"description":"Programmatic interface to a 3X-UI panel. Authenticate either by logging in (cookie) or with an API token from Settings → Security → API Token (Bearer). All endpoints under /panel/api/* honour both modes."
},
"servers":[
{
"url":"/",
"description":"Current panel (basePath aware)"
}
],
"components":{
"securitySchemes":{
"bearerAuth":{
"type":"http",
"scheme":"bearer",
"description":"API token from Settings → Security → API Token. Send as `Authorization: Bearer <token>`."
},
"cookieAuth":{
"type":"apiKey",
"in":"cookie",
"name":"3x-ui",
"description":"Session cookie set by POST /login. Browser-only."
}
}
},
"security":[
{
"bearerAuth":[]
},
{
"cookieAuth":[]
}
],
"tags":[
{
"name":"Authentication",
"description":"Two authentication modes are supported. UI sessions use a cookie set by the login endpoint. Programmatic clients (bots, scripts, remote panels) authenticate with a Bearer token taken from Settings → Security → API Token. Both work for every endpoint under /panel/api/*."
},
{
"name":"Inbounds",
"description":"Manage inbound configurations and their clients. All endpoints live under /panel/api/inbounds and require a logged-in session or Bearer token. Link-generating endpoints honour forwarded headers only when the request comes from a configured trusted proxy."
},
{
"name":"Server",
"description":"System status, log retrieval, certificate generators, Xray binary management, and backup/restore. All under /panel/api/server."
},
{
"name":"Clients",
"description":"Manage clients as first-class entities that can be attached to one or more inbounds. A single client row drives the settings.clients entry in every inbound it belongs to. Endpoints live under /panel/api/clients."
},
{
"name":"Nodes",
"description":"Manage remote 3x-ui panels acting as nodes for a central panel. All endpoints under /panel/api/nodes."
},
{
"name":"Custom Geo",
"description":"Manage user-supplied GeoIP / GeoSite source files. All endpoints under /panel/api/custom-geo."
},
{
"name":"Backup",
"description":"Operations that interact with the configured Telegram bot."
},
{
"name":"Settings",
"description":"Panel configuration and user credentials. All endpoints live under /panel/setting and require a logged-in session or Bearer token."
},
{
"name":"API Tokens",
"description":"Manage Bearer tokens used for programmatic auth (bots, central panels acting on this node, CI). Each token has a unique name and an enabled flag — disable to revoke without deleting, delete to revoke permanently. Tokens are stored plaintext so the SPA can show them on demand. Send one as <code>Authorization: Bearer <token></code> on any /panel/api/* request."
},
{
"name":"Xray Settings",
"description":"Xray configuration template, outbound management, Warp/Nord integration, and config testing. All endpoints under /panel/xray."
},
{
"name":"Subscription Server",
"description":"A separate HTTP/HTTPS server that serves proxy subscription links (standard, JSON, and Clash) to clients. The server listens on its own port (default 10882) and is configured in Settings → Subscription. Paths are configurable; defaults are shown below. All subscription endpoints set response headers for client apps to read traffic/expiry info."
},
{
"name":"WebSocket",
"description":"Real-time status updates via WebSocket. Connect once at <code>ws://<panel>/ws</code> to receive a stream of JSON messages without polling. Requires an authenticated session cookie (Bearer token auth is not supported). Each message has a <code>type</code> field that identifies the payload shape."
}
],
"paths":{
"/login":{
"post":{
"tags":[
"Authentication"
],
"summary":"Authenticate with username + password and receive a session cookie. Required before any cookie-based API call.",
"operationId":"post_login",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"username":{
"type":"string",
"description":"Panel admin username."
},
"password":{
"type":"string",
"description":"Panel admin password."
},
"twoFactorCode":{
"type":"string",
"description":"OTP code when 2FA is enabled. Omit otherwise."
