:44:55:66",
"broadcast": "ff:ff:ff:ff:ff:ff",
"addr_info": [{"family": "inet6",
"local": "::1",
"prefixlen": 64,
"scope": "link",
"valid_life_time": 4294967295,
"preferred_life_time": "preferred_life_time"
}
]
}
]

Set Link State

Set ip link status up or down

Authorizations:

basicAuthbearerAuth

path Parameters

interface required	string Interface name
state required	string/^(up\|down)$/ Set interface to up or down

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/ip/link/wlan0/up"

NFTable Verdict Map

Returns the output of nft -j for the verdict map specificed by the name parameter

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Name of the nfmap to fetch

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/nfmap/dns_access"

Response samples

200

Content type

application/json

{ }

ARP Table

Returns the ARP table

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/arp"

Response samples

200

Content type

application/json

[{"IP": "192.168.2.142",
"HWType": "0x1",
"Flags": "0x6",
"MAC": "11:22:33:44:55:66",
"Mask": "*",
"Device": "wlan1.4097"
}
]

Wifi Interfaces

Returns the output of iw list in json format

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/iw/list"

Response samples

200

Content type

application/json

[{ }
]

Wifi Devices

Returns the output of iw dev in json format

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/iw/dev"

Response samples

200

Content type

application/json

{ }

Get Nearby Wifi Networks

Returns the output of iw dev iface scan in json format.

Note: the specified interface needs to be in managed mode.

Authorizations:

basicAuthbearerAuth

path Parameters

iface

required

string

Example: wlan0

interface

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/iw/dev/wlan0/scan"

Response samples

200

Content type

application/json

[{"bssid": "11:11:11:11:11:11",
"interface": "wlan0",
"freq": 2412,
"ssid": "sample_ssid1",
"authentication_suites": "PSK",
"signal_dbm": -64
}
]

Get Subnet Configuration

Retrieves the current subnet configuration.

Authorizations:

basicAuthbearerAuth

Responses

Response samples

200

Content type

application/json

{"TinyNets": ["string"
],
"LeaseTime": "string"
}

Set Subnet Configuration

Sets or updates the subnet configuration. This will overwrite the existing configuration.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

TinyNets required	Array of strings List of subnet pools.
LeaseTime required	string Duration of the DHCP lease time.

Responses

Request samples

Payload
CLI

Content type

application/json

{"TinyNets": ["string"
],
"LeaseTime": "string"
}

Get DNS Settings

Retrieves the current DNS settings.

Authorizations:

basicAuthbearerAuth

Responses

Response samples

200

Content type

application/json

{"UpstreamTLSHost": "string",
"UpstreamIPAddress": "string",
"TlsDisable": true
}

Update DNS Settings

Updates the DNS settings. This operation overwrites the existing settings.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

UpstreamTLSHost required	string DNS name of the upstream TLS host.
UpstreamIPAddress required	string IP address of the upstream DNS server.
TlsDisable required	boolean Flag to disable TLS.

Responses

Request samples

Payload
CLI

Content type

application/json

{"UpstreamTLSHost": "string",
"UpstreamIPAddress": "string",
"TlsDisable": true
}

Perform an ICMP ping test

Performs an ICMP ping test from a specified interface to a given address

path Parameters

interface required	string Network interface to use for the ping test
address required	string IP address to ping

Responses

Request samples

CLI

curl -X PUT http://localhost/ping/eth0/8.8.8.8

Response samples

200

Content type

application/json

["10.523ms",
"9.872ms",
"11.245ms",
"10.101ms"
]

Perform a UDP ping test

Performs a UDP ping test from a specified interface to a given address

path Parameters

interface required	string Network interface to use for the UDP ping test
address required	string IP address and port to ping

Responses

Request samples

CLI

curl -X PUT http://localhost/ping/eth0/8.8.8.8:53/udp

Response samples

200

Content type

application/json

["15.789ms",
"14.234ms",
"16.012ms",
"15.456ms"
]

Get Topology

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/topology"

Response samples

200

Content type

application/json

{"GeneratedAt": "2024-03-14T10:12:00Z",
"Nodes": [{"ID": "dev:11:22:33:44:55:66",
"Kind": "device",
"Name": "laptop",
"MAC": "11:22:33:44:55:66",
"IP": "192.168.2.20",
"TinyNet": "192.168.2.20/30",
"VLANTag": "10",
"ConnType": "wifi",
"Iface": "wlan0",
"SSID": "SPR",
"Radio": {"Channel": 36,
"Freq": 5180,
"Modes": ["ac",
"ax"
],
"Stations": 3
},
"Groups": ["dns",
"wan"
],
"Policies": ["lan"
],
"Tags": ["lab"
],
"Signal": {"RSSI": -55,
"TxRate": 866,
"RxRate": 866,
"Caps": ["VHT",
"HE"
]
},
"Online": true,
"Isolated": false,
"Style": { },
"DHCPFirstTime": "2024-03-13T23:43:39Z",
"DHCPLastTime": "2024-03-14T10:12:00Z"
}
],
"Edges": [{"From": "dev:11:22:33:44:55:66",
"To": "iface:wlan0",
"Layer": "l1",
"Kind": "wifi",
"Metric": -55,
"Bidir": true
}
],
"Sinks": [{"ID": "plugin:mesh:sink:tailscale",
"Name": "tailscale",
"Iface": "tailscale0",
"IP": "100.64.0.1",
"Online": true
}
]
}

List nftables tables

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/nftables

Response samples

200

Content type

application/json

{ }

Show an nftables table

Authorizations:

basicAuthbearerAuth

path Parameters

family required	string Example: inet nftables address family (e.g. ip, ip6, inet)
name required	string Example: filter nftables table name

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/nftable/inet/filter

Firewall

Operations for forwarding rules and blocking

Retrieve firewall config

Returns the firewall API configuration

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/firewall/config"

Response samples

200

Content type

application/json

{"ForwardingRules": [{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"SrcPort": "0-10",
"DstPort": "any",
"Protocol": "tcp"
}
],
"BlockRules": [{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"Protocol": "tcp"
}
],
"ForwardingBlockRules": [{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"DstPort": "0-65535",
"Protocol": "tcp"
}
],
"ServicePorts": [{"UpstreamEnabled": false,
"Port": "22",
"Protocol": "tcp"
}
]
}

Add a Forwarding Rule

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Use 'any' for the port to forward all ports. Specify a port or a port range otherwise

DstIP	string
SrcIP	string
SrcPort	string/any\|[0-9]+/
DstPort	string/any\|[0-9]+/
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"SrcPort": "0-10",
"DstPort": "any",
"Protocol": "tcp"
}

Delete a Forwarding Rule

Delete forwarding rule with matching contents

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Use 'any' for the port to forward all ports. Specify a port or a port range otherwise

DstIP	string
SrcIP	string
SrcPort	string/any\|[0-9]+/
DstPort	string/any\|[0-9]+/
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"SrcPort": "0-10",
"DstPort": "any",
"Protocol": "tcp"
}

Add IP Block

Add IP Block Rule

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlock

DstIP	string
SrcIP	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"Protocol": "tcp"
}

Delete IP Block

Delete blocking rule with matching contents

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlock

DstIP	string
SrcIP	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"Protocol": "tcp"
}

Add Forward Block

Add Forward Block Rule, to block outbound traffic

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlockForward

DstIP	string
SrcIP	string
DstPort	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"DstPort": "0-65535",
"Protocol": "tcp"
}

Delete Forward Block

Delete blocking rule with matching contents

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlockForward

DstIP	string
SrcIP	string
DstPort	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"DstPort": "0-65535",
"Protocol": "tcp"
}

Allow Service Port Access

Service Ports are ports that run on the SPR router itself. They can be for LAN clients only or for upstream also

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

ServicePort

UpstreamEnabled	boolean Reachable from WAN/Upstream Interface
Port	string
Protocol	string/tcp/ Only TCP services are currently supported

Responses

Request samples

Payload
CLI

Content type

application/json

{"UpstreamEnabled": false,
"Port": "22",
"Protocol": "tcp"
}

Delete Service Port Access

Delete service port from allow list

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

ServicePort

UpstreamEnabled	boolean Reachable from WAN/Upstream Interface
Port	string
Protocol	string/tcp/ Only TCP services are currently supported

Responses

Request samples

Payload
CLI

Content type

application/json

{"UpstreamEnabled": false,
"Port": "22",
"Protocol": "tcp"
}

Add Firewall Endpoint

Endpoints store common destinations for the UI to populate fields with

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

RuleName	string
Disabled	boolean
Protocol	string
IP	string
Domain	string
Port	string
Tags	Array of strings Tags for Device

Responses

Request samples

Payload
CLI

Content type

application/json

{"RuleName": "string",
"Disabled": true,
"Protocol": "string",
"IP": "1.2.3.4",
"Domain": "www.domain.com",
"Port": "22",
"Tags": ["private"
]
}

Delete Firewall Endpoint

Delete an existing endpoint from the firewall configuration.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

RuleName	string
Disabled	boolean
Protocol	string
IP	string
Domain	string
Port	string
Tags	Array of strings Tags for Device

Responses

Request samples

Payload
CLI

Content type

application/json

{"RuleName": "string",
"Disabled": true,
"Protocol": "string",
"IP": "1.2.3.4",
"Domain": "www.domain.com",
"Port": "22",
"Tags": ["private"
]
}

Enable Multicast Port (UDP over a multicast IP/ethernet address)

Configures a multicast port in the firewall.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Upstream	boolean Reachable from Uplinks
Port	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"Upstream": true,
"Port": "22"
}

Disable Multicast Port

Removes a multicast port configuration from the firewall.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Upstream	boolean Reachable from Uplinks
Port	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"Upstream": true,
"Port": "22"
}

Add Custom Interface Rule to join an interface to the network

Adds a custom interface rule to the firewall.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Interface	string interface name
SrcIP	string IP or CIDR assigned to interface
RouteDst	string IP destination to route to, for example container host IP
Policies	Array of strings Policies for Interface
Groups	Array of strings Groups to join Interfaces to Devices
Tags	Array of strings Tags to apply. NOTE, no impact for now

Responses

Request samples

Payload
CLI

Content type

application/json

{"Interface": "wlan1",
"SrcIP": "172.16.0.0/16",
"RouteDst": "172.12.0.2",
"Policies": ["api",
"wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras"
],
"Tags": ["private"
]
}

Remove Custom Interface Rule

Removes a custom interface rule from the firewall.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Interface	string interface name
SrcIP	string IP or CIDR assigned to interface
RouteDst	string IP destination to route to, for example container host IP
Policies	Array of strings Policies for Interface
Groups	Array of strings Groups to join Interfaces to Devices
Tags	Array of strings Tags to apply. NOTE, no impact for now

Responses

Request samples

Payload
CLI

Content type

application/json

{"Interface": "wlan1",
"SrcIP": "172.16.0.0/16",
"RouteDst": "172.12.0.2",
"Policies": ["api",
"wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras"
],
"Tags": ["private"
]
}

Configure ICMP Options

Configures ICMP options in the firewall.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

PingLan required	boolean Allow ping from LAN
PingWan required	boolean Allow ping from WAN/upstream

Responses

Request samples

Payload
CLI

Content type

application/json

{"PingLan": true,
"PingWan": false
}

Get multicast settings

Retrieves the current multicast settings

Responses

Request samples

CLI

curl http://localhost/multicastSettings

Response samples

200

Content type

application/json

{"Disabled": false,
"Addresses": [{"Address": "224.0.0.251:5353"
}
],
"DisableMDNSAdvertise": false,
"MDNSName": "MyDevice"
}

