3x-uiServer
System status, log retrieval, certificate generators, Xray binary management, and backup/restore. All under /panel/api/server.
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/openapi.json'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/status'{ "success": true, "obj": { "cpu": 12.5, "mem": { "current": 2147483648, "total": 8589934592 }, "swap": { "current": 0, "total": 4294967296 }, "disk": { "current": 53687091200, "total": 268435456000 }, "netIO": { "up": 1073741824, "down": 2147483648 }, "xray": { "state": "running", "version": "v25.10.31" }, "tcpCount": 42, "load": { "load1": 0.5, "load5": 0.3, "load15": 0.2 } }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/fail2banStatus'{ "success": true, "obj": { "enabled": true, "installed": true, "usable": true, "windows": false }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
bucket*integerBucket size in seconds. Allowed: 2, 30, 60, 120, 180, 300.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/cpuHistory/0'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
metric*stringcpu | mem | netUp | netDown | online | load1 | load5 | load15.
bucket*integerBucket size in seconds. Allowed: 2, 30, 60, 120, 180, 300.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/history/string/0'{ "success": true, "obj": [ { "t": 1700000000, "v": 12.5 }, { "t": 1700000002, "v": 13.1 } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/xrayMetricsState'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
metric*stringxrAlloc | xrSys | xrHeapObjects | xrNumGC | xrPauseNs.
bucket*integerBucket size in seconds. Allowed: 2, 30, 60, 120, 180, 300.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/xrayMetricsHistory/string/0'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/xrayObservatory'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
tag*stringOutbound tag from the observatory config.
bucket*integerBucket size in seconds. Allowed: 2, 30, 60, 120, 180, 300.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/xrayObservatoryHistory/string/0'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getXrayVersion'{ "success": true, "obj": [ "v25.10.31", "v25.9.15", "v25.8.1" ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getPanelUpdateInfo'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?PanelUpdateStatus reports the outcome of the most recently launched panel self-update. RunID lets the caller confirm this status belongs to the update it started rather than a stale result left over from an earlier run; State is one of "pending", "success", or "failed". RunID is a decimal string, not a JSON number: it's a formatted UnixNano timestamp, and JavaScript's number type can't represent that precisely (it exceeds Number.MAX_SAFE_INTEGER), which would let two different runs round to the same value on the wire and defeat the whole point of this field.
curl -X GET 'https://example.com/panel/api/server/getUpdateStatus'{ "success": true, "obj": { "exitCode": 0, "finishedAt": 1735689612, "runId": "1735689600123456789", "state": "success" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getConfigJson'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getDb'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getMigration'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X GET 'https://example.com/panel/api/server/getNewUUID'{ "success": true, "obj": { "uuid": "550e8400-e29b-41d4-a716-446655440000" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getWebCertFiles'{ "success": true, "obj": { "webCertFile": "/root/cert/example.com/fullchain.pem", "webKeyFile": "/root/cert/example.com/privkey.pem" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/descendants'{ "success": true, "obj": [ { "guid": "c3d4-...", "parentGuid": "a1b2-...", "name": "Node3", "address": "10.0.0.3", "status": "online" } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getNewX25519Cert'{ "success": true, "obj": { "privateKey": "uN9qLfV3zH8w...", "publicKey": "5v8xPqR2sM7k..." }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X GET 'https://example.com/panel/api/server/getNewmldsa65'{ "success": true, "obj": { "seed": "mldsa65-seed", "verify": "mldsa65-verify" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X GET 'https://example.com/panel/api/server/getNewmlkem768'{ "success": true, "obj": { "client": "mlkem768-client", "seed": "mlkem768-seed" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/server/getNewVlessEnc'{ "success": true, "obj": { "auths": [ { "id": 0, "label": "Auth #0", "encryption": "aes-256-gcm", "decryption": "" } ] }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/stopXrayService'{ "success": true, "msg": "string", "obj": null}Reload Xray with the current config. Typically required after structural inbound or routing changes.
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/restartXrayService'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
version*stringXray tag (e.g. v25.10.31) or "latest".
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/installXray/string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
dev?booleanOverride this run's channel. Omit to use the panel's configured channel.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/updatePanel' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "obj": { "runId": "1735689600123456789" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
dev*booleantrue = dev channel, false = stable.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/setUpdateChannel' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'dev=true'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/updateGeofile'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
fileName*stringFilename of the data file to refresh.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/updateGeofile/string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
count*integerNumber of trailing log lines.
application/x-www-form-urlencoded- body
level?stringMinimum log level filter.
syslog?booleanRead system logs instead of the panel log.
Successful response
application/json- response
success?booleanmsg?stringobj?array<string>|nullcurl -X POST 'https://example.com/panel/api/server/logs/0' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "obj": [ "2025/01/01 12:00:00 [INFO] Server started", "2025/01/01 12:00:01 [INFO] Xray is running" ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
count*integerNumber of trailing log lines.
application/x-www-form-urlencoded- body
filter?stringKeyword filter — only lines containing this string.
showDirect?string"true" to include direct (freedom) traffic lines.
showBlocked?string"true" to include blocked (blackhole) traffic lines.
showProxy?string"true" to include proxy traffic lines.
