Skip to content

NOBA API Reference

Base URL: http://<host>:<port> (default port 8080)

Authentication

All endpoints except /api/health and /api/login require a valid session token.

Pass the token in either:

  • HTTP header: Authorization: Bearer <token>
  • Query parameter: ?token=<token> (required for SSE / EventSource)

Tokens are valid for 24 hours and expire automatically. A cleanup job runs every 5 minutes to purge expired tokens.

Full interactive API docs are available at /api/docs (Swagger UI) and /api/redoc (ReDoc) when the server is running. This document covers the core endpoints — for the complete reference (300+ routes across 15 routers), use the interactive docs (disabled by default — set NOBA_OPENAPI=1 to enable).

Roles

RoleAccess
viewerRead-only: stats, history, logs, dashboards
operatorViewer + service control, automations, agent commands, approvals
adminFull access: settings, user management, system update, audit log

Endpoint Reference

1. Core (stats.py)

Health, metrics, history, alerts, notifications, and dashboard layout.

MethodEndpointAuthDescription
GET/api/healthNoneHealth check with version and uptime
GET/api/meReadCurrent user info and permissions
GET/api/permissionsReadList all permissions by role
GET/api/pluginsReadList loaded plugins
GET/api/statsReadLive system metrics snapshot
GET/api/streamSSEServer-Sent Events metrics stream
GET/api/history/multiReadMultiple metrics for overlay charting
GET/api/history/{metric}ReadTime-series history for a metric
GET/api/history/{metric}/exportReadExport metric history as CSV
GET/api/history/{metric}/trendReadTrend projection for a metric
GET/api/metrics/availableReadList available metric names
GET/api/metrics/prometheusReadPrometheus exposition format
GET/api/metrics/correlateReadAligned multi-metric correlation
GET/api/alert-rulesReadList configured alert rules
POST/api/alert-rulesAdminCreate a new alert rule
PUT/api/alert-rulesAdminReplace all alert rules (batch)
PUT/api/alert-rules/{rule_id}AdminUpdate an existing alert rule
DELETE/api/alert-rules/{rule_id}AdminDelete an alert rule
GET/api/alert-rules/test/{rule_id}AdminTest rule against current stats

Conditions are validated at creation/update time. Invalid conditions return HTTP 400 with a descriptive error (e.g., "Invalid condition fragment: '>' — expected 'metric operator number'").

| GET | /api/sla/{rule_id} | Read | SLA uptime for an alert rule | | GET | /api/alert-history | Read | Historical alert firings | | GET | /api/notifications | Read | User notifications with unread count | | POST | /api/notifications/{notif_id}/read | Read | Mark notification as read | | POST | /api/notifications/read-all | Read | Mark all notifications as read | | GET | /api/dashboard | Read | Get user dashboard layout | | POST | /api/dashboard | Read | Save user dashboard layout |


2. Auth (auth.py)

Login, TOTP 2FA, social/OIDC auth, profile, preferences, admin user/session/key management.

MethodEndpointAuthDescription
POST/api/loginNoneAuthenticate and get session token
POST/api/logoutNoneRevoke current session token
POST/api/auth/totp/setupReadGenerate TOTP secret for 2FA
POST/api/auth/totp/enableReadEnable 2FA with TOTP code
POST/api/auth/totp/disableAdminDisable 2FA for a user
GET/api/auth/providersNoneList available auth providers
GET/api/auth/social/{provider}/loginNoneRedirect to social provider login
GET/api/auth/social/{provider}/callbackNoneHandle social provider callback
GET/api/auth/social/{provider}/linkNoneInitiate account linking to provider
GET/api/auth/social/{provider}/link/callbackNoneHandle account link callback
GET/api/auth/linked-providersReadList linked social providers
DELETE/api/auth/linked-providers/{provider}ReadUnlink a social provider
GET/api/auth/oidc/loginNoneRedirect to generic OIDC provider
GET/api/auth/oidc/callbackNoneHandle OIDC callback
POST/api/auth/oidc/exchangeNoneExchange OIDC code for token
GET/api/profileReadUser profile with activity summary
POST/api/profile/passwordReadChange own password
GET/api/profile/sessionsReadList own active sessions
GET/api/user/preferencesReadGet dashboard preferences
PUT/api/user/preferencesReadSave dashboard preferences
DELETE/api/user/preferencesReadReset preferences to defaults
GET/api/admin/usersAdminList all users
POST/api/admin/usersAdminAdd, remove, or change user password
GET/api/admin/sessionsAdminList all active sessions
POST/api/admin/sessions/revokeAdminRevoke a session by token prefix
GET/api/admin/api-keysAdminList API keys
POST/api/admin/api-keysAdminCreate an API key
DELETE/api/admin/api-keys/{key_id}AdminDelete an API key
GET/api/admin/ssh-keysAdminList authorized SSH keys
POST/api/admin/ssh-keysAdminAdd an SSH authorized key
DELETE/api/admin/ssh-keys/{key_id}AdminRemove an SSH authorized key

