Authentication
POST /api/login with the admin credentials sets a myrax_session cookie.
Every other endpoint (except /api/health and /api/session) requires it.
Login is rate-limited per IP.
{"error": "message"} with a matching HTTP status.
Reading metrics
GET /api/stats returns one snapshot; GET /api/events/stats streams the
same payload as server-sent events every second.
Endpoints
Session
| Method | Path | What it does |
|---|---|---|
| GET | /api/health | liveness, no auth |
| GET | /api/session | am I logged in |
| POST | /api/login | log in, sets cookie |
| POST | /api/logout | drop the session |
System
| Method | Path | What it does |
|---|---|---|
| GET | /api/stats | CPU, RAM, disk, network, host snapshot |
| GET | /api/events/stats | the same as SSE, 1s interval |
| GET | /api/processes | process list (?limit=N) |
| POST | /api/processes/kill | kill by PID |
| GET | /api/services | systemd units |
| POST | /api/services/action | start / stop / restart a unit |
| GET | /api/network | per-interface rates |
| GET | /api/disks | mounted volumes |
| GET | /api/logs | journal snapshot |
| GET | /api/events/logs | journal tail as SSE |
Control
| Method | Path | What it does |
|---|---|---|
| GET | /api/config | current config |
| PUT | /api/config | update bind / port / panel path / credentials |
| GET | /api/updates | latest release info |
| POST | /api/actions/update | self-update |
| POST | /api/actions/reboot | reboot the server |
| POST | /api/actions/shutdown | power off |
| POST | /api/actions/reload | restart the panel service |
Plugins
| Method | Path | What it does |
|---|---|---|
| GET | /api/plugins | installed plugins + runtime statuses |
| GET | /api/plugins/store | built-in catalog with install state |
| POST | /api/plugins/install | install by name, URL or path |
| POST | /api/plugins/enable / disable / remove | manage |
| GET | /api/plugins/{id}/logs | runtime log |
| POST | /api/plugins/{id}/restart | restart runtime |
| POST | /api/plugins/{id}/update | re-install from source |
| ANY | /api/plugins/{id}/proxy/{path} | HTTP proxy to the plugin runtime |
| WS | /api/plugins/{id}/ws/{path} | websocket proxy to the plugin runtime |
| GET | /addons/{id}/{file} | plugin static assets (JS, CSS, images) |