}
},
"required":[
"username",
"password",
"twoFactorCode"
]
},
"example":{
"username":"admin",
"password":"admin",
"twoFactorCode":"123456"
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"msg":"Logged in successfully"
}
}
}
},
"400":{
"description":"Error response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
}
}
},
"example":{
"success":false,
"msg":"Wrong username or password"
}
}
}
}
}
}
},
"/logout":{
"post":{
"tags":[
"Authentication"
],
"summary":"Clear the session cookie. Requires the CSRF header for browser sessions.",
"operationId":"post_logout",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true
}
}
}
}
}
}
},
"/csrf-token":{
"get":{
"tags":[
"Authentication"
],
"summary":"Mint a CSRF token for the current session. The SPA replays it in the X-CSRF-Token header on unsafe requests. Bearer-token callers can skip this — the middleware short-circuits CSRF for authenticated API requests.",
"operationId":"get_csrf_token",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":"csrf-token-string"
}
}
}
}
}
}
},
"/getTwoFactorEnable":{
"post":{
"tags":[
"Authentication"
],
"summary":"Returns whether 2FA is enabled on the panel — used by the login page to decide whether to show the OTP field.",
"operationId":"post_getTwoFactorEnable",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":false
}
}
}
}
}
}
},
"/panel/api/inbounds/list":{
"get":{
"tags":[
"Inbounds"
],
"summary":"List every inbound owned by the authenticated user, including each inbound’s clientStats traffic counters. settings, streamSettings, and sniffing are returned as nested JSON objects (no escaped strings); legacy callers that send them back as JSON-encoded strings are still accepted on write.",
"operationId":"get_panel_api_inbounds_list",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":[
{
"id":1,
"userId":1,
"up":0,
"down":0,
"total":0,
"remark":"VLESS-443",
"enable":true,
"expiryTime":0,
"listen":"",
"port":443,
"protocol":"vless",
"settings":{
"clients":[],
"decryption":"none"
},
"streamSettings":{
"network":"tcp",
"security":"reality",
"realitySettings":{
"show":false,
"dest":"..."
}
},
"tag":"inbound-443",
"sniffing":{
"enabled":true,
"destOverride":[
"http",
"tls"
]
},
"clientStats":[]
}
]
}
}
}
}
}
}
},
"/panel/api/inbounds/list/slim":{
"get":{
"tags":[
"Inbounds"
],
"summary":"Same shape as /list but with settings.clients[] stripped down to {email, enable, comment} and ClientStats not enriched with UUID/SubId. Use this for list pages; fetch /get/:id when you need the full per-client payload (uuid, password, flow, ...).",
"operationId":"get_panel_api_inbounds_list_slim",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":[
{
"id":1,
"userId":1,
"remark":"VLESS-443",
"settings":{
"clients":[
{
"email":"alice",
"enable":true
}
],
"decryption":"none"
},
"clientStats":[]
}
]
}
}
}
}
}
}
},
"/panel/api/inbounds/options":{
"get":{
"tags":[
"Inbounds"
],
"summary":"Lightweight picker projection of the authenticated user’s inbounds. Returns only id, remark, protocol, port, and a server-computed tlsFlowCapable flag (true for VLESS / port-fallback on TCP with tls or reality). Use this for dropdowns and attach pickers — it skips settings, streamSettings, and clientStats so the payload stays small even on panels with thousands of clients.",
"operationId":"get_panel_api_inbounds_options",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":[
{
"id":1,
"remark":"VLESS-443",
"protocol":"vless",
"port":443,
"tlsFlowCapable":true
}
]
}
}
}
}
}
}
},
"/panel/api/inbounds/get/{id}":{
"get":{
"tags":[
"Inbounds"
],
"summary":"Fetch a single inbound by numeric ID.",
"operationId":"get_panel_api_inbounds_get_id",
"parameters":[
{
"name":"id",
"in":"path",
"required":true,
"description":"Inbound ID.",
"schema":{
"type":"integer"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/api/inbounds/add":{
"post":{
"tags":[
"Inbounds"
],
"summary":"Create a new inbound. Send the full inbound payload (protocol, port, settings, streamSettings, sniffing, remark, expiryTime, total, enable). settings, streamSettings, and sniffing may be sent as nested JSON objects (preferred) or as JSON-encoded strings (legacy).",
"operationId":"post_panel_api_inbounds_add",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object"
},
"example":{
"enable":true,
"remark":"VLESS-443",
"listen":"",
"port":443,
"protocol":"vless",
"expiryTime":0,
"total":0,
"settings":{
"clients":[
{
"id":"...",
"email":"user1"
}
],
"decryption":"none",
"fallbacks":[]
},
"streamSettings":{
"network":"tcp",
"security":"reality",
"realitySettings":{
"show":false,
"dest":"..."