Update multicast settings

Updates the multicast settings

Request Body schema: application/json
required

Disabled	boolean Whether multicast is disabled
	Array of objects (MulticastAddress) List of multicast addresses
DisableMDNSAdvertise	boolean Whether MDNS advertisement is disabled
MDNSName	string MDNS name

Responses

Request samples

Payload
CLI

Content type

application/json

{"Disabled": false,
"Addresses": [{"Address": "224.0.0.251:5353"
}
],
"DisableMDNSAdvertise": false,
"MDNSName": "MyDevice"
}

Response samples

200

Content type

application/json

{"Disabled": false,
"Addresses": [{"Address": "224.0.0.251:5353"
}
],
"DisableMDNSAdvertise": false,
"MDNSName": "MyDevice"
}

Get Geo/ASN Block Config

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X GET \
  "http://192.168.2.1/firewall/geo_block/config"

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Update Geo/ASN Block Config

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

GeoBlockConfig

Enabled	boolean Master enable for geo/ASN blocking
DenyCountries	Array of strings Two-letter ISO country codes to block
	Array of objects (GeoASN) Autonomous Systems to block
	Array of objects (GeoBlockList) External block lists to fetch
RefreshSeconds	integer Refresh interval in seconds (minimum 3600, defaults to 86400)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Get Geo/ASN Block Status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X GET \
  "http://192.168.2.1/firewall/geo_block/status"

Response samples

200

Content type

application/json

{"Enabled": true,
"LastRefresh": "2026-07-09T12:00:00Z",
"RangesProgrammed": 1024,
"Sources": [{"Type": "asn",
"Key": "AS13335",
"Ranges": 42,
"ASNs": 3,
"LastFetch": "2026-07-09T12:00:00Z",
"Error": ""
}
]
}

Refresh Geo/ASN Block Ranges

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/firewall/geo_block/refresh"

Response samples

200

Content type

application/json

{"Enabled": true,
"LastRefresh": "2026-07-09T12:00:00Z",
"RangesProgrammed": 1024,
"Sources": [{"Type": "asn",
"Key": "AS13335",
"Ranges": 42,
"ASNs": 3,
"LastFetch": "2026-07-09T12:00:00Z",
"Error": ""
}
]
}

Add Blocked ASN

Authorizations:

basicAuthbearerAuth

path Parameters

asn

required

integer

Example: 13335

Autonomous System Number to block

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/firewall/geo_block/asn/13335"

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Delete Blocked ASN

Authorizations:

basicAuthbearerAuth

path Parameters

asn

required

integer

Example: 13335

Autonomous System Number to unblock

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/firewall/geo_block/asn/13335"

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Add Blocked Country

Authorizations:

basicAuthbearerAuth

path Parameters

cc

required

string

Example: CN

Two-letter ISO 3166-1 alpha-2 country code

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/firewall/geo_block/country/CN"

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Delete Blocked Country

Authorizations:

basicAuthbearerAuth

path Parameters

cc

required

string

Example: CN

Two-letter ISO 3166-1 alpha-2 country code

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/firewall/geo_block/country/CN"

Response samples

200

Content type

application/json

{"Enabled": true,
"DenyCountries": ["CN"
],
"DenyASNs": [{"ASN": 13335,
"Name": "CLOUDFLARENET"
}
],
"Lists": [{"URI": "https://www.spamhaus.org/drop/asndrop.json",
"Enabled": false,
"Note": "Spamhaus ASN-DROP"
}
],
"RefreshSeconds": 86400
}

Add Output Block

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlockOutput

DstIP	string
SrcIP	string
DstPort	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"DstPort": "0-65535",
"Protocol": "tcp"
}

Delete Output Block

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

FirewallBlockOutput

DstIP	string
SrcIP	string
DstPort	string
Protocol	string/udp\|tcp/

Responses

Request samples

Payload
CLI

Content type

application/json

{"DstIP": "1.2.3.4",
"SrcIP": "0.0.0.0/24",
"DstPort": "0-65535",
"Protocol": "tcp"
}

Get TLS Status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X GET \
  "http://192.168.2.1/firewall/enableTLS"

Response samples

200

Content type

application/json

true

Enable TLS

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/firewall/enableTLS"

Response samples

200

Content type

application/json

"Done"

Disable TLS

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/firewall/enableTLS"

Response samples

200

Content type

application/json

"Done"

Set System DNS Override

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

SystemDnsOverride

string (SystemDnsOverride)

System DNS override upstream IP, empty string to clear

Responses

Request samples

Payload
CLI

Content type

application/json

"8.8.8.8"

Network Traffic

Device traffic information

Retrieve IP traffic

Returns IP traffic information

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/iptraffic"

Response samples

200

Content type

application/json

[{"Interface": "wlan1",
"Src": "192.168.2.100",
"Dst": "192.168.2.102",
"Packets": 1024,
"Bytes": 4096
}
]

Retrieve traffic for LAN/WAN

Returns traffic information from the counter specified by the name parameter. Countermap can be one of incoming_traffic_lan | outgoing_traffic_lan | outgoing_traffic_wan | incoming_traffic_wan. See the accounting.sh NFT rules for additional information

Authorizations:

basicAuthbearerAuth

path Parameters

countermap

required

string

Example: incoming_traffic_lan

Name of counter

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/traffic/outgoing_traffic_lan"

Response samples

200

Content type

application/json

[{"IP": "192.168.2.1",
"Packets": 7544,
"Bytes": 824606
}
]

Retrieve historical traffic data for devices

Returns traffic information for all devices

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/traffic_history"

Response samples

200

Content type

application/json

{"192.168.2.11": {"LanIn": 11125256532,
"LanOut": 292437928,
"WanIn": 52664,
"WanOut": 52664
},
"192.168.2.12": {"LanIn": 11125256532,
"LanOut": 292437928,
"WanIn": 52664,
"WanOut": 52664
}
}

Get Traffic Insights Configuration

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/traffic_insights/config"

Response samples

200

Content type

application/json

{"Enabled": true,
"RetentionDays": 7
}

Update Traffic Insights Configuration

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Traffic insights configuration object

Enabled	boolean Whether traffic insights collection is enabled
RetentionDays	integer Number of days of hourly buckets to retain (1-90)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Enabled": true,
"RetentionDays": 7
}

Response samples

200

Content type

application/json

{"Enabled": true,
"RetentionDays": 7
}

Get Traffic Insights Overview

Authorizations:

basicAuthbearerAuth

query Parameters

minutes

integer

Example: minutes=1440

Length of the lookback window in minutes (defaults to 1440)

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/traffic_insights/overview?minutes=1440"

Response samples

200

Content type

application/json

{"Start": "2026-07-08T00:00:00Z",
"End": "2026-07-09T00:00:00Z",
"TotalIn": 8388608,
"TotalOut": 4194304,
"Countries": [{"Country": "US",
"BytesIn": 4194304,
"BytesOut": 2097152,
"Devices": [{"IP": "192.168.2.20",
"BytesIn": 1048576,
"BytesOut": 524288
}
],
"ASNs": [{"ASN": 15169,
"Name": "GOOGLE",
"Country": "US",
"BytesIn": 2097152,
"BytesOut": 1048576,
"Devices": [{"IP": "192.168.2.20",
"BytesIn": 1048576,
"BytesOut": 524288
}
]
}
]
}
],
"ASNs": [{"ASN": 15169,
"Name": "GOOGLE",
"Country": "US",
"BytesIn": 2097152,
"BytesOut": 1048576,
"Devices": [{"IP": "192.168.2.20",
"BytesIn": 1048576,
"BytesOut": 524288
}
]
}
],
"ContainerNets": ["172.17.0.0/16"
]
}

Get Traffic Insights for a Device

Authorizations:

basicAuthbearerAuth

path Parameters

ip

required

string

Example: 192.168.2.20

IP address of the local device to report on

query Parameters

minutes

integer

Example: minutes=1440

Length of the lookback window in minutes (defaults to 1440)

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/traffic_insights/device/192.168.2.20?minutes=1440"

Response samples

200

Content type

application/json

{"IP": "192.168.2.20",
"BytesIn": 1048576,
"BytesOut": 524288,
"Destinations": [{"IP": "142.250.72.14",
"Domain": "www.google.com",
"ASN": 15169,
"ASNName": "GOOGLE",
"Country": "US",
"BytesIn": 65536,
"BytesOut": 32768,
"LastSeen": "2026-07-09T11:30:00Z"
}
]
}

PSK

Manage Device Passphrases

Reload PSK files

Tells Hostapd to reload PSK files. This will not boot off connected devices. This does not need to be called after adding or removing PSK entries.

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT  \
  "http://192.168.2.1/reloadPSKFiles"

Pending PSKs

Checks if there is a pending PSK that has not been assigned to a MAC yet

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/pendingPSK"

Response samples

200

Content type

application/json

true

Hostapd

Operations about hostapd

Retrieve hostapd status

Returns current status for hostapd

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/status"

Response samples

200

Content type

application/json

{"beacon_int": "100",
"bss[0]": "wlan1",
"bssid[0]": "00:c0:ca:33:11:22",
"cac_time_left_seconds": "N/A",
"cac_time_seconds": "0",
"channel": "36",
"dtim_period": "2",
"edmg_channel": "0",
"edmg_enable": "0",
"freq": "5180",
"ht_caps_info": "01ff",
"ht_mcs_bitmask": "ffff0000000000000000",
"ht_op_mode": "0x6",
"ieee80211ac": "1",
"ieee80211ax": "0",
"ieee80211n": "1",
"max_txpower": "23",
"num_sta[0]": "6",
"num_sta_ht40_intolerant": "0",
"num_sta_ht_20_mhz": "2",
"num_sta_ht_no_gf": "6",
"num_sta_no_ht": "0",
"num_sta_no_short_preamble": "6",
"num_sta_no_short_slot_time": "6",
"num_sta_non_erp": "0",
"olbc": "0",
"olbc_ht": "0",
"phy": "phy1",
"rx_vht_mcs_map": "fffa",
"secondary_channel": "1",
"ssid[0]": "test_ap",
"state": "ENABLED",
"supported_rates": "0c 12 18 24 30 48 60 6c",
"tx_vht_mcs_map": "fffa",
"vht_caps_info": "318001b0",
"vht_oper_centr_freq_seg0_idx": "42",
"vht_oper_centr_freq_seg1_idx": "0",
"vht_oper_chwidth": "1"
}

Retrieve all_stations output

Returns current status for all stations

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/all_stations"

