Admin API
FF1 Master provides a REST API for bulk operations and scripted actions. Paths are prefixed with /api/, authenticated with an API Token (Bearer) and authorized by scope.
Authentication
Section titled “Authentication”Issue an API Token in the console (GET/POST /api/tokens), and include it on calls:
Authorization: Bearer <token>Scopes take the form resource:action:
| Scope | Capability |
|---|---|
nodes:read / nodes:write | Read / write nodes |
rules:read / rules:write | Read / write forwarding rules |
tunnels:read / tunnels:write | Read / write tunnels |
users:read / users:write | Read / write users |
audit:read | Audit read-only |
license:read | License read-only |
* | Everything (use with caution) |
Common endpoints
Section titled “Common endpoints”| Domain | Path |
|---|---|
| Login | POST /api/auth/login |
| Tokens | GET/POST /api/tokens, DELETE /api/tokens/{id} |
| Nodes | GET /api/nodes, GET/PUT/DELETE /api/nodes/{id}, POST /api/nodes |
| Node installation | POST /api/nodes/{id}/install-ssh, POST /api/nodes/{id}/reinstall |
| Forwarding rules | GET/POST /api/rules, GET/PUT /api/rules/{id}, POST /api/rules/{id}/sync |
| Tunnels | GET/POST /api/tunnels, GET/PUT/DELETE /api/tunnels/{id} |
| Settings | GET/PATCH /api/settings |
| Audit | GET /api/audit-logs |
| Dashboard | GET /api/dashboard, GET /api/dashboard/traffic |
Bulk operations: POST /api/nodes/batch-delete, POST /api/rules/batch-delete, etc.
Examples
Section titled “Examples”List nodes:
curl -sS -H "Authorization: Bearer $FF1_TOKEN" \ "https://master.example.com/api/nodes"Trigger sync after creating and pushing a forwarding rule:
curl -sS -X POST -H "Authorization: Bearer $FF1_TOKEN" \ "https://master.example.com/api/rules/123/sync"- Tokens carry broad privileges—issue them with the least scope and never leak them
- Write operations are recorded in the audit log
- For bulk scripts, watch your rate to avoid contending with live operations for the SQLite write lock