Inbounds

Manage inbound configurations and their clients. All endpoints live under /panel/api/inbounds and require a logged-in session or Bearer token. Link-generating endpoints honour forwarded headers only when the request comes from a configured trusted proxy.

List every inbound owned by the authenticated user, including each inbound’s clientStats traffic counters. settings, streamSettings, and sniffing are returned as nested JSON objects (no escaped strings); legacy callers that send them back as JSON-encoded strings are still accepted on write.

GET

/panel/api/inbounds/list

GET

/panel/api/inbounds/list

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?array<>

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/list'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/list'

Example ResponseSchema200

{
  "success": true,
  "obj": [
    {
      "clientStats": [
        {
          "down": 2097152,
          "email": "user1",
          "enable": true,
          "expiryTime": 1735689600000,
          "id": 14825,
          "inboundId": 1,
          "lastOnline": 1735680000000,
          "lastSubFetch": 1735680000000,
          "reset": 0,
          "resetCount": 0,
          "resetDay": 0,
          "resetMax": 0,
          "resetWeekday": 0,
          "subId": "i7tvdpeffi0hvvf1",
          "total": 10737418240,
          "up": 1048576,
          "uuid": "e18c9a96-71bf-48d4-933f-8b9a46d4290c"
        }
      ],
      "disableFlow": false,
      "down": 0,
      "enable": true,
      "excludeFromSub": false,
      "expiryTime": 0,
      "fallbackParent": null,
      "id": 1,
      "lastTrafficResetTime": 0,
      "listen": "",
      "nodeId": null,
      "originNodeGuid": "",
      "port": 443,
      "protocol": "vless",
      "remark": "VLESS-443",
      "settings": null,
      "shareAddr": "",
      "shareAddrStrategy": "node",
      "sniffing": null,
      "streamSettings": null,
      "subSortIndex": 1,
      "tag": "in-443-tcp",
      "total": 0,
      "trafficReset": "never",
      "trafficResetDay": 1,
      "up": 0
    }
  ]
}

{  "success": true,  "obj": [    {      "clientStats": [        {          "down": 2097152,          "email": "user1",          "enable": true,          "expiryTime": 1735689600000,          "id": 14825,          "inboundId": 1,          "lastOnline": 1735680000000,          "lastSubFetch": 1735680000000,          "reset": 0,          "resetCount": 0,          "resetDay": 0,          "resetMax": 0,          "resetWeekday": 0,          "subId": "i7tvdpeffi0hvvf1",          "total": 10737418240,          "up": 1048576,          "uuid": "e18c9a96-71bf-48d4-933f-8b9a46d4290c"        }      ],      "disableFlow": false,      "down": 0,      "enable": true,      "excludeFromSub": false,      "expiryTime": 0,      "fallbackParent": null,      "id": 1,      "lastTrafficResetTime": 0,      "listen": "",      "nodeId": null,      "originNodeGuid": "",      "port": 443,      "protocol": "vless",      "remark": "VLESS-443",      "settings": null,      "shareAddr": "",      "shareAddrStrategy": "node",      "sniffing": null,      "streamSettings": null,      "subSortIndex": 1,      "tag": "in-443-tcp",      "total": 0,      "trafficReset": "never",      "trafficResetDay": 1,      "up": 0    }  ]}

Same shape as /list but with settings.clients[] stripped down to {email, enable, comment} and ClientStats not enriched with UUID/SubId. Use this for list pages; fetch /get/:id when you need the full per-client payload (uuid, password, flow, ...).

GET

/panel/api/inbounds/list/slim

GET

/panel/api/inbounds/list/slim

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/list/slim'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/list/slim'

Example ResponseSchema200

{
  "success": true,
  "obj": [
    {
      "id": 1,
      "remark": "VLESS-443",
      "settings": {
        "clients": [
          {
            "email": "alice",
            "enable": true
          }
        ],
        "decryption": "none"
      },
      "clientStats": []
    }
  ]
}

{  "success": true,  "obj": [    {      "id": 1,      "remark": "VLESS-443",      "settings": {        "clients": [          {            "email": "alice",            "enable": true          }        ],        "decryption": "none"      },      "clientStats": []    }  ]}

Lightweight picker projection of the authenticated user’s inbounds. Returns id, remark, tag, protocol, port, a server-computed tlsFlowCapable flag (true for VLESS on TCP with tls or reality, or on XHTTP with VLESS encryption / vlessenc enabled), and ssMethod (the Shadowsocks cipher, empty for non-Shadowsocks inbounds — used by the client UI to generate a valid Shadowsocks 2022 PSK). Use this for dropdowns and attach pickers — it skips settings, streamSettings, and clientStats so the payload stays small even on panels with thousands of clients.

