REST API reference

Generated page

Generated from freesense src/etc/inc/restapi/; do not edit by hand. Regenerate it with node scripts/generate-api-reference.mjs <freesense checkout>.

This reference lists the 467 endpoints of the base system’s REST API (API level 8). All paths are below https://<firewall>/api. Optional packages can add further endpoints; those are listed in the firewall’s own OpenAPI document (GET /api/v1/openapi.json) and in the API Explorer, not here.

How to read the tables:

• Scope is the permission the endpoint needs, <area>:read or <area>:write. A write scope includes read.
• Access names the WebUI page that grants the scope: a user who may open that page may call the endpoint. The REST API - <area> privileges listed under each area grant the same scope without any WebUI access. An API key limited to scopes must also include the scope.
• Write endpoints are refused for read-only keys and for users with the “User - Config: Deny Config Write” privilege.
• Path parameters are shown in braces, for example {name}. “Body” and “Query” summarize what the endpoint accepts, as declared in the route table.

See REST API overview for authentication, errors and staging, and Getting started with the REST API for worked examples.

Capabilities reported by GET /api/v1/meta: session, batch, log-cursors, jobs, me, schemas, log-webui, meta, history, top-talkers, update-center, schedules-vips, nat-v2, dns-resolver, assignments, routing-v2, dhcp-server.

Areas

Area	Covers	Endpoints
(none)	Any authenticated key	16
system	System information	7
status	Status (interfaces, gateways, services, ARP, DHCP leases)	10
config	Configuration history and revert	4
backup	Remote backups	4
firewall.aliases	Firewall aliases	6
firewall.rules	Firewall rules	11
firewall.nat	Firewall NAT (port forward, 1:1, outbound, NPt)	32
firewall.schedules	Firewall schedules	5
firewall.vips	Firewall virtual IPs	6
routing	Gateways and static routes	21
interfaces	Interfaces (VLAN, VXLAN, GIF, GRE, LAGG, QinQ, bridges, groups, assignments)	52
services.dns	DNS services (DNS Forwarder, DNS Resolver)	39
services.misc	Other services (UPnP IGD & PCP, Wake-on-LAN, IGMP Proxy, SNMP, DHCP/DHCPv6 Relay)	26
services.time	NTP server (settings and access restrictions)	4
services.ddns	Dynamic DNS (Dynamic DNS and RFC 2136 clients)	16
services.dhcp	DHCP and DHCPv6 servers, static mappings and router advertisements	53
vpn.ipsec	IPsec (tunnels, pre-shared keys, status)	22
vpn.l2tp	L2TP VPN server and users	7
vpn.openvpn	OpenVPN servers, clients and client-specific overrides	16
pki	Certificates, certificate authorities and revocation lists	23
users	Users, groups, privileges and authentication servers	26
system.settings	System settings (general setup, high availability, update settings, admin access, advanced firewall, networking, miscellaneous, notifications, tunables)	27
logs	System logs (read)	4
packages	Packages and system version (lists, update check, install, reinstall, remove, system update)	18
diagnostics	Diagnostics (ping, traceroute, DNS lookup, states)	6
operations	System operations (service start/stop/restart, state table reset, reboot, halt)	6

General endpoints

These endpoints belong to no permission area: any valid API key of a user with REST API access may call them.

Endpoint	Description	Scope	Access
GET /api/v1/openapi.json	This OpenAPI document.	-	any valid key
POST /api/v1/batch	Run up to 20 GET requests in one call; each is authorized and answered as if sent alone. Changes nothing (POST for the request body).	-	any valid key
GET /api/v1/schema/{area}/{name}	Form schema of a resource (fields, labels, options, rules) for the WebUI editors; needs the editor’s privilege.	-	any valid key
GET /api/v1/meta	API level and capabilities of this firewall (used by the WebUI to check compatibility).	-	any valid key
GET /api/v1/me	The user and API key making the request.	-	any valid key
DELETE /api/v1/me/api-keys	Revoke all of your own API keys, including the one making this request.	-	any valid key
POST /api/v1/me/signout	Sign out of this WebUI session.	-	any valid key
GET /api/v1/me/profile	Your profile: name, email, groups, initials.	-	any valid key
PUT /api/v1/me/profile	Change your display name and email (local users).	-	any valid key
GET /api/v1/me/preferences	Your WebUI preferences: theme, mode, accent, density, start page.	-	any valid key
PUT /api/v1/me/preferences	Change some of your WebUI preferences.	-	any valid key
GET /api/v1/me/sessions	Your signed-in WebGUI sessions.	-	any valid key
DELETE /api/v1/me/sessions/{id}	Sign out one of your other WebGUI sessions.	-	any valid key
GET /api/v1/dashboard/layout	Your dashboard layout (null: the default layout).	-	any valid key
PUT /api/v1/dashboard/layout	Save your dashboard layout.	-	any valid key
DELETE /api/v1/dashboard/layout	Reset your dashboard to the default layout.	-	any valid key

System information (system)

System information.

API-only privileges: “REST API - System information: read” (api-system-read) and “REST API - System information: write” (api-system-write).

Endpoint	Description	Scope	Access
GET /api/v1/system/info	Hostname, version, platform and uptime.	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
GET /api/v1/status/system	Live system metrics: CPU, memory, swap, mbufs, states, temperatures, disks, uptime.	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
GET /api/v1/status/system/history	CPU and memory use in percent over time (system RRDs). Query: range (10m, 1h, 24h, 7d or 30d).	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
GET /api/v1/status/vpn	OpenVPN, IPsec and WireGuard tunnels: status, peer, uptime or last handshake, bytes in and out.	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
GET /api/v1/status/top-talkers	Hosts on an interface’s IPv4 subnet moving the most traffic (one-second sample, bits/s). Query: interface (interface name (default lan)).	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
GET /api/v1/notices	System notices.	system:read	index.php (WebCfg - System: Login / Logout / Dashboard)
DELETE /api/v1/notices/{id}	Dismiss a notice (“all” dismisses every notice).	system:write	index.php (WebCfg - System: Login / Logout / Dashboard)

Status (status)

Status (interfaces, gateways, services, ARP, DHCP leases).

API-only privileges: “REST API - Status (interfaces, gateways, services, ARP, DHCP leases): read” (api-status-read) and “REST API - Status (interfaces, gateways, services, ARP, DHCP leases): write” (api-status-write).

Endpoint	Description	Scope	Access
GET /api/v1/status/interfaces	Status and counters of the assigned interfaces.	status:read	status_interfaces.php (WebCfg - Status: Interfaces)
GET /api/v1/status/gateways	Gateway monitoring status (latency, loss, state).	status:read	status_gateways.php (WebCfg - Status: Gateways)
GET /api/v1/status/services	Services and whether they are running.	status:read	status_services.php (WebCfg - Status: Services)
GET /api/v1/status/arp	ARP table.	status:read	diag_arp.php (WebCfg - Diagnostics: ARP Table)
GET /api/v1/status/ndp	NDP table (IPv6 neighbors).	status:read	diag_ndp.php (WebCfg - Diagnostics: NDP Table)
GET /api/v1/status/dhcp-leases	DHCPv4 leases.	status:read	status_dhcp_leases.php (WebCfg - Status: DHCP leases)
GET /api/v1/status/traffic	Current traffic rates (bits/s, packets/s) and byte counters per interface. Query: if (Comma-separated interfaces (wan,lan,opt1); all when omitted).	status:read	status_graph.php (WebCfg - Status: Traffic Graph)
GET /api/v1/status/traffic/history	Traffic history in bits/s from the interface RRD. Query: if (Interface (wan, lan, opt1)), range (10m, 1h, 24h, 7d or 30d).	status:read	status_graph.php (WebCfg - Status: Traffic Graph)
GET /api/v1/status/gateways/history	Latency, jitter (ms) and loss (%) of every gateway over time (quality RRDs). Query: range (10m, 1h, 24h, 7d or 30d).	status:read	status_gateways.php (WebCfg - Status: Gateways)
GET /api/v1/status/states	State table size, limit and search/insert/removal rates.	status:read	diag_states_summary.php (WebCfg - Diagnostics: States Summary)

Configuration history and revert (config)

Configuration history and revert.

API-only privileges: “REST API - Configuration history and revert: read” (api-config-read) and “REST API - Configuration history and revert: write” (api-config-write).

Endpoint	Description	Scope	Access
GET /api/v1/config/revisions	Configuration history (newest first).	config:read	diag_confbak.php (WebCfg - Diagnostics: Configuration History)
GET /api/v1/config/revisions/{time}	Download a configuration revision as XML (“current” for the running one). Returns application/xml.	config:read	diag_confbak.php (WebCfg - Diagnostics: Configuration History)
GET /api/v1/config/revisions/{time}/diff	Unified diff between a revision and another revision. Query: against (Revision time to compare with, or “current” (default)). Returns text/plain.	config:read	diag_confbak.php (WebCfg - Diagnostics: Configuration History)
POST /api/v1/config/revisions/{time}/restore	Revert the running configuration to a revision. Body: confirm (boolean, required).	config:write	diag_confbak.php (WebCfg - Diagnostics: Configuration History)

Remote backups (backup)

Remote backups.

API-only privileges: “REST API - Remote backups: read” (api-backup-read) and “REST API - Remote backups: write” (api-backup-write).

Endpoint	Description	Scope	Access
GET /api/v1/backup/remote	Remote backup settings, targets and last results (no secrets).	backup:read	diag_backup_remote.php (WebCfg - Diagnostics: Backup & Restore: Remote Backup)
POST /api/v1/backup/remote/run	Run remote backups now. Body: target (string), force (boolean).	backup:write	diag_backup_remote.php (WebCfg - Diagnostics: Backup & Restore: Remote Backup)
POST /api/v1/backup/remote/targets/{id}/test	Upload, list and delete a probe file on a target.	backup:write	diag_backup_remote.php (WebCfg - Diagnostics: Backup & Restore: Remote Backup)
GET /api/v1/backup/remote/targets/{id}/files	Backups of this firewall stored on a target (newest first).	backup:read	diag_backup_remote.php (WebCfg - Diagnostics: Backup & Restore: Remote Backup)

Firewall aliases (firewall.aliases)

Firewall aliases.

API-only privileges: “REST API - Firewall aliases: read” (api-firewall-aliases-read) and “REST API - Firewall aliases: write” (api-firewall-aliases-write).

Endpoint	Description	Scope	Access
GET /api/v1/firewall/aliases	List aliases.	firewall.aliases:read	firewall_aliases.php (WebCfg - Firewall: Aliases)
GET /api/v1/firewall/aliases/{name}	Get an alias.	firewall.aliases:read	firewall_aliases.php (WebCfg - Firewall: Aliases)
POST /api/v1/firewall/aliases	Create an alias. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: name (string), type (host | network | port | url | url_ports | urltable | urltable_ports), description (string), entries (array of object), update_frequency (integer). Form schema: GET /api/v1/schema/firewall/aliases.	firewall.aliases:write	firewall_aliases_edit.php (WebCfg - Firewall: Alias: Edit)
PUT /api/v1/firewall/aliases/{name}	Update an alias (omitted fields keep their value; “name” renames it). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: name (string), type (host | network | port | url | url_ports | urltable | urltable_ports), description (string), entries (array of object), update_frequency (integer). Form schema: GET /api/v1/schema/firewall/aliases.	firewall.aliases:write	firewall_aliases_edit.php (WebCfg - Firewall: Alias: Edit)
DELETE /api/v1/firewall/aliases/{name}	Delete an alias that nothing references. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.aliases:write	firewall_aliases.php (WebCfg - Firewall: Aliases)
POST /api/v1/firewall/aliases/apply	Apply pending alias changes (reloads the filter).	firewall.aliases:write	firewall_aliases.php (WebCfg - Firewall: Aliases)

Firewall rules (firewall.rules)

Firewall rules.

API-only privileges: “REST API - Firewall rules: read” (api-firewall-rules-read) and “REST API - Firewall rules: write” (api-firewall-rules-write).

Endpoint	Description	Scope	Access
GET /api/v1/firewall/pending	Firewall changes waiting to be applied, per area.	firewall.rules:read	firewall_rules.php (WebCfg - Firewall: Rules)
POST /api/v1/firewall/apply	Apply every pending firewall change (virtual IPs, then rules, NAT and aliases in one filter reload).	firewall.rules:write	firewall_rules.php (WebCfg - Firewall: Rules)
GET /api/v1/firewall/rules	List filter rules in evaluation order. Query: interface (Only rules of this interface (e.g. lan, wan, or “floating”)).	firewall.rules:read	firewall_rules.php (WebCfg - Firewall: Rules)
GET /api/v1/firewall/rules/tabs	The rule list tabs (Floating, then every interface and group) with their rule counts.	firewall.rules:read	firewall_rules.php (WebCfg - Firewall: Rules)
GET /api/v1/firewall/rules/{id}	Get a filter rule (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.rules:read	firewall_rules.php (WebCfg - Firewall: Rules)
POST /api/v1/firewall/rules	Create a filter rule. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the rule edit page: type (pass|block|reject|match), interface (a list for floating rules), floating, direction, quick, ipprotocol (inet|inet6|inet46), proto, icmptype (list), srctype, src, srcmask, srcnot, srcbeginport, srcendport, dsttype, dst, dstmask, dstnot, dstbeginport, dstendport, descr, disabled, log, gateway, sched, defaultqueue, ackqueue, dnpipe, pdnpipe, tag, tagged, statetype, max, … and “after” (create: insert after this rule id, -1 for the top). GET /firewall/rules/{id} returns them as “fields”. Form schema: GET /api/v1/schema/firewall/rules.	firewall.rules:write	firewall_rules_edit.php (WebCfg - Firewall: Rules: Edit)
PUT /api/v1/firewall/rules/{id}	Update a filter rule (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the rule edit page: type (pass|block|reject|match), interface (a list for floating rules), floating, direction, quick, ipprotocol (inet|inet6|inet46), proto, icmptype (list), srctype, src, srcmask, srcnot, srcbeginport, srcendport, dsttype, dst, dstmask, dstnot, dstbeginport, dstendport, descr, disabled, log, gateway, sched, defaultqueue, ackqueue, dnpipe, pdnpipe, tag, tagged, statetype, max, … and “after” (create: insert after this rule id, -1 for the top). GET /firewall/rules/{id} returns them as “fields”. Form schema: GET /api/v1/schema/firewall/rules.	firewall.rules:write	firewall_rules_edit.php (WebCfg - Firewall: Rules: Edit)
POST /api/v1/firewall/rules/{id}/toggle	Enable or disable a filter rule. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.rules:write	firewall_rules.php (WebCfg - Firewall: Rules)
DELETE /api/v1/firewall/rules/{id}	Delete a filter rule. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.rules:write	firewall_rules.php (WebCfg - Firewall: Rules)
POST /api/v1/firewall/rules/order	Reorder the rules of one interface. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: interface (string, required), order (array of integer, required).	firewall.rules:write	firewall_rules.php (WebCfg - Firewall: Rules)
POST /api/v1/firewall/rules/apply	Apply pending filter rule changes (reloads the filter).	firewall.rules:write	firewall_rules.php (WebCfg - Firewall: Rules)

Firewall NAT (firewall.nat)

Firewall NAT (port forward, 1:1, outbound, NPt).

API-only privileges: “REST API - Firewall NAT (port forward, 1:1, outbound, NPt): read” (api-firewall-nat-read) and “REST API - Firewall NAT (port forward, 1:1, outbound, NPt): write” (api-firewall-nat-write).

