Reference
HTTP API
The panel's HTTP API — session-cookie for the browser, Bearer CLI token for automation.
Updated Edit this page on GitHub
Everything the panel UI does goes through its HTTP API under /api/* on your panel URL. Two authentication methods exist:
| Method | How | Used by |
|---|---|---|
| Session cookie | POST /api/auth/login → Set-Cookie hipno_session | The browser UI |
| Bearer token | Authorization: Bearer <cli-token> (root-only file data/cli-token.json) | The hypno CLI, automation |
A few endpoints
| Endpoint | Purpose |
|---|---|
GET /api/auth/session | Current session + user |
GET /api/system/overview | Version, uptime, host info |
GET /api/dashboard/live | Live CPU/mem/disk/net metrics |
GET /api/websites · POST /api/websites | List / create websites |
GET /api/dns/zones | DNS zones + Cloudflare link state |
GET /api/apps · POST /api/apps | List / create apps |
GET /api/audit | Audit log (paginated, filterable) |
GET /api/system/tunnel | Relay tunnel status + access URL |
Errors are JSON: { "error": "…", "code": "…" } with a meaningful HTTP status. All list endpoints are paginated; all mutating endpoints are audit-logged and role-checked (admin / developer / viewer).