Successful response
application/json- response
success?booleanmsg?stringobj?array<>|nullcurl -X POST 'https://example.com/panel/api/server/xraylogs/0' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "obj": [ { "DateTime": "2025-01-01T12:00:00Z", "Email": "alice@example.com", "Event": 0, "FromAddress": "192.0.2.10:54321", "Inbound": "inbound-443", "Outbound": "direct", "ToAddress": "example.com:443" } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
count*integerMaximum peer rows and event lines to return.
application/x-www-form-urlencoded- body
filter?stringKeyword filter — only rows/lines containing this string.
Successful response
application/json- response
success?booleanmsg?stringobj?AmneziaWGLogs is what the overview's AmneziaWG log view renders: the live per-peer activity of every running embedded interface, plus the panel's own recent AmneziaWG lifecycle log lines that explain a peer being absent from Peers at all.
curl -X POST 'https://example.com/panel/api/server/amneziawglogs/0' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "obj": { "events": [ "2025/01/01 12:00:00 amneziawg: started interface awg1 for inbound 1" ], "peers": [ { "allowedIPs": "10.8.1.2/32", "down": 4194304, "email": "peer@example.com", "endpoint": "203.0.113.9:51820", "handshake": 1735732800000, "inboundId": 1, "interface": "awg1", "online": true, "tag": "inbound-51820", "up": 1048576 } ], "running": true }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
multipart/form-data- body
db*unknownDatabase backup or migration file to upload.
keepHostSettings?booleanKeep this machine's addresses, certificates and node identity. Default true.
trueSuccessful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/importDB' \ -F 'db=null'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
sni*stringServer Name Indication to generate the ECH config for.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/getNewEchCert' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'sni=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
certFile*stringPath to a certificate file on the server. Takes precedence over certContent.
.*\S.*certContent?stringInline PEM (or DER) certificate content, used when certFile is empty.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/getCertHash' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'certFile=string'{ "success": true, "obj": [ "e8e2d3..." ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
server*stringRemote server as domain or domain:port (default port 443), e.g. cloudflare-dns.com.
allowPrivate?booleanPing a private/internal/loopback server (LAN, Docker service name). Default false (SSRF guard blocks it and the error response sets obj.privateTarget=true).
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/getRemoteCertHash' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'server=string'{ "success": true, "obj": [ "e8e2d3..." ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
target*stringCandidate target as host or host:port (default port 443), e.g. www.cloudflare.com:443.
sni?stringSNI the handshake sends and the certificate is verified against (the inbound serverNames). Defaults to the target host, which a fronting proxy answers with its default certificate.
xver?integerPROXY protocol version the target expects (matches the inbound xver). 0 = none.
allowPrivate?booleanProbe a private/internal/loopback target (LAN, Docker service name). Default false (SSRF guard blocks it and the response sets privateTarget=true).
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X POST 'https://example.com/panel/api/server/scanRealityTarget' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'target=string'{ "success": true, "obj": { "alpn": "h2", "certChainBytes": 3427, "certChainValid": true, "certIssuer": "Google Trust Services", "certSubject": "cloudflare.com", "certValid": true, "curveID": "X25519", "feasible": true, "h2": true, "host": "www.cloudflare.com", "ip": "104.16.124.96", "latencyMs": 180, "notAfter": "2026-08-01T00:00:00Z", "port": 443, "privateTarget": false, "reason": "", "serverNames": [ "" ], "target": "www.cloudflare.com:443", "tls13": true, "tlsVersion": "1.3", "x25519": true }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
targets?stringOptional comma-separated tokens: domain[:port], IP[:port], or CIDR (e.g. 104.16.0.0/24). When omitted, the realityScanCandidates setting is probed (the built-in seed list if that setting is empty).
Successful response
application/json- response
success?booleanmsg?stringobj?array<>curl -X POST 'https://example.com/panel/api/server/scanRealityTargets' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "obj": [ { "alpn": "h2", "certChainBytes": 3427, "certChainValid": true, "certIssuer": "Google Trust Services", "certSubject": "cloudflare.com", "certValid": true, "curveID": "X25519", "feasible": true, "h2": true, "host": "www.cloudflare.com", "ip": "104.16.124.96", "latencyMs": 180, "notAfter": "2026-08-01T00:00:00Z", "port": 443, "privateTarget": false, "reason": "", "serverNames": [ "" ], "target": "www.cloudflare.com:443", "tls13": true, "tlsVersion": "1.3", "x25519": true } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?array<>curl -X GET 'https://example.com/panel/api/server/clientIps'{ "success": true, "obj": [ { "clientEmail": "", "id": 0, "ips": null } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/json- body
[index: integer]?Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/server/clientIps' \ -H 'Content-Type: application/json' \ -d '[ { "clientEmail": "string", "ips": [ { "ip": "string", "timestamp": 0 } ] }]'{ "success": true, "msg": "string", "obj": null}