Endpoint	Description	Scope	Access
GET /api/v1/firewall/nat/port-forwards	List port forwards.	firewall.nat:read	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
POST /api/v1/firewall/nat/port-forwards/order	Reorder the port forwards (like dragging them on the list page). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: order (array of integer, required).	firewall.nat:write	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
GET /api/v1/firewall/nat/port-forwards/{id}	Get a port forward (plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.nat:read	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
POST /api/v1/firewall/nat/port-forwards	Create a port forward. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the port forward edit page (interface, ipprotocol, proto, srctype, src, srcmask, srcbeginport, srcendport, dsttype, dst, dstmask, dstbeginport, dstendport, localtype, localip, localbeginport, natreflection, descr, disabled, nordr, nosync, filter-rule-association (none “”, add-associated, add-unassociated or pass; on an update add-associated keeps an existing linked rule), after). GET returns them as “fields”. Form schema: GET /api/v1/schema/firewall/nat_port_forwards.	firewall.nat:write	firewall_nat_edit.php (WebCfg - Firewall: NAT: Port Forward: Edit)
PUT /api/v1/firewall/nat/port-forwards/{id}	Update a port forward (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the port forward edit page (interface, ipprotocol, proto, srctype, src, srcmask, srcbeginport, srcendport, dsttype, dst, dstmask, dstbeginport, dstendport, localtype, localip, localbeginport, natreflection, descr, disabled, nordr, nosync, filter-rule-association (none “”, add-associated, add-unassociated or pass; on an update add-associated keeps an existing linked rule), after). GET returns them as “fields”. Form schema: GET /api/v1/schema/firewall/nat_port_forwards.	firewall.nat:write	firewall_nat_edit.php (WebCfg - Firewall: NAT: Port Forward: Edit)
POST /api/v1/firewall/nat/port-forwards/{id}/toggle	Enable or disable a port forward. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
DELETE /api/v1/firewall/nat/port-forwards/{id}	Delete a port forward and its associated rule (applies at once).	firewall.nat:write	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
POST /api/v1/firewall/nat/apply	Apply pending NAT changes (reloads the filter).	firewall.nat:write	firewall_nat.php (WebCfg - Firewall: NAT: Port Forward)
GET /api/v1/firewall/nat/one-to-one	List 1:1 NAT mappings.	firewall.nat:read	firewall_nat_1to1.php (WebCfg - Firewall: NAT: 1:1)
POST /api/v1/firewall/nat/one-to-one/order	Reorder the 1:1 NAT mappings (like dragging them on the list page). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: order (array of integer, required).	firewall.nat:write	firewall_nat_1to1.php (WebCfg - Firewall: NAT: 1:1)
GET /api/v1/firewall/nat/one-to-one/{id}	Get a 1:1 NAT mapping (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.nat:read	firewall_nat_1to1.php (WebCfg - Firewall: NAT: 1:1)
POST /api/v1/firewall/nat/one-to-one	Create a 1:1 NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the 1:1 NAT mapping edit page: interface, ipprotocol, external, exttype, srctype, src, srcmask, srcnot, dsttype, dst, dstmask, dstnot, natreflection, nobinat, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_one_to_one.	firewall.nat:write	firewall_nat_1to1_edit.php (WebCfg - Firewall: NAT: 1:1: Edit)
PUT /api/v1/firewall/nat/one-to-one/{id}	Update a 1:1 NAT mapping (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the 1:1 NAT mapping edit page: interface, ipprotocol, external, exttype, srctype, src, srcmask, srcnot, dsttype, dst, dstmask, dstnot, natreflection, nobinat, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_one_to_one.	firewall.nat:write	firewall_nat_1to1_edit.php (WebCfg - Firewall: NAT: 1:1: Edit)
POST /api/v1/firewall/nat/one-to-one/{id}/toggle	Enable or disable a 1:1 NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_1to1.php (WebCfg - Firewall: NAT: 1:1)
DELETE /api/v1/firewall/nat/one-to-one/{id}	Delete a 1:1 NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_1to1.php (WebCfg - Firewall: NAT: 1:1)
GET /api/v1/firewall/nat/outbound	List outbound NAT mappings.	firewall.nat:read	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
POST /api/v1/firewall/nat/outbound/order	Reorder the outbound NAT mappings (like dragging them on the list page). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: order (array of integer, required).	firewall.nat:write	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
GET /api/v1/firewall/nat/outbound/{id}	Get a outbound NAT mapping (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.nat:read	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
POST /api/v1/firewall/nat/outbound	Create a outbound NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the outbound NAT mapping edit page: interface, ipprotocol, protocol, source_type, source, source_subnet, sourceport, destination_type, destination, destination_subnet, destination_not, dstport, target_type, target, target_subnet, poolopts, source_hash_key, natport, staticnatport, eimnat, nonat, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_outbound.	firewall.nat:write	firewall_nat_out_edit.php (WebCfg - Firewall: NAT: Outbound: Edit)
PUT /api/v1/firewall/nat/outbound/{id}	Update a outbound NAT mapping (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the outbound NAT mapping edit page: interface, ipprotocol, protocol, source_type, source, source_subnet, sourceport, destination_type, destination, destination_subnet, destination_not, dstport, target_type, target, target_subnet, poolopts, source_hash_key, natport, staticnatport, eimnat, nonat, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_outbound.	firewall.nat:write	firewall_nat_out_edit.php (WebCfg - Firewall: NAT: Outbound: Edit)
POST /api/v1/firewall/nat/outbound/{id}/toggle	Enable or disable a outbound NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
DELETE /api/v1/firewall/nat/outbound/{id}	Delete a outbound NAT mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
GET /api/v1/firewall/nat/npt	List NPt mappings.	firewall.nat:read	firewall_nat_npt.php (WebCfg - Firewall: NAT: NPt)
POST /api/v1/firewall/nat/npt/order	Reorder the NPt mappings (like dragging them on the list page). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: order (array of integer, required).	firewall.nat:write	firewall_nat_npt.php (WebCfg - Firewall: NAT: NPt)
GET /api/v1/firewall/nat/npt/{id}	Get a NPt mapping (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.nat:read	firewall_nat_npt.php (WebCfg - Firewall: NAT: NPt)
POST /api/v1/firewall/nat/npt	Create a NPt mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the NPt mapping edit page: interface, src, srcmask, srcnot, dsttype, dst, dstmask, dstnot, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_npt.	firewall.nat:write	firewall_nat_npt_edit.php (WebCfg - Firewall: NAT: NPt: Edit)
PUT /api/v1/firewall/nat/npt/{id}	Update a NPt mapping (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the NPt mapping edit page: interface, src, srcmask, srcnot, dsttype, dst, dstmask, dstnot, disabled, descr; and “after” (create: insert after this id). GET returns the same shape as “fields”. Form schema: GET /api/v1/schema/firewall/nat_npt.	firewall.nat:write	firewall_nat_npt_edit.php (WebCfg - Firewall: NAT: NPt: Edit)
POST /api/v1/firewall/nat/npt/{id}/toggle	Enable or disable a NPt mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_npt.php (WebCfg - Firewall: NAT: NPt)
DELETE /api/v1/firewall/nat/npt/{id}	Delete a NPt mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.nat:write	firewall_nat_npt.php (WebCfg - Firewall: NAT: NPt)
GET /api/v1/firewall/nat/outbound-mode	Outbound NAT mode (automatic, hybrid, advanced or disabled) and the mode “choices”.	firewall.nat:read	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
PUT /api/v1/firewall/nat/outbound-mode	Set the outbound NAT mode (switching to advanced creates rules from the automatic ones). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: mode (automatic | hybrid | advanced | disabled, required).	firewall.nat:write	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)
GET /api/v1/firewall/nat/outbound-automatic	The automatic outbound NAT rules the firewall generates (with “display” like the mappings).	firewall.nat:read	firewall_nat_out.php (WebCfg - Firewall: NAT: Outbound)

Firewall schedules (firewall.schedules)

Firewall schedules.

API-only privileges: “REST API - Firewall schedules: read” (api-firewall-schedules-read) and “REST API - Firewall schedules: write” (api-firewall-schedules-write).

Endpoint	Description	Scope	Access
GET /api/v1/firewall/schedules	List schedules (with “fields”: the editor fields, and “display”: ranges as text, active now, rules using it).	firewall.schedules:read	firewall_schedule.php (WebCfg - Firewall: Schedules)
GET /api/v1/firewall/schedules/{name}	Get a schedule (with “fields” and “display”).	firewall.schedules:read	firewall_schedule.php (WebCfg - Firewall: Schedules)
POST /api/v1/firewall/schedules	Create a schedule (applies at once, like the GUI). Body: name (string), description (string), ranges (array of object), timerange (array). Form schema: GET /api/v1/schema/firewall/schedules.	firewall.schedules:write	firewall_schedule_edit.php (WebCfg - Firewall: Schedules: Edit)
PUT /api/v1/firewall/schedules/{name}	Update a schedule (omitted fields keep their value; “ranges” replaces all ranges; a schedule in use keeps its name; applies at once). Body: name (string), description (string), ranges (array of object), timerange (array). Form schema: GET /api/v1/schema/firewall/schedules.	firewall.schedules:write	firewall_schedule_edit.php (WebCfg - Firewall: Schedules: Edit)
DELETE /api/v1/firewall/schedules/{name}	Delete a schedule that no rule uses.	firewall.schedules:write	firewall_schedule.php (WebCfg - Firewall: Schedules)

Firewall virtual IPs (firewall.vips)

Firewall virtual IPs.

API-only privileges: “REST API - Firewall virtual IPs: read” (api-firewall-vips-read) and “REST API - Firewall virtual IPs: write” (api-firewall-vips-write).

Endpoint	Description	Scope	Access
GET /api/v1/firewall/virtual-ips	List virtual IPs (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	firewall.vips:read	firewall_virtual_ip.php (WebCfg - Firewall: Virtual IP Addresses)
GET /api/v1/firewall/virtual-ips/{id}	Get a virtual IP (with “fields” and “display”).	firewall.vips:read	firewall_virtual_ip.php (WebCfg - Firewall: Virtual IP Addresses)
POST /api/v1/firewall/virtual-ips	Create a virtual IP. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the virtual IP edit page (mode, interface, subnet, subnet_bits, type, descr, vhid, advbase, advskew, password, noexpand). GET returns them as “fields” (never the password). On update a missing or empty password keeps the current one. Form schema: GET /api/v1/schema/firewall/virtual_ips.	firewall.vips:write	firewall_virtual_ip_edit.php (WebCfg - Firewall: Virtual IP Address: Edit)
PUT /api/v1/firewall/virtual-ips/{id}	Update a virtual IP (omitted fields keep their value; false clears a checkbox; no password keeps it). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the virtual IP edit page (mode, interface, subnet, subnet_bits, type, descr, vhid, advbase, advskew, password, noexpand). GET returns them as “fields” (never the password). On update a missing or empty password keeps the current one. Form schema: GET /api/v1/schema/firewall/virtual_ips.	firewall.vips:write	firewall_virtual_ip_edit.php (WebCfg - Firewall: Virtual IP Address: Edit)
DELETE /api/v1/firewall/virtual-ips/{id}	Delete a virtual IP that nothing uses. Query: apply (true to apply the change at once (default: stage it like the GUI)).	firewall.vips:write	firewall_virtual_ip.php (WebCfg - Firewall: Virtual IP Addresses)
POST /api/v1/firewall/virtual-ips/apply	Apply pending virtual IP changes.	firewall.vips:write	firewall_virtual_ip.php (WebCfg - Firewall: Virtual IP Addresses)

Gateways and static routes (routing)

Gateways and static routes.

API-only privileges: “REST API - Gateways and static routes: read” (api-routing-read) and “REST API - Gateways and static routes: write” (api-routing-write).

Endpoint	Description	Scope	Access
POST /api/v1/routing/apply	Apply pending gateway, gateway group and static route changes.	routing:write	system_gateways.php (WebCfg - System: Gateways)
GET /api/v1/routing/pending	Whether gateway, gateway group or static route changes are staged (not yet applied).	routing:read	system_gateways.php (WebCfg - System: Gateways)
GET /api/v1/routing/gateways	List gateways (with “fields”: the edit form fields, and “display”: the list columns as text and the monitoring status).	routing:read	system_gateways.php (WebCfg - System: Gateways)
GET /api/v1/routing/gateways/{name}	Get a gateway (with “fields” and “display”).	routing:read	system_gateways.php (WebCfg - System: Gateways)
POST /api/v1/routing/gateways	Create a gateway. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the gateway edit page: interface, ipprotocol (inet|inet6), name, gateway (address or “dynamic”), descr, disabled, monitor_disable, action_disable, monitor, dpinger_dont_add_static_route, force_down, gw_down_kill_states, weight, data_payload, latencylow, latencyhigh, losslow, losshigh, interval, loss_interval, time_period, alert_interval, nonlocalgateway. Checkboxes are booleans. GET returns them as “fields”. The name of an existing gateway cannot change. Form schema: GET /api/v1/schema/routing/gateways.	routing:write	system_gateways_edit.php (WebCfg - System: Gateways: Edit Gateway)
PUT /api/v1/routing/gateways/{name}	Update a gateway (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the gateway edit page: interface, ipprotocol (inet|inet6), name, gateway (address or “dynamic”), descr, disabled, monitor_disable, action_disable, monitor, dpinger_dont_add_static_route, force_down, gw_down_kill_states, weight, data_payload, latencylow, latencyhigh, losslow, losshigh, interval, loss_interval, time_period, alert_interval, nonlocalgateway. Checkboxes are booleans. GET returns them as “fields”. The name of an existing gateway cannot change. Form schema: GET /api/v1/schema/routing/gateways.	routing:write	system_gateways_edit.php (WebCfg - System: Gateways: Edit Gateway)
DELETE /api/v1/routing/gateways/{name}	Delete a gateway that no group, static route or DNS server uses. Query: apply (true to apply the change at once (default: stage it like the GUI)).	routing:write	system_gateways.php (WebCfg - System: Gateways)
POST /api/v1/routing/gateways/{name}/toggle	Enable or disable a gateway (disabling is refused while it is in use). Query: apply (true to apply the change at once (default: stage it like the GUI)).	routing:write	system_gateways.php (WebCfg - System: Gateways)
GET /api/v1/routing/default-gateways	The IPv4 and IPv6 default gateway selection and the choices.	routing:read	system_gateways.php (WebCfg - System: Gateways)
PUT /api/v1/routing/default-gateways	Set the default gateways (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: defaultgw4 (string), defaultgw6 (string). Form schema: GET /api/v1/schema/routing/default_gateways.	routing:write	system_gateways.php (WebCfg - System: Gateways)
GET /api/v1/routing/gateway-groups	List gateway groups (with “fields”: the editor fields, and “display”: the list columns as text).	routing:read	system_gateway_groups.php (WebCfg - System: Gateway Groups)
GET /api/v1/routing/gateway-groups/{name}	Get a gateway group (with “fields” and “display”).	routing:read	system_gateway_groups.php (WebCfg - System: Gateway Groups)
POST /api/v1/routing/gateway-groups	Create a gateway group. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: name (string), descr (string), trigger (down | downloss | downlatency | downlosslatency), keep_failover_states (| keep | kill), items (array of object). Form schema: GET /api/v1/schema/routing/gateway_groups.	routing:write	system_gateway_groups_edit.php (WebCfg - System: Gateways: Edit Gateway Groups)
PUT /api/v1/routing/gateway-groups/{name}	Update a gateway group (omitted fields keep their value; “items” replaces the members). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: name (string), descr (string), trigger (down | downloss | downlatency | downlosslatency), keep_failover_states (| keep | kill), items (array of object). Form schema: GET /api/v1/schema/routing/gateway_groups.	routing:write	system_gateway_groups_edit.php (WebCfg - System: Gateways: Edit Gateway Groups)
DELETE /api/v1/routing/gateway-groups/{name}	Delete a gateway group that is not a default gateway and nothing references. Query: apply (true to apply the change at once (default: stage it like the GUI)).	routing:write	system_gateway_groups.php (WebCfg - System: Gateway Groups)
GET /api/v1/routing/static-routes	List static routes (with “fields”: the edit form fields, and “display”: the list columns as text).	routing:read	system_routes.php (WebCfg - System: Static Routes)
GET /api/v1/routing/static-routes/{id}	Get a static route (with “fields” and “display”).	routing:read	system_routes.php (WebCfg - System: Static Routes)
POST /api/v1/routing/static-routes	Create a static route. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the static route edit page: network (address or alias; “address/bits” is also accepted), network_subnet (bits), gateway (name), descr, disabled (boolean). GET returns them as “fields”. Form schema: GET /api/v1/schema/routing/static_routes.	routing:write	system_routes_edit.php (WebCfg - System: Static Routes: Edit route)
PUT /api/v1/routing/static-routes/{id}	Update a static route (omitted fields keep their value; false clears a checkbox). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The same fields as the static route edit page: network (address or alias; “address/bits” is also accepted), network_subnet (bits), gateway (name), descr, disabled (boolean). GET returns them as “fields”. Form schema: GET /api/v1/schema/routing/static_routes.	routing:write	system_routes_edit.php (WebCfg - System: Static Routes: Edit route)
DELETE /api/v1/routing/static-routes/{id}	Delete a static route. Query: apply (true to apply the change at once (default: stage it like the GUI)).	routing:write	system_routes.php (WebCfg - System: Static Routes)
POST /api/v1/routing/static-routes/{id}/toggle	Enable or disable a static route. Query: apply (true to apply the change at once (default: stage it like the GUI)).	routing:write	system_routes.php (WebCfg - System: Static Routes)

Interfaces (interfaces)

Interfaces (VLAN, VXLAN, GIF, GRE, LAGG, QinQ, bridges, groups, assignments).

API-only privileges: “REST API - Interfaces (VLAN, VXLAN, GIF, GRE, LAGG, QinQ, bridges, groups, assignments): read” (api-interfaces-read) and “REST API - Interfaces (VLAN, VXLAN, GIF, GRE, LAGG, QinQ, bridges, groups, assignments): write” (api-interfaces-write).