Response samples

200

Content type

application/json

{"11:22:33:44:55:61": {"AKMSuiteSelector": "00-0f-ac-2",
"aid": "3",
"capability": "0x11",
"connected_time": "4946",
"dot11RSNAStatsSTAAddress": "11:22:33:44:55:61",
"dot11RSNAStatsSelectedPairwiseCipher": "00-0f-ac-4",
"dot11RSNAStatsTKIPLocalMICFailures": "0",
"dot11RSNAStatsTKIPRemoteMICFailures": "0",
"dot11RSNAStatsVersion": "1",
"flags": "[AUTH][ASSOC][AUTHORIZED][WMM][HT]",
"hostapdWPAPTKGroupState": "0",
"hostapdWPAPTKState": "11",
"ht_caps_info": "0x016e",
"ht_mcs_bitmask": "ff000000000000000000",
"inactive_msec": "1584",
"listen_interval": "1",
"rx_bytes": "126055",
"rx_packets": "2394",
"rx_rate_info": "60",
"signal": "-85",
"supported_rates": "8c 12 98 24 b0 48 60 6c",
"timeout_next": "NULLFUNC POLL",
"tx_bytes": "485584",
"tx_packets": "1957",
"tx_rate_info": "1200 mcs 5 shortGI",
"vlan_id": "4247",
"wpa": "2"
},
"11:22:33:44:55:62": {"AKMSuiteSelector": "00-0f-ac-2",
"aid": "3",
"capability": "0x11",
"connected_time": "4946",
"dot11RSNAStatsSTAAddress": "11:22:33:44:55:61",
"dot11RSNAStatsSelectedPairwiseCipher": "00-0f-ac-4",
"dot11RSNAStatsTKIPLocalMICFailures": "0",
"dot11RSNAStatsTKIPRemoteMICFailures": "0",
"dot11RSNAStatsVersion": "1",
"flags": "[AUTH][ASSOC][AUTHORIZED][WMM][HT]",
"hostapdWPAPTKGroupState": "0",
"hostapdWPAPTKState": "11",
"ht_caps_info": "0x016e",
"ht_mcs_bitmask": "ff000000000000000000",
"inactive_msec": "1584",
"listen_interval": "1",
"rx_bytes": "126055",
"rx_packets": "2394",
"rx_rate_info": "60",
"signal": "-85",
"supported_rates": "8c 12 98 24 b0 48 60 6c",
"timeout_next": "NULLFUNC POLL",
"tx_bytes": "485584",
"tx_packets": "1957",
"tx_rate_info": "1200 mcs 5 shortGI",
"vlan_id": "4247",
"wpa": "2"
}
}

Retrieve hostapd config

Returns hostapd configuration

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/config"

Set hostapd config

Set hostapd configuration

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Request Body schema: application/json
required

Channel Parameters for WiFi

Country_code	string 2-letter country code
Vht_capab	string Very High Throughput capabilities for 5ghz (802.11ac). Should be removed for 2.4ghz
Ht_capab	string High Throughput capabilities (802.11n)
Hw_mode	string/^(a/b/g)$/ a for 5ghz, b/g for 2.4ghz
Ieee80211ax	integer WiFi 6 support
He_su_beamformer	integer High Efficiency (WiFi 6) Single User Beamformer enable
He_su_beamformee	integer High Efficiency (WiFi 6) Single User Beamformee enable
He_mu_beamformer	integer High Efficiency (WiFi 6) Multiple User Beamformer enable
Ssid	string WiFi SSID Name
Channel	integer See the list of WLAN channels
Vht_oper_centr_freq_seg0_idx	integer
He_oper_centr_freq_seg0_idx	integer
Vht_oper_chwidth	integer
He_oper_chwidth	integer

Responses

Request samples

Payload

Content type

application/json

{"Country_code": "US",
"Vht_capab": "[RXLDPC][SHORT-GI-80][TX-STBC-2BY1][RX-STBC-1][MAX-A-MPDU-LEN-EXP3][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN]",
"Ht_capab": "[LDPC][HT40+][HT40-][GF][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1]",
"Hw_mode": "a",
"Ieee80211ax": 1,
"He_su_beamformer": 1,
"He_su_beamformee": 1,
"He_mu_beamformer": 1,
"Ssid": "8hzWANip",
"Channel": 36,
"Vht_oper_centr_freq_seg0_idx": 42,
"He_oper_centr_freq_seg0_idx": 42,
"Vht_oper_chwidth": 1,
"He_oper_chwidth": 1
}

Set WiFi Channel

Sets channel configuration

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Request Body schema: application/json
required

Channel Parameters for WiFi

Mode	string/^(a\|b\|g)$/ g for 2.4Ghz, a for 5Ghz
Channel	integer See the list of WLAN channels
Bandwidth	integer Channel width in Mhz. One of 20, 40, 80, 160, or 8080 for 80+80
HT_Enable	boolean 802.11n support - High Throughput
VHT_Enable	boolean 802.11ac support - Very High Throughput (WiFi 5)
HE_Enable	boolean 802.11ax support - High Effiency (WiFi 6)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Mode": "a",
"Channel": 36,
"Bandwidth": 80,
"HT_Enable": true,
"VHT_Enable": true,
"HE_Enable": true
}

Response samples

200

Content type

application/json

{"Vht_oper_centr_freq_seg0_idx": 42,
"He_oper_centr_freq_seg0_idx": 42,
"Vht_oper_chwidth": 1,
"He_oper_chwidth": 1
}

Enable Wireless Interface

Enables a wireless interface, creating an configuration if needed, and starting hostapd

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Disable Wireless Interface

Disables a wireless interface, and restarts hostapd

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Reset Wireless Interface Configuration

Resets HostAP Configuration to the Default Template

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Restart WiFI Service

Restarts all hostapd instances

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/config"

Enable Additional BSS on Interface

Enables an additional BSS (Basic Service Set) on the specified interface. This supports WPA1, and disabled isolation. Requires card support

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of the network interface.

Request Body schema: application/json

Ssid	string
Bssid	string
Wpa	string
WpaKeyMgmt	string
DisableIsolation	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"Ssid": "string",
"Bssid": "string",
"Wpa": "string",
"WpaKeyMgmt": "string",
"DisableIsolation": true
}

Disable Extra BSS on Interface

Disables an additional BSS on the specified interface.

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of the network interface.

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/hostapd/eth0/enableExtraBSS"

Retrieve interface configuration

SPR Tracks the state of interfaces to decide launching hostap

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/interfacesConfiguration"

Response samples

200

Content type

application/json

[{"Name": "wlan1",
"Type": "AP",
"Enabled": true
}
]

Get Fast-Roaming Configuration

Returns the current 802.11v fast-roaming configuration proxied from wifid

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/roaming/config"

Response samples

200

Content type

application/json

{"DryRun": true,
"PollIntervalSeconds": 15,
"ObservationDelaySeconds": 20,
"RSSIThresholdDBM": -70,
"MinimumImprovementDBM": 5,
"CooldownSeconds": 900,
"MaxTransitionsPerHour": 4,
"ExplorationRate": 0,
"AllowedInterfaces": [ ]
}

Update Fast-Roaming Configuration

Validates and stores the 802.11v fast-roaming configuration

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Fast-roaming configuration to store

DryRun	boolean When true, recommend transitions without sending them
PollIntervalSeconds	integer Seconds between topology polls (5-300)
ObservationDelaySeconds	integer Seconds to wait before observing a transition outcome (5-180)
RSSIThresholdDBM	integer Only roam stations weaker than this RSSI in dBm (-100 to -30)
MinimumImprovementDBM	integer Minimum expected RSSI improvement in dBm to act (0-40)
CooldownSeconds	integer Per-station cooldown between transitions in seconds (30-86400)
MaxTransitionsPerHour	integer Maximum live transitions per hour across the router (1-100)
ExplorationRate	number <float> Probability of exploring a random candidate (0-1)
AllowedInterfaces	Array of strings Interfaces eligible as transition targets; empty means all

Responses

Request samples

Payload
CLI

Content type

application/json

{"DryRun": true,
"PollIntervalSeconds": 15,
"ObservationDelaySeconds": 20,
"RSSIThresholdDBM": -70,
"MinimumImprovementDBM": 5,
"CooldownSeconds": 900,
"MaxTransitionsPerHour": 4,
"ExplorationRate": 0,
"AllowedInterfaces": [ ]
}

Response samples

200

Content type

application/json

{"DryRun": true,
"PollIntervalSeconds": 15,
"ObservationDelaySeconds": 20,
"RSSIThresholdDBM": -70,
"MinimumImprovementDBM": 5,
"CooldownSeconds": 900,
"MaxTransitionsPerHour": 4,
"ExplorationRate": 0,
"AllowedInterfaces": [ ]
}

Get Fast-Roaming Status

Returns runtime status counters for the fast-roaming manager

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/roaming/status"

Response samples

200

Content type

application/json

{"RoamingEnabled": true,
"Config": {"DryRun": true,
"PollIntervalSeconds": 15,
"ObservationDelaySeconds": 20,
"RSSIThresholdDBM": -70,
"MinimumImprovementDBM": 5,
"CooldownSeconds": 900,
"MaxTransitionsPerHour": 4,
"ExplorationRate": 0,
"AllowedInterfaces": [ ]
},
"HistoryCount": 12,
"ModelArms": 8,
"TransitionsActive": 0
}

Get Fast-Roaming History

Returns recorded BSS transition attempts, newest first

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/roaming/history"

Response samples

200

Content type

application/json

[{"ID": "1718000000000000000-1",
"RequestedAt": "2026-07-09T12:00:00Z",
"ObservedAt": "2026-07-09T12:00:20Z",
"Origin": "auto",
"MAC": "11:22:33:44:55:66",
"SourceInterface": "wlan0",
"TargetInterface": "wlan1",
"SourceRSSI": -75,
"PostRSSI": -55,
"PostInterface": "wlan1",
"DryRun": false,
"State": "succeeded",
"Reward": 45,
"HostapdResponse": "OK",
"Error": ""
}
]

Get Fast-Roaming Model

Returns the learned bandit model, keyed by device/interface/RSSI bucket

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/roaming/model"

Response samples

200

Content type

application/json

{"property1": {"Count": 3,
"Value": 42.5,
"LastReward": 45,
"UpdatedAt": "2026-07-09T12:00:20Z"
},
"property2": {"Count": 3,
"Value": 42.5,
"LastReward": 45,
"UpdatedAt": "2026-07-09T12:00:20Z"
}
}

Calculate Channel Parameters

Computes center frequencies and channel widths without applying them

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Channel Parameters for WiFi

Mode	string/^(a\|b\|g)$/ g for 2.4Ghz, a for 5Ghz
Channel	integer See the list of WLAN channels
Bandwidth	integer Channel width in Mhz. One of 20, 40, 80, 160, or 8080 for 80+80
HT_Enable	boolean 802.11n support - High Throughput
VHT_Enable	boolean 802.11ac support - Very High Throughput (WiFi 5)
HE_Enable	boolean 802.11ax support - High Effiency (WiFi 6)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Mode": "a",
"Channel": 36,
"Bandwidth": 80,
"HT_Enable": true,
"VHT_Enable": true,
"HE_Enable": true
}

Response samples

200

Content type

application/json

{"Vht_oper_centr_freq_seg0_idx": 42,
"He_oper_centr_freq_seg0_idx": 42,
"Vht_oper_chwidth": 1,
"He_oper_chwidth": 1
}

Sync Mesh Devices

Triggers the mesh plugin to synchronize device PSK state

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/hostapd/syncMesh"

Restart Setup WiFi Service

Restarts the wifid-setup service used during initial provisioning

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/hostapd/restart_setup"

Request BSS Transition

Sends an advisory 802.11v BSS transition for a station toward a target interface

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of the source wireless interface

Request Body schema: application/json
required

BSS transition target for a station

MAC	string Station MAC address to steer
TargetInterface	string Interface to steer the station toward

Responses

Request samples

Payload
CLI

Content type

application/json

{"MAC": "11:22:33:44:55:66",
"TargetInterface": "wlan1"
}

Deauthenticate Station

Disassociates and deauthenticates a station from the interface

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Request Body schema: application/json
required

JSON string containing the station MAC to deauthenticate

string

Station MAC address

Responses

Request samples

Payload
CLI

Content type

application/json

"11:22:33:44:55:66"

Get Failsafe Status

Reports whether the interface is running in failsafe mode

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Name of wireless interface

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/hostapd/wlan0/failsafe"

Response samples

200

Content type

application/json

"ok"

Uplink

Configure outbound interfaces

Get WPA Supplicant Configuration

Retrieves the current WPA supplicant configuration.