3. Admin (admin.py)

Settings, config, audit, backup, reports, plugins, runbooks, Graylog.

MethodEndpointAuthDescription
GET/api/settingsReadRead all persisted settings
POST/api/settingsAdminWrite settings to config.yaml
POST/api/notifications/testAdminSend a test notification
GET/api/config/changelogAdminSettings change history
GET/api/auditAdminRetrieve audit log entries
GET/api/config/backupAdminDownload config.yaml backup
POST/api/config/restoreAdminUpload and restore config.yaml
GET/api/backup/statusReadNAS and cloud backup status
POST/api/backup/reportAdminEmail backup status report
GET/api/backup/historyReadList backup snapshots
GET/api/backup/snapshots/{name}/browseReadBrowse snapshot directory tree
GET/api/backup/snapshots/diffReadDiff two snapshots
GET/api/backup/file-versionsReadFile versions across snapshots
POST/api/backup/restoreAdminRestore a file from a snapshot
GET/api/backup/config-historyAdminList config.yaml backup versions
GET/api/backup/config-history/{filename}AdminDownload a config backup version
GET/api/backup/resticReadRestic repository status
GET/api/backup/schedulesReadList backup-related automations
POST/api/backup/scheduleAdminCreate a backup schedule
GET/api/backup/progressReadRunning backup job progress
GET/api/backup/healthReadBackup destination health check
GET/api/log-viewerOperatorReturn log file contents by type
GET/api/action-logOperatorCurrent action log output
GET/api/reports/bandwidthReadBandwidth usage report
GET/api/reports/anomaliesReadAnomaly detection summary
POST/api/reports/customOperatorGenerate custom metric report
GET/api/grafana/dashboardReadGrafana dashboard JSON template
GET/api/plugins/availableAdminList available remote plugins
GET/api/plugins/bundledAdminList bundled catalog plugins
POST/api/plugins/installAdminInstall a plugin
GET/api/plugins/{plugin_id}/configAdminGet plugin config and schema
POST/api/plugins/{plugin_id}/configAdminSave plugin config
GET/api/plugins/managedReadList plugins with metadata
POST/api/plugins/{name}/enableAdminEnable a plugin
POST/api/plugins/{name}/disableAdminDisable a plugin
POST/api/plugins/reloadAdminReload all plugins
GET/api/runbooksReadList all runbooks
GET/api/runbooks/{runbook_id}ReadGet runbook detail
GET/api/graylog/searchOperatorSearch Graylog log messages

4. Agents (agents.py)

Agent management, commands, file transfer, WebSocket, deploy.