Endpoint	Description	Scope	Access
GET /api/v1/interfaces/vlans	List VLANs (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_vlan.php (WebCfg - Interfaces: VLAN)
GET /api/v1/interfaces/vlans/{id}	Get a VLAN by position or interface name.	interfaces:read	interfaces_vlan.php (WebCfg - Interfaces: VLAN)
POST /api/v1/interfaces/vlans	Create a VLAN (the interface is created at once). Body: The same fields as the VLAN edit page: if (parent interface, e.g. em1), tag (1-4094), tag_type (ctag|stag, default ctag), pcp (priority 0-7), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/vlans. Form schema: GET /api/v1/schema/network/vlans.	interfaces:write	interfaces_vlan_edit.php (WebCfg - Interfaces: VLAN: Edit)
PUT /api/v1/interfaces/vlans/{id}	Update a VLAN (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the VLAN edit page: if (parent interface, e.g. em1), tag (1-4094), tag_type (ctag|stag, default ctag), pcp (priority 0-7), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/vlans. Form schema: GET /api/v1/schema/network/vlans.	interfaces:write	interfaces_vlan_edit.php (WebCfg - Interfaces: VLAN: Edit)
DELETE /api/v1/interfaces/vlans/{id}	Delete a VLAN that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_vlan.php (WebCfg - Interfaces: VLAN)
GET /api/v1/interfaces/vxlans	List VXLANs (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_vxlan.php (WebCfg - Interfaces: VXLAN)
GET /api/v1/interfaces/vxlans/{id}	Get a VXLAN by position or interface name.	interfaces:read	interfaces_vxlan.php (WebCfg - Interfaces: VXLAN)
POST /api/v1/interfaces/vxlans	Create a VXLAN (the interface is created at once). Body: The same fields as the VXLAN edit page: if (parent interface or VIP), ipproto (inet|inet6, default inet), mode (unicast|multicast, default unicast), vni, remote-addr (unicast) or mcastgroup (multicast), localport, remoteport, ttl, learn (boolean, default true), allowrule (boolean), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/vxlans. Form schema: GET /api/v1/schema/network/vxlans.	interfaces:write	interfaces_vxlan_edit.php (WebCfg - Interfaces: VXLAN: Edit)
PUT /api/v1/interfaces/vxlans/{id}	Update a VXLAN (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the VXLAN edit page: if (parent interface or VIP), ipproto (inet|inet6, default inet), mode (unicast|multicast, default unicast), vni, remote-addr (unicast) or mcastgroup (multicast), localport, remoteport, ttl, learn (boolean, default true), allowrule (boolean), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/vxlans. Form schema: GET /api/v1/schema/network/vxlans.	interfaces:write	interfaces_vxlan_edit.php (WebCfg - Interfaces: VXLAN: Edit)
DELETE /api/v1/interfaces/vxlans/{id}	Delete a VXLAN that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_vxlan.php (WebCfg - Interfaces: VXLAN)
GET /api/v1/interfaces/gifs	List GIF tunnels (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_gif.php (WebCfg - Interfaces: GIF)
GET /api/v1/interfaces/gifs/{id}	Get a GIF tunnel by position or interface name.	interfaces:read	interfaces_gif.php (WebCfg - Interfaces: GIF)
POST /api/v1/interfaces/gifs	Create a GIF tunnel (the interface is created at once). Body: The same fields as the GIF edit page: if (parent interface or VIP), remote-addr, tunnel-local-addr, tunnel-remote-addr, tunnel-remote-net (bits), link1 (ECN friendly), link2 (no outer source filtering), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/gifs. Form schema: GET /api/v1/schema/network/gifs.	interfaces:write	interfaces_gif_edit.php (WebCfg - Interfaces: GIF: Edit)
PUT /api/v1/interfaces/gifs/{id}	Update a GIF tunnel (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the GIF edit page: if (parent interface or VIP), remote-addr, tunnel-local-addr, tunnel-remote-addr, tunnel-remote-net (bits), link1 (ECN friendly), link2 (no outer source filtering), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/gifs. Form schema: GET /api/v1/schema/network/gifs.	interfaces:write	interfaces_gif_edit.php (WebCfg - Interfaces: GIF: Edit)
DELETE /api/v1/interfaces/gifs/{id}	Delete a GIF tunnel that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_gif.php (WebCfg - Interfaces: GIF)
GET /api/v1/interfaces/gres	List GRE tunnels (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_gre.php (WebCfg - Interfaces: GRE)
GET /api/v1/interfaces/gres/{id}	Get a GRE tunnel by position or interface name.	interfaces:read	interfaces_gre.php (WebCfg - Interfaces: GRE)
POST /api/v1/interfaces/gres	Create a GRE tunnel (the interface is created at once). Body: The same fields as the GRE edit page: if (parent interface or VIP), remote-addr, tunnel-local-addr, tunnel-remote-addr, tunnel-remote-net (bits, default 32), tunnel-local-addr6, tunnel-remote-addr6, tunnel-remote-net6 (bits, default 128), link1 (add static route), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/gres. Form schema: GET /api/v1/schema/network/gres.	interfaces:write	interfaces_gre_edit.php (WebCfg - Interfaces: GRE: Edit)
PUT /api/v1/interfaces/gres/{id}	Update a GRE tunnel (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the GRE edit page: if (parent interface or VIP), remote-addr, tunnel-local-addr, tunnel-remote-addr, tunnel-remote-net (bits, default 32), tunnel-local-addr6, tunnel-remote-addr6, tunnel-remote-net6 (bits, default 128), link1 (add static route), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/gres. Form schema: GET /api/v1/schema/network/gres.	interfaces:write	interfaces_gre_edit.php (WebCfg - Interfaces: GRE: Edit)
DELETE /api/v1/interfaces/gres/{id}	Delete a GRE tunnel that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_gre.php (WebCfg - Interfaces: GRE)
GET /api/v1/interfaces/laggs	List LAGGs (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_lagg.php (WebCfg - Interfaces: LAGG:)
GET /api/v1/interfaces/laggs/{id}	Get a LAGG by position or interface name.	interfaces:read	interfaces_lagg.php (WebCfg - Interfaces: LAGG:)
POST /api/v1/interfaces/laggs	Create a LAGG (the interface is created at once). Body: The same fields as the LAGG edit page: members (list of unassigned ports, e.g. [“igb2”,“igb3”]), proto (none|lacp|failover|loadbalance|roundrobin, default none), failovermaster (a member or auto), lacptimeout (slow|fast), lagghash (l2,l3,l4|l2|l3|l4|l2,l3|l3,l4|l2,l4), descr. Recreating a LAGG also recreates its VLANs. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/laggs. Form schema: GET /api/v1/schema/network/laggs.	interfaces:write	interfaces_lagg_edit.php (WebCfg - Interfaces: LAGG: Edit)
PUT /api/v1/interfaces/laggs/{id}	Update a LAGG (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the LAGG edit page: members (list of unassigned ports, e.g. [“igb2”,“igb3”]), proto (none|lacp|failover|loadbalance|roundrobin, default none), failovermaster (a member or auto), lacptimeout (slow|fast), lagghash (l2,l3,l4|l2|l3|l4|l2,l3|l3,l4|l2,l4), descr. Recreating a LAGG also recreates its VLANs. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/laggs. Form schema: GET /api/v1/schema/network/laggs.	interfaces:write	interfaces_lagg_edit.php (WebCfg - Interfaces: LAGG: Edit)
DELETE /api/v1/interfaces/laggs/{id}	Delete a LAGG that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_lagg.php (WebCfg - Interfaces: LAGG:)
GET /api/v1/interfaces/qinqs	List QinQs (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_qinq.php (WebCfg - Interfaces: QinQ)
GET /api/v1/interfaces/qinqs/{id}	Get a QinQ by position or interface name.	interfaces:read	interfaces_qinq.php (WebCfg - Interfaces: QinQ)
POST /api/v1/interfaces/qinqs	Create a QinQ (the interface is created at once). Body: The same fields as the QinQ edit page: if (parent interface), tag (first level tag; parent and tag cannot change later), tag_type (ctag|stag, default stag), members (list of inner tags or ranges, e.g. [“10”,“20-30”], or rows [{“tag”:“10”}] as “fields” returns them), autogroup (boolean: add to the QinQ interface group), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/qinq. Form schema: GET /api/v1/schema/network/qinq.	interfaces:write	interfaces_qinq_edit.php (WebCfg - Interfaces: QinQ: Edit)
PUT /api/v1/interfaces/qinqs/{id}	Update a QinQ (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the QinQ edit page: if (parent interface), tag (first level tag; parent and tag cannot change later), tag_type (ctag|stag, default stag), members (list of inner tags or ranges, e.g. [“10”,“20-30”], or rows [{“tag”:“10”}] as “fields” returns them), autogroup (boolean: add to the QinQ interface group), descr. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/qinq. Form schema: GET /api/v1/schema/network/qinq.	interfaces:write	interfaces_qinq_edit.php (WebCfg - Interfaces: QinQ: Edit)
DELETE /api/v1/interfaces/qinqs/{id}	Delete a QinQ that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_qinq.php (WebCfg - Interfaces: QinQ)
GET /api/v1/interfaces/groups	List interface groups (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_groups.php (WebCfg - Interfaces: Groups)
GET /api/v1/interfaces/groups/{id}	Get an interface group by position or name.	interfaces:read	interfaces_groups.php (WebCfg - Interfaces: Groups)
POST /api/v1/interfaces/groups	Create an interface group (applied at once). Body: The same fields as the interface group edit page: ifname (group name, letters, digits and _, at most 15, no leading or trailing digit), members (list of assigned interfaces, e.g. [“lan”,“opt1”]), descr. Renaming a group also renames it in the firewall rules and port forwards that use it. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/groups. Form schema: GET /api/v1/schema/network/groups.	interfaces:write	interfaces_groups_edit.php (WebCfg - Interfaces: Groups: Edit)
PUT /api/v1/interfaces/groups/{id}	Update an interface group (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the interface group edit page: ifname (group name, letters, digits and _, at most 15, no leading or trailing digit), members (list of assigned interfaces, e.g. [“lan”,“opt1”]), descr. Renaming a group also renames it in the firewall rules and port forwards that use it. Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/groups. Form schema: GET /api/v1/schema/network/groups.	interfaces:write	interfaces_groups_edit.php (WebCfg - Interfaces: Groups: Edit)
DELETE /api/v1/interfaces/groups/{id}	Delete an interface group that no firewall or NAT rule uses.	interfaces:write	interfaces_groups.php (WebCfg - Interfaces: Groups)
GET /api/v1/interfaces/bridges	List bridges (stored form, plus “fields”: the edit form fields, and “display”: the list columns as text).	interfaces:read	interfaces_bridge.php (WebCfg - Interfaces: Bridge)
GET /api/v1/interfaces/bridges/{id}	Get a bridge by position or interface name.	interfaces:read	interfaces_bridge.php (WebCfg - Interfaces: Bridge)
POST /api/v1/interfaces/bridges	Create a bridge (the interface is created at once). Body: The same fields as the bridge edit page: members (list of assigned interfaces), descr, maxaddr, timeout, span, edge, autoedge, ptp, autoptp, static, private (lists of interfaces), ip6linklocal (boolean), enablestp (boolean), proto (rstp|stp, default rstp), stp (list), maxage, fwdelay, hellotime, priority, holdcnt, ifpriority and ifpathcost (objects of interface => value). Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/bridges. Form schema: GET /api/v1/schema/network/bridges.	interfaces:write	interfaces_bridge_edit.php (WebCfg - Interfaces: Bridge edit)
PUT /api/v1/interfaces/bridges/{id}	Update a bridge (omitted fields keep their value; false clears a checkbox; applied at once). Body: The same fields as the bridge edit page: members (list of assigned interfaces), descr, maxaddr, timeout, span, edge, autoedge, ptp, autoptp, static, private (lists of interfaces), ip6linklocal (boolean), enablestp (boolean), proto (rstp|stp, default rstp), stp (list), maxage, fwdelay, hellotime, priority, holdcnt, ifpriority and ifpathcost (objects of interface => value). Checkboxes are booleans. GET returns the current values as “fields” and the list columns as “display”. Form schema: GET /api/v1/schema/network/bridges. Form schema: GET /api/v1/schema/network/bridges.	interfaces:write	interfaces_bridge_edit.php (WebCfg - Interfaces: Bridge edit)
DELETE /api/v1/interfaces/bridges/{id}	Delete a bridge that is not in use (the interface is destroyed at once).	interfaces:write	interfaces_bridge.php (WebCfg - Interfaces: Bridge)
GET /api/v1/interfaces/assignments	Interface assignments with display texts; meta lists the free ports, all ports and whether an apply is pending.	interfaces:read	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
GET /api/v1/interfaces/assignments/pending	Whether the page would show “Apply Changes” (interface mismatch after a restore: the apply reboots).	interfaces:read	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
POST /api/v1/interfaces/assignments/apply	The page’s “Apply Changes”: reboot when an interface mismatch is pending (202), otherwise reload the filter. Body: confirm (boolean, required).	interfaces:write	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
GET /api/v1/interfaces/assignments/{name}	Get an interface assignment by interface name (wan, lan, opt1, …).	interfaces:read	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
POST /api/v1/interfaces/assignments	Assign a port as the next interface (LAN when there is none, else the next optN; not enabled). Body: port (string, required), confirm (boolean, required). Form schema: GET /api/v1/schema/network/assignments.	interfaces:write	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
PUT /api/v1/interfaces/assignments/{name}	Move an interface to another port (the interface is reconfigured at once). Body: port (string, required), confirm (boolean, required). Form schema: GET /api/v1/schema/network/assignments.	interfaces:write	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
DELETE /api/v1/interfaces/assignments/{name}	Unassign an interface that is not in use (never WAN or LAN); removes its DHCP settings, rules and port forwards. Query: confirm (true instead of the {“confirm”: true} body). Body: confirm (boolean, required).	interfaces:write	interfaces_assign.php (WebCfg - Interfaces: Interface Assignments)
GET /api/v1/interfaces/config	Address configuration of every assigned interface (summary).	interfaces:read	interfaces.php (WebCfg - Interfaces: WAN)
GET /api/v1/interfaces/config/pending	Whether saved interface changes wait to be applied, and for which interfaces.	interfaces:read	interfaces.php (WebCfg - Interfaces: WAN)
POST /api/v1/interfaces/config/apply	Apply saved interface changes (reconfigures the interfaces, gateways and the filter at once). Body: confirm (boolean, required).	interfaces:write	interfaces.php (WebCfg - Interfaces: WAN)
GET /api/v1/interfaces/config/{name}	One interface’s configuration (wan, lan, opt1, …) with the choices of its selects.	interfaces:read	interfaces.php (WebCfg - Interfaces: WAN)
PUT /api/v1/interfaces/config/{name}	Change an interface’s configuration (saved as pending; omitted fields keep their value). Body: Fields of the interface form (omitted fields keep their value): enable, block_private, block_bogons, ipv6_use_ipv4_link, dhcp6_send_prefix_hint, dhcp6_use_ipv4, dhcp6_prefix_only, dhcp6_without_ra, slaac_use_ipv4 (booleans); description; ipv4_type (none|staticv4|dhcp|ppp|pppoe|pptp|l2tp, from “ipv4_type_choices”), ipv4_address, ipv4_subnet (bits), gateway (from “gateway_choices”, “none” on a LAN); ipv6_type (none|staticv6|dhcp6|slaac|6rd|6to4|track6), ipv6_address, ipv6_subnet, gatewayv6 (from “gatewayv6_choices”); track6_interface (from “track6_interface_choices”), track6_prefix_id (hexadecimal, up to “track6_prefix_id_max” of the tracked interface); prefix_6rd, gateway_6rd, prefix_6rd_v4_length; spoof_mac, mtu, mss, media (from “media_choices”; “” for autoselect); dhcp_hostname, dhcp_alias_address, dhcp_alias_subnet, dhcp_reject_from; dhcp6_prefix_delegation_size (from “dhcp6_prefix_delegation_size_choices”). Saving records the change; POST /api/v1/interfaces/config/apply applies it. Form schema: GET /api/v1/schema/interfaces/config.	interfaces:write	interfaces.php (WebCfg - Interfaces: WAN)

DNS services (services.dns)

DNS services (DNS Forwarder, DNS Resolver).

API-only privileges: “REST API - DNS services (DNS Forwarder, DNS Resolver): read” (api-services-dns-read) and “REST API - DNS services (DNS Forwarder, DNS Resolver): write” (api-services-dns-write).

Endpoint	Description	Scope	Access
GET /api/v1/services/dns-forwarder	DNS Forwarder settings, the listen address choices and whether changes are pending.	services.dns:read	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
PUT /api/v1/services/dns-forwarder	Change DNS Forwarder settings (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DNS Forwarder settings form: enable, regdhcp, regdhcpstatic, dhcpfirst, no_system_dns, strict_order, domain_needed, no_private_reverse, strictbind (booleans), port (empty: 53), interface (list of listen addresses from “interface_choices”; empty: all), custom_options (text). Omitted fields keep their value.	services.dns:write	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
POST /api/v1/services/dns-forwarder/apply	Apply pending DNS Forwarder changes (settings, host and domain overrides).	services.dns:write	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
GET /api/v1/services/dns-forwarder/host-overrides	List host overrides.	services.dns:read	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
GET /api/v1/services/dns-forwarder/host-overrides/{id}	Get a host override.	services.dns:read	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
POST /api/v1/services/dns-forwarder/host-overrides	Create a host override. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: host (string), domain (string), ip (string), descr (string), aliases (array of object).	services.dns:write	services_dnsmasq_edit.php (WebCfg - Services: DNS Forwarder: Edit host)
PUT /api/v1/services/dns-forwarder/host-overrides/{id}	Update a host override (omitted fields keep their value; “aliases” replaces the list). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: host (string), domain (string), ip (string), descr (string), aliases (array of object).	services.dns:write	services_dnsmasq_edit.php (WebCfg - Services: DNS Forwarder: Edit host)
DELETE /api/v1/services/dns-forwarder/host-overrides/{id}	Delete a host override. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
GET /api/v1/services/dns-forwarder/domain-overrides	List domain overrides.	services.dns:read	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
GET /api/v1/services/dns-forwarder/domain-overrides/{id}	Get a domain override.	services.dns:read	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
POST /api/v1/services/dns-forwarder/domain-overrides	Create a domain override. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: domain (string), ip (string), dnssrcip (string), descr (string).	services.dns:write	services_dnsmasq_domainoverride_edit.php (WebCfg - Services: DNS Forwarder: Edit Domain Override)
PUT /api/v1/services/dns-forwarder/domain-overrides/{id}	Update a domain override (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: domain (string), ip (string), dnssrcip (string), descr (string).	services.dns:write	services_dnsmasq_domainoverride_edit.php (WebCfg - Services: DNS Forwarder: Edit Domain Override)
DELETE /api/v1/services/dns-forwarder/domain-overrides/{id}	Delete a domain override. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_dnsmasq.php (WebCfg - Services: DNS Forwarder)
GET /api/v1/services/dns-resolver	DNS Resolver general settings, their choices and whether changes are pending.	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
PUT /api/v1/services/dns-resolver	Change DNS Resolver general settings (staged like the page’s Save; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DNS Resolver general settings form: enable, enablessl, strictout, dnssec, python, forwarding, forward_tls_upstream, regovpnclients, regdhcp and regdhcpstatic (the last two only with the ISC DHCP backend) (booleans); port, tlsport (empty: 53/853), sslcertref (from “sslcertref_choices”), system_domain_local_zone_type (from “local_zone_type_choices”), python_order (pre_validator|post_validator), python_script (from “python_script_choices”), custom_options (text); active_interface and outgoing_interface (lists from “interface_choices”; “all” for every address). Omitted fields keep their value. The generated configuration must pass unbound-checkconf. Form schema: GET /api/v1/schema/services/dns_resolver.	services.dns:write	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/pending	Whether DNS Resolver changes are staged and wait for apply.	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
POST /api/v1/services/dns-resolver/apply	Apply pending DNS Resolver changes (settings, overrides, access lists).	services.dns:write	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/advanced	DNS Resolver advanced settings and their choices.	services.dns:read	services_unbound_advanced.php (WebCfg - Services: DNS Resolver: Advanced)
PUT /api/v1/services/dns-resolver/advanced	Change DNS Resolver advanced settings (staged; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DNS Resolver advanced settings form: hideidentity, hideversion, qname-minimisation, qname-minimisation-strict, prefetch, prefetchkey, dnssecstripped, dnsrecordcache, aggressivensec, infra_keep_probing, disable_auto_added_access_control, disable_auto_added_host_entries, use_caps, dns64_enable, allow_dns64_for_localhost (booleans); msgcachesize, outgoing_num_tcp, incoming_num_tcp, edns_buffer_size, num_queries_per_thread, jostle_timeout, infra_host_ttl, infra_cache_numhosts, unwanted_reply_threshold, log_verbosity (values from “choices”); sock_queue_timeout, cache_max_ttl, cache_min_ttl (non-negative integers); dns64_prefix. Omitted fields keep their value. Form schema: GET /api/v1/schema/services/dns_resolver_advanced.	services.dns:write	services_unbound_advanced.php (WebCfg - Services: DNS Resolver: Advanced)
GET /api/v1/services/dns-resolver/host-overrides	List host overrides (sorted by host; with “fields” and “display”).	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/host-overrides/{id}	Get a host override (with “fields” and “display”).	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
POST /api/v1/services/dns-resolver/host-overrides	Create a host override (the list is sorted by host; the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: host (string), domain (string), ip (string), descr (string), aliases (array of object). Form schema: GET /api/v1/schema/services/dns_host_override.	services.dns:write	services_unbound_host_edit.php (WebCfg - Services: DNS Resolver: Edit host)
PUT /api/v1/services/dns-resolver/host-overrides/{id}	Update a host override (omitted fields keep their value; “aliases” replaces the list; the response has its new id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: host (string), domain (string), ip (string), descr (string), aliases (array of object). Form schema: GET /api/v1/schema/services/dns_host_override.	services.dns:write	services_unbound_host_edit.php (WebCfg - Services: DNS Resolver: Edit host)
DELETE /api/v1/services/dns-resolver/host-overrides/{id}	Delete a host override. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/domain-overrides	List domain overrides (with “fields” and “display”).	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/domain-overrides/{id}	Get a domain override (with “fields” and “display”).	services.dns:read	services_unbound.php (WebCfg - Services: DNS Resolver)
POST /api/v1/services/dns-resolver/domain-overrides	Create a domain override. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: domain (string), ip (string), forward_tls_upstream (boolean), tls_hostname (string), descr (string). Form schema: GET /api/v1/schema/services/dns_domain_override.	services.dns:write	services_unbound_domainoverride_edit.php (WebCfg - Services: DNS Resolver: Edit Domain Override)
PUT /api/v1/services/dns-resolver/domain-overrides/{id}	Update a domain override (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: domain (string), ip (string), forward_tls_upstream (boolean), tls_hostname (string), descr (string). Form schema: GET /api/v1/schema/services/dns_domain_override.	services.dns:write	services_unbound_domainoverride_edit.php (WebCfg - Services: DNS Resolver: Edit Domain Override)
DELETE /api/v1/services/dns-resolver/domain-overrides/{id}	Delete a domain override. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_unbound.php (WebCfg - Services: DNS Resolver)
GET /api/v1/services/dns-resolver/access-lists	List access lists (with “fields” and “display”).	services.dns:read	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
GET /api/v1/services/dns-resolver/access-lists/{id}	Get an access list (with “fields” and “display”).	services.dns:read	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
POST /api/v1/services/dns-resolver/access-lists	Create an access list. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: aclname (string), aclaction (allow | deny | refuse | allow snoop | deny nonlocal | refuse nonlocal), description (string), networks (array of object). Form schema: GET /api/v1/schema/services/dns_access_list.	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
PUT /api/v1/services/dns-resolver/access-lists/{id}	Update an access list (omitted fields keep their value; “networks” replaces the list). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: aclname (string), aclaction (allow | deny | refuse | allow snoop | deny nonlocal | refuse nonlocal), description (string), networks (array of object). Form schema: GET /api/v1/schema/services/dns_access_list.	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
DELETE /api/v1/services/dns-resolver/access-lists/{id}	Delete an access list. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
GET /api/v1/services/dns-resolver/acls	List access lists (with “fields” and “display”).	services.dns:read	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
GET /api/v1/services/dns-resolver/acls/{id}	Get an access list (with “fields” and “display”).	services.dns:read	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
POST /api/v1/services/dns-resolver/acls	Create an access list. Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: aclname (string), aclaction (allow | deny | refuse | allow snoop | deny nonlocal | refuse nonlocal), description (string), networks (array of object). Form schema: GET /api/v1/schema/services/dns_access_list.	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
PUT /api/v1/services/dns-resolver/acls/{id}	Update an access list (omitted fields keep their value; “networks” replaces the list). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: aclname (string), aclaction (allow | deny | refuse | allow snoop | deny nonlocal | refuse nonlocal), description (string), networks (array of object). Form schema: GET /api/v1/schema/services/dns_access_list.	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)
DELETE /api/v1/services/dns-resolver/acls/{id}	Delete an access list. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dns:write	services_unbound_acls.php (WebCfg - Services: DNS Resolver: Access Lists)

Other services (services.misc)

Other services (UPnP IGD & PCP, Wake-on-LAN, IGMP Proxy, SNMP, DHCP/DHCPv6 Relay).