Authorizations:

basicAuthbearerAuth

Responses

Response samples

200

Content type

application/json

{"WPAs": [{"Iface": "string",
"Enabled": true,
"Networks": [{"Disabled": true,
"Password": "string",
"SSID": "string",
"KeyMgmt": "string",
"Priority": "string",
"BSSID": "string"
}
]
}
]
}

Update or Add WPA Supplicant Interface Configuration

Updates an existing WPA interface configuration or adds a new one.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Iface	string
Enabled	boolean
	Array of objects (WPANetwork)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Iface": "string",
"Enabled": true,
"Networks": [{"Disabled": true,
"Password": "string",
"SSID": "string",
"KeyMgmt": "string",
"Priority": "string",
"BSSID": "string"
}
]
}

Get PPP Configuration

Retrieves the current PPP configuration.

Authorizations:

basicAuthbearerAuth

Responses

Response samples

200

Content type

application/json

{"PPPs": [{"Iface": "string",
"PPPIface": "string",
"Enabled": true,
"Username": "string",
"Secret": "string",
"VLAN": "string",
"MTU": "string"
}
]
}

Update or Add PPP Interface Configuration

Updates an existing PPP interface configuration or adds a new one.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Iface	string
PPPIface	string
Enabled	boolean
Username	string
Secret	string
VLAN	string or null
MTU	string or null

Responses

Request samples

Payload
CLI

Content type

application/json

{"Iface": "string",
"PPPIface": "string",
"Enabled": true,
"Username": "string",
"Secret": "string",
"VLAN": "string",
"MTU": "string"
}

Update Interface IP Configuration for an existing interface

Updates the IP configuration of a network interface.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Name	string
Enabled	boolean
DisableDHCP	boolean or null
IP	string or null
Router	string or null
VLAN	string or null

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "string",
"Enabled": true,
"DisableDHCP": true,
"IP": "string",
"Router": "string",
"VLAN": "string"
}

Link

Configure LAN interfaces

Update Link Configuration

Updates the configuration of a LAN network interface.

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Name	string Interface name on system
Type	string Enum: "AP" "Uplink" "Downlink" "Other"
Subtype	string
Enabled	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "string",
"Type": "AP",
"Subtype": "string",
"Enabled": true
}

Update VLAN Trunk State on Interface

Set an interface as a VLAN trunk, enabling or disabling it.

Authorizations:

basicAuthbearerAuth

path Parameters

interface required	string Name of the network interface.
state required	string Enum: "enable" "disable" State of the VLAN trunk on the interface (enable or disable).

Responses

Request samples

CLI

# Example to enable VLAN trunk on eth0
curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/link/vlan/eth0/enable"
# Example to disable VLAN trunk on eth0
curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/link/vlan/eth0/disable"

Update LAN Link IP

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Interface IP configuration to apply

Name	string Interface name on system
Type	string Interface type
Enabled	boolean Whether the interface is enabled
IP	string Primary IP or CIDR for the interface
Router	string Gateway IP for the interface
VLAN	string VLAN tag for the interface
	Array of objects (AdditionalIP) Additional IPs bound to the interface

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "eth1",
"Type": "Downlink",
"Enabled": true,
"IP": "192.168.2.1/24",
"Router": "192.168.2.1",
"VLAN": "10",
"AdditionalIPs": [{"IP": "192.168.5.1/24",
"Router": "192.168.5.1"
}
]
}

Misc

Misc information

Get Status

Returns "Online". Can be used to test authentication

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/status"

Response samples

200

Content type

application/json

"Online"

Get Features

Returns an array of features

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/status"

Response samples

200

Content type

application/json

["wifi"
]

Get Version

Get latest tag from docker specified by the container parameter. If no container is specified version is fetched for superd

Authorizations:

basicAuthbearerAuth

query Parameters

container

string

container to get version for

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/version"

Response samples

200

Content type

application/json

"0.1.23"

Test download speed to Web API

Authorizations:

basicAuthbearerAuth

Responses

Test upload speed to Web API

Authorizations:

basicAuthbearerAuth

Request Body schema: text/plain

string

Responses

Retreive System Logs

Returns the output of journalctl in json format

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/logs"

Response samples

200

Content type

application/json

[{"CONTAINER_NAME": "superapi",
"MESSAGE": "192.168.2.101:1234 GET /logs",
"__REALTIME_TIMESTAMP": 1651066188615770
}
]

Get IP to interface mappings

Retrieves the current IP to interface mappings

Responses

Request samples

CLI

curl http://localhost/ip/interfaces

Response samples

200

Content type

application/json

{"192.168.1.1": "eth0",
"10.0.0.1": "wlan0"
}

Get Authorized CA Certificate

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/cert/authorized"

List configuration backups

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/backup

Response samples

200

Content type

application/json

[{"Name": "spr-configs-v0.3.5.tgz",
"Timestamp": "2026-07-09T12:00:00Z"
}
]

Create a configuration backup

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/backup

Response samples

200

Content type

application/json

"spr-configs-v0.3.5.tgz"

Download a configuration backup

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

path Parameters

name

required

string

Example: spr-configs-v0.3.5.tgz

Backup archive filename

Responses

Request samples

cURL

curl -u "admin:pass" -OJ http://192.168.2.1/backup/spr-configs-v0.3.5.tgz

Delete a configuration backup

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

path Parameters

name

required

string

Example: spr-configs-v0.3.5.tgz

Backup archive filename

Responses

Request samples

cURL

curl -u "admin:pass" -X DELETE http://192.168.2.1/backup/spr-configs-v0.3.5.tgz

Get SSH authorized keys

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/authorizedKeys

Response samples

200

Content type

application/json

["ssh-ed25519 AAAAC3Nza... user@host"
]

Set SSH authorized keys

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Full list of SSH authorized keys to store

Array

string

Responses

Request samples

Payload
cURL

Content type

application/json

["ssh-ed25519 AAAAC3Nza... user@host"
]

Get current server time

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/time

Response samples

200

Content type

application/json

{"unix": 1752048000
}

Sync system time

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/time/sync

Get system information

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: uptime

Info field to retrieve (uptime, dockernetworks, docker, hostname, ss)

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/info/uptime

Response samples

200

Content type

application/json

{ }

Set system information

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: hostname

Info field to set (currently only hostname is supported)

Request Body schema: application/json

New value for the named system info field (currently hostname)

string

Responses

Request samples

Payload
cURL

Content type

application/json

"my-router"

Get docker container status

Authorizations:

basicAuthbearerAuth

query Parameters

service	string Example: service=mesh Service name to inspect
compose_file	string Example: compose_file=/configs/plugins/mesh/docker-compose.yml Compose file path to inspect

Responses

Request samples

cURL

curl -u "admin:pass" "http://192.168.2.1/dockerPS?service=mesh"

Response samples

200

Content type

application/json

"CONTAINER ID IMAGE STATUS"

Restart all containers

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/restart

Releases

Manage SPR Release Channel and Version

Get release settings

Returns an object with the current SPR version and Channel, Version settings

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/release"

Response samples

200

Content type

application/json

{"CustomChannel": "-dev",
"CustomVersion": "0.1.2",
"Current": "0.1.2-dev"
}

Set release settings

Set a custom Channel, Version to update into

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

CustomChannel	string
CustomVersion	string
Current	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"CustomChannel": "-dev",
"CustomVersion": "0.1.3"
}

Reset release settings

Clear out custom release and channel

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/release"

Get Release Channels

Get configured release channels

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/releaseChannels"

Response samples

200

Content type

application/json

["main",
"-dev"
]

Get releases available

Returns a list of tags available to update into

Authorizations:

basicAuthbearerAuth

query Parameters

container

required

string

Example: container=super_superd

Container name

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/releaseChannels"

Response samples

200

Content type

application/json

["latest",
"0.1.23",
"0.1.23-dev"
]

Trigger update

SPR will run a self update, to the configured release Channel and Version (latest by default)

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -X PUT -u "admin:pass" \
  "http://192.168.2.1/update"

Get attestation status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/attestStatus

Response samples

200

Content type

application/json

{ }

Refresh attestation status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/attestStatus

Response samples

200

Content type

application/json

{ }

Get auto update setting

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/autoupdate

Response samples

200

Content type

application/json

false

Enable auto updates

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/autoupdate

Disable auto updates

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X DELETE http://192.168.2.1/autoupdate

Get check-updates setting

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" http://192.168.2.1/checkupdates

Response samples

200

Content type

application/json

true

Enable update checks

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X PUT http://192.168.2.1/checkupdates

Disable update checks

Authorizations:

basicAuthbearerAuth

Responses

Request samples

cURL

curl -u "admin:pass" -X DELETE http://192.168.2.1/checkupdates

Set release channel settings

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json

Release channel and version settings to apply

CustomChannel	string Custom release channel to track
CustomVersion	string Pinned custom version to install
Current	string Currently running release version

Responses

Request samples

Payload
cURL

Content type

application/json

{"CustomChannel": "main",
"CustomVersion": "0.3.6",
"Current": "0.3.5"
}

Clear release channel settings

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Responses

Request samples

cURL

curl -u "admin:pass" -X DELETE http://192.168.2.1/releaseSet

Plugins

Operations about plugins

Get Plugins

Get a list of all the plugins

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins"

Response samples

200

Content type

application/json

[{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true,
"Plus": false,
"GitURL": "https://github.com/example/dns-block-plugin.git",
"ComposeFilePath": "plugins/plugin/docker-compose.yml",
"HasUI": true,
"SandboxedUI": true,
"InstallTokenPath": "/config/plugins/dns-block/install-token",
"ScopedPaths": ["/config/plugins/dns-block",
"/state/plugins/dns-block"
]
}
]

Add or Update Plugin

Add or update a plugin specified by the name parameter

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: dns-block

plugin name

Request Body schema: application/json
required

PluginEntry to be added or updated

Name	string Plugin name
URI	string Plugin URI
UnixPath	string Plugin path for unix socket
Enabled	boolean Plugin state
Plus	boolean Indicates if this is a PLUS plugin
GitURL	string Git repository URL for the plugin
ComposeFilePath	string Relative path to docker compose file
HasUI	boolean Indicates if the plugin has a user interface
SandboxedUI	boolean Indicates if the plugin UI is sandboxed
InstallTokenPath	string Path to the installation token
ScopedPaths	Array of strings List of scoped paths for the plugin

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true,
"Plus": false,
"GitURL": "https://github.com/example/dns-block-plugin.git",
"ComposeFilePath": "plugins/plugin/docker-compose.yml",
"HasUI": true,
"SandboxedUI": true,
"InstallTokenPath": "/config/plugins/dns-block/install-token",
"ScopedPaths": ["/config/plugins/dns-block",
"/state/plugins/dns-block"
]
}

Delete Plugin

Delete plugin specified by the name parameter

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: dns-block

plugin name

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE  \
  "http://192.168.2.1/plugins/plugin-test" \
  --data '{}'

Get Custom Compose Paths

Retrieves the current set of custom compose paths.

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Responses

Response samples

200

Content type

application/json

["string"
]

Update Custom Docker Compose Paths for plugins

Updates the permit list of docker compose files that can be launched from disk

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json
required

Array

string

Responses

Request samples

Payload

Content type

application/json

["string"
]

Install from Git URL

Installs a plugin from the provided user URL on github.

