Skip to main content
Everything the panel does goes through this API — there is no hidden channel. All endpoints are JSON over the panel’s port.

Authentication

POST /api/login with the admin credentials sets a myrax_session cookie. Every other endpoint (except /api/health and /api/session) requires it. Login is rate-limited per IP.
Errors come back as {"error": "message"} with a matching HTTP status.

Reading metrics

GET /api/stats returns one snapshot; GET /api/events/stats streams the same payload as server-sent events every second.

Endpoints

Session

System

Control

Plugins

The two proxy routes are how plugin frontends talk to their backends — see Runtime.