Management REST API

The management server exposes a REST API over HTTPS (default :8080) for programmatic control of your mesh. The dashboard is built entirely on this API.

Authentication

All endpoints require a JWT bearer token. An agent receives its JWT when it enrolls with a setup key; administrators obtain one by signing in to the dashboard.

curl https://your-host:8080/api/peers \
  -H "Authorization: Bearer <jwt>"

The JWT encodes the peer ID, WireGuard public key, and account ID. Requests without a valid token receive 401 Unauthorized.

Peers

Method	Path	Description
GET	/api/peers	List all peers in the account.
PUT	/api/peers/:key	Update a peer's tags. Body: `{"tags":[...]}`.
DELETE	/api/peers/:key	Remove a peer. Requires an Admin session (a device-token session cannot delete).

:keyis the peer's WireGuard public key. Because keys are base64 and may contain /, the dashboard and router handle URL-encoding of the key.

# Assign tags to a peer
curl -X PUT https://your-host:8080/api/peers/<pubkey> \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{"tags":["tag:web","tag:prod"]}'

Method	Path	Description
GET	/api/tags	List all tags currently in use across peers.

Setup keys

Method	Path	Description
GET	/api/setup-keys	List setup keys.
POST	/api/setup-keys	Create a new setup key.
DELETE	/api/setup-keys/:id	Revoke a setup key.

curl -X POST https://your-host:8080/api/setup-keys \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{"name":"ci-runners","expires_in_days":30}'

Access Control Lists

Method	Path	Description
GET	/api/acls	List access policy rules.
POST	/api/acls	Create a rule.
PUT	/api/acls/:id	Update a rule.
DELETE	/api/acls/:id	Delete a rule.

Account

Method	Path	Description
GET	/api/account	Retrieve account details (ID, mesh CIDR, DNS suffix).