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json
required

string

Responses

Request samples

Payload
CLI

Content type

application/json

"https://github.com/spr-networks/spr-sample-plugin.git"

Restart Plugin

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: dns-block

Plugin name

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/dns-block/restart"

Update Plugin Container

Authorizations:

basicAuthbearerAuth

path Parameters

name

required

string

Example: dns-block

Plugin name

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/dns-block/update_container"

Complete User Plugin Install

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json
required

PluginEntry to be added or updated

Name	string Plugin name
URI	string Plugin URI
UnixPath	string Plugin path for unix socket
Enabled	boolean Plugin state
Plus	boolean Indicates if this is a PLUS plugin
GitURL	string Git repository URL for the plugin
ComposeFilePath	string Relative path to docker compose file
HasUI	boolean Indicates if the plugin has a user interface
SandboxedUI	boolean Indicates if the plugin UI is sandboxed
InstallTokenPath	string Path to the installation token
ScopedPaths	Array of strings List of scoped paths for the plugin

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true,
"Plus": false,
"GitURL": "https://github.com/example/dns-block-plugin.git",
"ComposeFilePath": "plugins/plugin/docker-compose.yml",
"HasUI": true,
"SandboxedUI": true,
"InstallTokenPath": "/config/plugins/dns-block/install-token",
"ScopedPaths": ["/config/plugins/dns-block",
"/state/plugins/dns-block"
]
}

Response samples

200

Content type

application/json

[{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true,
"Plus": false,
"GitURL": "https://github.com/example/dns-block-plugin.git",
"ComposeFilePath": "plugins/plugin/docker-compose.yml",
"HasUI": true,
"SandboxedUI": true,
"InstallTokenPath": "/config/plugins/dns-block/install-token",
"ScopedPaths": ["/config/plugins/dns-block",
"/state/plugins/dns-block"
]
}
]

Download User Plugin Info

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json
required

Git URL string of the user plugin

string (PluginGitURL)

Git URL of the plugin to download

Responses

Request samples

Payload
CLI

Content type

application/json

"https://github.com/spr-networks/spr-sample-plugin"

Response samples

200

Content type

application/json

{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true,
"Plus": false,
"GitURL": "https://github.com/example/dns-block-plugin.git",
"ComposeFilePath": "plugins/plugin/docker-compose.yml",
"HasUI": true,
"SandboxedUI": true,
"InstallTokenPath": "/config/plugins/dns-block/install-token",
"ScopedPaths": ["/config/plugins/dns-block",
"/state/plugins/dns-block"
]
}

Get plugin attestation

Authorizations:

basicAuthbearerAuth

query Parameters

compose_file	string Example: compose_file=/configs/plugins/mesh/docker-compose.yml Path to the plugin compose file to attest (compose_file or service required)
service	string Example: service=mesh Service name to attest (compose_file or service required)
force	string Example: force=1 Force re-attestation when set to a non-empty value

Responses

Request samples

cURL

curl -u "admin:pass" "http://192.168.2.1/pluginAttest?service=mesh"

Response samples

200

Content type

application/json

{ }

Tokens

Api Tokens

Get API Tokens

Get an array of all tokens

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Responses

Request samples

CLI

curl -u "admin:pass" -H "X-JWT-OTP:..." \
  "http://192.168.2.1/tokens"

Response samples

200

Content type

application/json

[{"Name": "TestToken",
"Token": "dG9rbnRva250b2tudG9rbnRva250b2tudG9rbnRva24K",
"ScopedPaths": ["wifi"
],
"Expire": 1656440879
}
]

Add API Token

Create a new token. If Expire is 0 or undefined the Token will never expire

Authorizations:

(basicAuthOTPAuth) (bearerAuthOTPAuth)

Request Body schema: application/json

Expire	integer
ScopedPaths	Array of strings

Responses

Request samples

Payload
CLI

Content type

application/json

{"Expire": 1656440879,
"ScopedPaths": ["/status",
"/docker/info"
]
}

Response samples

200

Content type

application/json

{"Name": "TestToken",
"Token": "dG9rbnRva250b2tudG9rbnRva250b2tudG9rbnRva24K",
"ScopedPaths": ["wifi"
],
"Expire": 1656440879
}

Delete API Token

Delete token specified by the Token parameter

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Token

string

Responses

Request samples

Payload
CLI

Content type

application/json

{"Token": "dG9rbnRva250b2tudG9rbnRva250b2tudG9rbnRva24K"
}

Alerts

Retrieve all alerts

Returns a list of all alert settings.

Responses

Request samples

CLI

curl -X GET "http://192.168.2.1/alerts"

Response samples

200

Content type

application/json

[{"TopicPrefix": "string",
"MatchAnyOne": true,
"InvertRule": true,
"Conditions": [{"JPath": "string"
}
],
"Actions": [{"SendNotification": true,
"StoreAlert": true,
"StoreTopicSuffix": "string",
"MessageTitle": "string",
"MessageBody": "string",
"NotificationType": "string",
"ActionType": "string",
"GrabEvent": true,
"GrabValues": true,
"GrabFields": ["string"
]
}
],
"Name": "string",
"Disabled": true,
"RuleId": "string"
}
]

Add or Update Alerts

If an alert setting does not exist, it will be created, otherwise updated

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

AlertSetting object that needs to be added

TopicPrefix required	string
MatchAnyOne	boolean
InvertRule	boolean
	Array of objects (ConditionEntry)
	Array of objects (ActionConfig)
Name	string
Disabled	boolean
RuleId	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"TopicPrefix": "string",
"MatchAnyOne": true,
"InvertRule": true,
"Conditions": [{"JPath": "string"
}
],
"Actions": [{"SendNotification": true,
"StoreAlert": true,
"StoreTopicSuffix": "string",
"MessageTitle": "string",
"MessageBody": "string",
"NotificationType": "string",
"ActionType": "string",
"GrabEvent": true,
"GrabValues": true,
"GrabFields": ["string"
]
}
],
"Name": "string",
"Disabled": true,
"RuleId": "string"
}

Delete an alert by index

Deletes a specific alert setting by its index.

path Parameters

index

required

integer

Example: 1

Responses

Request samples

CLI

curl -X DELETE "http://192.168.2.1/alerts/{index}"

Update Alert by Index

Update an alert setting at a specific index. If the alert setting does not exist at this index, it will be created. Fields are optional.

Authorizations:

basicAuthbearerAuth

path Parameters

index

required

integer

Example: 1

Request Body schema: application/json
required

AlertSetting object that needs to be added

TopicPrefix required	string
MatchAnyOne	boolean
InvertRule	boolean
	Array of objects (ConditionEntry)
	Array of objects (ActionConfig)
Name	string
Disabled	boolean
RuleId	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"TopicPrefix": "string",
"MatchAnyOne": true,
"InvertRule": true,
"Conditions": [{"JPath": "string"
}
],
"Actions": [{"SendNotification": true,
"StoreAlert": true,
"StoreTopicSuffix": "string",
"MessageTitle": "string",
"MessageBody": "string",
"NotificationType": "string",
"ActionType": "string",
"GrabEvent": true,
"GrabValues": true,
"GrabFields": ["string"
]
}
],
"Name": "string",
"Disabled": true,
"RuleId": "string"
}

Get Mobile Alert Proxy Settings

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/alerts_mobile_proxy"

Response samples

200

Content type

application/json

{"Disabled": false,
"APNSDomain": "apns.supernetworks.org"
}

Set Mobile Alert Proxy Settings

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Mobile alert proxy settings object

Disabled	boolean When true, the mobile alert proxy is disabled
APNSDomain	string Domain of the APNS proxy that relays notifications

Responses

Request samples

Payload
CLI

Content type

application/json

{"Disabled": false,
"APNSDomain": "apns.supernetworks.org"
}

Response samples

200

Content type

application/json

{"Disabled": false,
"APNSDomain": "apns.supernetworks.org"
}

Get Registered Alert Devices

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/alerts_register_ios"

Response samples

200

Content type

application/json

[{"DeviceId": "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9",
"DeviceToken": "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
"PublicKey": "MFkwEwYHKoZIzj0CAQYIK...",
"LastActive": "2024-03-13T23:43:39Z"
}
]

Register Alert Device

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Alert device object

DeviceId	string Mobile device identifier (36 char UUID for iOS)
DeviceToken	string APNS device token (64 hex characters)
PublicKey	string Device public key used to encrypt alert payloads
LastActive	string <date-time> Timestamp the device was last active

Responses

Request samples

Payload
CLI

Content type

application/json

{"DeviceId": "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9",
"DeviceToken": "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
"PublicKey": "MFkwEwYHKoZIzj0CAQYIK...",
"LastActive": "2024-03-13T23:43:39Z"
}

Response samples

200

Content type

application/json

[{"DeviceId": "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9",
"DeviceToken": "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
"PublicKey": "MFkwEwYHKoZIzj0CAQYIK...",
"LastActive": "2024-03-13T23:43:39Z"
}
]

Delete Alert Device

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Alert device object

DeviceId	string Mobile device identifier (36 char UUID for iOS)
DeviceToken	string APNS device token (64 hex characters)
PublicKey	string Device public key used to encrypt alert payloads
LastActive	string <date-time> Timestamp the device was last active

Responses

Request samples

Payload
CLI

Content type

application/json

{"DeviceId": "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9",
"DeviceToken": "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
"PublicKey": "MFkwEwYHKoZIzj0CAQYIK...",
"LastActive": "2024-03-13T23:43:39Z"
}

Response samples

200

Content type

application/json

[{"DeviceId": "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9",
"DeviceToken": "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
"PublicKey": "MFkwEwYHKoZIzj0CAQYIK...",
"LastActive": "2024-03-13T23:43:39Z"
}
]

Send Test Alert to Device

Authorizations:

basicAuthbearerAuth

path Parameters

deviceToken

required

string

Example: aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899

APNS device token (64 hex characters)

Request Body schema: application/json
required

APNS alert to send

title	string Alert title
body	string Alert body text

Responses

Request samples

Payload
CLI

Content type

application/json

{"title": "SPR Alert",
"body": "A new device joined the network"
}

Response samples

200

Content type

application/json

{"title": "SPR Alert",
"body": "A new device joined the network"
}

OTP

One Time Password Authentication

Configure OTP User

Updates an OTP user with the given details. If already registered, a valid code is required

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Name	string
Code	string
UpdateAlwaysOn	boolean
AlwaysOn	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "string",
"Code": "string",
"UpdateAlwaysOn": true,
"AlwaysOn": true
}

Delete OTP User

Deletes an OTP user. Valid code required

Authorizations:

bearerAuthbasicAuth

Request Body schema: application/json
required

Name	string
Code	string
UpdateAlwaysOn	boolean
AlwaysOn	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "string",
"Code": "string",
"UpdateAlwaysOn": true,
"AlwaysOn": true
}

Generate an OTP JWT

Validates the provided OTP user details and generates the X-JWT-OTP token

Authorizations:

bearerAuthbasicAuth

Request Body schema: application/json
required

Name	string
Code	string
UpdateAlwaysOn	boolean
AlwaysOn	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "string",
"Code": "string",
"UpdateAlwaysOn": true,
"AlwaysOn": true
}

Response samples

200

Content type

application/json

"string"

Get OTP Status

Retrieves the status of the OTP service.

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -H "Authorization: Bearer [token]" -H "X-JWT-Token: [jwt-token]" \
  "http://192.168.2.1/otp_status"

Response samples

200

Content type

application/json

{"State": "string",
"AlwaysOn": true
}

JWT OTP Test

Endpoint to test OTP JWT validity.

