Authentication
POST /api/login with the admin credentials sets a myrax_session cookie.
Every other endpoint (except /api/health and /api/session) requires it.
Login is rate-limited per IP.
{"error": "message"} with a matching HTTP status.
Reading metrics
GET /api/stats returns one snapshot; GET /api/events/stats streams the
same payload as server-sent events every second.
Endpoints
Session
System
Control
Plugins
The two proxy routes are how plugin frontends talk to their backends — see
Runtime.