}
},
"sniffing":{
"enabled":true,
"destOverride":[
"http",
"tls"
]
}
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
},
"400":{
"description":"Error response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
}
}
},
"example":{
"success":false,
"msg":"Port 443 is already in use"
}
}
}
}
}
}
},
"/panel/api/inbounds/del/{id}":{
"post":{
"tags":[
"Inbounds"
],
"summary":"Delete an inbound by ID. Also removes its associated client stats rows.",
"operationId":"post_panel_api_inbounds_del_id",
"parameters":[
{
"name":"id",
"in":"path",
"required":true,
"description":"Inbound ID.",
"schema":{
"type":"integer"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/api/inbounds/update/{id}":{
"post":{
"tags":[
"Inbounds"
],
"summary":"Replace an inbound’s configuration. Body shape mirrors /add. Heavy on inbounds with thousands of clients — prefer /setEnable for enable-only flips.",
"summary":"Bulk-import an inbound from a JSON blob (e.g. one exported via the UI). The body uses form encoding with a single \"data\" field.",
"operationId":"post_panel_api_inbounds_import",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/api/inbounds/{id}/fallbacks":{
"get":{
"tags":[
"Inbounds"
],
"summary":"List the fallback rules attached to a master VLESS/Trojan TCP-TLS inbound. Each rule links one child inbound (the dest) to optional SNI/ALPN/path/xver match criteria.",
"summary":"Real-time machine snapshot: CPU, memory, swap, disk, network IO, load averages, open connections, Xray state. Cached and refreshed every 2 seconds in the background.",
"operationId":"get_panel_api_server_status",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":{
"cpu":12.5,
"mem":{
"current":2147483648,
"total":8589934592
},
"swap":{
"current":0,
"total":4294967296
},
"disk":{
"current":53687091200,
"total":268435456000
},
"netIO":{
"up":1073741824,
"down":2147483648
},
"xray":{
"state":"running",
"version":"v25.10.31"
},
"tcpCount":42,
"load":{
"load1":0.5,
"load5":0.3,
"load15":0.2
}
}
}
}
}
}
}
}
},
"/panel/api/server/cpuHistory/{bucket}":{
"get":{
"tags":[
"Server"
],
"summary":"Legacy: aggregated CPU history. Use /history/cpu/:bucket instead — same data with a uniform {t, v} shape.",
"summary":"Xray runtime metrics state — whether the xray config has a `metrics` block, which expvar keys are flowing, and the current snapshot values for each. Returns an empty state when metrics are not configured.",
"summary":"Latest snapshot from the Xray observatory — per-outbound latency, health status, and last-probe time. Only populated when the Xray config has an observatory configured.",
"summary":"List every client with its attached inbound IDs and traffic record. The reverse field, if set, is returned as a nested JSON object (legacy JSON-encoded-string form is still accepted on write).",
"operationId":"get_panel_api_clients_list",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":[
{
"id":1,
"email":"alice@example.com",
"subId":"abcd1234",
"uuid":"...",
"totalGB":53687091200,
"expiryTime":1735689600000,
"enable":true,
"reverse":null,
"inboundIds":[
3,
5
],
"traffic":{
"up":1024,
"down":4096,
"enable":true
}
}
]
}
}
}
}
}
}
},
"/panel/api/clients/list/paged":{
"get":{
"tags":[
"Clients"
],
"summary":"Filter, sort, and paginate clients on the server. Each item is a slim row (no uuid/password/auth/flow/security/reverse/tgId) so the clients page can ship 25-ish rows in a few KB instead of the full table. The response also includes a summary computed across the full DB row set so dashboard counters stay stable as the user paginates or filters. Page size capped at 200; fetch /get/:email to obtain the full per-client payload for an edit/info modal.",
"operationId":"get_panel_api_clients_list_paged",
"parameters":[
{
"name":"page",
"in":"query",
"required":true,
"description":"1-indexed page number. Defaults to 1.",
"schema":{
"type":"integer"
}
},
{