GET

/panel/api/inbounds/options

GET

/panel/api/inbounds/options

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?array<>

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/options'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/options'

Example ResponseSchema200

{
  "success": true,
  "obj": [
    {
      "awgServer": null,
      "enable": true,
      "id": 1,
      "listen": "",
      "mtprotoDomain": "",
      "network": "",
      "nodeAddress": "",
      "nodeId": null,
      "port": 443,
      "protocol": "vless",
      "remark": "VLESS-443",
      "security": "",
      "shareAddr": "",
      "shareAddrStrategy": "",
      "ssMethod": "",
      "tag": "in-443-tcp",
      "tlsFlowCapable": true,
      "tuicServer": null,
      "wgDns": "",
      "wgMtu": 0,
      "wgPublicKey": ""
    }
  ]
}

{  "success": true,  "obj": [    {      "awgServer": null,      "enable": true,      "id": 1,      "listen": "",      "mtprotoDomain": "",      "network": "",      "nodeAddress": "",      "nodeId": null,      "port": 443,      "protocol": "vless",      "remark": "VLESS-443",      "security": "",      "shareAddr": "",      "shareAddrStrategy": "",      "ssMethod": "",      "tag": "in-443-tcp",      "tlsFlowCapable": true,      "tuicServer": null,      "wgDns": "",      "wgMtu": 0,      "wgPublicKey": ""    }  ]}

Whether this host can run an AmneziaWG inbound on the kernel module. Returns ready, host blocker codes (root/tools/module/nft), and the command that fixes them. Saving an inbound also checks its features and rejects IPv6, port forwarding, routeThroughXray, or a pinned listen address that the kernel backend cannot honor.

GET

/panel/api/inbounds/amneziawgKernelReadiness

GET

/panel/api/inbounds/amneziawgKernelReadiness

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?

Readiness is the host's ability to run any kernel-mode inbound at all.

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/amneziawgKernelReadiness'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/amneziawgKernelReadiness'

Example ResponseSchema200

{
  "success": true,
  "obj": {
    "blockers": [
      {
        "code": "tools",
        "detail": "awg"
      }
    ],
    "installCommand": "sudo /usr/local/x-ui/x-ui install-awg-kernel",
    "ready": false
  }
}

{  "success": true,  "obj": {    "blockers": [      {        "code": "tools",        "detail": "awg"      }    ],    "installCommand": "sudo /usr/local/x-ui/x-ui install-awg-kernel",    "ready": false  }}

Return every protocol URL (vless://, vmess://, trojan://, ss://, hysteria://, mtproto) across all inbounds and all of their clients. Links are rendered through the subscription engine, so the configured remark template (name-only display part) is applied per client — the same output the client info/QR pages use. Protocols without a URL form (socks, http, mixed, wireguard, dokodemo, tunnel) contribute nothing. Used by the panel’s "Export all inbound links" action.

GET

/panel/api/inbounds/allLinks

GET

/panel/api/inbounds/allLinks

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?array<string>|null

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/allLinks'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/allLinks'

Example ResponseSchema200

{
  "success": true,
  "obj": [
    "vless://uuid@host:443?security=reality&...#Germany-alice",
    "vmess://eyJ2IjoyLC..."
  ]
}

{  "success": true,  "obj": [    "vless://uuid@host:443?security=reality&...#Germany-alice",    "vmess://eyJ2IjoyLC..."  ]}

Fetch a single inbound by numeric ID.

GET

/panel/api/inbounds/get/{id}

GET

/panel/api/inbounds/get/{id}

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/get/0'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/get/0'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Create a new inbound. Send the full inbound payload (protocol, port, settings, streamSettings, sniffing, remark, expiryTime, total, enable). settings, streamSettings, and sniffing may be sent as nested JSON objects (preferred) or as JSON-encoded strings (legacy). VLESS empty fallback arrays are normalized away; nonempty fallbacks cannot be combined with active server decryption.

