3x-uiAPI Tokens
Manage scoped Bearer tokens for programmatic auth. admin grants the full panel API; monitor is read-only for status and metrics; node-sync manages node configuration without panel updates; node-admin adds panel self-update to node-sync. Tokens may expire and are stored as SHA-256 hashes. The plaintext is returned only once at creation.
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/setting/apiTokens'{ "success": true, "obj": [ { "id": 1, "name": "central-panel-a", "enabled": true, "createdAt": 1736000000, "scope": "node-admin", "expiresAt": 0 } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/json- body
name*stringHuman-readable label, e.g. "central-panel-a".
scope?stringadmin (default), monitor, node-sync, or node-admin. node-admin inherits node-sync and may also start a panel update.
"admin""monitor""node-sync""node-admin"expiresAt?integerFuture Unix milliseconds, or 0 for no expiry.
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X POST 'https://example.com/panel/api/setting/apiTokens/create' \ -H 'Content-Type: application/json' \ -d '{ "name": "central-panel-a", "scope": "node-admin", "expiresAt": 1798761600000}'{ "success": true, "obj": { "createdAt": 1736000000, "enabled": true, "expiresAt": 0, "id": 2, "name": "central-panel-a", "scope": "admin", "token": "new-token-string" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerToken row ID.
application/json- body
expectedScope*stringStored scope expected by the operator.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/setting/apiTokens/delete/0' \ -H 'Content-Type: application/json' \ -d '{ "expectedScope": "node-sync"}'{ "success": true}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerToken row ID.
application/json- body
enabled*booleanNew enabled state.
expectedScope*stringStored scope expected by the operator.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/setting/apiTokens/setEnabled/0' \ -H 'Content-Type: application/json' \ -d '{ "enabled": false, "expectedScope": "node-sync"}'{ "success": true}