3x-ui3x-ui

Settings

Panel configuration and user credentials. All endpoints live under /panel/api/setting and require a logged-in session or Bearer token.

Return every panel setting: web server, Telegram bot, subscription, security, LDAP. The full JSON blob that the Settings page edits.

POST
/panel/api/setting/all

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/all'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Return the computed default settings based on the request host. Useful to preview what a fresh install would use.

POST
/panel/api/setting/defaultSettings

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/defaultSettings'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Return the shipped (factory) default value per browser-safe setting key, so clients can tell a stored value apart from the default it would fall back to. Per-install material (secret, panelGuid, mTLS keys) and credential fields are never included.

POST
/panel/api/setting/factoryDefaults

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/factoryDefaults'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Persist every setting at once. The body mirrors the shape returned by /all. Invalid values (bad ports, missing cert pairs, etc.) are rejected before write.

POST
/panel/api/setting/update

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json
  1. body

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/update' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Validate any regular expression with the backend Go RE2 compiler without saving it.

POST
/panel/api/setting/validateRegex

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json
  1. body

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/validateRegex' \  -H 'Content-Type: application/json' \  -d '{  "regex": "(?m)^general-purpose$"}'
Example Response200
{  "success": true,  "msg": ""}

Change the panel admin username and password. Requires the current credentials for verification. The session is refreshed with the new values on success.

POST
/panel/api/setting/updateUser

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json
  1. body
oldUsername*string

Current admin username.

oldPassword*string

Current admin password.

newUsername*string

Desired new username.

newPassword*string

Desired new password.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/updateUser' \  -H 'Content-Type: application/json' \  -d '{  "oldUsername": "admin",  "oldPassword": "admin",  "newUsername": "newadmin",  "newPassword": "newpass"}'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Restart the entire 3x-ui process after a 3-second grace period. The connection drops immediately; the panel comes back online ~5-10 seconds later.

POST
/panel/api/setting/restartPanel

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/restartPanel'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}

Test SMTP connection with stage-by-stage reporting (connect, auth, send). Returns structured result with stage and message.

POST
/panel/api/setting/testSmtp

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/testSmtp'
Example Response200
{  "success": true,  "stage": "send",  "msg": "Test email sent successfully"}

Test Telegram bot connection by sending a test message to the configured chat.

POST
/panel/api/setting/testTgBot

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/testTgBot'
Example Response200
{  "success": true,  "msg": "Test message sent to Telegram"}

Report what the configured bot can do. Inline mode is a BotFather switch, so the panel warns when it is off.

POST
/panel/api/setting/tgBotCapabilities

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?

TgBotCapabilities is the browser-safe shape of the bot's own capabilities.

Example Request
curl -X POST 'https://example.com/panel/api/setting/tgBotCapabilities'
Example Response200
{  "success": true,  "obj": {    "groupPrivacy": false,    "inlineEnabled": true,    "running": true,    "username": "xui_bot"  }}

Test Discord bot connection by sending a test embed to the configured channel.

POST
/panel/api/setting/testDiscord

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X POST 'https://example.com/panel/api/setting/testDiscord'
Example Response200
{  "success": true,  "msg": "Test notification sent successfully"}

Return the built-in default Xray JSON config template that ships with this panel version.

GET
/panel/api/setting/getDefaultJsonConfig

Authorization

headerAuthorizationBearer <token>

Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
Example Request
curl -X GET 'https://example.com/panel/api/setting/getDefaultJsonConfig'
Example Response200
{  "success": true,  "msg": "string",  "obj": null}