Authorizations:

(bearerAuthOTPAuth) (basicAuthOTPAuth)

Responses

Request samples

CLI

curl -X PUT -H "Authorization: Bearer [token]" -H "X-JWT-Token: [jwt-token]" \
  "http://192.168.2.1/otp_jwt_test"

PLUS

PLUS features

Start PLUS extension

Start a PLUS extension. Currently this is the pfw plugin

Authorizations:

basicAuthbearerAuth

query Parameters

name	string Example: name=pfw Name of plus extension

Responses

Response samples

200

Content type

application/json

[{"Conditions": {"Prefix": "drop:input",
"Protocol": "tcp",
"DstIP": "1.1.1.1",
"DstPort": 80,
"SrcIP": "192.168.2.10",
"SrcPort": 1234
},
"Notification": true
}
]

Stop PLUS extension

Stop a PLUS extension. Currently this is the pfw plugin

Authorizations:

basicAuthbearerAuth

query Parameters

name	string Example: name=pfw Name of plus extension

Responses

Response samples

200

Content type

application/json

[{"Conditions": {"Prefix": "drop:input",
"Protocol": "tcp",
"DstIP": "1.1.1.1",
"DstPort": 80,
"SrcIP": "192.168.2.10",
"SrcPort": 1234
},
"Notification": true
}
]

Get PLUS token

Get the configured PLUS token

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/tokens"

Response samples

200

Content type

application/json

"string"

Set PLUS token

Configure a PLUS token and trigger PLUS installation

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

string

Responses

Request samples

Payload
CLI

Content type

application/json

"plus_token"

Check Plus Token Validity

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plusTokenValid"

Internet Health

WAN uplink health monitoring, outages, speed tests and failover

Get WAN Status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/wan/status"

Response samples

200

Content type

application/json

[{"Iface": "eth0",
"Up": true,
"Active": true,
"Gateway": "192.168.1.1",
"LatencyMs": 12.4,
"JitterMs": 1.8,
"LossPct": 0,
"LastChange": 1720000000,
"TotalOutages": 2,
"Downtime24h": 45
}
]

Get WAN Health Config

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/wan/config"

Response samples

200

Content type

application/json

{"Enabled": true,
"IntervalSeconds": 5,
"ProbeTargets": ["1.1.1.1"
],
"FailThreshold": 4,
"RecoverThreshold": 3,
"FailoverEnabled": true,
"SpeedTestURL": "https://speed.cloudflare.com/__down?bytes=33554432"
}

Update WAN Health Config

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

WanHealthConfig object that needs to be updated

Enabled	boolean Whether WAN health monitoring is enabled
IntervalSeconds	integer Probe interval in seconds (2-60)
ProbeTargets	Array of strings List of IPv4 addresses to probe via ICMP
FailThreshold	integer Consecutive probe failures before marking an uplink down (1-60)
RecoverThreshold	integer Consecutive probe successes before marking an uplink up (1-60)
FailoverEnabled	boolean Whether to remove a failed uplink from load balancing
SpeedTestURL	string HTTP(S) URL used for downlink speed tests

Responses

Request samples

Payload
CLI

Content type

application/json

{"Enabled": true,
"IntervalSeconds": 5,
"ProbeTargets": ["1.1.1.1"
],
"FailThreshold": 4,
"RecoverThreshold": 3,
"FailoverEnabled": true,
"SpeedTestURL": "https://speed.cloudflare.com/__down?bytes=33554432"
}

Response samples

200

Content type

application/json

{"Enabled": true,
"IntervalSeconds": 5,
"ProbeTargets": ["1.1.1.1"
],
"FailThreshold": 4,
"RecoverThreshold": 3,
"FailoverEnabled": true,
"SpeedTestURL": "https://speed.cloudflare.com/__down?bytes=33554432"
}

Get WAN History

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Example: eth0

Uplink interface name

query Parameters

scale	string Example: scale=minutes Sample resolution, either minutes or hours
count	integer Example: count=60 Maximum number of samples to return

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/wan/history/eth0?scale=minutes&count=60"

Response samples

200

Content type

application/json

[{"Time": 1720000000,
"LatencyMs": 12.4,
"JitterMs": 1.8,
"LossPct": 0,
"Up": true
}
]

Get WAN Outages

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/wan/outages"

Response samples

200

Content type

application/json

[{"Iface": "eth0",
"Start": 1720000000,
"End": 1720000300,
"Reason": "probe timeouts"
}
]

Get WAN Speed Results

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/wan/speedtest"

Response samples

200

Content type

application/json

[{"Iface": "eth0",
"Time": 1720000000,
"DownMbps": 235.6,
"Seconds": 1.14,
"Bytes": 33554432,
"URL": "https://speed.cloudflare.com/__down?bytes=33554432",
"Error": "no data transferred"
}
]

Run WAN Speed Test

Authorizations:

basicAuthbearerAuth

path Parameters

interface

required

string

Example: eth0

Uplink interface name to test

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/wan/speedtest/eth0"

Response samples

200

Content type

application/json

{"Iface": "eth0",
"Time": 1720000000,
"DownMbps": 235.6,
"Seconds": 1.14,
"Bytes": 33554432,
"URL": "https://speed.cloudflare.com/__down?bytes=33554432",
"Error": "no data transferred"
}

Parental Controls

Personas, schedules and daily time limits

Get parental personas

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/parentalControls/personas"

Response samples

200

Content type

application/json

[{"Name": "kids",
"Tag": "persona:kids",
"Description": "Children devices",
"DailyLimitMinutes": 120,
"Schedules": [{"Days": [0,
1,
1,
1,
1,
1,
0
],
"Start": "21:00",
"End": "07:00"
}
],
"DNSFamily": true,
"Disabled": false
}
]

Create or update a parental persona

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Persona object

Name	string Unique persona name
Tag	string Device tag bound to the persona; must start with "persona:" (defaults to persona:Name)
Description	string Human-readable description of the persona
DailyLimitMinutes	integer Daily internet time budget in minutes; 0 disables the limit
	Array of objects (TimeWindow) Recurring time windows during which internet access is blocked
DNSFamily	boolean Whether to apply family-safe DNS filtering to the persona
Disabled	boolean Whether enforcement for this persona is disabled

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "kids",
"Tag": "persona:kids",
"Description": "Children devices",
"DailyLimitMinutes": 120,
"Schedules": [{"Days": [0,
1,
1,
1,
1,
1,
0
],
"Start": "21:00",
"End": "07:00"
}
],
"DNSFamily": true,
"Disabled": false
}

Response samples

200

Content type

application/json

[{"Name": "kids",
"Tag": "persona:kids",
"Description": "Children devices",
"DailyLimitMinutes": 120,
"Schedules": [{"Days": [0,
1,
1,
1,
1,
1,
0
],
"Start": "21:00",
"End": "07:00"
}
],
"DNSFamily": true,
"Disabled": false
}
]

Delete a parental persona

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Persona object

Name	string Unique persona name
Tag	string Device tag bound to the persona; must start with "persona:" (defaults to persona:Name)
Description	string Human-readable description of the persona
DailyLimitMinutes	integer Daily internet time budget in minutes; 0 disables the limit
	Array of objects (TimeWindow) Recurring time windows during which internet access is blocked
DNSFamily	boolean Whether to apply family-safe DNS filtering to the persona
Disabled	boolean Whether enforcement for this persona is disabled

Responses

Request samples

Payload
CLI

Content type

application/json

{"Name": "kids",
"Tag": "persona:kids",
"Description": "Children devices",
"DailyLimitMinutes": 120,
"Schedules": [{"Days": [0,
1,
1,
1,
1,
1,
0
],
"Start": "21:00",
"End": "07:00"
}
],
"DNSFamily": true,
"Disabled": false
}

Response samples

200

Content type

application/json

[{"Name": "kids",
"Tag": "persona:kids",
"Description": "Children devices",
"DailyLimitMinutes": 120,
"Schedules": [{"Days": [0,
1,
1,
1,
1,
1,
0
],
"Start": "21:00",
"End": "07:00"
}
],
"DNSFamily": true,
"Disabled": false
}
]

Get per-persona usage

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/parentalControls/usage"

Response samples

200

Content type

application/json

{"persona:kids": {"Used": 45,
"Limit": 120,
"Blocked": false,
"PauseUntil": 0,
"GrantUntil": 0
}
}

Pause a persona

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Persona tag and duration in minutes

Tag	string Persona tag or persona name to target
Minutes	integer Duration in minutes; 0 or less clears the override

Responses

Request samples

Payload
CLI

Content type

application/json

{"Tag": "persona:kids",
"Minutes": 30
}

Response samples

200

Content type

application/json

{"Date": "2026-07-09",
"UsedMinutes": {"persona:kids": 45
},
"PauseUntil": {"persona:kids": 1752096000
},
"GrantUntil": {"persona:kids": 1752096000
}
}

Extend (grant) time for a persona

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Persona tag and duration in minutes

Tag	string Persona tag or persona name to target
Minutes	integer Duration in minutes; 0 or less clears the override

Responses

Request samples

Payload
CLI

Content type

application/json

{"Tag": "persona:kids",
"Minutes": 30
}

Response samples

200

Content type

application/json

{"Date": "2026-07-09",
"UsedMinutes": {"persona:kids": 45
},
"PauseUntil": {"persona:kids": 1752096000
},
"GrantUntil": {"persona:kids": 1752096000
}
}

Reset usage and overrides for a persona

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Persona tag to reset

Tag	string Persona tag or persona name to reset

Responses

Request samples

Payload
CLI

Content type

application/json

{"Tag": "persona:kids"
}

Response samples

200

Content type

application/json

{"Date": "2026-07-09",
"UsedMinutes": {"persona:kids": 45
},
"PauseUntil": {"persona:kids": 1752096000
},
"GrantUntil": {"persona:kids": 1752096000
}
}

Themes

Custom UI themes and appearance

Get Custom Themes

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/customThemes"

Response samples

200

Content type

application/json

[{"id": "custom-ocean",
"name": "Ocean",
"spec": {"colorMode": "dark",
"accent": "#3b82f6",
"background": "#0b1220",
"card": "#111827",
"text": "#e5e7eb"
}
}
]

Update Custom Themes

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Array of custom theme objects to store

Array

id	string Unique theme identifier matching ^custom-[a-z0-9-]{1,64}$
name	string Human-readable theme name (1-64 characters)
	object (CustomThemeSpec)

Responses

Request samples

Payload
CLI

Content type

application/json

[{"id": "custom-ocean",
"name": "Ocean",
"spec": {"colorMode": "dark",
"accent": "#3b82f6",
"background": "#0b1220",
"card": "#111827",
"text": "#e5e7eb"
}
}
]

Response samples

200

Content type

application/json

[{"id": "custom-ocean",
"name": "Ocean",
"spec": {"colorMode": "dark",
"accent": "#3b82f6",
"background": "#0b1220",
"card": "#111827",
"text": "#e5e7eb"
}
}
]

DNS Block

CoreDNS Block plugin

Retrieve coredns-block config

Returns coredns-block config

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/block/config"

Response samples

200

Content type

application/json

"config"

Add override domain

Add domain to be blocked/permitted by DNS

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

DNSDomainOverride object that needs to be added

Type	string type of override (permit or block)
Domain	string domain name to override
ResultIP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/ ip to return
ClientIP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/ target to apply to, '*' for all
Expiration	integer if non zero has unix time for when the entry should disappear

Responses

Request samples

Payload
CLI

Content type

application/json

{"Type": "permit",
"Domain": "example.com",
"ResultIP": "1.2.3.4",
"ClientIP": "192.168.2.102",
"Expiration": 0
}

Delete override domain

Delete domain to be blocked/permitted by DNS

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

DNSDomainOverride object that needs to be added

Type	string type of override (permit or block)
Domain	string domain name to override
ResultIP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/ ip to return
ClientIP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/ target to apply to, '*' for all
Expiration	integer if non zero has unix time for when the entry should disappear

Responses

Request samples

Payload
CLI

Content type

application/json

{"Type": "permit",
"Domain": "example.com",
"ResultIP": "1.2.3.4",
"ClientIP": "192.168.2.102",
"Expiration": 0
}

Retrieve blocklists

Returns blocklist URIs

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/block/blocklist"

Response samples

200

Content type

application/json

[{"URI": "http://asdf.com/",
"Enabled": true
}
]