API-only privileges: “REST API - Other services (UPnP IGD & PCP, Wake-on-LAN, IGMP Proxy, SNMP, DHCP/DHCPv6 Relay): read” (api-services-misc-read) and “REST API - Other services (UPnP IGD & PCP, Wake-on-LAN, IGMP Proxy, SNMP, DHCP/DHCPv6 Relay): write” (api-services-misc-write).

Endpoint	Description	Scope	Access
GET /api/v1/services/upnp	UPnP IGD & PCP settings and whether miniupnpd runs.	services.misc:read	pkg_edit.php?xml=miniupnpd.xml (WebCfg - Services: UPnP IGD & PCP)
PUT /api/v1/services/upnp	Change UPnP IGD & PCP settings and restart miniupnpd at once (omitted fields keep their value). Body: The UPnP IGD & PCP settings form (pkg_edit.php?xml=miniupnpd.xml): enable, enable_upnp, enable_natpmp, enable_stun, logpackets, sysuptime, permdefault (booleans), ext_iface, iface_array (list), stun_host, stun_port, overridewanip, download, upload, upnpqueue, presentationurl, modelnumber, acl (list of “allow|deny ext-ports address/bits int-ports” entries). Omitted fields keep their value.	services.misc:write	pkg_edit.php?xml=miniupnpd.xml (WebCfg - Services: UPnP IGD & PCP)
GET /api/v1/services/upnp/status	Whether UPnP runs and its active port maps.	services.misc:read	status_upnp.php (WebCfg - Status: UPnP IGD & PCP)
DELETE /api/v1/services/upnp/port-maps	Delete all port maps (restarts miniupnpd; only while UPnP is enabled).	services.misc:write	status_upnp.php (WebCfg - Status: UPnP IGD & PCP)
GET /api/v1/services/wol/entries	List Wake-on-LAN devices.	services.misc:read	services_wol.php (WebCfg - Services: Wake-on-LAN)
GET /api/v1/services/wol/entries/{id}	Get a Wake-on-LAN device.	services.misc:read	services_wol.php (WebCfg - Services: Wake-on-LAN)
POST /api/v1/services/wol/entries	Add a Wake-on-LAN device (the list is sorted by description, so ids can change). Body: interface (string), mac (string), descr (string).	services.misc:write	services_wol_edit.php (WebCfg - Services: Wake-on-LAN: Edit)
PUT /api/v1/services/wol/entries/{id}	Update a Wake-on-LAN device (omitted fields keep their value; the response has its new id). Body: interface (string), mac (string), descr (string).	services.misc:write	services_wol_edit.php (WebCfg - Services: Wake-on-LAN: Edit)
DELETE /api/v1/services/wol/entries/{id}	Delete a Wake-on-LAN device.	services.misc:write	services_wol.php (WebCfg - Services: Wake-on-LAN)
POST /api/v1/services/wol/entries/{id}/wake	Send a magic packet to a stored device.	services.misc:write	services_wol.php (WebCfg - Services: Wake-on-LAN)
POST /api/v1/services/wol/wake	Send a magic packet to a MAC address on an interface. Body: interface (string, required), mac (string, required).	services.misc:write	services_wol.php (WebCfg - Services: Wake-on-LAN)
POST /api/v1/services/wol/wake-all	Send a magic packet to every stored device.	services.misc:write	services_wol.php (WebCfg - Services: Wake-on-LAN)
GET /api/v1/services/igmp-proxy	IGMP Proxy settings and whether changes are pending.	services.misc:read	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
PUT /api/v1/services/igmp-proxy	Change IGMP Proxy settings (enabling needs an upstream and a downstream entry). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: enable (boolean), verbose (boolean).	services.misc:write	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
POST /api/v1/services/igmp-proxy/apply	Apply pending IGMP Proxy changes.	services.misc:write	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
GET /api/v1/services/igmp-proxy/entries	List IGMP Proxy interfaces.	services.misc:read	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
GET /api/v1/services/igmp-proxy/entries/{id}	Get an IGMP Proxy interface.	services.misc:read	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
POST /api/v1/services/igmp-proxy/entries	Add an IGMP Proxy interface (only one upstream). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: ifname (string), type (upstream | downstream), threshold (string), networks (array of string), descr (string).	services.misc:write	services_igmpproxy_edit.php (WebCfg - Services: IGMP Proxy: Edit)
PUT /api/v1/services/igmp-proxy/entries/{id}	Update an IGMP Proxy interface (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: ifname (string), type (upstream | downstream), threshold (string), networks (array of string), descr (string).	services.misc:write	services_igmpproxy_edit.php (WebCfg - Services: IGMP Proxy: Edit)
DELETE /api/v1/services/igmp-proxy/entries/{id}	Delete an IGMP Proxy interface. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.misc:write	services_igmpproxy.php (WebCfg - Services: IGMP Proxy)
GET /api/v1/services/dhcp-relay	DHCP Relay settings and choices (the relay cannot run while a DHCP server is enabled).	services.misc:read	services_dhcp_relay.php (WebCfg - Services: DHCP Relay)
PUT /api/v1/services/dhcp-relay	Change DHCP Relay settings (applied at once). Body: The relay settings form: enable, agentoption (booleans), interface (list from “interface_choices”), server (list of upstream server addresses), carpstatusvip (“none” or a VIP from “carp_choices”). Omitted fields keep their value. Saving reconfigures the relay at once. GET also returns “fields”, the form of the schema services/dhcp[v6]_relay, whose servers are {address} rows; a PUT takes either form. Form schema: GET /api/v1/schema/services/dhcp_relay.	services.misc:write	services_dhcp_relay.php (WebCfg - Services: DHCP Relay)
GET /api/v1/services/dhcpv6-relay	DHCPv6 Relay settings and choices (the relay cannot run while a DHCPv6 server is enabled).	services.misc:read	services_dhcpv6_relay.php (WebCfg - Services: DHCPv6 Relay)
PUT /api/v1/services/dhcpv6-relay	Change DHCPv6 Relay settings (applied at once). Body: The relay settings form: enable, agentoption (booleans), interface (list from “interface_choices”), server (list of upstream server addresses), carpstatusvip (“none” or a VIP from “carp_choices”). Omitted fields keep their value. Saving reconfigures the relay at once. GET also returns “fields”, the form of the schema services/dhcp[v6]_relay, whose servers are {address} rows; a PUT takes either form. Form schema: GET /api/v1/schema/services/dhcpv6_relay.	services.misc:write	services_dhcpv6_relay.php (WebCfg - Services: DHCPv6 Relay)
GET /api/v1/services/snmp	SNMP settings (community and trap strings read as “(set)”).	services.misc:read	services_snmp.php (WebCfg - Services: SNMP)
PUT /api/v1/services/snmp	Change SNMP settings (applied at once). Body: The SNMP settings form: enable, trapenable, mibii, netgraph, pf, hostres, bridge, ucd, regex (booleans), pollport, syslocation, syscontact, rocommunity, trapserver, trapserverport, trapstring, ipprotocol (inet4|inet6|inet46), bindip (list from “bindip_choices”). Omitted fields keep their value; rocommunity and trapstring read as “(set)” and sending “(set)” keeps them. Saving restarts the SNMP daemon at once.	services.misc:write	services_snmp.php (WebCfg - Services: SNMP)

NTP server (services.time)

NTP server (settings and access restrictions).

API-only privileges: “REST API - NTP server (settings and access restrictions): read” (api-services-time-read) and “REST API - NTP server (settings and access restrictions): write” (api-services-time-write).

Endpoint	Description	Scope	Access
GET /api/v1/services/ntp	NTP server settings (the authentication key reads as “(set)”) and whether ntpd runs.	services.time:read	services_ntpd.php (WebCfg - Services: NTP Settings)
PUT /api/v1/services/ntp	Change NTP server settings (applied at once; omitted fields keep their value). Body: The NTP settings form: enable, statsgraph, logpeer, logsys, clockstats, loopstats, peerstats, serverauth (booleans); interface (list from “interface_choices”; empty: all); servers (list of {server, prefer, noselect, auth (booleans), type: server|pool|peer}, at most 10; empty: pool.ntp.org); ntpmaxpeers, ntporphan, ntpminpoll, ntpmaxpoll (from “poll_choices”), dnsresolv (auto|inet|inet6), leaptext (the leap seconds file), leapfile_base64 (write only: a base64 encoded leap seconds file that replaces leaptext), serverauthkeyid, serverauthkey (“(set)” keeps it), serverauthalgo (md5|sha1|sha256). Omitted fields keep their value. Saving restarts ntpd at once. Form schema: GET /api/v1/schema/services/ntp.	services.time:write	services_ntpd.php (WebCfg - Services: NTP Settings)
GET /api/v1/services/ntp/acls	NTP default and custom access restrictions.	services.time:read	services_ntpd_acls.php (WebCfg - Services: NTP ACL Settings)
PUT /api/v1/services/ntp/acls	Change NTP access restrictions (applied at once; “networks” replaces the list). Body: Default access restrictions as the ACLs form shows them: kod, nomodify, noquery, noserve, nopeer, notrap (booleans); networks: list of {network: “address/bits”, kod, nomodify, noquery, noserve, nopeer, notrap}, at most 50, replaces the list. Omitted fields keep their value. Saving restarts ntpd at once.	services.time:write	services_ntpd_acls.php (WebCfg - Services: NTP ACL Settings)

Dynamic DNS (services.ddns)

Dynamic DNS (Dynamic DNS and RFC 2136 clients).

API-only privileges: “REST API - Dynamic DNS (Dynamic DNS and RFC 2136 clients): read” (api-services-ddns-read) and “REST API - Dynamic DNS (Dynamic DNS and RFC 2136 clients): write” (api-services-ddns-write).

Endpoint	Description	Scope	Access
GET /api/v1/services/dyndns/choices	Choices of the Dynamic DNS client form (service types, interfaces, check IP modes).	services.ddns:read	services_dyndns_edit.php (WebCfg - Services: Dynamic DNS client)
GET /api/v1/services/dyndns/clients	List Dynamic DNS clients (passwords read as “(set)”; with “fields” and “display”: the list columns as text and the update status).	services.ddns:read	services_dyndns.php (WebCfg - Services: Dynamic DNS clients)
GET /api/v1/services/dyndns/clients/{id}	Get a Dynamic DNS client (with “fields” and “display”).	services.ddns:read	services_dyndns.php (WebCfg - Services: Dynamic DNS clients)
POST /api/v1/services/dyndns/clients	Create a Dynamic DNS client (an enabled client is updated at once). Body: The Dynamic DNS client form: enable, wildcard, proxied, verboselog, curl_ipresolve_v4, curl_ssl_verifypeer, curl_proxy (booleans); type (from GET …/choices), interface, requestif (custom types), check_ip_mode (default|always|never), host, domainname, mx, username, password (“(set)” keeps it), zoneid, updateurl, resultmatch, ttl, maxcacheage, descr. Omitted fields keep their value (a new client starts from the form’s defaults: enabled, first interface, verify TLS). Saving an enabled client updates its provider at once. Form schema: GET /api/v1/schema/services/dyndns.	services.ddns:write	services_dyndns_edit.php (WebCfg - Services: Dynamic DNS client)
PUT /api/v1/services/dyndns/clients/{id}	Update a Dynamic DNS client (omitted fields and an empty password keep their value; an enabled client is updated at once). Body: The Dynamic DNS client form: enable, wildcard, proxied, verboselog, curl_ipresolve_v4, curl_ssl_verifypeer, curl_proxy (booleans); type (from GET …/choices), interface, requestif (custom types), check_ip_mode (default|always|never), host, domainname, mx, username, password (“(set)” keeps it), zoneid, updateurl, resultmatch, ttl, maxcacheage, descr. Omitted fields keep their value (a new client starts from the form’s defaults: enabled, first interface, verify TLS). Saving an enabled client updates its provider at once. Form schema: GET /api/v1/schema/services/dyndns.	services.ddns:write	services_dyndns_edit.php (WebCfg - Services: Dynamic DNS client)
DELETE /api/v1/services/dyndns/clients/{id}	Delete a Dynamic DNS client and its cached address.	services.ddns:write	services_dyndns.php (WebCfg - Services: Dynamic DNS clients)
POST /api/v1/services/dyndns/clients/{id}/toggle	Enable or disable a Dynamic DNS client (runs the Dynamic DNS updates, like the list page).	services.ddns:write	services_dyndns.php (WebCfg - Services: Dynamic DNS clients)
POST /api/v1/services/dyndns/clients/{id}/update	Force an update of a Dynamic DNS client (the edit page’s “Save & Force Update”; nothing is sent for a disabled client).	services.ddns:write	services_dyndns_edit.php (WebCfg - Services: Dynamic DNS client)
GET /api/v1/services/rfc2136/choices	Choices of the RFC 2136 client form (interfaces, key algorithms, update sources, families, record types).	services.ddns:read	services_rfc2136_edit.php (WebCfg - Services: RFC 2136 Client: Edit)
GET /api/v1/services/rfc2136/clients	List RFC 2136 clients (keys read as “(set)”; with “fields” and “display”: the list columns as text and the update status).	services.ddns:read	services_rfc2136.php (WebCfg - Services: RFC 2136 Clients)
GET /api/v1/services/rfc2136/clients/{id}	Get an RFC 2136 client (with “fields” and “display”).	services.ddns:read	services_rfc2136.php (WebCfg - Services: RFC 2136 Clients)
POST /api/v1/services/rfc2136/clients	Create an RFC 2136 client (runs the updates of the enabled clients). Body: The RFC 2136 client form: enable, usetcp, usepublicip (booleans); interface, host, zone, ttl, keyname, keyalgorithm, keydata (“(set)” keeps it), server (“address” or “address port”), updatesource, updatesourcefamily, recordtype (A|AAAA|both), descr (choices from GET …/choices). Omitted fields keep their value (a new client starts disabled). Saving runs the RFC 2136 updates of the enabled clients at once. Form schema: GET /api/v1/schema/services/rfc2136.	services.ddns:write	services_rfc2136_edit.php (WebCfg - Services: RFC 2136 Client: Edit)
PUT /api/v1/services/rfc2136/clients/{id}	Update an RFC 2136 client (omitted fields and an empty key keep their value; runs the updates of the enabled clients). Body: The RFC 2136 client form: enable, usetcp, usepublicip (booleans); interface, host, zone, ttl, keyname, keyalgorithm, keydata (“(set)” keeps it), server (“address” or “address port”), updatesource, updatesourcefamily, recordtype (A|AAAA|both), descr (choices from GET …/choices). Omitted fields keep their value (a new client starts disabled). Saving runs the RFC 2136 updates of the enabled clients at once. Form schema: GET /api/v1/schema/services/rfc2136.	services.ddns:write	services_rfc2136_edit.php (WebCfg - Services: RFC 2136 Client: Edit)
DELETE /api/v1/services/rfc2136/clients/{id}	Delete an RFC 2136 client and its cached addresses.	services.ddns:write	services_rfc2136.php (WebCfg - Services: RFC 2136 Clients)
POST /api/v1/services/rfc2136/clients/{id}/toggle	Enable or disable an RFC 2136 client (like the list page, no update is run).	services.ddns:write	services_rfc2136.php (WebCfg - Services: RFC 2136 Clients)
POST /api/v1/services/rfc2136/clients/{id}/update	Force an update of an RFC 2136 client (the edit page’s “Save & Force Update”; nothing is sent for a disabled client).	services.ddns:write	services_rfc2136_edit.php (WebCfg - Services: RFC 2136 Client: Edit)

DHCP and DHCPv6 servers, static mappings and router advertisements (services.dhcp)

DHCP and DHCPv6 servers, static mappings and router advertisements.

API-only privileges: “REST API - DHCP and DHCPv6 servers, static mappings and router advertisements: read” (api-services-dhcp-read) and “REST API - DHCP and DHCPv6 servers, static mappings and router advertisements: write” (api-services-dhcp-write).