"name":"pageSize",
"in":"query",
"required":true,
"description":"Rows per page. Defaults to 25, capped at 200.",
"schema":{
"type":"integer"
}
},
{
"name":"search",
"in":"query",
"required":true,
"description":"Case-insensitive substring match on email / subId / comment.",
"summary":"Create a new client and attach it to one or more inbounds in a single call. Body is JSON. Per-protocol secrets (UUID for VLESS/VMess, password for Trojan/Shadowsocks, auth for Hysteria) are generated server-side when omitted, so callers can send only the universal fields.",
"operationId":"post_panel_api_clients_add",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object"
},
"example":{
"client":{
"email":"alice@example.com",
"totalGB":53687091200,
"expiryTime":1735689600000,
"tgId":0,
"limitIp":0,
"enable":true
},
"inboundIds":[
3,
5
]
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"msg":"Client added"
}
}
}
}
}
}
},
"/panel/api/clients/update/{email}":{
"post":{
"tags":[
"Clients"
],
"summary":"Update an existing client by email. Changes propagate to every attached inbound. Body is the JSON client payload — supply the full set of fields you want to keep (the server replaces the row, it does not patch).",
"summary":"Reset the up/down counters for every client globally. Quotas and expiry are not affected. Triggers an Xray restart if any counter actually moved.",
"summary":"Delete every client whose traffic quota is exhausted (used >= total, when reset is disabled) or whose expiry has passed. Returns the deleted count and triggers an Xray restart when any client was on a running inbound.",
"summary":"Shift expiry and/or traffic quota for many clients in one call. addDays/addBytes may be negative. Clients with unlimited expiry (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the corresponding field — bulk extend never converts unlimited to limited. Returns the adjusted count and per-email skip reasons.",
"summary":"Delete many clients in one call. The server processes the list sequentially so each delete sees the committed state of the previous one — avoids the race the per-email fan-out had on the panel side. Pass keepTraffic=true to retain the xray_client_traffic rows after deletion.",
"operationId":"post_panel_api_clients_bulkDel",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object"
},
"example":{
"emails":[
"alice",
"bob"
],
"keepTraffic":false
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":{
"deleted":2,
"skipped":[
{
"email":"carol",
"reason":"client not found"
}
]
}
}
}
}
}
}
}
},
"/panel/api/clients/bulkCreate":{
"post":{
"tags":[
"Clients"
],
"summary":"Create many clients in one call. Body is a JSON array of {client, inboundIds} payloads — the same shape /add accepts. Items are processed sequentially; per-email skip reasons are returned for items that fail (e.g., duplicate email). Triggers a single Xray restart at the end if any inbound was running.",
"summary":"Zero out a single client’s up/down counters. Re-enables the client across every attached inbound and pushes the change to Xray (or the remote node) so depleted users can connect again immediately.",
"description":"Client email (unique across the panel).",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"success":true,
"obj":{
"email":"user1",
"up":1048576,
"down":2097152,
"total":10737418240,
"expiryTime":1735689600000
}
}
}
}
}
}
}
},
"/panel/api/clients/subLinks/{subId}":{
"get":{
"tags":[
"Clients"
],
"summary":"Return every protocol URL (vless://, vmess://, trojan://, ss://, hysteria://, hy2://) for clients matching the subscription ID. Same result set as /sub/<subId>, but as a JSON array — no base64. When an inbound has streamSettings.externalProxy set, one URL is emitted per external proxy. Empty array when the subId has no enabled clients.",