Add blocklist

Add blocklist entry

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

DNSListEntry object that needs to be added

URI	string
Enabled	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"URI": "http://asdf.com/",
"Enabled": true
}

Delete blocklist entry

Delete a blocklist entry

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

DNSListEntry object that needs to be added

URI	string
Enabled	boolean

Responses

Request samples

Payload
CLI

Content type

application/json

{"URI": "http://asdf.com/",
"Enabled": true
}

Retrieve IPs excluded from blocking

Returns IPs excluded from DNS block

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/block/exclusions"

Response samples

200

Content type

application/json

["192.168.2.102",
"192.168.2.112"
]

Add IP to exclude

Add IP address to exclusion list

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

string

ip to exclude

Responses

Request samples

Payload
CLI

Content type

application/json

"192.168.2.102"

Delete IP from exclusion list

Delete IP address from exclusion list

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

string

ip to delete exclude for

Responses

Request samples

Payload
CLI

Content type

application/json

"192.168.2.102"

Dump all domains loaded from block lists

Returns aggregate list of all block domains

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" "http://192.168.2.1/plugins/dns/block/dump_domains"

Response samples

200

Content type

application/json

["asdf.com",
"example.com"
]

Get metrics

Returns metrics for DNS block

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/block/metrics"

Response samples

200

Content type

application/json

{"TotalQueries": 1024,
"BlockedQueries": 512,
"BlockedDomains": 1000
}

DNS Log

CoreDNS Log plugin

Retrieve coredns-jsonlog configuration

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/log/config"

Response samples

200

Content type

application/json

[{"HostPrivacyIPList": ["192.168.1.10"
]
},
{"DomainIgnoreList": ["asdf.com",
"asdf2.com",
"test.com."
]
}
]

Retrieve list of privacy hosts

List of hosts to exclude from DNS Log

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/log/host_privacy_list"

Response samples

200

Content type

application/json

["192.168.1.10"
]

Set the list of privacy hosts

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json

Array

string

Responses

Request samples

Payload
CLI

Content type

application/json

["string"
]

Retrieve list of domains to exclude from logging

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/log/domain_ignores"

Response samples

200

Content type

application/json

["localhost"
]

Add domain to exclude from logs

Authorizations:

basicAuthbearerAuth

path Parameters

domain

required

string

domain name

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/dns/log/domain_ignore/example.com"

Response samples

200

Content type

application/json

[{ }
]

Remove domain from exclude list

Authorizations:

basicAuthbearerAuth

path Parameters

domain

required

string

domain name

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/plugins/dns/log/domain_ignore/example.com"

Response samples

200

Content type

application/json

["string"
]

Retrieve recent DNS history for a given IP

Authorizations:

basicAuthbearerAuth

path Parameters

ip

required

string

Example: 1.1.1.1

ip address

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dns/log/history/192.168.1.10"

Response samples

200

Content type

application/json

[{"Q": [{"Name": "supernetworks.org.",
"Qtype": 1,
"Qclass": 1
}
],
"A": [{"Hdr": {"Name": "supernetworks.org.",
"Rrtype": 1,
"Class": 1,
"Ttl": 30,
"Rdlength": 4
},
"A": "172.67.71.52"
},
{"Hdr": {"Name": "supernetworks.org.",
"Rrtype": 1,
"Class": 1,
"Ttl": 30,
"Rdlength": 4
},
"A": "104.26.7.38"
},
{"Hdr": {"Name": "supernetworks.org.",
"Rrtype": 1,
"Class": 1,
"Ttl": 30,
"Rdlength": 4
},
"A": "104.26.6.38"
}
],
"Type": "NOERROR",
"FirstName": "supernetworks.org.",
"FirstAnswer": "172.67.71.52",
"Local": "[::]:53",
"Remote": "127.0.0.1:60237",
"Timestamp": "2022-03-28T21:47:49.563958-07:00"
}
]

Delete Device History by IP

Delete device history in the IP parameter

Authorizations:

basicAuthbearerAuth

path Parameters

ip

required

string

Example: 1.1.1.1

ip address

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/plugins/dns/log/history/192.168.1.10"

Wireguard

Wireguard plugin

Peers

Returns a list of peers connected to Wireguard

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/wireguard/peers"

Response samples

200

Content type

application/json

[{"PublicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"AllowedIPs": "192.168.3.3/32",
"Endpoint": "192.168.2.1:51280",
"PresharedKey": "w9bfMAfqRnLjnlHofX+JSzaRDADrW1tvyW1UWzXJjrg=",
"PersistentKeepalive": 25
}
]

Peer

Creates a new peer

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
optional

Device object

PublicKey	string Base64 public key
AllowedIPs	string Allowed IP address
Endpoint	string Endpoint to connect to
PresharedKey	any Preshared key
PersistentKeepalive	integer Keepalive timeout

Responses

Request samples

Payload
CLI

Content type

application/json

{"PublicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"AllowedIPs": "192.168.3.3/32",
"Endpoint": "192.168.2.1:51280",
"PresharedKey": "w9bfMAfqRnLjnlHofX+JSzaRDADrW1tvyW1UWzXJjrg=",
"PersistentKeepalive": 25
}

Response samples

200

Content type

application/json

{"Interface": {"PrivateKey": "6KVVbcmXanU/6mByHy17eNO9DXe9BQJWOyaA204JYH4=",
"Address": "192.168.3.3/24",
"DNS": "1.1.1.1"
},
"Peer": {"PublicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"AllowedIPs": "192.168.3.3/32",
"Endpoint": "192.168.2.1:51280",
"PresharedKey": "w9bfMAfqRnLjnlHofX+JSzaRDADrW1tvyW1UWzXJjrg=",
"PersistentKeepalive": 25
}
}

Config

Return Wireguard server config

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/wireguard/config"

Response samples

200

Content type

application/json

"[Interface]\nAddress = 192.168.3.1/24\nListenPort = 51280\nPrivateKey = 6KVVbcmXanU/6mByHy17eNO9DXe9BQJWOyaA204JYH4=\n\n[Peer]\nPublicKey = 7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=\nPresharedKey = w9bfMAfqRnLjnlHofX+JSzaRDADrW1tvyW1UWzXJjrg=\nAllowedIPs = 192.168.3.2/32\n"

Status

Return Wireguard server and peer status

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/wireguard/status"

Response samples

200

Content type

application/json

{"wg0": {"privateKey": "6KVVbcmXanU/6mByHy17eNO9DXe9BQJWOyaA204JYH4=",
"publicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"listenPort": "51280,",
"peers": {"HvtqvLJ1F33eHmR5Yk9PLZfTHg7w6sazPZtZi9u8pBQ=": {"presharedKey": "w9bfMAfqRnLjnlHofX+JSzaRDADrW1tvyW1UWzXJjrg=",
"allowedIps": ["192.168.3.2/32"
]
}
}
}
}

Up

Start Wireguard if not running

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/wireguard/up"

Response samples

200

Content type

application/json

true

Down

Stop Wireguard if running

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/wireguard/down"

Response samples

200

Content type

application/json

true

Lookup

Lookup plugin for ASN & OUI information

IP ASN

Get ASN information for IP address

Authorizations:

basicAuthbearerAuth

path Parameters

ips

required

string

Example: 1.1.1.1,2.2.2.2

ip address list, separated by ,

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/lookup/asn/1.1.1.1"

Response samples

200

Content type

application/json

{"IP": "1.1.1.1",
"ASN": 13335,
"Name": "CLOUDFLARENET",
"Country": "US"
}

IPs ASN

Get ASN information for IPs separated by ,

Authorizations:

basicAuthbearerAuth

path Parameters

ips

required

string

Example: 1.1.1.1,2.2.2.2

ip address list, separated by ,

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/lookup/asns/1.1.1.1,8.8.8.8"

Response samples

200

Content type

application/json

[{"IP": "1.1.1.1",
"ASN": 13335,
"Name": "CLOUDFLARENET",
"Country": "US"
}
]

MAC OUI

Get OUI vendor information for MAC address

Authorizations:

basicAuthbearerAuth

path Parameters

mac

required

string

Example: 11:22:33:44:55:66

MAC address

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/lookup/oui/00:11:22:33:44:55"

Response samples

200

Content type

application/json

{"MAC": "00:11:22:33:44:66",
"Vendor": "CIMSYS"
}

MACs OUI

Get OUI vendor information for MACs separated by ,

Authorizations:

basicAuthbearerAuth

path Parameters

macs

required

string

Example: 00:11:22:33:44:66

MAC address list separated by ,

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/lookup/ouis/00:11:22:33:44:66"

Response samples

200

Content type

application/json

[{"MAC": "00:11:22:33:44:66",
"Vendor": "CIMSYS"
}
]

Dynamic DNS

Dynamic DNS Record Updater

Retrieve dyndns configuration

Returns the dyndns configuration

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dyndns/config"

Response samples

200

Content type

application/json

{"Provider": "Cloudflare",
"Email": "[email protected]",
"Password": "stringypassword",
"LoginToken": "logintoken++",
"IpUrl": "https://ip4.seeip.org",
"Ipv6Url": "https://ip6.seeip.org",
"IpType": "IPv4",
"Interval": 300,
"Socks5Proxy": "string",
"Resolver": "8.8.8.8",
"RunOnce": true,
"Domains": [{"DomainName": "supernetworks.org",
"SubDomains": ["dyndns"
]
}
]
}

Updates the dyndns config

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Dyndns Configuration. See godns for details

Provider	string
Email	string
Password	string
LoginToken	string
IpUrl	string
Ipv6Url	string
IpType	string
Interval	integer How many seconds to wait before checking for an update
Socks5Proxy	string socks5 proxy to use
Resolver	string DNS Resolver to use
RunOnce	boolean Run once and exit (note always set to true)
	Array of objects (GodyndnsDomain)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Provider": "Cloudflare",
"Email": "[email protected]",
"Password": "stringypassword",
"LoginToken": "logintoken++",
"IpUrl": "https://ip4.seeip.org",
"Ipv6Url": "https://ip6.seeip.org",
"IpType": "IPv4",
"Interval": 300,
"Socks5Proxy": "string",
"Resolver": "8.8.8.8",
"RunOnce": true,
"Domains": [{"DomainName": "supernetworks.org",
"SubDomains": ["dyndns"
]
}
]
}

Refresh the dyndns client

Runs a dyndns update

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/dyndns/refresh"

Mesh Common APIs

The mesh extension lets users grow the network with multiple SPR Access Points

Get mesh configuration

Retrieves the current mesh network configuration

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/mesh/config"

Response samples

200

Content type

application/json

{"ParentCredentials": {"ParentIP": "string",
"ParentAPIToken": "string",
"ParentCA": "string"
},
"LeafRouters": [{"APIToken": "string",
"IP": "string",
"TLSCA": "string"
}
]
}

Get leaf mode status

Retrieves the current status of leaf mode

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/mesh/leafMode"

Response samples

200

Content type

application/json

true

Mesh Main Router APIs

The mesh extension lets users grow the network with multiple SPR Access Points

Get list of leaf routers

Retrieves a list of all leaf routers the main router has configured

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/mesh/leafRouters"

Response samples

200

Content type

application/json

[{"APIToken": "string",
"IP": "string",
"TLSCA": "string"
}
]

Add or update a leaf router

Adds a new leaf router or updates an existing one

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

APIToken	string
IP	string
TLSCA	string This field should be left empty when adding or updating a leaf router.

Responses

Request samples

Payload
CLI

Content type

application/json

{"APIToken": "string",
"IP": "string",
"TLSCA": "string"
}

Remove a leaf router

Removes a leaf router from the main router's mesh network

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

APIToken	string
IP	string
TLSCA	string This field should be left empty when adding or updating a leaf router.