Endpoint	Description	Scope	Access
GET /api/v1/services/dhcp/interfaces	Interfaces, whether the DHCP and DHCPv6 servers can serve them and their state.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcpv6/interfaces	Interfaces, whether the DHCP and DHCPv6 servers can serve them and their state.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcp/settings	DHCP server settings (Kea backend), their choices and whether changes are pending.	services.dhcp:read	services_dhcp_settings.php (WebCfg - Services: DHCP Server: Settings)
PUT /api/v1/services/dhcp/settings	Change DHCP server settings (Kea backend; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The Kea settings form: dnsreg, earlydnsreg, ha_enable, ha_tls, ha_mutualtls (booleans); loglevel (from “loglevel_choices”), ha_role (primary|standby), ha_localname, ha_localip, ha_localport, ha_remotename, ha_remoteip, ha_remoteport, ha_heartbeatdelay, ha_maxresponsedelay, ha_maxackdelay, ha_maxunackedclients, ha_maxrejectedleaseupdates, ha_scertref and ha_ccertref (from “scertref_choices” / “ccertref_choices”), custom_kea_config (JSON text; only users allowed to edit custom Kea configuration may change it). Omitted fields keep their value. Only with the Kea DHCP backend. Form schema: GET /api/v1/schema/services/dhcp_settings.	services.dhcp:write	services_dhcp_settings.php (WebCfg - Services: DHCP Server: Settings)
POST /api/v1/services/dhcp/apply	Apply pending DHCP server changes.	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/{if}/static-mappings	List the DHCP static mappings of an interface (sorted by address).	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/{if}/static-mappings/{id}	Get a DHCP static mapping by position or MAC address.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
POST /api/v1/services/dhcp/{if}/static-mappings	Create a DHCP static mapping (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The static mapping edit form: mac, cid, ipaddr, hostname, descr, earlydnsregpolicy (default|enable|disable), gateway, domain, domainsearchlist, tftp, ldap, filename, filename32, filename64, filename32arm, filename64arm, uefihttpboot, rootpath (strings); arp_table_static_entry, netboot (booleans); winsserver (at most 2), dnsserver (at most 4), ntpserver (at most 4) (lists of addresses). Kea backend: custom_kea_config (JSON text). ISC backend: deftime, maxtime, nextserver, ddnsdomain, ddnsdomainprimary, ddnsdomainsecondary, ddnsdomainkeyname, ddnsdomainkeyalgorithm, ddnsdomainkey (“(set)” keeps it) (strings); ddnsupdate, ddnsforcehostname (booleans); numberoptions (list of {number, type, value}). Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcp_edit.php (WebCfg - Services: DHCP Server: Edit static mapping)
PUT /api/v1/services/dhcp/{if}/static-mappings/{id}	Update a DHCP static mapping (omitted fields keep their value; the response has its new id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The static mapping edit form: mac, cid, ipaddr, hostname, descr, earlydnsregpolicy (default|enable|disable), gateway, domain, domainsearchlist, tftp, ldap, filename, filename32, filename64, filename32arm, filename64arm, uefihttpboot, rootpath (strings); arp_table_static_entry, netboot (booleans); winsserver (at most 2), dnsserver (at most 4), ntpserver (at most 4) (lists of addresses). Kea backend: custom_kea_config (JSON text). ISC backend: deftime, maxtime, nextserver, ddnsdomain, ddnsdomainprimary, ddnsdomainsecondary, ddnsdomainkeyname, ddnsdomainkeyalgorithm, ddnsdomainkey (“(set)” keeps it) (strings); ddnsupdate, ddnsforcehostname (booleans); numberoptions (list of {number, type, value}). Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcp_edit.php (WebCfg - Services: DHCP Server: Edit static mapping)
DELETE /api/v1/services/dhcp/{if}/static-mappings/{id}	Delete a DHCP static mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcpv6/settings	DHCPv6 server settings (Kea backend), their choices and whether changes are pending.	services.dhcp:read	services_dhcpv6_settings.php (WebCfg - Services: DHCPv6 Server: Settings)
PUT /api/v1/services/dhcpv6/settings	Change DHCPv6 server settings (Kea backend; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The Kea settings form: dnsreg, earlydnsreg, ha_enable, ha_tls, ha_mutualtls (booleans); loglevel (from “loglevel_choices”), ha_role (primary|standby), ha_localname, ha_localip, ha_localport, ha_remotename, ha_remoteip, ha_remoteport, ha_heartbeatdelay, ha_maxresponsedelay, ha_maxackdelay, ha_maxunackedclients, ha_maxrejectedleaseupdates, ha_scertref and ha_ccertref (from “scertref_choices” / “ccertref_choices”), custom_kea_config (JSON text; only users allowed to edit custom Kea configuration may change it). Omitted fields keep their value. Only with the Kea DHCP backend. Form schema: GET /api/v1/schema/services/dhcpv6_settings.	services.dhcp:write	services_dhcpv6_settings.php (WebCfg - Services: DHCPv6 Server: Settings)
POST /api/v1/services/dhcpv6/apply	Apply pending DHCPv6 server changes.	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/{if}/static-mappings	List the DHCPv6 static mappings of an interface (sorted by address).	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/{if}/static-mappings/{id}	Get a DHCPv6 static mapping by position or DUID.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
POST /api/v1/services/dhcpv6/{if}/static-mappings	Create a DHCPv6 static mapping (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DHCPv6 static mapping edit form: duid (required), ipaddrv6, hostname, descr, earlydnsregpolicy (default|enable|disable). Kea backend: pdprefix (delegated prefix/length), custom_kea_config (JSON text). ISC backend with network booting enabled on the interface: filename, rootpath. Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcpv6_edit.php (WebCfg - Services: DHCPv6 Server: Edit static mapping)
PUT /api/v1/services/dhcpv6/{if}/static-mappings/{id}	Update a DHCPv6 static mapping (omitted fields keep their value; the response has its new id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DHCPv6 static mapping edit form: duid (required), ipaddrv6, hostname, descr, earlydnsregpolicy (default|enable|disable). Kea backend: pdprefix (delegated prefix/length), custom_kea_config (JSON text). ISC backend with network booting enabled on the interface: filename, rootpath. Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcpv6_edit.php (WebCfg - Services: DHCPv6 Server: Edit static mapping)
DELETE /api/v1/services/dhcpv6/{if}/static-mappings/{id}	Delete a DHCPv6 static mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcp/pending	Whether DHCP server changes are staged until POST /v1/services/dhcp/apply.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/servers	Every interface with its DHCP server: enabled, range, static mappings and whether the server can run on it.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/servers/{interface}	The DHCP server of an interface: stored settings, “fields” (the edit form) and “display” (texts and hints).	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
PUT /api/v1/services/dhcp/servers/{interface}	Change the DHCP server of an interface (omitted fields keep their value; staged like the GUI). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the server (schema services/dhcp_server or services/dhcpv6_server): the DHCP[v6] Server page’s fields; the address lists (winsserver, dnsserver, ntpserver) as lists of addresses or of {address} rows. Omitted fields keep their value; false clears a switch; “(set)” keeps a key. Form schema: GET /api/v1/schema/services/dhcp_server.	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/servers/{interface}/static-mappings	The DHCP static mappings of an interface with “fields” and “display” (sorted by address).	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/servers/{interface}/static-mappings/{id}	A DHCP static mapping by position or MAC address.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
POST /api/v1/services/dhcp/servers/{interface}/static-mappings	Create a DHCP static mapping (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the static mapping (schema services/dhcp_static_mapping or services/dhcpv6_static_mapping): the edit page’s fields; the address lists as lists of addresses or of {address} rows. Omitted fields keep their value (create: empty). Form schema: GET /api/v1/schema/services/dhcp_static_mapping.	services.dhcp:write	services_dhcp_edit.php (WebCfg - Services: DHCP Server: Edit static mapping)
PUT /api/v1/services/dhcp/servers/{interface}/static-mappings/{id}	Update a DHCP static mapping (omitted fields keep their value; the response has its new id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the static mapping (schema services/dhcp_static_mapping or services/dhcpv6_static_mapping): the edit page’s fields; the address lists as lists of addresses or of {address} rows. Omitted fields keep their value (create: empty). Form schema: GET /api/v1/schema/services/dhcp_static_mapping.	services.dhcp:write	services_dhcp_edit.php (WebCfg - Services: DHCP Server: Edit static mapping)
DELETE /api/v1/services/dhcp/servers/{interface}/static-mappings/{id}	Delete a DHCP static mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcpv6/pending	Whether DHCPv6 server changes are staged until POST /v1/services/dhcpv6/apply.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/servers	Every interface with its DHCPv6 server: enabled, range, static mappings and whether the server can run on it.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/servers/{interface}	The DHCPv6 server of an interface: stored settings, “fields” (the edit form) and “display” (texts and hints).	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
PUT /api/v1/services/dhcpv6/servers/{interface}	Change the DHCPv6 server of an interface (omitted fields keep their value; staged like the GUI). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the server (schema services/dhcp_server or services/dhcpv6_server): the DHCP[v6] Server page’s fields; the address lists (winsserver, dnsserver, ntpserver) as lists of addresses or of {address} rows. Omitted fields keep their value; false clears a switch; “(set)” keeps a key. Form schema: GET /api/v1/schema/services/dhcpv6_server.	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/servers/{interface}/static-mappings	The DHCPv6 static mappings of an interface with “fields” and “display” (sorted by address).	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/servers/{interface}/static-mappings/{id}	A DHCPv6 static mapping by position or DUID.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
POST /api/v1/services/dhcpv6/servers/{interface}/static-mappings	Create a DHCPv6 static mapping (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the static mapping (schema services/dhcp_static_mapping or services/dhcpv6_static_mapping): the edit page’s fields; the address lists as lists of addresses or of {address} rows. Omitted fields keep their value (create: empty). Form schema: GET /api/v1/schema/services/dhcpv6_static_mapping.	services.dhcp:write	services_dhcpv6_edit.php (WebCfg - Services: DHCPv6 Server: Edit static mapping)
PUT /api/v1/services/dhcpv6/servers/{interface}/static-mappings/{id}	Update a DHCPv6 static mapping (omitted fields keep their value; the response has its new id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The “fields” of the static mapping (schema services/dhcp_static_mapping or services/dhcpv6_static_mapping): the edit page’s fields; the address lists as lists of addresses or of {address} rows. Omitted fields keep their value (create: empty). Form schema: GET /api/v1/schema/services/dhcpv6_static_mapping.	services.dhcp:write	services_dhcpv6_edit.php (WebCfg - Services: DHCPv6 Server: Edit static mapping)
DELETE /api/v1/services/dhcpv6/servers/{interface}/static-mappings/{id}	Delete a DHCPv6 static mapping. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcp/{if}	The DHCP server of an interface: its settings for the running backend, choices and whether changes are pending.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
PUT /api/v1/services/dhcp/{if}	Change the DHCP server of an interface (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DHCP Server page of the interface: enable, staticarp, netboot (booleans); range_from, range_to, denyunknown (disabled|enabled|class), gateway, domain, domainsearchlist, deftime, maxtime, mac_allow, mac_deny, tftp, ldap, nextserver, filename, filename32, filename64, filename32arm, filename64arm, uefihttpboot, rootpath (strings); winsserver (at most 2), dnsserver (at most 4), ntpserver (at most 4) (lists of addresses); ignoreclientuids (boolean). Kea backend: dnsregpolicy, earlydnsregpolicy (default|enable|disable), custom_kea_config (JSON text). ISC backend: ignorebootp, nonak, omapi_gen_key, ddnsupdate, ddnsforcehostname, dhcpleaseinlocaltime, statsgraph, disablepingcheck (booleans); failover_peerip, omapi_port, omapi_key, omapi_key_algorithm, ddnsdomain, ddnsdomainprimary, ddnsdomainprimaryport, ddnsdomainsecondary, ddnsdomainsecondaryport, ddnsdomainkeyname, ddnsdomainkeyalgorithm, ddnsdomainkey, ddnsclientupdates (strings; “(set)” keeps a key); numberoptions (list of {number, type, value}). Omitted fields keep their value.	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/{if}/pools	List the additional address pools of an interface.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcp/{if}/pools/{id}	Get an additional address pool by position.	services.dhcp:read	services_dhcp.php (WebCfg - Services: DHCP Server)
POST /api/v1/services/dhcp/{if}/pools	Add an address pool (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: An additional address pool: the fields of the DHCP server of the interface that the pool form has: descr, range_from, range_to (required), denyunknown, the server lists, gateway, domain, domainsearchlist, mac_allow, mac_deny, tftp, ldap, netboot and the boot file names; Kea: custom_kea_config; ISC: also ignoreclientuids, deftime, maxtime, nextserver, the OMAPI, dynamic DNS and custom option fields. Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
PUT /api/v1/services/dhcp/{if}/pools/{id}	Change an address pool (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: An additional address pool: the fields of the DHCP server of the interface that the pool form has: descr, range_from, range_to (required), denyunknown, the server lists, gateway, domain, domainsearchlist, mac_allow, mac_deny, tftp, ldap, netboot and the boot file names; Kea: custom_kea_config; ISC: also ignoreclientuids, deftime, maxtime, nextserver, the OMAPI, dynamic DNS and custom option fields. Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
DELETE /api/v1/services/dhcp/{if}/pools/{id}	Delete an address pool. Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcp.php (WebCfg - Services: DHCP Server)
GET /api/v1/services/dhcpv6/{if}	The DHCPv6 server of an interface: its settings for the running backend, choices and whether changes are pending.	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
PUT /api/v1/services/dhcpv6/{if}	Change the DHCPv6 server of an interface (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The DHCPv6 Server page of the interface: enable, dhcp6c-dns (provide DNS servers), netboot (booleans); range_from, range_to, denyunknown (disabled|enabled|class), domain, domainsearchlist, deftime, maxtime, bootfile_url (strings); dnsserver, ntpserver (lists of at most 4 IPv6 addresses). Kea backend: dnsregpolicy, earlydnsregpolicy (default|enable|disable), pdprefix, pdprefixlen, pddellen (delegated prefixes), custom_kea_config (JSON text). ISC backend: prefixrange_from, prefixrange_to, prefixrange_length, ldap, ddnsdomain, ddnsdomainprimary, ddnsdomainsecondary, ddnsdomainkeyname, ddnsdomainkeyalgorithm, ddnsdomainkey (“(set)” keeps it), ddnsclientupdates (strings); dhcpv6leaseinlocaltime, ddnsupdate, ddnsforcehostname, ddnsreverse (booleans); numberoptions (list of {number, value}). Omitted fields keep their value.	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/{if}/pools	List the additional DHCPv6 address pools of an interface (Kea backend).	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/dhcpv6/{if}/pools/{id}	Get an additional DHCPv6 address pool by position (Kea backend).	services.dhcp:read	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
POST /api/v1/services/dhcpv6/{if}/pools	Add a DHCPv6 address pool (Kea backend; the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: An additional DHCPv6 address pool (Kea backend): descr, range_from, range_to (required), denyunknown, domain, domainsearchlist, bootfile_url, custom_kea_config (strings); dnsserver, ntpserver (lists); netboot (boolean). Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
PUT /api/v1/services/dhcpv6/{if}/pools/{id}	Change a DHCPv6 address pool (Kea backend; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: An additional DHCPv6 address pool (Kea backend): descr, range_from, range_to (required), denyunknown, domain, domainsearchlist, bootfile_url, custom_kea_config (strings); dnsserver, ntpserver (lists); netboot (boolean). Omitted fields keep their value (create: empty).	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
DELETE /api/v1/services/dhcpv6/{if}/pools/{id}	Delete a DHCPv6 address pool (Kea backend). Query: apply (true to apply the change at once (default: stage it like the GUI)).	services.dhcp:write	services_dhcpv6.php (WebCfg - Services: DHCPv6 Server)
GET /api/v1/services/router-advertisements	Interfaces that can send router advertisements, with “fields” and “display” (interface, mode, priority, DHCPv6 server as text).	services.dhcp:read	services_radvd.php (WebCfg - Services: Router Advertisement)
GET /api/v1/services/router-advertisements/{if}	Router advertisements of an interface: the settings and their choices (with “fields” and “display”).	services.dhcp:read	services_radvd.php (WebCfg - Services: Router Advertisement)
PUT /api/v1/services/router-advertisements/{if}	Change the router advertisements of an interface (applied at once; omitted fields keep their value). Body: The Router Advertisement page of the interface: ramode, rapriority (from “choices”), rainterface (the interface or one of its IPv6 CARP VIPs, from “choices”; empty without such a VIP), ravalidlifetime, rapreferredlifetime, raminrtradvinterval, ramaxrtradvinterval, raadvdefaultlifetime, pref64_lifetime, pref64_prefix (only when the NAT64 prefix override is allowed), radomainsearchlist (strings); pref64_enable, radvd-dns, rasamednsasdhcp6 (booleans); subnets (list of “address/bits” or aliases), radnsserver (list of at most 4). Omitted fields keep their value. Applied at once, like the page. Form schema: GET /api/v1/schema/services/router_advertisements.	services.dhcp:write	services_radvd.php (WebCfg - Services: Router Advertisement)

IPsec (vpn.ipsec)

IPsec (tunnels, pre-shared keys, status).

API-only privileges: “REST API - IPsec (tunnels, pre-shared keys, status): read” (api-vpn-ipsec-read) and “REST API - IPsec (tunnels, pre-shared keys, status): write” (api-vpn-ipsec-write).