MethodEndpointAuthDescription
POST/api/agent/reportAgentReceive agent metrics report
WS/api/agent/wsAgentAgent WebSocket for real-time comms
WS/api/agents/{hostname}/terminalOperatorBrowser terminal WebSocket
GET/api/agents/{hostname}/stream/{cmd_id}OperatorPoll log stream lines for command
GET/api/agentsReadList all agents with metrics
GET/api/agents/command-historyReadCommand execution history
GET/api/agents/{hostname}ReadDetailed metrics for an agent
POST/api/agents/bulk-commandOperatorSend command to multiple agents
POST/api/agents/{hostname}/commandOperatorQueue command for an agent
POST/api/agents/{hostname}/uninstallAdminQueue agent uninstall command
DELETE/api/agents/{hostname}AdminRemove agent from dashboard
GET/api/agents/{hostname}/resultsReadGet command results for agent
GET/api/agents/{hostname}/historyReadHistorical agent metrics
POST/api/agents/{hostname}/network-statsOperatorTrigger network stats collection
POST/api/agents/{hostname}/stream-logsOperatorStart live log stream on agent
DELETE/api/agents/{hostname}/stream-logs/{cmd_id}OperatorStop a running log stream
GET/api/agents/{hostname}/streamsReadList active log streams
GET/api/sla/summaryReadSLA uptime across agents/services
GET/api/agent/updateAgentServe latest agent.pyz (zipapp) for self-update
GET/api/agent/install-scriptAgentGenerate agent install script
POST/api/agents/deployAdminRemote deploy agent via SSH
POST/api/agent/file-uploadAgentReceive file chunk from agent
GET/api/agent/file-download/{transfer_id}AgentServe file to agent for push
POST/api/agents/{hostname}/transferAdminInitiate file push to agent

5. Containers (containers.py)

Docker/Podman control, stats, compose, TrueNAS VMs.

MethodEndpointAuthDescription
POST/api/container-controlOperatorStart/stop/restart a container
GET/api/containers/{name}/logsOperatorGet container logs (tail N lines)
GET/api/containers/{name}/inspectOperatorDetailed container inspection
GET/api/containers/statsReadPer-container resource usage
POST/api/containers/{name}/pullAdminPull latest image for container
GET/api/compose/projectsReadList Docker Compose projects
POST/api/compose/{project}/{action}OperatorCompose up/down/pull/restart
POST/api/truenas/vmOperatorStart/stop/restart TrueNAS VM

6. Monitoring (monitoring.py)

Uptime, health score, status page, endpoint monitors.

MethodEndpointAuthDescription
GET/api/uptimeReadUptime stats for all services
GET/api/health-scoreReadInfrastructure health score (0-100)
GET/statusNonePublic status page (HTML)
GET/api/status/publicNonePublic status data (JSON)
GET/api/status/incidentsNonePublic incident list with updates
POST/api/status/componentsAdminCreate status page component
PUT/api/status/components/{comp_id}AdminUpdate a status component
DELETE/api/status/components/{comp_id}AdminDelete a status component
GET/api/status/componentsReadList all status components
POST/api/status/incidents/createAdminCreate a status incident
POST/api/status/incidents/{id}/updateAdminAdd update to a status incident
PUT/api/status/incidents/{id}/resolveAdminResolve a status incident
GET/api/endpointsReadList endpoint monitors
POST/api/endpointsAdminCreate an endpoint monitor
PUT/api/endpoints/{monitor_id}AdminUpdate an endpoint monitor
DELETE/api/endpoints/{monitor_id}AdminDelete an endpoint monitor
POST/api/endpoints/{monitor_id}/checkOperatorTrigger immediate endpoint check

7. Infrastructure (infrastructure.py)

Service control, network, Proxmox, Kubernetes, terminal.

MethodEndpointAuthDescription
POST/api/service-controlOperatorStart/stop/restart systemd service
GET/api/network/connectionsOperatorList active network connections
GET/api/network/portsReadList listening ports with process
GET/api/network/interfacesReadNetwork interface details
GET/api/services/mapReadService dependency map
GET/api/disks/predictionReadDisk capacity prediction
GET/api/k8s/namespacesReadList Kubernetes namespaces
GET/api/k8s/podsReadList pods with details
GET/api/k8s/pods/{ns}/{name}/logsOperatorGet pod logs
GET/api/k8s/deploymentsReadList deployments with replicas
POST/api/k8s/deployments/{ns}/{name}/scaleOperatorScale a deployment
GET/api/proxmox/nodes/{node}/vmsReadList VMs/containers on PVE node
GET/api/proxmox/nodes/{node}/vms/{vmid}/snapshotsReadList VM snapshots
POST/api/proxmox/nodes/{node}/vms/{vmid}/snapshotAdminCreate a VM snapshot
GET/api/proxmox/nodes/{node}/vms/{vmid}/consoleOperatorGet noVNC console URL
WS/api/terminalAdminWebSocket terminal (server shell)
GET/api/network/devicesReadList discovered network devices
POST/api/network/discover/{hostname}OperatorTrigger network discovery on agent
DELETE/api/network/devices/{device_id}OperatorRemove a discovered device

8. Automations (automations.py)

Automation CRUD, job runs, webhooks, maintenance windows, approvals.

