Configuration settings

Create, read, update, and delete configurations, servers, and tweaks in your panel using your account’s API key. No panel login session is required.

POST /api/v1/configs, PATCH /api/v1/configs/{config_key} → settings.

PATCH changes only the fields you send and preserves omitted settings. A supplied list replaces the entire list. If an updates, access.password, or access.hwid object includes mode, that entire object is replaced, clearing values from the previous mode.

Defaults to cloud for Client API creation and none for Business API generation. The Business API does not support cloud.

Start with defaults

When creating a configuration, omit settings to use an enabled configuration without a password, device lock, or expiry date. Editing permissions, shared/custom resources, and banner hiding default to false. Access defaults to restricted, so locks and restrictions can be added later. In a PATCH request, omitting settings leaves the saved settings unchanged.

A small example that permits credential editing:

{
  "settings": {
    "permissions": {
      "edit": {"credentials": true}
    }
  }
}

Use this example in a Client API create or update request, or a Business API generation request. Credential editing also enables the server permission flag, but the app interprets the combination as permission to edit credentials only. Server addresses and the full tunnel profile remain locked.

Access and updates

Paths below are relative to settings.

Both APIs accept a plaintext password of up to 100 bytes in access.password.verifier and convert it to the app’s password verifier. A lowercase hexadecimal string of exactly 64 characters is treated as an existing verifier. An arbitrary SHA-256 hash is not necessarily compatible with the app.

{
  "settings": {
    "access": {
      "password": {"mode": "local", "verifier": "ReplaceThisPassword"}
    }
  }
}

Specify mode when choosing an update source or password/device lock type. With Client API PATCH, you can omit mode to change values within the current mode. Only send values that apply to the selected mode.

Restrictions

{
  "settings": {
    "restrictions": {
      "expires_at": "2027-01-01T00:00:00Z",
      "block_root": true,
      "allowed_carrier_codes": ["51502", "51503"]
    }
  }
}

Use JSON booleans (true / false), not quoted strings. Lists must be JSON arrays. Send mobile-operator codes as strings to preserve leading zeroes.

Editing and display

All these fields are booleans and default to false:

Shared resources retain their source configuration. Its access checks still apply when a recipient uses one of those resources. These flags do not publish resources to the panel's public server catalog. Local custom resources and permitted local edits do not write changes back through the Client API.

For access.mode: "open", the generator clears individual edit permissions and add_custom along with locks and restrictions. Open access corresponds to the panel's Unlock All behavior: the apps can transfer the imported copy to the recipient as owner. Use restricted access with explicit permissions when you want recipients to make only selected edits; restricted access can still have no password or device lock.

Android and iOS restrictions

Test access as an ordinary recipient. Verified configuration owners can bypass recipient restrictions, so importing as the owner is not a sufficient lock test. The app's displayed device ID is the value to use for device locks; it is different from an API key and from a raw device-registration identifier.

Sharing and owner metadata

In Client API create/update requests and Business API generation requests, place these fields at the top level, alongside settings:

{
  "sharing": {"allow_reshare": false},
  "owner": {"device_hwid": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
}

sharing.allow_reshare defaults to false. The optional owner device ID can contain up to 32 characters. The owner’s username comes from the authenticated API account and cannot be supplied in the request.