"summary":"Return every URL for one client across all attached inbounds — the same strings the Copy URL button copies in the panel UI. Supported protocols: vmess, vless, trojan, shadowsocks, hysteria. If streamSettings.externalProxy is set, returns one URL per external proxy. Protocols without a URL form (socks, http, mixed, wireguard, dokodemo, tunnel) contribute nothing.",
"summary":"Persist every setting at once. The body mirrors the shape returned by /all. Invalid values (bad ports, missing cert pairs, etc.) are rejected before write.",
"operationId":"post_panel_setting_update",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object"
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/setting/updateUser":{
"post":{
"tags":[
"Settings"
],
"summary":"Change the panel admin username and password. Requires the current credentials for verification. The session is refreshed with the new values on success.",
"operationId":"post_panel_setting_updateUser",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"oldUsername":{
"type":"string",
"description":"Current admin username."
},
"oldPassword":{
"type":"string",
"description":"Current admin password."
},
"newUsername":{
"type":"string",
"description":"Desired new username."
},
"newPassword":{
"type":"string",
"description":"Desired new password."
}
},
"required":[
"oldUsername",
"oldPassword",
"newUsername",
"newPassword"
]
},
"example":{
"oldUsername":"admin",
"oldPassword":"admin",
"newUsername":"newadmin",
"newPassword":"newpass"
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/setting/restartPanel":{
"post":{
"tags":[
"Settings"
],
"summary":"Restart the entire 3x-ui process after a 3-second grace period. The connection drops immediately; the panel comes back online ~5-10 seconds later.",
"operationId":"post_panel_setting_restartPanel",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/setting/getDefaultJsonConfig":{
"get":{
"tags":[
"Settings"
],
"summary":"Return the built-in default Xray JSON config template that ships with this panel version.",
"summary":"Return the Xray config template (JSON string), available inbound tags, client reverse tags, and the configured outbound test URL in one response.",
"summary":"Return the most recent Xray process stdout/stderr output. Useful to check for startup errors or runtime warnings.",
"operationId":"get_panel_xray_getXrayResult",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/xray/update":{
"post":{
"tags":[
"Xray Settings"
],
"summary":"Save the Xray JSON config template and optionally the outbound test URL. Both are sent as form fields.",
"operationId":"post_panel_xray_update",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/xray/warp/{action}":{
"post":{
"tags":[
"Xray Settings"
],
"summary":"Manage Cloudflare Warp integration. The action parameter selects the operation.",
"operationId":"post_panel_xray_warp_action",
"parameters":[
{
"name":"action",
"in":"path",
"required":true,
"description":"data — return Warp stats (quota, remaining). del — delete Warp data. config — return current Warp config. reg — register a new Warp endpoint (sends privateKey, publicKey). license — set a Warp+ license key (sends license).",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/xray/nord/{action}":{
"post":{
"tags":[
"Xray Settings"
],
"summary":"Manage NordVPN integration. The action parameter selects the operation.",
"operationId":"post_panel_xray_nord_action",
"parameters":[
{
"name":"action",
"in":"path",
"required":true,
"description":"countries — list available countries. servers — list servers in a country (sends countryId). reg — get NordVPN credentials (sends token). setKey — store NordVPN API key (sends key). data — return current NordVPN connection data. del — delete NordVPN data.",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/panel/xray/resetOutboundsTraffic":{
"post":{
"tags":[
"Xray Settings"
],
"summary":"Reset traffic counters for a specific outbound by tag.",