MethodEndpointAuthDescription
GET/api/run-statusReadCheck if a script is running
GET/api/runsReadList job runs with filters
GET/api/runs/{run_id}ReadGet job run details
POST/api/runs/{run_id}/cancelOperatorCancel an active run
POST/api/runs/{run_id}/approveAdminApprove a pending run
GET/api/automationsReadList all automations
POST/api/automationsOperatorCreate an automation
PUT/api/automations/{auto_id}OperatorUpdate an automation
DELETE/api/automations/{auto_id}AdminDelete an automation
POST/api/automations/{auto_id}/runOperatorManually trigger automation
GET/api/automations/templatesReadList automation templates
GET/api/playbooksReadList playbook templates
GET/api/playbooks/{playbook_id}ReadGet a playbook template
POST/api/playbooks/{playbook_id}/installOperatorInstall playbook as workflow
GET/api/automations/statsReadAutomation execution statistics
GET/api/automations/exportAdminExport automations as YAML
POST/api/automations/importAdminImport automations from YAML
POST/api/automations/{auto_id}/triggerNoneTrigger via API key or X-Trigger-Key
GET/api/automations/{auto_id}/traceReadWorkflow execution trace
POST/api/automations/validate-workflowOperatorValidate workflow step IDs
POST/api/webhookOperatorTrigger a configured webhook
POST/api/runOperatorExecute a script asynchronously
GET/api/webhooksAdminList webhook receiver endpoints
POST/api/webhooksAdminCreate a webhook endpoint
DELETE/api/webhooks/{webhook_id}AdminDelete a webhook endpoint
GET/api/maintenance-windows/activeReadGet active maintenance windows
GET/api/maintenance-windowsReadList all maintenance windows
POST/api/maintenance-windowsAdminCreate a maintenance window
PUT/api/maintenance-windows/{id}AdminUpdate a maintenance window
DELETE/api/maintenance-windows/{id}AdminDelete a maintenance window
GET/api/approvals/countReadCount of pending approvals
GET/api/approvalsReadList approvals by status
GET/api/approvals/{approval_id}ReadGet approval details
POST/api/approvals/{approval_id}/decideOperatorApprove or deny a pending action
GET/api/action-auditReadQuery action audit trail
POST/api/webhooks/receive/{hook_id}NonePublic webhook receiver (HMAC)

9. Integrations (integrations.py)

Cameras, Tailscale, Home Assistant, Pi-hole, game servers, cloud remotes, InfluxDB.

MethodEndpointAuthDescription
GET/api/cameras/snapshot/{cam}ReadProxy camera snapshot from Frigate
GET/api/camerasReadList configured camera feeds
GET/api/tailscale/statusReadTailscale network status
GET/api/disks/intelligenceReadScrutiny disk intelligence
GET/api/services/dependencies/blast-radiusReadService blast radius analysis
POST/api/hass/services/{domain}/{service}OperatorCall Home Assistant service
GET/api/hass/entitiesReadList HA entities with state
GET/api/hass/servicesReadList available HA services
POST/api/hass/toggle/{entity_id}OperatorToggle a HA entity
POST/api/hass/scene/{entity_id}OperatorActivate a HA scene
POST/api/pihole/toggleOperatorEnable/disable Pi-hole blocking
GET/api/game-serversReadProbe configured game servers
POST/api/wolOperatorSend Wake-on-LAN magic packet
GET/api/cloud-remotesReadList rclone remotes
POST/api/cloud-remotes/createAdminCreate an rclone remote
DELETE/api/cloud-remotes/{name}AdminDelete an rclone remote
POST/api/cloud-testOperatorTest rclone remote connectivity
POST/api/influxdb/queryAdminExecute an InfluxDB Flux query

10. Integration Instances (integration_instances.py)

Multi-instance integration management, catalog, groups.

