Aquadactyl API
Build integrations with the Client and Application APIs, browser authentication, Blueprint, and Wings callbacks.
Use the Client API to control servers as a panel user, or the Application API to provision users, nodes, allocations, and servers as an administrator. Blueprint extensions can use the same Client API through the panel's shared HTTP client.
This reference is pinned to Aquadactyl commit
2bfd6ae2a30c.
It covers 135 operations: every route in api-client.php,
api-application.php, and api-remote.php, plus Blueprint's built-in client
endpoint. Browser authentication and WebSocket protocols have separate guides.
Installed extensions can register additional endpoints.
Start here
- Read authentication and conventions for keys, permissions, identifiers, pagination, validation, and errors.
- Follow the request examples to list servers, send power actions, edit files, use trash, create schedules, or provision a server.
- Build the Server Pulse Blueprint extension to use the API inside the panel with its current libraries.
Choose an API
| API | Base path | Authentication | Typical use |
|---|---|---|---|
| Client | /api/client | User's Client API key or panel session | Console, files, backups, schedules, subusers, account settings |
| Application | /api/application | Administrator; Application API key with resource ACLs | Hosting automation and provisioning |
| Blueprint | /api/client/extensions and /api/application/extensions | Corresponding panel API middleware | Extension-owned endpoints |
| Browser authentication | /auth and /account/security | Guest or authenticated web session, with CSRF | Passwords, passkeys, OAuth, account linking |
| Wings callbacks | /api/remote | Node token | Wings reporting installation, transfer, backup and activity results |
The Wings callback API is hosted by the panel. The HTTP and WebSocket servers hosted by Wings use separate URLs and credentials.
Client reference
Find an endpoint
135 of 135 endpoints · showing first 20
- GET
/api/client - GET
/api/client/permissions - GET
/api/client/account - GET
/api/client/account/two-factor - POST
/api/client/account/two-factor - POST
/api/client/account/two-factor/disable - POST
/api/client/account/two-factor/regenerate-tokens - PUT
/api/client/account/email - PUT
/api/client/account/password - POST
/api/client/account/avatar - DELETE
/api/client/account/avatar - PUT
/api/client/account/privacy - PUT
/api/client/account/language - GET
/api/client/account/activity - GET
/api/client/account/api-keys - POST
/api/client/account/api-keys - DELETE
/api/client/account/api-keys/{identifier} - GET
/api/client/account/ssh-keys - POST
/api/client/account/ssh-keys - POST
/api/client/account/ssh-keys/remove
- Servers, resource usage, player counts, commands, power and console sharing
- Account, two-factor authentication, avatar, language, privacy, API and SSH keys
- Permission catalogue
- Files and upload/download URLs
- File trash and restoration
- Databases
- Schedules and tasks
- Network allocations
- Subusers and permissions
- Backups
- Startup variables
- Server settings
Application reference
- Users and external IDs
- Nodes, configuration, deployment candidates and allocations
- Locations
- Servers, build limits, startup, lifecycle and databases
- Nests and eggs
Source and maintenance
Each operation links to its pinned route, controller, and request class. Field tables resolve the request's model rules; expandable implementation excerpts retain conditional authorization, responses and service calls. The response object reference contains all 28 Client and Application response transformers, including relationship objects.
Download the JSON route and validation inventory. It records the source revision, method, path, validation expressions, success status, and documentation URL. This is a source inventory, not an OpenAPI schema.
Maintainers can regenerate these pages from a reviewed panel checkout:
node scripts/generate-api-docs.mjs /path/to/aquadactylThe generator checks route counts and fails on missing handlers. Review the handwritten guides and the example extension when the source changes. This reference describes the pinned checkout; deployments may have different feature flags, custom extensions or a different release. Examples use illustrative IDs and response data. They do not send requests to a live panel.
Source excerpts retain the upstream MIT attribution in the included license.