Skip to main content
Everything the panel does goes through this API — there is no hidden channel. All endpoints are JSON over the panel’s port.

Authentication

POST /api/login with the admin credentials sets a myrax_session cookie. Every other endpoint (except /api/health and /api/session) requires it. Login is rate-limited per IP.
const res = await fetch("http://server:1487/api/login", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ username: "admin", password: "secret" }),
  credentials: "include" // keep the myrax_session cookie
});
if (!res.ok) throw new Error(`login failed: ${res.status}`);
Errors come back as {"error": "message"} with a matching HTTP status.

Reading metrics

GET /api/stats returns one snapshot; GET /api/events/stats streams the same payload as server-sent events every second.
// one snapshot
const stats = await (await fetch("/api/stats", { credentials: "include" })).json();
console.log(stats.cpu.usagePercent, stats.memory.usedPercent);

// live stream (SSE)
const events = new EventSource("/api/events/stats");
events.onmessage = (event) => {
  const stats = JSON.parse(event.data);
  console.log(stats.cpu.usagePercent);
};

Endpoints

Session

MethodPathWhat it does
GET/api/healthliveness, no auth
GET/api/sessionam I logged in
POST/api/loginlog in, sets cookie
POST/api/logoutdrop the session

System

MethodPathWhat it does
GET/api/statsCPU, RAM, disk, network, host snapshot
GET/api/events/statsthe same as SSE, 1s interval
GET/api/processesprocess list (?limit=N)
POST/api/processes/killkill by PID
GET/api/servicessystemd units
POST/api/services/actionstart / stop / restart a unit
GET/api/networkper-interface rates
GET/api/disksmounted volumes
GET/api/logsjournal snapshot
GET/api/events/logsjournal tail as SSE

Control

MethodPathWhat it does
GET/api/configcurrent config
PUT/api/configupdate bind / port / panel path / credentials
GET/api/updateslatest release info
POST/api/actions/updateself-update
POST/api/actions/rebootreboot the server
POST/api/actions/shutdownpower off
POST/api/actions/reloadrestart the panel service

Plugins

MethodPathWhat it does
GET/api/pluginsinstalled plugins + runtime statuses
GET/api/plugins/storebuilt-in catalog with install state
POST/api/plugins/installinstall by name, URL or path
POST/api/plugins/enable / disable / removemanage
GET/api/plugins/{id}/logsruntime log
POST/api/plugins/{id}/restartrestart runtime
POST/api/plugins/{id}/updatere-install from source
ANY/api/plugins/{id}/proxy/{path}HTTP proxy to the plugin runtime
WS/api/plugins/{id}/ws/{path}websocket proxy to the plugin runtime
GET/addons/{id}/{file}plugin static assets (JS, CSS, images)
The two proxy routes are how plugin frontends talk to their backends — see Runtime.