Endpoint	Description	Scope	Access
POST /api/v1/vpn/ipsec/apply	Apply pending IPsec changes.	vpn.ipsec:write	vpn_ipsec.php (WebCfg - VPN: IPsec)
GET /api/v1/vpn/ipsec/status	IPsec status: for every tunnel whether it is connected, its security associations and its phase 2 entries.	vpn.ipsec:read	status_ipsec.php (WebCfg - Status: IPsec)
GET /api/v1/vpn/ipsec/pre-shared-keys	List the IPsec pre-shared keys (keys read as “(set)”).	vpn.ipsec:read	vpn_ipsec_keys.php (WebCfg - VPN: IPsec: Pre-Shared Keys List)
GET /api/v1/vpn/ipsec/pre-shared-keys/{id}	Get an IPsec pre-shared key by position or identifier.	vpn.ipsec:read	vpn_ipsec_keys.php (WebCfg - VPN: IPsec: Pre-Shared Keys List)
POST /api/v1/vpn/ipsec/pre-shared-keys	Create an IPsec pre-shared key (the response has its id). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A pre-shared key: ident (identifier: an address, FQDN, e-mail address or “any”), type (PSK|EAP), psk (the key; “(set)” keeps it), ident_type (EAP identifier type: none|email|fqdn|userfqdn|keyid|asn1dn), pool_address, pool_netbits (EAP virtual address pool), dns_address (EAP DNS server). Omitted fields keep their value (create: type PSK, ident_type none, pool_netbits 32).	vpn.ipsec:write	vpn_ipsec_keys_edit.php (WebCfg - VPN: IPsec: Edit Pre-Shared Keys)
PUT /api/v1/vpn/ipsec/pre-shared-keys/{id}	Update an IPsec pre-shared key (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A pre-shared key: ident (identifier: an address, FQDN, e-mail address or “any”), type (PSK|EAP), psk (the key; “(set)” keeps it), ident_type (EAP identifier type: none|email|fqdn|userfqdn|keyid|asn1dn), pool_address, pool_netbits (EAP virtual address pool), dns_address (EAP DNS server). Omitted fields keep their value (create: type PSK, ident_type none, pool_netbits 32).	vpn.ipsec:write	vpn_ipsec_keys_edit.php (WebCfg - VPN: IPsec: Edit Pre-Shared Keys)
DELETE /api/v1/vpn/ipsec/pre-shared-keys/{id}	Delete an IPsec pre-shared key. Query: apply (true to apply the change at once (default: stage it like the GUI)).	vpn.ipsec:write	vpn_ipsec_keys.php (WebCfg - VPN: IPsec: Pre-Shared Keys List)
GET /api/v1/vpn/ipsec/tunnels	List the IPsec tunnels (phase 1 entries with a summary of their phase 2 entries) and whether changes are pending.	vpn.ipsec:read	vpn_ipsec.php (WebCfg - VPN: IPsec)
GET /api/v1/vpn/ipsec/tunnels/{ikeid}	Get an IPsec tunnel (phase 1, secrets read as “(set)”) with its phase 2 entries and its edit form (“fields”).	vpn.ipsec:read	vpn_ipsec.php (WebCfg - VPN: IPsec)
POST /api/v1/vpn/ipsec/tunnels	Create an IPsec tunnel (phase 1; the response has its ikeid). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A phase 1 as its edit page’s form (“fields” of GET): descr, disabled, iketype (ikev1|ikev2|auto), protocol (inet|inet6|both), interface, remotegw, authentication_method, mode (main|aggressive, IKEv1), myid_type, myid_data, peerid_type, peerid_data, pskey (“(set)” keeps it), certref, caref, pkcs11certref, pkcs11pin, encryption (list of {algorithm, keylen, hash, prf, dhgroup}), lifetime, rekey_time, reauth_time, rand_time, startaction, closeaction, nat_traversal (on|force), mobike (on|off), gw_duplicates, splitconn, prfselect_enable, dpd_enable (booleans), ikeport, nattport, dpd_delay, dpd_maxfail; create only: mobile (boolean). Omitted fields keep their value (create: the page’s defaults).	vpn.ipsec:write	vpn_ipsec_phase1.php (WebCfg - VPN: IPsec: Edit Phase 1)
PUT /api/v1/vpn/ipsec/tunnels/{ikeid}	Update an IPsec tunnel (phase 1; omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A phase 1 as its edit page’s form (“fields” of GET): descr, disabled, iketype (ikev1|ikev2|auto), protocol (inet|inet6|both), interface, remotegw, authentication_method, mode (main|aggressive, IKEv1), myid_type, myid_data, peerid_type, peerid_data, pskey (“(set)” keeps it), certref, caref, pkcs11certref, pkcs11pin, encryption (list of {algorithm, keylen, hash, prf, dhgroup}), lifetime, rekey_time, reauth_time, rand_time, startaction, closeaction, nat_traversal (on|force), mobike (on|off), gw_duplicates, splitconn, prfselect_enable, dpd_enable (booleans), ikeport, nattport, dpd_delay, dpd_maxfail; create only: mobile (boolean). Omitted fields keep their value (create: the page’s defaults).	vpn.ipsec:write	vpn_ipsec_phase1.php (WebCfg - VPN: IPsec: Edit Phase 1)
POST /api/v1/vpn/ipsec/tunnels/{ikeid}/phase2	Create a phase 2 entry of an IPsec tunnel (the response has its uniqid). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A phase 2 as its edit page’s form (“fields” of GET): descr, disabled, mode (tunnel|tunnel6|transport|vti), localid_type (address|network|<interface>), localid_address, localid_netbits, natlocalid_type (none|address|network), natlocalid_address, natlocalid_netbits, remoteid_type (address|network), remoteid_address, remoteid_netbits, proto (esp|ah), encryption (list of {algorithm, keylen}; keylen “auto” or bits), halgos (list; sent only when AES-CBC is selected or with AH, like the page), pfsgroup, lifetime, rekey_time, rand_time, pinghost, keepalive. Omitted fields keep their value (create: the page’s defaults).	vpn.ipsec:write	vpn_ipsec_phase2.php (WebCfg - VPN: IPsec: Edit Phase 2)
PUT /api/v1/vpn/ipsec/tunnels/{ikeid}/phase2/{uniqid}	Update a phase 2 entry (omitted fields keep their value). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: A phase 2 as its edit page’s form (“fields” of GET): descr, disabled, mode (tunnel|tunnel6|transport|vti), localid_type (address|network|<interface>), localid_address, localid_netbits, natlocalid_type (none|address|network), natlocalid_address, natlocalid_netbits, remoteid_type (address|network), remoteid_address, remoteid_netbits, proto (esp|ah), encryption (list of {algorithm, keylen}; keylen “auto” or bits), halgos (list; sent only when AES-CBC is selected or with AH, like the page), pfsgroup, lifetime, rekey_time, rand_time, pinghost, keepalive. Omitted fields keep their value (create: the page’s defaults).	vpn.ipsec:write	vpn_ipsec_phase2.php (WebCfg - VPN: IPsec: Edit Phase 2)
POST /api/v1/vpn/ipsec/tunnels/{ikeid}/toggle	Enable or disable an IPsec tunnel (phase 1). Query: apply (true to apply the change at once (default: stage it like the GUI)).	vpn.ipsec:write	vpn_ipsec.php (WebCfg - VPN: IPsec)
DELETE /api/v1/vpn/ipsec/tunnels/{ikeid}	Delete an IPsec tunnel (phase 1) with its phase 2 entries. Query: apply (true to apply the change at once (default: stage it like the GUI)).	vpn.ipsec:write	vpn_ipsec.php (WebCfg - VPN: IPsec)
GET /api/v1/vpn/ipsec/tunnels/{ikeid}/phase2/{uniqid}	Get a phase 2 entry of an IPsec tunnel with its edit form (“fields”).	vpn.ipsec:read	vpn_ipsec.php (WebCfg - VPN: IPsec)
POST /api/v1/vpn/ipsec/tunnels/{ikeid}/phase2/{uniqid}/toggle	Enable or disable a phase 2 entry. Query: apply (true to apply the change at once (default: stage it like the GUI)).	vpn.ipsec:write	vpn_ipsec.php (WebCfg - VPN: IPsec)
DELETE /api/v1/vpn/ipsec/tunnels/{ikeid}/phase2/{uniqid}	Delete a phase 2 entry. Query: apply (true to apply the change at once (default: stage it like the GUI)).	vpn.ipsec:write	vpn_ipsec.php (WebCfg - VPN: IPsec)
GET /api/v1/vpn/ipsec/mobile	IPsec mobile client settings, their choices and the mobile phase 1 (ikeid, or null).	vpn.ipsec:read	vpn_ipsec_mobile.php (WebCfg - VPN: IPsec: Mobile)
PUT /api/v1/vpn/ipsec/mobile	Change the IPsec mobile client settings (omitted fields keep their value; ?apply=true restarts IPsec like the page). Query: apply (true to apply the change at once (default: stage it like the GUI)). Body: The Mobile Clients page: enable, group_source, radiusaccounting, pool_enable, pool_enable_v6, radius_ip_priority_enable, radius_advanced, net_list_enable, save_passwd_enable, dns_domain_enable, dns_split_enable, dns_server_enable, wins_server_enable, pfs_group_enable, login_banner_enable (booleans); user_source, auth_groups (lists, from the *_choices); pool_address, pool_netbits, pool_address_v6, pool_netbits_v6, radius_retransmit_base, radius_retransmit_timeout, radius_retransmit_tries, radius_sockets, dns_domain, dns_split, dns_server1-4, wins_server1-2, pfs_group, login_banner. Omitted fields keep their value.	vpn.ipsec:write	vpn_ipsec_mobile.php (WebCfg - VPN: IPsec: Mobile)
GET /api/v1/vpn/ipsec/settings	IPsec advanced settings and their choices.	vpn.ipsec:read	vpn_ipsec_settings.php (WebCfg - VPN: IPsec: Settings)
PUT /api/v1/vpn/ipsec/settings	Change the IPsec advanced settings (applied at once like the page; omitted fields keep their value). Body: The Advanced Settings page: logging (object category => level, from “choices”), uniqueids, filtermode, ikev2_retransmit_tries/_timeout/_base/_jitter/_limit, maxexchange, dns-interval, port, port_nat_t (strings); ikev2_retransmit_enable, compression, pkcs11support, enableinterfacesuse, acceptunencryptedmainmode, unityplugin, strictcrlpolicy, makebeforebreak, async_crypto, autoexcludelanaddress, ipsecbypass (booleans); bypassrules (list of {source, srcmask, destination, dstmask}). Omitted fields keep their value. Applied at once, like the page.	vpn.ipsec:write	vpn_ipsec_settings.php (WebCfg - VPN: IPsec: Settings)

L2TP VPN server and users (vpn.l2tp)

L2TP VPN server and users.

API-only privileges: “REST API - L2TP VPN server and users: read” (api-vpn-l2tp-read) and “REST API - L2TP VPN server and users: write” (api-vpn-l2tp-write).

Endpoint	Description	Scope	Access
GET /api/v1/vpn/l2tp	L2TP server settings (secrets read as “(set)”), choices and whether the server runs.	vpn.l2tp:read	vpn_l2tp.php (WebCfg - VPN: L2TP)
PUT /api/v1/vpn/l2tp	Change the L2TP server settings (applied at once; omitted fields keep their value). Body: The L2TP Configuration page: enable, radiusenable, radacct_enable, radiusissueips (booleans); interface (from “interface_choices”), localip (server address), remoteip and l2tp_subnet (first remote address and its mask bits), n_l2tp_units (1-255), secret, paporchap (chap|chap-msv2|pap), l2tp_dns1, l2tp_dns2, mtu, radiusserver, radiussecret (strings; “(set)” keeps a secret). Omitted fields keep their value. Applied at once (the L2TP server restarts), like the page.	vpn.l2tp:write	vpn_l2tp.php (WebCfg - VPN: L2TP)
GET /api/v1/vpn/l2tp/users	List the L2TP users (sorted by name).	vpn.l2tp:read	vpn_l2tp_users.php (WebCfg - VPN: L2TP: Users)
GET /api/v1/vpn/l2tp/users/{id}	Get an L2TP user by position or name.	vpn.l2tp:read	vpn_l2tp_users.php (WebCfg - VPN: L2TP: Users)
POST /api/v1/vpn/l2tp/users	Create an L2TP user (applied at once; the response has its id). Body: An L2TP user: name (letters, digits, “.”, “@”, “-”, “_”), password (required for a new user; “(set)” or omitted keeps it), ip (optional fixed address). Omitted fields keep their value. Applied at once, like the page.	vpn.l2tp:write	vpn_l2tp_users_edit.php (WebCfg - VPN: L2TP: Users: Edit)
PUT /api/v1/vpn/l2tp/users/{id}	Update an L2TP user (applied at once; omitted fields keep their value; the response has its new id). Body: An L2TP user: name (letters, digits, “.”, “@”, “-”, “_”), password (required for a new user; “(set)” or omitted keeps it), ip (optional fixed address). Omitted fields keep their value. Applied at once, like the page.	vpn.l2tp:write	vpn_l2tp_users_edit.php (WebCfg - VPN: L2TP: Users: Edit)
DELETE /api/v1/vpn/l2tp/users/{id}	Delete an L2TP user (applied at once).	vpn.l2tp:write	vpn_l2tp_users.php (WebCfg - VPN: L2TP: Users)

OpenVPN servers, clients and client-specific overrides (vpn.openvpn)

OpenVPN servers, clients and client-specific overrides.

API-only privileges: “REST API - OpenVPN servers, clients and client-specific overrides: read” (api-vpn-openvpn-read) and “REST API - OpenVPN servers, clients and client-specific overrides: write” (api-vpn-openvpn-write).

Endpoint	Description	Scope	Access
GET /api/v1/vpn/openvpn/servers	List the OpenVPN servers.	vpn.openvpn:read	vpn_openvpn_server.php (WebCfg - OpenVPN: Servers)
GET /api/v1/vpn/openvpn/servers/{vpnid}	Get an OpenVPN server by vpnid (keys read as “(set)”) with its edit form (“fields”) and choices.	vpn.openvpn:read	vpn_openvpn_server.php (WebCfg - OpenVPN: Servers)
POST /api/v1/vpn/openvpn/servers	Create an OpenVPN server (applied at once; the response has its vpnid). Body: A server as its edit page’s form (“fields” of GET): description, disable, mode, authmode (list of authentication servers), dev_mode, protocol, interface, local_port, tlsauth_enable, autotls_enable (generate a new TLS key), tls (“(set)” keeps it), tls_type, tlsauth_keydir, caref, crlref, ocspcheck, ocspurl, certref, dh_length, ecdh_curve, autokey_enable (generate a new shared key), shared_key (“(set)” keeps it), data_ciphers (list), data_ciphers_fallback, digest, cert_depth, strictusercn, remote_cert_tls, tunnel_network, tunnel_networkv6_type, tunnel_networkv6, tunnel_track6_interface, tunnel_track6_prefix_id, serverbridge_*, gwredir, gwredir6, local_network(v6), remote_network(v6), maxclients, allow_compression, compression, compression_push, passtos, client2client, duplicate_cn, connlimit, dynamic_ip, topology, inactive_seconds, ping_*, keepalive_*, dns_*, ntp_*, netbios_*, wins_*, nbdd_*, push_blockoutsidedns, push_register_dns, custom_options (needs the Edit Advanced privilege), username_as_common_name, udp_fast_io, exit_notify, sndrcvbuf, create_gw (both|v4only|v6only), verbosity_level. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_server.php (WebCfg - OpenVPN: Servers)
PUT /api/v1/vpn/openvpn/servers/{vpnid}	Update an OpenVPN server (applied at once; omitted fields keep their value). Body: A server as its edit page’s form (“fields” of GET): description, disable, mode, authmode (list of authentication servers), dev_mode, protocol, interface, local_port, tlsauth_enable, autotls_enable (generate a new TLS key), tls (“(set)” keeps it), tls_type, tlsauth_keydir, caref, crlref, ocspcheck, ocspurl, certref, dh_length, ecdh_curve, autokey_enable (generate a new shared key), shared_key (“(set)” keeps it), data_ciphers (list), data_ciphers_fallback, digest, cert_depth, strictusercn, remote_cert_tls, tunnel_network, tunnel_networkv6_type, tunnel_networkv6, tunnel_track6_interface, tunnel_track6_prefix_id, serverbridge_*, gwredir, gwredir6, local_network(v6), remote_network(v6), maxclients, allow_compression, compression, compression_push, passtos, client2client, duplicate_cn, connlimit, dynamic_ip, topology, inactive_seconds, ping_*, keepalive_*, dns_*, ntp_*, netbios_*, wins_*, nbdd_*, push_blockoutsidedns, push_register_dns, custom_options (needs the Edit Advanced privilege), username_as_common_name, udp_fast_io, exit_notify, sndrcvbuf, create_gw (both|v4only|v6only), verbosity_level. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_server.php (WebCfg - OpenVPN: Servers)
DELETE /api/v1/vpn/openvpn/servers/{vpnid}	Delete an OpenVPN server (stopped at once; 409 while its interface is assigned).	vpn.openvpn:write	vpn_openvpn_server.php (WebCfg - OpenVPN: Servers)
GET /api/v1/vpn/openvpn/clients	List the OpenVPN clients.	vpn.openvpn:read	vpn_openvpn_client.php (WebCfg - OpenVPN: Clients)
GET /api/v1/vpn/openvpn/clients/{vpnid}	Get an OpenVPN client by vpnid (keys and passwords read as “(set)”) with its edit form (“fields”) and choices.	vpn.openvpn:read	vpn_openvpn_client.php (WebCfg - OpenVPN: Clients)
POST /api/v1/vpn/openvpn/clients	Create an OpenVPN client (applied at once; the response has its vpnid). Body: A client as its edit page’s form (“fields” of GET): description, disable, mode, dev_mode, protocol, interface, local_port, server_addr, server_port, proxy_addr, proxy_port, proxy_authtype, proxy_user, proxy_passwd and auth_pass (“(set)” keeps them), auth_user, auth-retry-none, tlsauth_enable, autotls_enable, tls, tls_type, tlsauth_keydir, caref, crlref, autokey_enable, shared_key, certref, data_ciphers (list), data_ciphers_fallback, digest, remote_cert_tls, tunnel_network(v6), remote_network(v6), use_shaper, allow_compression, compression, topology, passtos, route_no_pull, route_no_exec, dns_add, inactive_seconds, ping_method, keepalive_*, ping_seconds, ping_action, ping_action_seconds, custom_options, udp_fast_io, exit_notify, sndrcvbuf, create_gw, verbosity_level. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_client.php (WebCfg - OpenVPN: Clients)
PUT /api/v1/vpn/openvpn/clients/{vpnid}	Update an OpenVPN client (applied at once; omitted fields keep their value). Body: A client as its edit page’s form (“fields” of GET): description, disable, mode, dev_mode, protocol, interface, local_port, server_addr, server_port, proxy_addr, proxy_port, proxy_authtype, proxy_user, proxy_passwd and auth_pass (“(set)” keeps them), auth_user, auth-retry-none, tlsauth_enable, autotls_enable, tls, tls_type, tlsauth_keydir, caref, crlref, autokey_enable, shared_key, certref, data_ciphers (list), data_ciphers_fallback, digest, remote_cert_tls, tunnel_network(v6), remote_network(v6), use_shaper, allow_compression, compression, topology, passtos, route_no_pull, route_no_exec, dns_add, inactive_seconds, ping_method, keepalive_*, ping_seconds, ping_action, ping_action_seconds, custom_options, udp_fast_io, exit_notify, sndrcvbuf, create_gw, verbosity_level. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_client.php (WebCfg - OpenVPN: Clients)
DELETE /api/v1/vpn/openvpn/clients/{vpnid}	Delete an OpenVPN client (stopped at once; 409 while its interface is assigned).	vpn.openvpn:write	vpn_openvpn_client.php (WebCfg - OpenVPN: Clients)
GET /api/v1/vpn/openvpn/csc	List the OpenVPN client specific overrides.	vpn.openvpn:read	vpn_openvpn_csc.php (WebCfg - OpenVPN: Client Specific Override)
GET /api/v1/vpn/openvpn/csc/{id}	Get a client specific override by position or common name with its edit form (“fields”) and choices.	vpn.openvpn:read	vpn_openvpn_csc.php (WebCfg - OpenVPN: Client Specific Override)
POST /api/v1/vpn/openvpn/csc	Create a client specific override (applied at once; the response has its id). Body: A client specific override as its edit page’s form (“fields” of GET): description, disable, common_name, block, server_list (list of server vpnids; empty: all servers), override_options (default|push_reset|remove_specified), remove_options (list), keep_minimal, tunnel_network(v6), gateway, gateway6, gwredir, gwredir6, local_network(v6), remote_network(v6), inactive_seconds, ping_seconds, ping_action, ping_action_seconds, dns_*, push_blockoutsidedns, push_register_dns, ntp_*, netbios_*, wins_*, nbdd_*, custom_options. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_csc.php (WebCfg - OpenVPN: Client Specific Override)
PUT /api/v1/vpn/openvpn/csc/{id}	Update a client specific override (applied at once; omitted fields keep their value). Body: A client specific override as its edit page’s form (“fields” of GET): description, disable, common_name, block, server_list (list of server vpnids; empty: all servers), override_options (default|push_reset|remove_specified), remove_options (list), keep_minimal, tunnel_network(v6), gateway, gateway6, gwredir, gwredir6, local_network(v6), remote_network(v6), inactive_seconds, ping_seconds, ping_action, ping_action_seconds, dns_*, push_blockoutsidedns, push_register_dns, ntp_*, netbios_*, wins_*, nbdd_*, custom_options. Checkboxes are booleans; omitted fields keep their value (create: the page’s defaults). Applied at once, like the page.	vpn.openvpn:write	vpn_openvpn_csc.php (WebCfg - OpenVPN: Client Specific Override)
DELETE /api/v1/vpn/openvpn/csc/{id}	Delete a client specific override (applied at once).	vpn.openvpn:write	vpn_openvpn_csc.php (WebCfg - OpenVPN: Client Specific Override)
GET /api/v1/vpn/openvpn/status	OpenVPN status: whether each server and client runs, connected clients and routes of the servers, the state of the clients.	vpn.openvpn:read	status_openvpn.php (WebCfg - Status: OpenVPN)

Certificates, certificate authorities and revocation lists (pki)

Certificates, certificate authorities and revocation lists.

API-only privileges: “REST API - Certificates, certificate authorities and revocation lists: read” (api-pki-read) and “REST API - Certificates, certificate authorities and revocation lists: write” (api-pki-write).