POST

/panel/api/inbounds/add

POST

/panel/api/inbounds/add

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json

body

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/add' \
  -H 'Content-Type: application/json' \
  -d '{
  "enable": true,
  "remark": "VLESS-443",
  "listen": "",
  "port": 443,
  "protocol": "vless",
  "expiryTime": 0,
  "total": 0,
  "settings": {
    "clients": [
      {
        "id": "...",
        "email": "user1"
      }
    ],
    "decryption": "none"
  },
  "streamSettings": {
    "network": "tcp",
    "security": "reality",
    "realitySettings": {
      "show": false,
      "dest": "..."
    }
  },
  "sniffing": {
    "enabled": true,
    "destOverride": [
      "http",
      "tls"
    ]
  }
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/add' \  -H 'Content-Type: application/json' \  -d '{  "enable": true,  "remark": "VLESS-443",  "listen": "",  "port": 443,  "protocol": "vless",  "expiryTime": 0,  "total": 0,  "settings": {    "clients": [      {        "id": "...",        "email": "user1"      }    ],    "decryption": "none"  },  "streamSettings": {    "network": "tcp",    "security": "reality",    "realitySettings": {      "show": false,      "dest": "..."    }  },  "sniffing": {    "enabled": true,    "destOverride": [      "http",      "tls"    ]  }}'

Example ResponseSchema

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Delete an inbound by ID. Also removes its associated client stats rows.

POST

/panel/api/inbounds/del/{id}

POST

/panel/api/inbounds/del/{id}

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/del/0'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/del/0'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Delete many inbounds in one call. Processes the list sequentially; failures are reported per id and the rest still proceed. Restarts xray at most once.

POST

/panel/api/inbounds/bulkDel

POST

/panel/api/inbounds/bulkDel

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json

body

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/bulkDel' \
  -H 'Content-Type: application/json' \
  -d '{
  "ids": [
    1,
    2,
    3
  ]
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/bulkDel' \  -H 'Content-Type: application/json' \  -d '{  "ids": [    1,    2,    3  ]}'

Example ResponseSchema200

{
  "success": true,
  "obj": {
    "deleted": 2,
    "skipped": [
      {
        "id": 3,
        "reason": "..."
      }
    ]
  }
}

{  "success": true,  "obj": {    "deleted": 2,    "skipped": [      {        "id": 3,        "reason": "..."      }    ]  }}

Replace an inbound’s configuration. Body shape mirrors /add, but the inbound keeps its stored client list and enable flag: settings.clients and enable in the body are ignored. Manage clients through the /panel/api/clients endpoints and toggle the inbound with /setEnable. Remove effective fallback rules before enabling VLESS server decryption.

POST

/panel/api/inbounds/update/{id}

POST

/panel/api/inbounds/update/{id}

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Request Body

application/json

body

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/update/0' \
  -H 'Content-Type: application/json' \
  -d '{
  "enable": true,
  "remark": "VLESS-443",
  "listen": "",
  "port": 443,
  "protocol": "vless",
  "expiryTime": 0,
  "total": 0,
  "settings": {
    "clients": [
      {
        "id": "...",
        "email": "user1"
      }
    ],
    "decryption": "none"
  },
  "streamSettings": {
    "network": "tcp",
    "security": "reality",
    "realitySettings": {
      "show": false,
      "dest": "..."
    }
  },
  "sniffing": {
    "enabled": true,
    "destOverride": [
      "http",
      "tls"
    ]
  }
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/update/0' \  -H 'Content-Type: application/json' \  -d '{  "enable": true,  "remark": "VLESS-443",  "listen": "",  "port": 443,  "protocol": "vless",  "expiryTime": 0,  "total": 0,  "settings": {    "clients": [      {        "id": "...",        "email": "user1"      }    ],    "decryption": "none"  },  "streamSettings": {    "network": "tcp",    "security": "reality",    "realitySettings": {      "show": false,      "dest": "..."    }  },  "sniffing": {    "enabled": true,    "destOverride": [      "http",      "tls"    ]  }}'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Toggle only the enable flag without serialising the whole settings JSON. Recommended for UI switches on large inbounds.

POST

/panel/api/inbounds/setEnable/{id}

POST

/panel/api/inbounds/setEnable/{id}

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Request Body

application/json

body

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/setEnable/0' \
  -H 'Content-Type: application/json' \
  -d '{
  "enable": false
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/setEnable/0' \  -H 'Content-Type: application/json' \  -d '{  "enable": false}'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Set only the subscription sort order. Reads the stored inbound, so a reorder cannot carry a stale client list over a concurrent edit.

POST

/panel/api/inbounds/{id}/subSortIndex

POST

/panel/api/inbounds/{id}/subSortIndex

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Request Body

application/json

body

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/subSortIndex' \
  -H 'Content-Type: application/json' \
  -d '{
  "subSortIndex": 2
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/subSortIndex' \  -H 'Content-Type: application/json' \  -d '{  "subSortIndex": 2}'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Zero out upload + download counters for a single inbound. Does not touch per-client counters.

POST

/panel/api/inbounds/{id}/resetTraffic

POST

/panel/api/inbounds/{id}/resetTraffic

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/resetTraffic'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/resetTraffic'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Remove every client attached to a single inbound while keeping the inbound itself. Collects emails from settings.clients[] and feeds them into the optimized bulk-delete path (runtime user removal + traffic-row cleanup + SyncInbound). Destructive and cannot be undone.

