Skip to content

REST API Reference

The StarkOne REST API is a JSON API served by the panel binary on TCP port 2087, under the /api/ path prefix. 800+ endpoints are documented in this reference.

Base URL

https://<server>:2087/api/

Authentication

All endpoints (except /api/health, /api/version, /api/license/*, and a small set of public probes) require a Bearer token:

Authorization: Bearer <token>

Tokens are obtained from POST /api/auth/login. See Authentication for the full flow.

When a token is missing or invalid, the API returns 401 Unauthorized. When the license is missing or blocked, it returns 403 no_license or 403 license_blocked.

Response Envelope

All responses use a consistent shape.

{ "data": { ... } }

{ "error": { "code": "bad_request", "message": "human-readable text" } }

Some list endpoints return { "data": [ ... ] } instead of an object - see each endpoint's page for the exact shape.

Authorization Guards

Many endpoints are protected by middleware guards. The most common are:

Guard Meaning
RequireSuperuser() Caller must be a superuser.
RequirePermission(db, "<perm>") Caller must hold the named permission on their role.
RequirePlugin(db, "<plugin-id>") The named plugin must be installed and enabled on this server.

The endpoint tables on each page list the exact guards for every route.

Reference by area

Auth & Identity

Websites

Databases

Network & DNS

Security

  • :material-firewall: Firewall (CSF) - allow/deny, country blocks (32)
  • Nginx ACL - F5-style ACL policies (21)
  • WAF - ModSecurity, signatures, events (19)

Observability & Ops

  • :material-vault: LogVault - centralized logs via OpenSearch (15)
  • Uptime Monitor - HTTP/TCP checks (8)
  • Server Info - host metrics (4)
  • System - LVM snapshots and host operations (17)
  • Tools - DNS, hosts file, port utilities (6)

AI & Automation

Platform

System endpoints

A handful of endpoints are top-level and unauthenticated, used for health checks and bootstrap:

Method Path Purpose
GET /api/health Liveness probe. Returns { "status": "ok" }.
GET /api/version Returns current panel version + update check. No auth.
GET /api/license/block-status Public - used by the UI to render the licensing-required page.
GET /api/license/info Public - current license info.
POST /api/license/recheck Public - re-validate license after a renewal.
POST /api/license/activate Public - used to activate when no license exists.

Rate limiting

The panel does not currently rate-limit authenticated calls; protect the panel port (2087) with the built-in CSF firewall (see Firewall).