MethodEndpointAuthDescription
GET/api/integrations/instancesReadList integration instances
GET/api/integrations/instances/{id}ReadGet a single instance
POST/api/integrations/instancesAdminCreate an integration instance
PATCH/api/integrations/instances/{id}AdminUpdate an instance (partial)
DELETE/api/integrations/instances/{id}AdminDelete an integration instance
POST/api/integrations/instances/test-connectionOperatorTest instance connectivity
GET/api/integrations/catalog/categoriesReadList integration categories
GET/api/integrations/catalog/categories/{cat}/platformsReadList platforms for a category
GET/api/integrations/groupsReadList integration groups
GET/api/integrations/groups/{name}/membersReadList group members
POST/api/integrations/groups/{name}/membersAdminAdd instance to group
DELETE/api/integrations/groups/{name}/members/{id}AdminRemove instance from group

11. Intelligence (intelligence.py)

Incidents, dependencies, baselines, config drift, AI/LLM, prediction.

MethodEndpointAuthDescription
GET/api/incidentsReadList recent incidents
POST/api/incidents/{id}/resolveOperatorResolve an incident
GET/api/incidents/{id}/messagesReadGet incident war room messages
POST/api/incidents/{id}/messagesOperatorPost to incident war room
PUT/api/incidents/{id}/assignOperatorAssign incident to a user
GET/api/dependenciesReadService dependency graph
POST/api/dependenciesAdminCreate a service dependency
DELETE/api/dependencies/{dep_id}AdminDelete a service dependency
GET/api/dependencies/impact/{service}ReadTransitive impact analysis
POST/api/dependencies/discover/{hostname}OperatorDiscover services on agent
GET/api/baselinesReadList config baselines
POST/api/baselinesAdminCreate a config baseline
DELETE/api/baselines/{id}AdminDelete a config baseline
POST/api/baselines/{id}/set-from/{hostname}AdminSet baseline hash from agent
POST/api/baselines/checkOperatorTrigger immediate drift check
GET/api/baselines/{id}/resultsReadDrift check results per agent
GET/api/ai/statusReadAI/LLM configuration status
POST/api/ai/chatOperatorChat with AI assistant
POST/api/ai/analyze-alert/{alert_id}OperatorAI analysis of an alert
POST/api/ai/analyze-logsOperatorAI analysis of log excerpt
POST/api/ai/summarize-incident/{id}OperatorAI incident summary/report
GET/api/predict/capacityReadMulti-metric capacity prediction
POST/api/ai/testAdminTest LLM connection

12. Security (security.py)

Security scanning, findings, posture scoring.

MethodEndpointAuthDescription
GET/api/security/scoreReadAggregate security score
GET/api/security/findingsReadSecurity findings with filters
GET/api/security/historyReadHistorical security scores
POST/api/security/scan/{hostname}OperatorTrigger security scan on agent
POST/api/security/scan-allOperatorScan all online agents
POST/api/security/recordAdminRecord scan results (internal)

13. Healing (healing.py)

Heal ledger, effectiveness, trust, maintenance, chaos, dry-run, rollback.

MethodEndpointAuthDescription
GET/api/healing/ledgerReadHealing action ledger
GET/api/healing/effectivenessReadHealing success rate stats
GET/api/healing/suggestionsReadList healing suggestions
POST/api/healing/suggestions/{id}/dismissOperatorDismiss a healing suggestion
GET/api/healing/trustReadList trust states per rule
POST/api/healing/trust/{rule_id}/promoteAdminPromote trust level
POST/api/healing/trust/{rule_id}/demoteAdminDemote trust level
PUT/api/healing/trust/{rule_id}AdminSet or create trust state
GET/api/healing/capabilities/{hostname}ReadAgent capability manifest
GET/api/healing/dependenciesReadDependency graph nodes
POST/api/healing/dependencies/validateReadValidate dependency config
POST/api/healing/capabilities/{hostname}/refreshOperatorRefresh agent capabilities
GET/api/healing/maintenanceReadActive healing maintenance windows
POST/api/healing/maintenanceOperatorCreate healing maintenance window
DELETE/api/healing/maintenance/{id}OperatorEnd maintenance window early
POST/api/healing/rollback/{ledger_id}AdminRollback a heal action
POST/api/healing/dry-runOperatorSimulate a heal event
GET/api/healing/chaos/scenariosReadList chaos test scenarios
POST/api/healing/chaos/runAdminRun a chaos test scenario
GET/api/healing/healthReadHealing pipeline health summary