POST

/panel/api/inbounds/{id}/delAllClients

POST

/panel/api/inbounds/{id}/delAllClients

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Inbound ID.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/delAllClients'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/delAllClients'

Example ResponseSchema200

{
  "success": true,
  "obj": {
    "deleted": 12
  }
}

{  "success": true,  "obj": {    "deleted": 12  }}

Reset upload + download counters on every inbound. Destructive — accounting history is lost.

POST

/panel/api/inbounds/resetAllTraffics

POST

/panel/api/inbounds/resetAllTraffics

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/resetAllTraffics'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/resetAllTraffics'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Bulk-import an inbound from a JSON blob (e.g. one exported via the UI). The body uses form encoding with a single "data" field. VLESS fallback validation is identical to /add.

POST

/panel/api/inbounds/import

POST

/panel/api/inbounds/import

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/x-www-form-urlencoded

body

data*string

JSON-encoded inbound payload.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/import' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'data=string'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/import' \  -H 'Content-Type: application/x-www-form-urlencoded' \  -d 'data=string'

Example ResponseSchema200

{
  "success": true,
  "msg": "string",
  "obj": null
}

{  "success": true,  "msg": "string",  "obj": null}

Receive a master panel's aggregated per-client usage, keyed by the master's GUID. Stored in a side table used only for the UI display overlay and local quota enforcement — never folded into the local counters that masters poll, so delta accounting stays intact. Called panel-to-panel by the node traffic sync job.

POST

/panel/api/inbounds/pushClientTraffics

POST

/panel/api/inbounds/pushClientTraffics

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json

body

masterGuid*string

Stable GUID of the pushing master panel.

traffics*array<>

Client traffic rows; only email/up/down are read.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/pushClientTraffics' \
  -H 'Content-Type: application/json' \
  -d '{
  "masterGuid": "9f6c2d-…",
  "traffics": [
    {
      "email": "alice",
      "up": 1048576,
      "down": 2097152
    }
  ]
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/pushClientTraffics' \  -H 'Content-Type: application/json' \  -d '{  "masterGuid": "9f6c2d-…",  "traffics": [    {      "email": "alice",      "up": 1048576,      "down": 2097152    }  ]}'

Example ResponseSchema200

{
  "success": true
}

{  "success": true}

List the fallback rules attached to a master VLESS/Trojan TCP-TLS inbound. Each rule links one child inbound (the dest) to optional SNI/ALPN/path/dest/xver match criteria. When dest is empty the child inbound's listen+port is used.

GET

/panel/api/inbounds/{id}/fallbacks

GET

/panel/api/inbounds/{id}/fallbacks

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Master inbound ID.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/0/fallbacks'

Example Request

curl -X GET 'https://example.com/panel/api/inbounds/0/fallbacks'

Example ResponseSchema200

{
  "success": true,
  "obj": [
    {
      "id": 1,
      "masterId": 10,
      "childId": 11,
      "name": "",
      "alpn": "",
      "path": "/vlws",
      "dest": "",
      "xver": 2,
      "sortOrder": 0
    }
  ]
}

{  "success": true,  "obj": [    {      "id": 1,      "masterId": 10,      "childId": 11,      "name": "",      "alpn": "",      "path": "/vlws",      "dest": "",      "xver": 2,      "sortOrder": 0    }  ]}

Replace the entire fallback list for a master inbound. Body is JSON. Nonempty lists require TCP with TLS/REALITY and no active VLESS server decryption. An empty list can remove rules even from an incompatible inbound. Triggers an Xray restart.

POST

/panel/api/inbounds/{id}/fallbacks

POST

/panel/api/inbounds/{id}/fallbacks

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Master inbound ID.

Request Body

application/json

body

fallbacks*array<>

Array of {childId, name, alpn, path, dest, xver, sortOrder} entries. Leave dest empty to auto-resolve from the child inbound's listen+port; set it (e.g. "8443", "127.0.0.1:8443", "/dev/shm/x.sock") to override.