Responses

Request samples

Payload
CLI

Content type

application/json

{"APIToken": "string",
"IP": "string",
"TLSCA": "string"
}

Mesh node reports station connection

Endpoint for mesh nodes to notify the main router/AP about a new station connection to the mesh network

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Event	string Type of event (e.g., "connect" or "disconnect")
Iface	string Network interface on the mesh node where the event occurred
Mac	string MAC address of the station
Router	string IP address of the mesh node reporting the event

Responses

Request samples

Payload
CLI

Content type

application/json

{"Event": "string",
"Iface": "string",
"Mac": "string",
"Router": "string"
}

Mesh node reports station connection failure

Endpoint for mesh nodes to notify the main router/AP about a failed station connection attempt

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Type	string Type of failure event (e.g., "connection_failure")
MAC	string MAC address of the station that failed to connect
Reason	string Reason for the connection failure
Status	string Status of the connection attempt (e.g., "failure")
Router	string IP address of the mesh node reporting the failure

Responses

Request samples

Payload
CLI

Content type

application/json

{"Type": "string",
"MAC": "string",
"Reason": "string",
"Status": "string",
"Router": "string"
}

Mesh node reports station disconnection

Endpoint for mesh nodes to notify the main router/AP about a station disconnection from the mesh network

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Event	string Type of event (e.g., "connect" or "disconnect")
Iface	string Network interface on the mesh node where the event occurred
Mac	string MAC address of the station
Router	string IP address of the mesh node reporting the event

Responses

Request samples

Payload
CLI

Content type

application/json

{"Event": "string",
"Iface": "string",
"Mac": "string",
"Router": "string"
}

Synchronize OTP settings

Tells the main router to sync the OTP code on the mesh nodes

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/mesh/syncOTP"

Mesh Node APIs

The mesh extension lets users grow the network with multiple SPR Access Points

Set leaf mode

Enable or disable leaf mode for the mesh node

Authorizations:

basicAuthbearerAuth

path Parameters

enable

required

string

Enum: "enable" "disable"

Responses

Request samples

CLI

curl -u "admin:pass" -X PUT \
  "http://192.168.2.1/plugins/mesh/leafMode/enable"

Synchronize devices

Mesh nodes handle this request when the main AP/Router sends down the devices listing

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

additional property

object (DeviceEntry)

Name	string Client Name
MAC	string HW address
WGPubKey	string PubKey
VLANTag	string VLANTag
RecentIP	string RecentIP
	object (PSKEntry)
Policies	Array of strings Policies for Device
Groups	Array of strings Interconnected Groups of Devices
DeviceTags	Array of strings Tags for Device

Responses

Request samples

Payload
CLI

Content type

application/json

{"property1": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
},
"property2": {"Name": "rpi4",
"MAC": "11:22:33:44:55:61",
"WGPubKey": "pubkey",
"VLANTag": "vlantag",
"RecentIP": "192.168.2.102",
"PSKEntry": {"Type": "sae",
"Psk": "password"
},
"Policies": ["wan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"tvs"
],
"DeviceTags": ["private"
]
}
}

Set SSID

The main router uses this call to set the SSID on mesh nodes

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

string

Responses

Request samples

Payload
CLI

Content type

application/json

"string"

Set OTP settings

The main router uses this call to sync the OTP login code on the mesh nodes

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

Token	string Authentication token for the request
	object (OTPSettings)

Responses

Request samples

Payload
CLI

Content type

application/json

{"Token": "string",
"Settings": {"OTPUsers": [{"Name": "string",
"Secret": "string",
"Confirmed": true,
"AlwaysOn": true
}
],
"JWTDurationSeconds": 0
}
}

Set parent credentials

Sets the credentials for the parent node in the mesh network, used for informing the parent about connection events

Authorizations:

basicAuthbearerAuth

Request Body schema: application/json
required

ParentIP	string
ParentAPIToken	string
ParentCA	string

Responses

Request samples

Payload
CLI

Content type

application/json

{"ParentIP": "string",
"ParentAPIToken": "string",
"ParentCA": "string"
}

Remove parent credentials

Removes the credentials for the parent node from the mesh node

Authorizations:

basicAuthbearerAuth

Responses

Request samples

CLI

curl -u "admin:pass" -X DELETE \
  "http://192.168.2.1/plugins/mesh/setParentCredentials"

Get mesh TLS certificate

Retrieves the TLS certificate for the mesh network. This endpoint implements HMAC Authentication using the mesh node's API key.

Authorizations:

basicAuthbearerAuth

header Parameters

X-SPR-Mesh-TLS-Hash

string

HMAC signature of the certificate file contents, using the Mesh's API Key. This header is used to verify the integrity and authenticity of the certificate. The client should validate this HMAC to ensure the certificate hasn't been tampered with.

Responses

Request samples

CLI

curl -u "admin:pass" \
  "http://192.168.2.1/plugins/mesh/cert

Wifid

Listens for requests on unix:///state/wifi/apisock

Report PSK auth failure

Request Body schema: application/json
required

PSKAuthFailure object that needs to be added

Type	string
MAC	string/^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/
Reason	string
Status	string

Responses

Request samples

Payload

Content type

application/json

{"Type": "sae",
"MAC": "11:22:33:44:55:66",
"Reason": "mismatch",
"Status": "Okay"
}

Report PSK auth success

Request Body schema: application/json
required

PSKAuthSuccess object that needs to be added

Iface	string
Event	string
MAC	string/^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/
Status	string

Responses

Request samples

Payload

Content type

application/json

{"Iface": "wlan1",
"Event": "AP-STA-CONNECTED",
"MAC": "11:22:33:44:55:66",
"Status": "Okay"
}

Get a space separated text listing of Wireless Interfaces

Responses

Response samples

200

Content type

application/text

[
  "wlan1 wlan2"
]

dhcpd

Listens for requests on unix:///state/dhcp/apisock

Update DHCP information

Handle networking tasks upon a DHCP

Request Body schema: application/json
required

DHCPUpdate object that needs to be added

IP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
MAC	string/^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/
Name	string
Iface	string
Router	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/

Responses

Request samples

Payload

Content type

application/json

{"IP": "192.168.2.102",
"MAC": "11:22:33:44:55:66",
"Name": "rpi4",
"Iface": "wlan1",
"Router": "192.168.2.1"
}

wireguard

Listens for requests on unix:///state/plugins/wireguard/apisock

Update Wireguard Peer

Handle networking tasks for a new wireguard peer

Request Body schema: application/json
required

WireguardUpdate object that needs to be added

IP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
PublicKey	string Base64 public key
Iface	string
Name	string

Responses

Request samples

Payload

Content type

application/json

{"IP": "192.168.2.102",
"PublicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"Iface": "wg0",
"Name": "wfh-laptop"
}

Delete wireguard peer

Handle networking tasks for removing a wireguard peer

Request Body schema: application/json
required

WireguardUpdate object that needs to be added

IP	string/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
PublicKey	string Base64 public key
Iface	string
Name	string

Responses

Request samples

Payload

Content type

application/json

{"IP": "192.168.2.102",
"PublicKey": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI=",
"Iface": "wg0",
"Name": "wfh-laptop"
}

Superd

Listens for requests on unix:///state/plugins/superd/socket

Run docker compose up -d on a service

path Parameters

service required	string Name of service
compose_file required	string Compose file to run

Responses

Run docker compose restart on a service

path Parameters

service required	string Name of service
compose_file required	string Compose file to run

Responses

Run docker compose pull on a service

path Parameters

service required	string Name of service
compose_file required	string Compose file to run

Responses

Run docker compose stop on a service

path Parameters

service required	string Name of service
compose_file required	string Compose file to run

Responses

Authenticate to GHCR

query Parameters

username	string username
secret	string Secret

Responses

Update PLUS extension git repostiory

query Parameters

git_url

string

git url to update clone into plus extensions and update

Responses

Get Version from git

Get latest tag from git repository specified by the plugin parameter

query Parameters

plugin

string

plugin to get version for

Responses

Request samples

CLI

curl --unix-socket \
  state/plugins/superd/socket \
  http://localhost/git_version

Response samples

200

Content type

application/json

"v0.1.23"

Get Version for docker container

Get latest tag from docker specified by the container parameter

query Parameters

container

string

container to get version for

Responses

Request samples

CLI

curl --unix-socket \
  state/plugins/superd/socket \
  http://localhost/container_version

Response samples

200

Content type

application/json

"0.1.23"

tinysubnets

Listens for requests on unix:///state/dhcp/tinysubnets_plugin

DHCPRequest - Reserves an IP

Reserves an IP address for plugins like wireguard to assign to clients

Request Body schema: application/json
required

AbstractDHCPRequest for requesting an IP by an Identifier

Identifier

string

Responses

Request samples

Payload

Content type

application/json

{"Identifier": "7SdFRh8o76RjUn/y4c7cQgCcCXA85s47/gVAdem3bBI="
}

Device

Name	string Client Name
MAC	string HW address
WGPubKey	string PubKey
VLANTag	string VLANTag
RecentIP	string RecentIP
	object (PSKEntry)
Policies	Array of strings Policies for Device
Groups	Array of strings Interconnected Groups of Devices
DeviceTags	Array of strings Tags for Device

{"Name": "mbp",
"MAC": "11:22:33:44:55:66",
"WGPubKey": "",
"VLANTag": "",
"RecentIP": "192.168.2.102",
"PskEntry": {"Type": "sae",
"Psk": "**"
},
"Policies": ["wan",
"lan",
"dns",
"lan_upstream"
],
"Groups": ["cameras",
"lightbulbs"
],
"DeviceTags": ["private"
]
}

Group

Name	string Unique Group Name
Disabled	boolean If Group is disabled
GroupTags	Array of strings Tags for Group

{"Name": "vpn",
"Disabled": false,
"GroupTags": ["private"
]
}

PSK

Type	string Enum: "sae" "wpa" sae for WPA3 or wpa for WPA2
Psk	string Password

{"Type": "sae",
"Psk": "password"
}

Plugin

Name	string Plugin name
URI	string Plugin URI
UnixPath	string Plugin path for unix socket
Enabled	boolean Plugin state
Plus	boolean Indicates if this is a PLUS plugin
GitURL	string Git repository URL for the plugin
ComposeFilePath	string Relative path to docker compose file
HasUI	boolean Indicates if the plugin has a user interface
SandboxedUI	boolean Indicates if the plugin UI is sandboxed
InstallTokenPath	string Path to the installation token
ScopedPaths	Array of strings List of scoped paths for the plugin

{"Name": "dns-block",
"URI": "dns/block",
"UnixPath": "/state/dns/dns_block_plugin",
"Enabled": true
}

Secure Programmable Router API (1.1.13)

Introduction

Authentication

Configuration

OTP Notes

basicAuth

bearerAuth

OTPAuth

API Plugins

Devices

Get Devices

Authorizations:

Responses

Request samples

Response samples

Sync Devices

Authorizations:

Request Body schema: application/jsonrequired

Responses

Request samples

Delete Devices

Authorizations:

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Get Device including PSK

Authorizations:

path Parameters

Responses

Request samples

Response samples

Update Device

Authorizations:

path Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Delete Device

Authorizations:

path Parameters

Responses

Request samples

Bulk Update Devices

Authorizations:

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Groups

Get all Groups

Authorizations:

Responses

Request samples

Response samples

Add Group

Authorizations:

Request Body schema: application/jsonrequired

Responses

Request samples

Delete Group

Authorizations:

Request Body schema: application/jsonrequired

Responses

Request samples

Network Information

IP Address Information

Authorizations:

Responses

Request samples

Response samples

Set Link State

Authorizations:

path Parameters

Responses

Request samples

NFTable Verdict Map

Authorizations:

path Parameters

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required