Endpoint	Description	Scope	Access
GET /api/v1/pki/cas	List the certificate authorities (subject, issuer, validity, serial, has_private_key, used_by).	pki:read	system_camanager.php (WebCfg - System: CA Manager)
GET /api/v1/pki/cas/{refid}	Get a certificate authority with its certificate (PEM) and edit form (“fields”); never its private key.	pki:read	system_camanager.php (WebCfg - System: CA Manager)
GET /api/v1/pki/cas/{refid}/certificate	Download the certificate of a certificate authority (PEM). Returns text/plain.	pki:read	system_camanager.php (WebCfg - System: CA Manager)
POST /api/v1/pki/cas	Create (internal, intermediate) or import (existing) a certificate authority (applied at once). Body: A new CA as its page’s form: method (internal: create a self-signed CA, intermediate: create a CA signed by “caref”, existing: import “cert” with the optional private key “key”), descr, trust and randomserial (booleans), serial (next certificate serial of an imported CA), caref, keytype (RSA|ECDSA), keylen, ecname, digest_alg, lifetime (days), dn_commonname, dn_country, dn_state, dn_city, dn_organization, dn_organizationalunit. Omitted fields take the page’s defaults. Applied at once (trust store).	pki:write	system_camanager.php (WebCfg - System: CA Manager)
PUT /api/v1/pki/cas/{refid}	Update a certificate authority (applied at once; omitted fields keep their value). Body: The CA edit form (“fields” of GET): descr, trust, randomserial, serial, cert (PEM), key (private key PEM; “(set)” or leaving it out keeps it, “” removes it). Omitted fields keep their value. Applied at once (trust store).	pki:write	system_camanager.php (WebCfg - System: CA Manager)
DELETE /api/v1/pki/cas/{refid}	Delete a certificate authority and its CRLs (409 while in use; its certificates are kept).	pki:write	system_camanager.php (WebCfg - System: CA Manager)
GET /api/v1/pki/certificates	List the certificates and pending signing requests (subject, issuer, SANs, validity, has_private_key, is_csr, used_by).	pki:read	system_certmanager.php (WebCfg - System: Certificate Manager)
GET /api/v1/pki/certificates/{refid}	Get a certificate with its certificate or signing request (PEM) and edit form (“fields”); never its private key.	pki:read	system_certmanager.php (WebCfg - System: Certificate Manager)
GET /api/v1/pki/certificates/{refid}/certificate	Download a certificate (PEM). Returns text/plain.	pki:read	system_certmanager.php (WebCfg - System: Certificate Manager)
GET /api/v1/pki/certificates/{refid}/csr	Download the certificate signing request of a pending request (PEM). Returns text/plain.	pki:read	system_certmanager.php (WebCfg - System: Certificate Manager)
POST /api/v1/pki/certificates	Create (internal), import, request (external) or sign a certificate (applied at once). Body: A new certificate as its page’s form. method: internal (create a certificate signed by the internal CA “caref”: keytype (RSA|ECDSA), keylen, ecname, digest_alg, lifetime (days), dn_commonname, dn_country, dn_state, dn_city, dn_organization, dn_organizationalunit, autorenew), import (import_type x509: “cert” and the optional private key “key” in PEM format; import_type pkcs12: “pkcs12” (the PKCS #12 file, base64), pkcs12_pass, pkcs12_intermediate (also import its intermediate CAs)), external (create a private key and a certificate signing request: csr_keytype, csr_keylen, csr_ecname, csr_digest_alg, csr_dn_commonname, csr_dn_country, …; complete it with POST …/{refid}/complete), sign (sign a request with the internal CA “catosignwith”: csrtosign “new” with csrpaste (PEM) and the optional private key keypaste, or the refid of a pending request; csrsign_lifetime, csrsign_digest_alg). Also descr, type (server|user) and altnames: list of {type: DNS|IP|URI|email, value} (subject alternative names; the common name is added automatically). Omitted fields take the page’s defaults. Private keys are stored on the firewall only. Applied at once.	pki:write	system_certmanager.php (WebCfg - System: Certificate Manager)
PUT /api/v1/pki/certificates/{refid}	Update a certificate (applied at once; omitted fields keep their value). Body: The certificate edit form (“fields” of GET): descr, autorenew, cert (PEM), key (private key PEM; “(set)” or leaving it out keeps it, “” removes it). Omitted fields keep their value. Not for a pending signing request (complete it). Applied at once.	pki:write	system_certmanager.php (WebCfg - System: Certificate Manager)
POST /api/v1/pki/certificates/{refid}/complete	Complete a pending signing request with the signed certificate (applied at once). Body: certificate: the signed certificate (PEM; it must match the pending request’s key), descr: optional new name. Applied at once.	pki:write	system_certmanager.php (WebCfg - System: Certificate Manager)
DELETE /api/v1/pki/certificates/{refid}	Delete a certificate or pending signing request (409 while in use).	pki:write	system_certmanager.php (WebCfg - System: Certificate Manager)
GET /api/v1/pki/crls	List the certificate revocation lists.	pki:read	system_crlmanager.php (WebCfg - System: CRL Manager)
GET /api/v1/pki/crls/{refid}	Get a certificate revocation list with its revoked certificates and edit form (“fields”).	pki:read	system_crlmanager.php (WebCfg - System: CRL Manager)
GET /api/v1/pki/crls/{refid}/crl	Download a certificate revocation list (PEM; an internal CRL is signed again, like the page’s export). Returns text/plain.	pki:read	system_crlmanager.php (WebCfg - System: CRL Manager)
POST /api/v1/pki/crls	Create (internal) or import (existing) a certificate revocation list (applied at once). Body: A new CRL as its page’s form: caref (required), method (internal: kept and signed by this system, needs a CA with a private key; existing: import “crltext”), descr, lifetime (days) and serial of an internal CRL, crltext (PEM) of an imported one. Applied at once.	pki:write	system_crlmanager.php (WebCfg - System: CRL Manager)
PUT /api/v1/pki/crls/{refid}	Update a certificate revocation list (applied at once; omitted fields keep their value). Body: The CRL edit form (“fields” of GET): descr, lifetime and serial (internal CRL) or descr and crltext (imported CRL). Omitted fields keep their value. Applied at once.	pki:write	system_crlmanager.php (WebCfg - System: CRL Manager)
DELETE /api/v1/pki/crls/{refid}	Delete a certificate revocation list (409 while in use).	pki:write	system_crlmanager.php (WebCfg - System: CRL Manager)
POST /api/v1/pki/crls/{refid}/revoke	Revoke certificates (by refid) or serial numbers in an internal CRL (applied at once). Body: certref: refid (or list of refids) of certificates signed by the CRL’s CA; serials: serial numbers (decimal or 0x hex; list or text separated by spaces); reason: RFC 5280 reason code (-1: no status, the default). Internal CRLs only. Applied at once.	pki:write	system_crlmanager.php (WebCfg - System: CRL Manager)
DELETE /api/v1/pki/crls/{refid}/revoked/{cert}	Remove a revoked certificate (by its refid, or the serial of an entry revoked by serial) from an internal CRL.	pki:write	system_crlmanager.php (WebCfg - System: CRL Manager)
POST /api/v1/users/{name}/certificates	Create a certificate for a user, or associate an existing one (applied at once). Body: method existing: certref (refid of a certificate to associate); or a new certificate for the user as POST /api/v1/pki/certificates takes it (method internal, import, external, sign, with their fields). Applied at once.	pki:write	system_certmanager.php (WebCfg - System: Certificate Manager)

Users, groups, privileges and authentication servers (users)

Users, groups, privileges and authentication servers.

API-only privileges: “REST API - Users, groups, privileges and authentication servers: read” (api-users-read) and “REST API - Users, groups, privileges and authentication servers: write” (api-users-write).

Endpoint	Description	Scope	Access
GET /api/v1/users	List the local users (groups, assigned privileges, certificates; never a password).	users:read	system_usermanager.php (WebCfg - System: User Manager)
GET /api/v1/users/{name}	Get a local user with its form fields (secrets masked, SSH keys as fingerprints).	users:read	system_usermanager.php (WebCfg - System: User Manager)
POST /api/v1/users	Create a local user (applied at once). Body: A user as its page’s form: name, password (write-only; required for a new user, “(set)” or leaving it out keeps it; the user’s REST API keys keep working after a password change), descr (full name), expires (MM/DD/YYYY), disabled, groups (list of group names), authorizedkeys (SSH keys, write-only; “(set)” or leaving it out keeps them), ipsecpsk (write-only), keephistory, customsettings, webguicss, webguifixedmenu, webguihostnamemenu, dashboardcolumns, interfacessort, dashboardavailablewidgetspanel, systemlogsfilterpanel, systemlogsmanagelogpanel, statusmonitoringsettingspanel, webguileftcolumnhyper, disablealiaspopupdetail, pagenamefirst (booleans). Omitted fields keep their value (a new user: the page’s defaults). Only privileges the key’s user holds can be granted through groups. Applied at once.	users:write	system_usermanager.php (WebCfg - System: User Manager)
PUT /api/v1/users/{name}	Update a local user (applied at once; omitted fields keep their value). Body: A user as its page’s form: name, password (write-only; required for a new user, “(set)” or leaving it out keeps it; the user’s REST API keys keep working after a password change), descr (full name), expires (MM/DD/YYYY), disabled, groups (list of group names), authorizedkeys (SSH keys, write-only; “(set)” or leaving it out keeps them), ipsecpsk (write-only), keephistory, customsettings, webguicss, webguifixedmenu, webguihostnamemenu, dashboardcolumns, interfacessort, dashboardavailablewidgetspanel, systemlogsfilterpanel, systemlogsmanagelogpanel, statusmonitoringsettingspanel, webguileftcolumnhyper, disablealiaspopupdetail, pagenamefirst (booleans). Omitted fields keep their value (a new user: the page’s defaults). Only privileges the key’s user holds can be granted through groups. Applied at once.	users:write	system_usermanager.php (WebCfg - System: User Manager)
DELETE /api/v1/users/{name}	Delete a local user and its REST API keys (409 for system users and the key’s own user).	users:write	system_usermanager.php (WebCfg - System: User Manager)
GET /api/v1/users/{name}/privileges	The privileges of a user: assigned, and effective (with the groups they come from).	users:read	system_usermanager.php (WebCfg - System: User Manager)
PUT /api/v1/users/{name}/privileges	Set the assigned privileges of a user (applied at once). Body: privileges: the complete list of assigned privilege ids (see GET /api/v1/privileges); privileges not listed are removed. Only privileges the key’s user holds can be added. Applied at once.	users:write	system_usermanager.php (WebCfg - System: User Manager)
DELETE /api/v1/users/{name}/api-keys	Revoke all REST API keys of a user (e.g. when the account may be compromised).	users:write	system_usermanager.php (WebCfg - System: User Manager)
GET /api/v1/users/{name}/certificates	The certificates associated with a user.	users:read	system_usermanager.php (WebCfg - System: User Manager)
DELETE /api/v1/users/{name}/certificates/{refid}	Remove a certificate association from a user (the certificate is kept).	users:write	system_usermanager.php (WebCfg - System: User Manager)
GET /api/v1/groups	List the groups (members, privileges).	users:read	system_groupmanager.php (WebCfg - System: Group Manager)
GET /api/v1/groups/{name}	Get a group with its form fields.	users:read	system_groupmanager.php (WebCfg - System: Group Manager)
POST /api/v1/groups	Create a group (applied at once). Body: A group as its page’s form: name, description, scope (local or remote; a system group keeps its scope and name), members (list of user names; the group with gid 1998 shows no membership on its page and keeps its members). Omitted fields keep their value. Applied at once.	users:write	system_groupmanager.php (WebCfg - System: Group Manager)
PUT /api/v1/groups/{name}	Update a group (applied at once; omitted fields keep their value). Body: A group as its page’s form: name, description, scope (local or remote; a system group keeps its scope and name), members (list of user names; the group with gid 1998 shows no membership on its page and keeps its members). Omitted fields keep their value. Applied at once.	users:write	system_groupmanager.php (WebCfg - System: Group Manager)
DELETE /api/v1/groups/{name}	Delete a group (409 for system groups and groups in use).	users:write	system_groupmanager.php (WebCfg - System: Group Manager)
GET /api/v1/groups/{name}/privileges	The privileges assigned to a group.	users:read	system_groupmanager.php (WebCfg - System: Group Manager)
PUT /api/v1/groups/{name}/privileges	Set the privileges of a group (applied at once; members are updated). Body: privileges: the complete list of assigned privilege ids (see GET /api/v1/privileges); privileges not listed are removed. Only privileges the key’s user holds can be added. Applied at once.	users:write	system_groupmanager.php (WebCfg - System: Group Manager)
GET /api/v1/groups/{name}/members	The members of a group.	users:read	system_groupmanager.php (WebCfg - System: Group Manager)
PUT /api/v1/groups/{name}/members	Set the members of a group (applied at once). Body: members: the complete list of member user names. Applied at once.	users:write	system_groupmanager.php (WebCfg - System: Group Manager)
GET /api/v1/auth-servers	List the authentication servers (and the built-in Local Database).	users:read	system_authservers.php (WebCfg - System: Authentication Servers)
GET /api/v1/auth-servers/{name}	Get an authentication server with its form fields (bind password and shared secret masked).	users:read	system_authservers.php (WebCfg - System: Authentication Servers)
POST /api/v1/auth-servers	Create an LDAP or RADIUS authentication server (applied at once). Body: An authentication server as its page’s form: name, type (ldap or radius; fixed once created). LDAP: ldap_host, ldap_port, ldap_urltype, ldap_caref, ldap_protver, ldap_timeout, ldap_scope, ldap_basedn, ldap_authcn (containers separated by “;”), ldap_extended_enabled, ldap_extended_query, ldap_anon, ldap_binddn, ldap_bindpw (write-only), ldap_attr_user, ldap_attr_group, ldap_attr_member, ldap_attr_groupobj, ldap_pam_groupdn, ldap_utf8, ldap_nostrip_at, ldap_allow_unauthenticated, ldap_rfc2307, ldap_rfc2307_userdn, ldap_rfc2307_basedn_groups. RADIUS: radius_protocol, radius_host, radius_secret (write-only), disable_radius_msg_auth, radius_srvcs (both, auth, acct), radius_auth_port, radius_acct_port, radius_timeout, radius_nasip_attribute. Omitted fields keep their value (a new server: the page’s defaults with the OpenLDAP template). Applied at once.	users:write	system_authservers.php (WebCfg - System: Authentication Servers)
PUT /api/v1/auth-servers/{name}	Update an authentication server (applied at once; omitted fields keep their value). Body: An authentication server as its page’s form: name, type (ldap or radius; fixed once created). LDAP: ldap_host, ldap_port, ldap_urltype, ldap_caref, ldap_protver, ldap_timeout, ldap_scope, ldap_basedn, ldap_authcn (containers separated by “;”), ldap_extended_enabled, ldap_extended_query, ldap_anon, ldap_binddn, ldap_bindpw (write-only), ldap_attr_user, ldap_attr_group, ldap_attr_member, ldap_attr_groupobj, ldap_pam_groupdn, ldap_utf8, ldap_nostrip_at, ldap_allow_unauthenticated, ldap_rfc2307, ldap_rfc2307_userdn, ldap_rfc2307_basedn_groups. RADIUS: radius_protocol, radius_host, radius_secret (write-only), disable_radius_msg_auth, radius_srvcs (both, auth, acct), radius_auth_port, radius_acct_port, radius_timeout, radius_nasip_attribute. Omitted fields keep their value (a new server: the page’s defaults with the OpenLDAP template). Applied at once.	users:write	system_authservers.php (WebCfg - System: Authentication Servers)
DELETE /api/v1/auth-servers/{name}	Delete an authentication server (409 while in use or for the Local Database).	users:write	system_authservers.php (WebCfg - System: Authentication Servers)
POST /api/v1/auth-servers/{name}/test	Test a user name and password against an authentication server (nothing is stored). Body: username and password to authenticate against the server, like Diagnostics > Authentication (nothing is stored or logged).	users:write	diag_authentication.php (WebCfg - Diagnostics: Authentication)
GET /api/v1/privileges	The privilege catalogue (id, name, description, warning) for assigning privileges.	users:read	system_usermanager.php (WebCfg - System: User Manager)

System settings (system.settings)

System settings (general setup, high availability, update settings, admin access, advanced firewall, networking, miscellaneous, notifications, tunables).

API-only privileges: “REST API - System settings (general setup, high availability, update settings, admin access, advanced firewall, networking, miscellaneous, notifications, tunables): read” (api-system-settings-read) and “REST API - System settings (general setup, high availability, update settings, admin access, advanced firewall, networking, miscellaneous, notifications, tunables): write” (api-system-settings-write).