When an alert rule's action includes a target hostname matching an online agent, the healing executor dispatches the action as an agent command via WebSocket instead of executing locally. Supported remote actions: restart_containercontainer_control, restart_service → agent restart_service.

The PUT /api/healing/trust/{rule_id} endpoint accepts a JSON body with level and optional ceiling fields. Valid levels: observation, dry_run, notify, approve, execute. Example: {"level": "approve", "ceiling": "execute"}.


14. Dashboards (dashboards.py)

Custom dashboard CRUD.

MethodEndpointAuthDescription
GET/api/dashboardsReadList user's dashboards
POST/api/dashboardsOperatorCreate a custom dashboard
PUT/api/dashboards/{id}OperatorUpdate a custom dashboard
DELETE/api/dashboards/{id}OperatorDelete a custom dashboard

15. Operations (operations.py)

System info, recovery, journal, SMART, processes, exports, backups, updates.

MethodEndpointAuthDescription
POST/api/recovery/tailscale-reconnectOperatorReconnect Tailscale VPN
POST/api/recovery/dns-flushOperatorRestart DNS service
POST/api/recovery/service-restartOperatorRestart a named service
GET/api/sites/sync-statusReadMulti-site sync status
GET/api/smartReadSMART disk health data
GET/api/journalOperatorQuery systemd journal
GET/api/journal/unitsOperatorList systemd units for filter
GET/api/system/infoReadExtended system information
GET/api/system/healthReadSystem health score with checks
POST/api/system/cpu-governorAdminSet CPU frequency governor
GET/api/processes/historyReadTop process history (rolling)
GET/api/processes/currentReadCurrent process list
GET/api/export/ansibleOperatorGenerate Ansible playbook
GET/api/export/docker-composeOperatorGenerate docker-compose.yml
GET/api/export/shellOperatorGenerate bash setup script

All export endpoints accept an optional ?discover=true query parameter that dispatches discover_services and container_list commands to the target agent via WebSocket before generating output. Warnings are returned via the X-Noba-Discovery-Warning response header. | GET | /api/backup/verifications | Read | Backup verification history | | POST | /api/backup/verify | Operator | Trigger backup verification | | GET | /api/backup/321-status | Read | 3-2-1 backup compliance status | | PUT | /api/backup/321-status | Operator | Update 3-2-1 compliance tracking | | GET | /api/system/update/check | Operator | Check for available updates | | POST | /api/system/update/apply | Admin | Pull, install, and restart |


Detailed Endpoint Documentation

GET /api/health

Health check. No authentication required.

Response 200:

json
{
  "status": "ok",
  "version": "2.0.0",
  "uptime_s": 3723
}

POST /api/login

Authenticate and obtain a session token.

Rate limited: 5 attempts per 60 seconds per IP. Exceeding the limit triggers a 300-second lockout.

Request body:

json
{
  "username": "admin",
  "password": "yourpassword"
}

Response 200:

json
{
  "token": "abc123...",
  "role": "admin",
  "username": "admin"
}

Response 401 — wrong credentials:

json
{ "error": "Invalid credentials" }

Response 429 — rate limited:

json
{ "error": "Too many login attempts. Try again in 287 seconds." }

POST /api/logout

Revoke the current session token.

Headers: Authorization: Bearer <token>

Response 200:

json
{ "status": "ok" }

GET /api/me

Return the authenticated user's info.

Response 200:

json
{
  "username": "admin",
  "role": "admin"
}

GET /api/stats

Return the latest collected system snapshot.