Response Body

Successful response

application/json

response

success?boolean

msg?string

obj?unknown

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/fallbacks' \
  -H 'Content-Type: application/json' \
  -d '{
  "fallbacks": [
    {
      "childId": 11,
      "path": "/vlws",
      "xver": 2
    },
    {
      "childId": 12,
      "alpn": "h2",
      "dest": "8443"
    }
  ]
}'

Example Request

curl -X POST 'https://example.com/panel/api/inbounds/0/fallbacks' \  -H 'Content-Type: application/json' \  -d '{  "fallbacks": [    {      "childId": 11,      "path": "/vlws",      "xver": 2    },    {      "childId": 12,      "alpn": "h2",      "dest": "8443"    }  ]}'

Example ResponseSchema200

{
  "success": true,
  "msg": "Inbound updated"
}

{  "success": true,  "msg": "Inbound updated"}

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

Same shape as /list but with settings.clients[] stripped down to {email, enable, comment} and ClientStats not enriched with UUID/SubId. Use this for list pages; fetch /get/:id when you need the full per-client payload (uuid, password, flow, ...).Copy Anchor Link

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

Fetch a single inbound by numeric ID.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

Delete an inbound by ID. Also removes its associated client stats rows.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Delete many inbounds in one call. Processes the list sequentially; failures are reported per id and the rest still proceed. Restarts xray at most once.Copy Anchor Link

AuthorizationCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

Toggle only the enable flag without serialising the whole settings JSON. Recommended for UI switches on large inbounds.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

Set only the subscription sort order. Reads the stored inbound, so a reorder cannot carry a stale client list over a concurrent edit.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

Zero out upload + download counters for a single inbound. Does not touch per-client counters.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Remove every client attached to a single inbound while keeping the inbound itself. Collects emails from settings.clients[] and feeds them into the optimized bulk-delete path (runtime user removal + traffic-row cleanup + SyncInbound). Destructive and cannot be undone.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Reset upload + download counters on every inbound. Destructive — accounting history is lost.Copy Anchor Link

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

Bulk-import an inbound from a JSON blob (e.g. one exported via the UI). The body uses form encoding with a single "data" field. VLESS fallback validation is identical to /add.Copy Anchor Link

AuthorizationCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

List the fallback rules attached to a master VLESS/Trojan TCP-TLS inbound. Each rule links one child inbound (the dest) to optional SNI/ALPN/path/dest/xver match criteria. When dest is empty the child inbound's listen+port is used.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Replace the entire fallback list for a master inbound. Body is JSON. Nonempty lists require TCP with TLS/REALITY and no active VLESS server decryption. An empty list can remove rules even from an incompatible inbound. Triggers an Xray restart.Copy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

Authorization

Response Body

Same shape as /list but with settings.clients[] stripped down to {email, enable, comment} and ClientStats not enriched with UUID/SubId. Use this for list pages; fetch /get/:id when you need the full per-client payload (uuid, password, flow, ...).

Authorization

Response Body

Authorization

Response Body

Authorization

Response Body

Authorization

Response Body

Fetch a single inbound by numeric ID.

Authorization

Path Parameters

Response Body

Authorization

Request Body

Response Body

Delete an inbound by ID. Also removes its associated client stats rows.

Authorization

Path Parameters

Response Body

Delete many inbounds in one call. Processes the list sequentially; failures are reported per id and the rest still proceed. Restarts xray at most once.

Authorization

Request Body

Response Body

Authorization

Path Parameters

Request Body

Response Body

Toggle only the enable flag without serialising the whole settings JSON. Recommended for UI switches on large inbounds.

Authorization

Path Parameters

Request Body

Response Body

Set only the subscription sort order. Reads the stored inbound, so a reorder cannot carry a stale client list over a concurrent edit.

Authorization

Path Parameters

Request Body

Response Body

Zero out upload + download counters for a single inbound. Does not touch per-client counters.

Authorization

Path Parameters

Response Body

Remove every client attached to a single inbound while keeping the inbound itself. Collects emails from settings.clients[] and feeds them into the optimized bulk-delete path (runtime user removal + traffic-row cleanup + SyncInbound). Destructive and cannot be undone.

Authorization

Path Parameters

Response Body

Reset upload + download counters on every inbound. Destructive — accounting history is lost.

Authorization

Response Body

Bulk-import an inbound from a JSON blob (e.g. one exported via the UI). The body uses form encoding with a single "data" field. VLESS fallback validation is identical to /add.

Authorization

Request Body

Response Body

Authorization

Request Body

Response Body

List the fallback rules attached to a master VLESS/Trojan TCP-TLS inbound. Each rule links one child inbound (the dest) to optional SNI/ALPN/path/dest/xver match criteria. When dest is empty the child inbound's listen+port is used.

Authorization

Path Parameters

Response Body

Replace the entire fallback list for a master inbound. Body is JSON. Nonempty lists require TCP with TLS/REALITY and no active VLESS server decryption. An empty list can remove rules even from an incompatible inbound. Triggers an Xray restart.

Authorization

Path Parameters

Request Body

Response Body