Endpoint	Description	Scope	Access
GET /api/v1/system/general	General Setup (hostname, domain, DNS servers, timezone, NTP servers, language, webConfigurator preferences).	system.settings:read	system.php (WebCfg - System: General Setup)
PUT /api/v1/system/general	Change General Setup (applied at once; omitted fields keep their value). Body: The General Setup form: hostname, domain, dnsservers (list of {address, hostname (for TLS verification), gateway (only with more than one gateway of an address family; “none”)}), dnslocalhost, timezone, language, webguicss, webguifixedmenu, webguihostnamemenu, logincss (from the choices), timeservers (space separated), dashboardcolumns (1-6), login_message, dnsallowoverride, interfacessort, dashboardavailablewidgetspanel, systemlogsfilterpanel, systemlogsmanagelogpanel, statusmonitoringsettingspanel, requirestatefilter, requirefirewallinterface, webguileftcolumnhyper, disablealiaspopupdetail, roworderdragging, loginshowhost, loginhideversion (booleans). Omitted fields keep their value. Applied at once (hostname, DNS, timezone, NTP, filter).	system.settings:write	system.php (WebCfg - System: General Setup)
GET /api/v1/system/hasync	High Availability sync settings (password as “(set)”).	system.settings:read	system_hasync.php (WebCfg - System: High Availability Sync)
PUT /api/v1/system/hasync	Change High Availability sync settings (applied at once; omitted fields keep their value). Body: The High Availability form: pfsyncenabled, synctlsinsecure, adminsync and the synchronize* options (booleans; synchronizekea6 only with the Kea DHCP backend), pfsyncinterface (from the choices), pfhostid (hex, up to 8 digits), pfsyncpeerip, synchronizetoip, username, password (“(set)” or leaving it out keeps it). Omitted fields keep their value. Applied at once.	system.settings:write	system_hasync.php (WebCfg - System: High Availability Sync)
GET /api/v1/system/update-settings	Firmware branch and dashboard update check (GitSync is not available through the API).	system.settings:read	system_update_settings.php (WebCfg - System: Update: Settings)
PUT /api/v1/system/update-settings	Select the firmware branch or change the dashboard update check. Body: fwbranch (string), disablecheck (boolean). Body: GitSync settings are not available through the API.	system.settings:write	system_update_settings.php (WebCfg - System: Update: Settings)
GET /api/v1/system/advanced/admin	Admin Access settings (webConfigurator, SSH, login protection, console).	system.settings:read	system_advanced_admin.php (WebCfg - System: Advanced: Admin Access Page)
PUT /api/v1/system/advanced/admin	Change Admin Access settings (lock-out risks need “confirm”: true; restarts run after the answer). Body: The Admin Access form: webguiproto (http|https), ssl-certref, webguiport, max_procs, althostnames (space separated), sshdkeyonly (disabled|enabled|both), sshport, sshguard_threshold, sshguard_blocktime, sshguard_detection_time, sshguard_whitelist (list of subnets), serialspeed, primaryconsole (serial|video); webgui-redirect, webgui-hsts, ocsp-staple, loginautocomplete, webgui-login-messages, roaming, noantilockout, nodnsrebindcheck, nohttpreferercheck, pagenamefirst, enablesshd, sshdagentforwarding, enableserial, disableconsolemenu (booleans); confirm (boolean). Changing webguiproto, webguiport, nodnsrebindcheck, nohttpreferercheck, sshport or sshdkeyonly, setting noantilockout or clearing enablesshd needs “confirm”: true. Omitted fields keep their value. Applied at once; a needed webConfigurator or sshd restart runs a few seconds after the answer (“restart”).	system.settings:write	system_advanced_admin.php (WebCfg - System: Advanced: Admin Access Page)
GET /api/v1/system/advanced/firewall	Advanced Firewall & NAT settings.	system.settings:read	system_advanced_firewall.php (WebCfg - System: Advanced: Firewall & NAT)
PUT /api/v1/system/advanced/firewall	Change advanced Firewall & NAT settings (applied at once; omitted fields keep their value). Body: The Firewall & NAT form: scrubnodf, scrubrnid, disablescrub, vpn_scrubnodf, vpn_fragment_reassemble, maxmss_enable, disablefilter, disable_auto_floating_states, bypassstaticroutes, disablevpnrules, disablereplyto, disablenegate, no_apipa_block, checkaliasesurlcert, allow_nat64_prefix_override, enablebinatreflection, enablenatreflectionhelper (booleans); optimization, statepolicy, bogonsinterval, natreflection (from the *_choices), tftpinterface (list of interfaces), adaptivestart, adaptiveend, maximumstates, maximumtableentries, maximumfrags, maxmss, aliasesresolveinterval, reflectiontimeout and the state timeouts (e.g. tcpfirsttimeout; empty: default). NAT reflection fields exist only with more than one interface. Omitted fields keep their value. Saving reloads the filter at once.	system.settings:write	system_advanced_firewall.php (WebCfg - System: Advanced: Firewall & NAT)
GET /api/v1/system/advanced/networking	Advanced Networking settings (DHCPv6 client, IPv6, ARP, PPPoE driver).	system.settings:read	system_advanced_network.php (WebCfg - System: Advanced: Networking)
PUT /api/v1/system/advanced/networking	Change advanced Networking settings (applied at once; omitted fields keep their value). Body: The Networking form: radvddebug, dhcp6debug, dhcp6norelease, ipv6allow, ipv6nat_enable, prefer_ipv4, ipv6dontcreatelocaldns, sharednet, ip_change_kill_states, use_if_pppoe (only with the if_pppoe driver) (booleans); ipv6nat_ipaddr, global-v6duid (raw DUID, empty: automatic). Omitted fields keep their value. Applied at once; reboot_required tells when a reboot is needed.	system.settings:write	system_advanced_network.php (WebCfg - System: Advanced: Networking)
GET /api/v1/system/advanced/misc	Miscellaneous advanced settings (proxy password as “(set)”).	system.settings:read	system_advanced_misc.php (WebCfg - System: Advanced: Miscellaneous)
PUT /api/v1/system/advanced/misc	Change miscellaneous advanced settings (applied at once; omitted fields keep their value). Body: The Miscellaneous form: proxyurl, proxyport, proxyuser, proxypass (“(set)” keeps it), lb_use_sticky (boolean), srctrack, hwpstate (boolean), hwpstate_control_level, hwpstate_epp (Speed Shift, only on supported hardware), powerd_enable (boolean), powerd_ac_mode, powerd_battery_mode, powerd_normal_mode, crypto_hardware, thermal_hardware, pti_disabled (boolean, when the kernel has PTI), mds_disable (when the kernel has MDS mitigation), schedule_states, keep_failover_states, skip_rules_gw_down, dpinger_dont_add_static_routes, use_mfs_tmpvar (booleans), remove_failover_states_default, gw_down_kill_states, php_memory_limit, use_mfs_tmp_size, use_mfs_var_size, rrdbackup, dhcpbackup, logsbackup, captiveportalbackup, harddiskstandby. Omitted fields keep their value. Applied at once; reboot_required lists the changes that need a reboot.	system.settings:write	system_advanced_misc.php (WebCfg - System: Advanced: Miscellaneous)
GET /api/v1/system/advanced/notifications	Notification settings (passwords and API keys as “(set)”).	system.settings:read	system_advanced_notifications.php (WebCfg - System: Advanced: Notifications)
PUT /api/v1/system/advanced/notifications	Change notification settings (saved at once; omitted fields keep their value). Body: The Notifications form: cert_enable_notify, revoked_cert_ignore_notify, disable_smtp, smtpssl, sslvalidate, consolebell, disablebeep, enable_telegram, enable_pushover, enable_slack (booleans); certexpiredays, smtpipaddress, smtpport, smtptimeout, smtpfromaddress, smtpnotifyemailaddress, smtpusername, smtppassword, smtpauthmech, api (Telegram bot API key), chatid, pushoverapikey, pushoveruserkey, pushoversound, pushoverpriority, pushoverretry, pushoverexpire, slack_api, slack_channel. Secrets read as “(set)”; “(set)” or leaving them out keeps them. Omitted fields keep their value. Saved at once. Test messages cannot be sent through the API.	system.settings:write	system_advanced_notifications.php (WebCfg - System: Advanced: Notifications)
GET /api/v1/system/tunables	System tunables: custom entries and the system defaults, with their running values.	system.settings:read	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
POST /api/v1/system/tunables/apply	Apply the pending tunable changes.	system.settings:write	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
GET /api/v1/system/tunables/{name}	One tunable.	system.settings:read	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
POST /api/v1/system/tunables	Add a custom tunable (pending until applied). Query: apply (true: apply the tunables at once (otherwise the change is pending, like in the GUI)). Body: tunable (string), value (string), descr (string).	system.settings:write	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
PUT /api/v1/system/tunables/{name}	Change a tunable; changing a system default adds a custom entry, like the GUI (pending until applied). Query: apply (true: apply the tunables at once (otherwise the change is pending, like in the GUI)). Body: tunable (string), value (string), descr (string).	system.settings:write	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
DELETE /api/v1/system/tunables/{name}	Delete a custom tunable (pending until applied). Query: apply (true: apply the tunables at once (otherwise the change is pending, like in the GUI)).	system.settings:write	system_advanced_sysctl.php (WebCfg - System: Advanced: Tunables)
GET /api/v1/system/boot-environments	ZFS boot environments and their snapshots, newest first; meta has the pool and its free space. 409 no_boot_environments without ZFS/bectl.	system.settings:read	system_boot_environments.php (WebCfg - System: Boot Environments)
POST /api/v1/system/boot-environments	Save the running system as a new boot environment (like “Create snapshot” on the page); answers 201. Requires an administrator (user admin or “WebCfg - All pages”). Body: name (string), description (string).	system.settings:write	system_boot_environments.php (WebCfg - System: Boot Environments)
POST /api/v1/system/boot-environments/{name}/activate	Boot this environment from the next boot on. Snapshots and environments of an older release (one-way rule) answer 409. Requires an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required), once (boolean).	system.settings:write	system_boot_environments.php (WebCfg - System: Boot Environments)
PATCH /api/v1/system/boot-environments/{name}	Rename a boot environment and/or change its description. Requires an administrator (user admin or “WebCfg - All pages”). Body: name (string), description (string).	system.settings:write	system_boot_environments.php (WebCfg - System: Boot Environments)
DELETE /api/v1/system/boot-environments/{name}	Delete a boot environment or snapshot; the running and next-boot environments answer 409. Requires an administrator (user admin or “WebCfg - All pages”).	system.settings:write	system_boot_environments.php (WebCfg - System: Boot Environments)

System logs (logs)

System logs (read).

API-only privileges: “REST API - System logs (read): read” (api-logs-read) and “REST API - System logs (read): write” (api-logs-write).

Endpoint	Description	Scope	Access
GET /api/v1/logs	The logs that can be read, with their endpoint, GUI page and size.	logs:read	status_logs.php (WebCfg - Status: Logs: System)
GET /api/v1/logs/firewall	Firewall log entries, parsed (time, interface, action, protocol, addresses, ports, rule numbers). Query: lines (Number of entries, 1-2000 (default 50)), filter (Only entries matching this regular expression (case-insensitive)), format (parsed (default; fields of the formatted view), raw (the log lines) or webui (the WebUI log viewer: normalized entries in data, cursors in meta; takes limit, q, and action/iface (firewall) or process)), after (Cursor: only entries newer than this entry id, oldest first (parsed only)), before (Cursor: only entries older than this entry id, newest first (parsed only)), interface (Only this interface (e.g. wan or its description)), action (Only these actions (e.g. block, or “pass block”); not combined with filter), srcip (Only this source address (not combined with filter)), dstip (Only this destination address (not combined with filter)), srcport (Only this source port (not combined with filter)), dstport (Only this destination port (not combined with filter)), proto (Only this protocol, e.g. TCP (not combined with filter)).	logs:read	status_logs_filter.php (WebCfg - Status: Logs: Firewall)
GET /api/v1/logs/vpn/{name}	PPPoE/L2TP server logs: logins, pppoe, l2tp. Query: lines (Number of entries, 1-2000 (default 50)), filter (Only entries matching this regular expression (case-insensitive)), format (parsed (default; fields of the formatted view), raw (the log lines) or webui (the WebUI log viewer: normalized entries in data, cursors in meta; takes limit, q, and action/iface (firewall) or process)), after (Cursor: only entries newer than this entry id, oldest first (parsed only)), before (Cursor: only entries older than this entry id, newest first (parsed only)).	logs:read	status_logs_vpn.php (WebCfg - Status: Logs: PPPoE/L2TP Server)
GET /api/v1/logs/{name}	A system log (system, dhcpd, auth, ipsec, openvpn, resolver, gateways, …; see GET /v1/logs). Query: lines (Number of entries, 1-2000 (default 50)), filter (Only entries matching this regular expression (case-insensitive)), format (parsed (default; fields of the formatted view), raw (the log lines) or webui (the WebUI log viewer: normalized entries in data, cursors in meta; takes limit, q, and action/iface (firewall) or process)), after (Cursor: only entries newer than this entry id, oldest first (parsed only)), before (Cursor: only entries older than this entry id, newest first (parsed only)).	logs:read	status_logs.php (WebCfg - Status: Logs: System)

Packages and system version (packages)

Packages and system version (lists, update check, install, reinstall, remove, system update).

API-only privileges: “REST API - Packages and system version (lists, update check, install, reinstall, remove, system update): read” (api-packages-read) and “REST API - Packages and system version (lists, update check, install, reinstall, remove, system update): write” (api-packages-write).

Endpoint	Description	Scope	Access
GET /api/v1/packages/installed	Installed packages with installed and available version and status. Query: offline (true: use only local information (no repository access; available versions may be unknown)).	packages:read	pkg_mgr_installed.php (WebCfg - System: Package Manager: Installed)
GET /api/v1/packages/available	Packages that can be installed (from the package repository).	packages:read	pkg_mgr.php (WebCfg - System: Package Manager)
GET /api/v1/system/version	Installed and latest system version and whether an update is available. Query: refresh (true: check the update repository now instead of using the cached result).	packages:read	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
GET /api/v1/packages/repositories	The built-in, FreeBSD and custom package repositories with their fixed priorities (no keys).	packages:read	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
POST /api/v1/packages/repositories	Add a custom package repository. Body: name (lowercase letters, digits, “-” and “_”; not starting with “freesense” or “freebsd”), descr, url (https://), signature_type (fingerprints|pubkey|none), key (the SHA-256 fingerprint, or a PEM public key), enable and ack_unsigned (required for signature_type none) as booleans.	packages:write	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
PUT /api/v1/packages/repositories/{id}	Change a custom package repository (omitted fields and an empty key keep their value). Body: name (lowercase letters, digits, “-” and “_”; not starting with “freesense” or “freebsd”), descr, url (https://), signature_type (fingerprints|pubkey|none), key (the SHA-256 fingerprint, or a PEM public key), enable and ack_unsigned (required for signature_type none) as booleans.	packages:write	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
DELETE /api/v1/packages/repositories/{id}	Delete a custom package repository (packages installed from it stay installed).	packages:write	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
POST /api/v1/packages/repositories/{id}/refresh	Fetch the package list of a repository.	packages:write	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
GET /api/v1/packages/repositories/{id}/packages	Packages a repository offers (“id” is a custom repository id or “freebsd”); “q” filters by name or description, at most 300 are returned.	packages:read	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
PUT /api/v1/packages/freebsd-repository	Switch the FreeBSD optional-package repository on or off. Body: enable (boolean, required).	packages:write	pkg_mgr_repos.php (WebCfg - System: Package Manager: Repositories)
GET /api/v1/jobs/{id}	A long operation as a job for the WebUI: “packages” is the package operation or system update (state, percent, current step, numbered log lines). Like GET /v1/packages/operation, the first read after an operation the API started has ended does its finished work once. Query: after (Only log lines after this line number (the cursor from the last response)).	packages:read	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
GET /api/v1/packages/operation	Status of the running or last package operation or system update (state, return code, progress, log). The first read after an operation the API started has ended reloads the filter and restarts the package services (once), like the Package Installer page. Query: lines (Number of log lines to return (default 50, at most 1000)).	packages:read	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
POST /api/v1/packages/{name}/install	Install a package (full name, e.g. FreeSense-pkg-nut) in the background; answers 202, follow it with GET /v1/packages/operation. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required).	packages:write	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
POST /api/v1/packages/{name}/reinstall	Reinstall an installed package in the background; answers 202. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required).	packages:write	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
DELETE /api/v1/packages/{name}	Remove an installed package in the background (not a vital one); answers 202. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required).	packages:write	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
POST /api/v1/system/firmware/update	Start the system update to the latest version of the selected branch (like System > Update; only when an update is available). It reboots the system when it needs to. Answers 202. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required).	packages:write	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
GET /api/v1/system/update/preflight	Checks before a system update (update available, no operation running, disk space, boot environment, configuration, repository): [{id, label, state pass|warn|fail, detail}]. Starts nothing.	packages:read	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)
GET /api/v1/system/update/changelog	Release notes of the latest release on the configured channel (cached for an hour).	packages:read	pkg_mgr_install.php (WebCfg - System: Package Manager: Install Package)

Diagnostics (diagnostics)

Diagnostics (ping, traceroute, DNS lookup, states).

API-only privileges: “REST API - Diagnostics (ping, traceroute, DNS lookup, states): read” (api-diagnostics-read) and “REST API - Diagnostics (ping, traceroute, DNS lookup, states): write” (api-diagnostics-write).

Endpoint	Description	Scope	Access
POST /api/v1/diagnostics/ping	Ping a host from the firewall (like Diagnostics > Ping); returns the output and the statistics. Body: host (string, required), count (integer), wait (integer), ipprotocol (ipv4 | ipv6), source (string).	diagnostics:write	diag_ping.php (WebCfg - Diagnostics: Ping)
POST /api/v1/diagnostics/traceroute	Trace the route to a host (like Diagnostics > Traceroute); stopped after 60 s. Body: host (string, required), maxttl (integer), protocol (udp | icmp), ipprotocol (ipv4 | ipv6), source (string), resolve (boolean).	diagnostics:write	diag_traceroute.php (WebCfg - Diagnostics: Traceroute)
GET /api/v1/diagnostics/sources	The source addresses ping and traceroute accept.	diagnostics:read	diag_ping.php (WebCfg - Diagnostics: Ping)
POST /api/v1/diagnostics/dns-lookup	Look up a host with the firewall’s resolver and time each DNS server (like Diagnostics > DNS Lookup; never creates an alias). Body: hostname (string, required), type (A | AAAA | CNAME | PTR). Changes nothing (POST for the request body).	diagnostics:read	diag_dns.php (WebCfg - Diagnostics: DNS Lookup)
GET /api/v1/diagnostics/states	The firewall state table, filtered like Diagnostics > States. Query: interface (Only this interface (e.g. lan, enc0, lo0; default all)), filter (Only states containing this text (e.g. an address, icmp or ESTABLISHED)), ruleid (Only states of these rule IDs (comma separated; not combined with interface)), limit (At most this many states, 1-10000 (default 500)).	diagnostics:read	diag_dump_states.php (WebCfg - Diagnostics: Show States)
DELETE /api/v1/diagnostics/states	Kill the states of an address or subnet, or from one address to another (never the whole table). Body: source (string, required), destination (string), confirm (boolean, required).	diagnostics:write	diag_dump_states.php (WebCfg - Diagnostics: Show States)

System operations (operations)

System operations (service start/stop/restart, state table reset, reboot, halt).

API-only privileges: “REST API - System operations (service start/stop/restart, state table reset, reboot, halt): read” (api-operations-read) and “REST API - System operations (service start/stop/restart, state table reset, reboot, halt): write” (api-operations-write).

Endpoint	Description	Scope	Access
POST /api/v1/services/{name}/start	Start a service listed by GET /v1/status/services (like Status > Services). Requires {“confirm”: true}; OpenVPN instances need mode and vpnid, captive portal zones need zone. Body: confirm (boolean, required), mode (server | client), vpnid (integer), zone (string).	operations:write	status_services.php (WebCfg - Status: Services)
POST /api/v1/services/{name}/stop	Stop a service listed by GET /v1/status/services (like Status > Services). Requires {“confirm”: true}; OpenVPN instances need mode and vpnid, captive portal zones need zone. Body: confirm (boolean, required), mode (server | client), vpnid (integer), zone (string).	operations:write	status_services.php (WebCfg - Status: Services)
POST /api/v1/services/{name}/restart	Restart a service listed by GET /v1/status/services (like Status > Services). Requires {“confirm”: true}; OpenVPN instances need mode and vpnid, captive portal zones need zone. Body: confirm (boolean, required), mode (server | client), vpnid (integer), zone (string).	operations:write	status_services.php (WebCfg - Status: Services)
POST /api/v1/diagnostics/states/reset	Reset the firewall state table and/or source tracking (like Diagnostics > States > Reset States). Requires {“confirm”: true}. Drops every connection, including this request’s: answers 202 first and flushes 2 s later. Body: confirm (boolean, required), state_table (boolean), source_tracking (boolean).	operations:write	diag_resetstate.php (WebCfg - Diagnostics: Reset states)
POST /api/v1/system/reboot	Reboot the system (like Diagnostics > Reboot; reroot is not available). Answers 202, then reboots 2 s later. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required), type (normal | fsck).	operations:write	diag_reboot.php (WebCfg - Diagnostics: Reboot System)
POST /api/v1/system/halt	Halt and power off the system (like Diagnostics > Halt System); it stays off until powered on locally. Answers 202, then halts 2 s later. Requires {“confirm”: true} and an administrator (user admin or “WebCfg - All pages”). Body: confirm (boolean, required).	operations:write	diag_halt.php (WebCfg - Diagnostics: Halt system)