"summary":"Test an outbound configuration. Sends the outbound JSON (required), optionally all outbounds (to resolve sockopt.dialerProxy dependencies), and a mode flag.",
"operationId":"post_panel_xray_testOutbound",
"requestBody":{
"required":true,
"content":{
"application/json":{
"schema":{
"type":"object"
}
}
}
},
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/{subPath}{subid}":{
"get":{
"tags":[
"Subscription Server"
],
"summary":"Return base64-encoded subscription links for all enabled clients matching the subscription ID. When the request has an Accept: text/html header or ?html=1, renders a styled info page instead. Default path: /sub/:subid.",
"operationId":"get_subPath_subid",
"parameters":[
{
"name":"subid",
"in":"path",
"required":true,
"description":"Client subscription ID.",
"schema":{
"type":"string"
}
},
{
"name":"subPath",
"in":"path",
"required":true,
"description":"",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/{jsonPath}{subid}":{
"get":{
"tags":[
"Subscription Server"
],
"summary":"Return subscription as a JSON array of proxy configs (one per enabled client). Only when JSON subscription is enabled in settings. Default path: /json/:subid.",
"operationId":"get_jsonPath_subid",
"parameters":[
{
"name":"subid",
"in":"path",
"required":true,
"description":"Client subscription ID.",
"schema":{
"type":"string"
}
},
{
"name":"jsonPath",
"in":"path",
"required":true,
"description":"",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/{clashPath}{subid}":{
"get":{
"tags":[
"Subscription Server"
],
"summary":"Return subscription as a Clash/Mihomo-compatible YAML config. Only when Clash subscription is enabled in settings. Default path: /clash/:subid.",
"operationId":"get_clashPath_subid",
"parameters":[
{
"name":"subid",
"in":"path",
"required":true,
"description":"Client subscription ID.",
"schema":{
"type":"string"
}
},
{
"name":"clashPath",
"in":"path",
"required":true,
"description":"",
"schema":{
"type":"string"
}
}
],
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"/ws":{
"get":{
"tags":[
"WebSocket"
],
"summary":"Upgrade an HTTP connection to a WebSocket. Requires an authenticated session cookie (Bearer token auth is not supported here). Returns 101 Switching Protocols on success. The server then pushes JSON messages described below.",
"operationId":"get_ws",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
}
}
}
}
}
}
},
"→ type: status":{
"ws":{
"tags":[
"WebSocket"
],
"summary":"Server health snapshot pushed every 2 seconds. Contains CPU, memory, swap, disk, network IO, load, and Xray state — same shape as <code>GET /panel/api/server/status</code>.",
"operationId":"ws_type_status",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"type":"status",
"data":{
"cpu":12.5,
"mem":{
"current":2147483648,
"total":8589934592
},
"xray":{
"state":"running"
}
}
}
}
}
}
}
}
},
"→ type: xrayState":{
"ws":{
"tags":[
"WebSocket"
],
"summary":"Xray process state change. Fired when Xray starts, stops, or encounters an error.",
"operationId":"ws_type_xrayState",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"type":"xrayState",
"data":"running"
}
}
}
}
}
}
},
"→ type: notification":{
"ws":{
"tags":[
"WebSocket"
],
"summary":"In-panel toast notification. Fired on Xray stop/restart, DB import, panel restart, etc.",
"operationId":"ws_type_notification",
"responses":{
"200":{
"description":"Successful response",
"content":{
"application/json":{
"schema":{
"type":"object",
"properties":{
"success":{
"type":"boolean"
},
"msg":{
"type":"string"
},
"obj":{}
}
},
"example":{
"type":"notification",
"title":"Xray service restarted",
"body":"Xray has been restarted successfully",
"severity":"success"
}
}
}
}
}
}
},
"→ type: invalidate":{
"ws":{
"tags":[
"WebSocket"
],
"summary":"Instructs the UI to re-fetch a resource. Fired when another admin session modifies data (e.g. toggling inbound enable).",
