Skip to main content

API and event interfaces

The server exposes interactive OpenAPI documentation at /docs and the schema at /openapi.json. Most application endpoints are under /v1/api; authentication setup and login are under /v1/auth.

Authentication

Browser requests use the configured session cookie. Scripts can send an API key created for a user:

curl \
-H 'X-Minipam-Api-Key: YOUR_API_KEY' \
http://localhost:8091/v1/api/networks/

API keys inherit their user's role and enabled state. Do not put keys in source control or command histories on shared systems.

Main REST resources

The OpenAPI document is the exact reference for the version you run. Its main groups cover:

  • overview, search, structured-filter schemas, and filter values;
  • sites, networks, addresses, pools, allocation maps, and address history;
  • device types, devices, interfaces, introspection, and application instances;
  • services, provider links, derived endpoints, gateways, and gateway routes;
  • agents, requests, jobs, schedules, logs, and network scans;
  • observed hosts and ports, import suggestions, previews, and apply operations;
  • users, credentials, tags, runtime configuration, inventory transfer, database usage, and time-series queries.

List endpoints commonly return an object containing items plus pagination metadata. Validation and conflict responses use the server's structured API error format; integrations should use its error code rather than matching human-readable text.

Live events

The UI subscribes to /sse/ for server-sent events such as job and log changes. Treat event delivery as a signal to refresh authoritative REST state, not as a permanent event archive.

Agents connect outward to /ws/agent with their identity token. That protocol is intended for MiniPAM agents; normal integrations should use REST and SSE.

Health checks

GET /health is unauthenticated and suitable for a basic process health check. It does not prove that an agent can reach a target network or that every scheduled job succeeds.