API Reference
Cookie-authenticated JSON API for bots and dashboards.
Authenticate with POST /api/login (keeps the zefira_session cookie), then send X-Requested-With: XMLHttpRequest on every mutating call. No OpenAPI explorer is exposed.
Auth & account
| Method | Endpoint | Notes |
|---|
| POST | /api/login | {username, password, code?} — 401, or totp_required |
| POST | /api/logout | Invalidates the session server-side |
| GET | /api/me | Username, 2FA state |
| POST | /api/change-password | Strong-password enforced, kills other sessions |
| GET | /api/2fa/status | — |
| POST | /api/2fa/setup · /enable · /disable | QR uri + 6-digit code flow |
Users
| Method | Endpoint | Notes |
|---|
| GET | /api/stats | Counters: active, expired, expiring-soon, limited… |
| GET | /api/users?q=… | Up to 500, username/note search |
| POST | /api/users | Create (protocols, volume, days, first-use, device limit) |
| PATCH | /api/users/{id} | Extend, top-up, note, expiry, active flag |
| DELETE | /api/users/{id} | — |
| POST | /api/users/{id}/reset-token | Rotates token + all secrets |
| GET | /api/users/{id}/qr · /config | Sub URL + QR / config file or ZIP |
Server objects
| Method | Endpoint | Notes |
|---|
| GET PUT | /api/settings | Domain, ports, REALITY, obfuscation… |
| POST | /api/reality/generate | New X25519 keypair |
| GET | /api/reality/private | Audit-logged reveal |
| GET | /api/ssl/status | Certbot presence, domains, expiry |
| POST | /api/ssl/issue · /ssl/renew | {domain, subdomain?, email} |
| GET POST DELETE | /api/inbounds · /api/inbounds/{id} | Extra ports per protocol |
| GET POST DELETE | /api/templates… · /api/nodes… · /api/blocklist… | Plans, tunnels, blocked sites |
| POST | /api/nodes/{id}/check · /guide · /reveal-token · /regen-token | Tunnel ops |
| POST | /api/backup | Full JSON export, password-confirmed (download) |
| POST | /api/restore | Password-confirmed re-import |
| GET | /api/audit · /api/system · /api/telegram… | Logs, CPU/RAM/disk, notifications |
Public
| Method | Endpoint | Notes |
|---|
| GET | /sub/{token} | Base64 sub, or Clash YAML with ?format=clash |
Example: create a user
curl -c jar.txt -H 'Content-Type: application/json' \
-H 'X-Requested-With: XMLHttpRequest' \
-d '{"username":"admin","password":"…"}' \
https://vpn.example.com/api/login
curl -b jar.txt -H 'Content-Type: application/json' \
-H 'X-Requested-With: XMLHttpRequest' \
-d '{"username":"buyer1","protocols":["vless","reality"],"volume_gb":50,"days":30}' \
https://vpn.example.com/api/users
ZEF