Response 200:

json
{
  "timestamp": 1718000000,
  "hostname": "myserver",
  "os": "Fedora Linux 40",
  "kernel": "6.8.9-300.fc40.x86_64",
  "uptime": "3 days, 2:14:05",
  "load": [0.52, 0.61, 0.58],
  "cpu_percent": 12.4,
  "cpu_history": [10.1, 11.2, 12.4, "..."],
  "cpu_temp": 45.0,
  "gpu_temp": null,
  "memory": {
    "total": 17179869184,
    "available": 8589934592,
    "percent": 50.0,
    "used": 8589934592
  },
  "disks": [
    { "mount": "/", "percent": 62, "total": "500G", "used": "310G", "free": "190G" }
  ],
  "net_rx_bytes": 12345,
  "net_tx_bytes": 6789,
  "services": [
    { "name": "nginx", "active": true, "user": true }
  ],
  "containers": ["..."],
  "pihole": { "queries": 12345, "blocked": 2345, "percent": 19.0 },
  "plex": { "sessions": 2, "activities": 0 },
  "truenas": { "apps": 5, "alerts": 0, "vms": ["..."] },
  "alerts": [
    { "severity": "warning", "msg": "CPU usage: 78%" }
  ],
  "radar": [
    { "host": "192.168.1.1", "up": true, "latency_ms": 1.2 }
  ]
}

GET /api/stream

Server-Sent Events stream — pushes a stats update every 5 seconds.

Query parameters (passed as query string, token required here):

ParameterDescription
tokenSession token
servicesComma-separated service names to monitor
radarIpsComma-separated hosts to ping
piholeUrlPi-hole base URL
plexUrlPlex base URL
plexTokenPlex token
kumaUrlUptime Kuma URL
truenasUrlTrueNAS URL
truenasKeyTrueNAS API key
bmcMapBMC host mapping

Event format:

data: {"timestamp":1718000000,"cpu_percent":12.4,...}\n\n

The browser frontend uses this stream via EventSource. On connection error it falls back to 5-second polling of /api/stats.


GET /api/history/{metric}

Retrieve time-series history for a metric.

Path parameter: metric name (one of cpu_percent, mem_percent, cpu_temp, gpu_temp, disk_percent, ping_ms, net_rx_bytes, net_tx_bytes)

Query parameters:

ParameterDefaultDescription
range_h24How many hours of history to return
resolution60Aggregation bucket size in seconds

Response 200:

json
[
  { "time": 1717996400, "value": 11.2 },
  { "time": 1717996460, "value": 12.8 }
]

GET /api/audit

Retrieve audit log entries. Admin only.

Query parameters:

ParameterDefaultDescription
limit100Maximum entries to return

Response 200:

json
[
  {
    "time": 1718000000,
    "username": "admin",
    "action": "script_run",
    "details": "backup -> done",
    "ip": "192.168.1.42"
  }
]

Logged actions:

ActionTrigger
system_startServer startup
system_stopServer shutdown
loginSuccessful login
login_failedFailed login attempt
logoutToken revoked
user_addNew user created
user_removeUser deleted
user_password_changePassword changed
script_runAutomation script executed
service_controlsystemctl action triggered
vm_actionTrueNAS VM action
webhookWebhook triggered
cloud_testrclone remote tested
settings_saveSettings written to config.yaml

GET /api/settings

Read all persisted settings. Authenticated (any role).

Response 200:

json
{
  "piholeUrl": "http://192.168.1.53",
  "piholeToken": "...",
  "monitoredServices": "nginx,docker",
  "radarIps": "192.168.1.1,8.8.8.8",
  "bookmarksStr": "Router|http://192.168.1.1|fa-network-wired",
  "customActions": ["..."],
  "automations": ["..."],
  "alertRules": ["..."]
}

POST /api/settings

Write settings to config.yaml. Admin only.

Request body: JSON object with any subset of the settings keys (unknown keys are ignored):

json
{
  "piholeUrl": "http://192.168.1.53",
  "piholeToken": "abc123",
  "monitoredServices": "nginx,docker,sshd"
}

Response 200:

json
{ "status": "ok" }

GET /api/cloud-remotes

List available rclone remotes.

Response 200:

json
{
  "available": true,
  "remotes": [
    { "name": "gdrive", "label": "Cloud" },
    { "name": "b2", "label": "Cloud" }
  ]
}

If rclone is not installed: { "available": false, "remotes": [] }


POST /api/run

Execute an automation script asynchronously. Only one script can run at a time.

