3x-uiAPI 令牌
管理用于程序化认证的 Bearer 令牌（机器人、代表本节点操作的中心面板、CI）。每个令牌都有唯一的名称和一个启用标志——禁用即可在不删除的情况下吊销，删除则为永久吊销。令牌以 SHA-256 哈希形式存储，明文仅在创建响应中返回一次——此后无法再次获取，因此请当场复制保存。在任意 /panel/api/* 请求中以 <code>Authorization: Bearer <token></code> 的形式发送令牌——该令牌是一份完全管理员凭据。
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET "https://example.com/panel/api/setting/apiTokens"{ "success": true, "obj": [ { "id": 1, "name": "central-panel-a", "enabled": true, "createdAt": 1736000000, "scope": "node-admin", "expiresAt": 0 } ]}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/json- body
name*stringHuman-readable label, e.g. "central-panel-a".
scope?stringadmin (default), monitor, node-sync, or node-admin. node-admin inherits node-sync and may also start a panel update.
"admin""monitor""node-sync""node-admin"expiresAt?integerFuture Unix milliseconds, or 0 for no expiry.
Successful response
application/json- response
success?booleanmsg?stringobj?curl -X POST "https://example.com/panel/api/setting/apiTokens/create" \ -H "Content-Type: application/json" \ -d '{ "name": "central-panel-a", "scope": "node-admin", "expiresAt": 1798761600000 }'{ "success": true, "obj": { "createdAt": 1736000000, "enabled": true, "expiresAt": 0, "id": 2, "name": "central-panel-a", "scope": "admin", "token": "new-token-string" }}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerToken row ID.
application/json- body
expectedScope*stringStored scope expected by the operator.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST "https://example.com/panel/api/setting/apiTokens/delete/0" \ -H "Content-Type: application/json" \ -d '{ "expectedScope": "node-sync" }'{ "success": true}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
id*integerToken row ID.
application/json- body
enabled*booleanNew enabled state.
expectedScope*stringStored scope expected by the operator.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST "https://example.com/panel/api/setting/apiTokens/setEnabled/0" \ -H "Content-Type: application/json" \ -d '{ "enabled": false, "expectedScope": "node-sync" }'{ "success": true}