3x-uiXray Settings
Xray configuration template, outbound management, Warp/Nord/PIA integration, and config testing. All endpoints under /panel/api/xray.
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/'{ "success": true, "obj": { "xraySetting": "{...raw xray config...}", "inboundTags": "[\"in-443-tcp\"]", "clientReverseTags": "[]", "outboundTestUrl": "https://www.google.com/generate_204" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/getDefaultJsonConfig'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/getOutboundsTraffic'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/getXrayResult'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
xraySetting*stringFull Xray JSON config template.
outboundTestUrl?stringURL used for outbound reachability tests. Defaults to https://www.google.com/generate_204.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/update' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'xraySetting=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
action*stringdata — return Warp stats. del — delete Warp data. config — return current config. reg — register (sends keys). regMasque — register a separate device enrolled for MASQUE and return its warp key pair, addresses and endpoint. changeIp — rotate the endpoint. license — set a Warp+ key. interval — set automatic rotation in hours.
application/x-www-form-urlencoded- body
privateKey?stringRequired when action=reg.
publicKey?stringRequired when action=reg.
license?stringRequired when action=license.
interval?integerNon-negative hours between automatic rotations. Required when action=interval; 0 disables rotation.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/warp/string' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
action*stringcountries — list available countries. servers — list servers in a country (sends countryId). reg — get NordVPN credentials (sends token). setKey — store NordVPN API key (sends key). data — return current NordVPN connection data. del — delete NordVPN data.
application/x-www-form-urlencoded- body
countryId?stringRequired when action=servers.
token?stringRequired when action=reg.
key?stringRequired when action=setKey.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/nord/string' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
action*stringcountries — list available countries from the signed PIA server list. servers — list regions and WireGuard servers in a country (sends countryCode). reg — sign in with a PIA username and password (sends username, password). data — return the signed-in account hint. del — delete stored PIA credentials. addKey — register a WireGuard key with the selected server (sends hostname) and return fields to build the outbound.
application/x-www-form-urlencoded- body
username?stringRequired when action=reg.
password?stringRequired when action=reg.
countryCode?stringRequired when action=servers.
hostname?stringRequired when action=addKey.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/pia/string' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
tag*stringOutbound tag to reset (e.g. "proxy", "direct").
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/resetOutboundsTraffic' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'tag=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
outbound*stringJSON-encoded single outbound to test (required).
allOutbounds?stringJSON array of all outbounds — used to resolve dialerProxy chains.
mode?string"tcp" for a fast dial-only probe (parallel-safe), "real" for a real-delay probe whose delay is the full request time including tunnel establishment. Default/empty uses a full HTTP probe reporting the warm per-request round-trip. Both HTTP variants run through a temp xray instance.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/testOutbound' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'outbound=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
outbounds*stringJSON array of outbound configs to test (required).
allOutbounds?stringJSON array of all outbounds — used to resolve dialerProxy chains.
mode?string"tcp" for fast dial-only probes (UDP-transport outbounds are still probed over HTTP), "real" for real-delay probes whose delay is the full request time including tunnel establishment. Default/empty routes an HTTP request through each outbound and reports the warm per-request round-trip.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/testOutbounds' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'outbounds=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
tags*stringComma-separated balancer tags to query (e.g. "b1,b2").
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/balancerStatus' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'tags=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
tag*stringBalancer tag (required).
target?stringOutbound tag to force; it must exist in the running config. Empty clears the override and returns control to the strategy.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/balancerOverride' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'tag=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
domain*stringTarget domain. Either domain or ip is required.
1 <= lengthip?stringTarget IP. Either domain or ip is required.
port?integerTarget port (optional).
network?string"tcp" (default) or "udp".
inboundTag?stringSimulate arrival on this inbound (optional).
protocol?stringSniffed protocol such as http, tls, bittorrent (optional).
email?stringUser attribution for user-based rules (optional).
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/routeTest' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'domain=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/geodata/files'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
file*stringDatabase file name inside the asset folder, e.g. geosite.dat (required).
q?stringCase-insensitive substring filter on the category code.
offset?integerRows to skip. Defaults to 0.
limit?integerRows to return, capped at 500. Omit it to return every category — the index is small and the panel filters it client-side.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/geodata/categories?file=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
file*stringDatabase file name inside the asset folder (required).
code*stringCategory code, case-insensitive, e.g. google (required).
q?stringCase-insensitive substring filter on the rule value.
offset?integerRows to skip. Defaults to 0.
limit?integerRows to return, capped at 500. Defaults to the cap.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/geodata/entries?file=string&code=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
tokens*stringComma-separated routing tokens, e.g. "geosite:google,geosite:blabla". Max 500 per request.
kind?string"ip" to parse the tokens as IP rules (geoip:, ext-ip:, leading !). Anything else parses them as domain rules (geosite:, ext-site:).
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/geodata/validate' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'tokens=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET 'https://example.com/panel/api/xray/outbound-subs'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
remark?stringOptional display label.
url*stringSubscription URL (required). Must be a public http(s) address; private/internal targets are blocked unless allowPrivate is true.
tagPrefix?stringPrefix for generated outbound tags. Defaults to the lowest free "sub-" prefix.
userAgent?stringCustom User-Agent sent when fetching this subscription. Defaults to "3x-ui-outbound-sub/1.0".
"3x-ui-outbound-sub/1.0"updateInterval?integerSeconds between auto-refreshes. Default 600.
600enabled?booleanWhether the subscription is active. Default true.
trueallowPrivate?booleanAllow the URL to point at a private/internal/loopback address. Default false.
falseallowInsecure?booleanSkip TLS certificate verification when fetching the subscription's URL. Default false.
falseprepend?booleanPlace this subscription's outbounds before the manual template outbounds. Default false.
falseSuccessful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'url=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerSubscription id.
application/x-www-form-urlencoded- body
remark?stringOptional display label.
url*stringSubscription URL (required). Must be a public http(s) address; private/internal targets are blocked unless allowPrivate is true.
tagPrefix?stringPrefix for generated outbound tags. Defaults to the lowest free "sub-" prefix.
userAgent?stringCustom User-Agent sent when fetching this subscription. Defaults to "3x-ui-outbound-sub/1.0".
"3x-ui-outbound-sub/1.0"updateInterval?integerSeconds between auto-refreshes. Default 600.
600enabled?booleanWhether the subscription is active. Default true.
trueallowPrivate?booleanAllow the URL to point at a private/internal/loopback address. Default false.
falseallowInsecure?booleanSkip TLS certificate verification when fetching the subscription's URL. Default false.
falseprepend?booleanPlace this subscription's outbounds before the manual template outbounds. Default false.
falseSuccessful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs/0' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'url=string'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerSubscription id.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X DELETE 'https://example.com/panel/api/xray/outbound-subs/0'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerSubscription id.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs/0/del'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerSubscription id.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs/0/refresh'{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerSubscription id.
application/x-www-form-urlencoded- body
dir?string"up" to raise priority, anything else to lower it.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs/0/move' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d ''{ "success": true, "msg": "string", "obj": null}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/x-www-form-urlencoded- body
url*stringSubscription URL to preview (required).
userAgent?stringCustom User-Agent sent while fetching the preview.
allowPrivate?booleanAllow a private/internal/loopback URL. Default false.
allowInsecure?booleanSkip TLS certificate verification. Default false.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST 'https://example.com/panel/api/xray/outbound-subs/parse' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'url=string'{ "success": true, "msg": "string", "obj": null}