Request body:

FieldTypeDescription
scriptstringOne of: backup, cloud, verify, organize, diskcheck, check_updates, speedtest, custom
argsstring or listExtra arguments passed to the script

For custom scripts, pass the action id as args:

json
{ "script": "custom", "args": "reboot-dns" }

Response 200:

json
{
  "success": true,
  "status": "done",
  "script": "backup"
}

Possible status values: done, failed, timeout, error


GET /api/action-log

Return the current contents of the action log (script output).

Response 200:

json
{ "content": ">> [14:32:01] Initiating: backup\n\n[INFO] Starting backup...\n..." }

GET /api/run-status

Check whether a script is currently running.

Response 200:

json
{
  "script": "backup",
  "status": "running",
  "started": "2024-06-10T14:32:01.123456"
}

Or when idle:

json
{ "status": "idle" }

GET /api/log-viewer

Return log file contents.

Query parameters:

ParameterValuesDescription
typesyserr, action, backup, cloudWhich log to return

Response 200:

json
{ "content": "Jun 10 14:32:01 myserver nginx[1234]: ..." }

POST /api/service-control

Start, stop, or restart a systemd service.

Request body:

FieldTypeDescription
servicestringService name (validated against [a-zA-Z0-9_@:.\\-]+)
actionstringOne of: start, stop, restart, poweroff
is_userbooltrue for user-scope (--user), false for system scope

Response 200:

json
{ "success": true, "stderr": "" }

System-scope actions require passwordless sudo for systemctl.


POST /api/truenas/vm

Start, stop, restart, or power off a TrueNAS VM.

Request body:

json
{
  "id": 1,
  "name": "my-vm",
  "action": "start"
}

Response 200:

json
{ "success": true }

POST /api/webhook

Trigger a configured webhook automation.

Request body:

json
{ "id": "n8n-sync" }

Response 200:

json
{ "success": true }

POST /api/cloud-test

Test connectivity to an rclone remote.

Request body:

json
{ "remote": "gdrive" }

Response 200:

json
{ "success": true, "error": "" }

POST /api/notifications/test

Send a test notification via all configured channels. Admin only.

Response 200:

json
{ "status": "sent" }

GET /api/admin/users

List all users. Admin only.

Request body:

json
{ "action": "list" }

Response 200:

json
[
  { "username": "admin", "role": "admin" },
  { "username": "viewer", "role": "viewer" }
]

POST /api/admin/users

Manage user accounts. Admin only.

Add user

json
{
  "action": "add",
  "username": "newuser",
  "password": "SecurePass1!",
  "role": "viewer"
}

Password must meet strength requirements (>=8 chars, >=1 uppercase, >=1 digit or symbol).

Response 200: { "status": "ok" }Response 400: { "error": "Password must be at least 8 characters" }Response 409: { "error": "User already exists" }

Change password

json
{
  "action": "change_password",
  "username": "existinguser",
  "password": "NewSecurePass2!"
}

Response 200: { "status": "ok" }

Remove user

json
{
  "action": "remove",
  "username": "olduser"
}

Response 200: { "status": "ok" }Response 404: { "error": "User not found" }


Error Codes

HTTP StatusMeaning
200Success
400Bad request — invalid parameters
401Not authenticated — missing or expired token
403Forbidden — insufficient role
404Resource not found
409Conflict — resource already exists
429Rate limited
500Internal server error

Rate Limiting

Only the /api/login endpoint is rate limited:

  • Window: 60 seconds
  • Max attempts: 5 per IP
  • Lockout duration: 300 seconds

Security Notes

  • API keys for integrations (TrueNAS, Plex, etc.) are stored server-side in config.yaml and never sent to the browser. The frontend only receives sanitised metric payloads.
  • Passwords are hashed with PBKDF2-HMAC-SHA256 (200,000 iterations) with a per-user random salt.
  • Alert rule conditions use a safe regex-based parser — no eval() is used anywhere.
  • The Content Security Policy (default-src 'self') prevents XSS injection into the dashboard.

Released under the MIT License.