MonsterOps logo MonsterOps
Docs / REST API / Overview

REST API — Overview

MonsterOps ships a versioned REST API so external systems — provisioning portals, monitoring tools, billing systems, scripts — can do the same things you do in the UI. The monsterops CLI is itself just a client of this API, so anything the CLI does, your own code can do too.

Base URL

Everything lives under /api/v1/ on your MonsterOps host:

https://your-host/api/v1

v1 is the version. Breaking changes go to a future /api/v2; /api/v1 stays stable.

Enable the API Keys module

The REST API is served by the API Keys module. It's on by default; if you've trimmed MONSTEROPS_ENABLED_MODULES, make sure apikeys is in the list — otherwise /api/v1/ returns 404. See Configuration.

Quick start

Create a scoped key in System → API Keys (see Authentication), then call the API with the X-API-Key header:

curl -H "X-API-Key: mr_xxxxxxxxxxxxxxxx" \
     https://your-host/api/v1/users

{
  "total": 128,
  "page": 1,
  "size": 50,
  "items": [
    { "username": "alice", "enabled": true, "groups": ["premium"], "expiration": null, "simultaneous_use": 1 }
  ]
}

That's the whole shape of the API: a header for auth, JSON in, JSON out.

What you can do

Resource Endpoints Docs
Users list · get · create · update · delete · sessions Users
Groups list · get · create · delete · add/remove members Groups
NAS list · get · create · update · delete NAS
Sessions & CoA list active sessions · disconnect Sessions & CoA
Auth logs query authentication history Auth Logs

Each endpoint requires a matching scope on the key.

Interactive spec (OpenAPI)

MonsterOps generates an OpenAPI schema. The interactive explorers are exposed only outside production, when MONSTEROPS_DEBUG=true:

  • GET /api/docs — Swagger UI (try requests in the browser)
  • GET /api/redoc — ReDoc reference
  • GET /api/openapi.json — the raw schema (generate a client from it)

In production (MONSTEROPS_DEBUG=false, the default) these are disabled and return 404 — the API itself still works, only the explorers are hidden.

Legacy endpoints

An older, unversioned set lives under /api/ext/ (/api/ext/sessions, /api/ext/users/{username}, /api/ext/coa/disconnect). It's kept for backward compatibility only. Build new integrations against /api/v1/ — it's paginated, consistent, and versioned.