Configurations

Create, read, update, and delete configurations, servers, and tweaks in your panel using your account’s API key. No panel login session is required.

All endpoints on this page require your Client API key. For terminal examples, set API_BASE, CLIENT_API_KEY, and CONFIG_KEY as shown in your first request.

Create a configuration

POST /api/v1/configs

The configuration, servers, tweaks, allowed devices, cloud passwords, and blocked devices are saved in a single transaction. If any entry is invalid, nothing is saved. Allowed-device and password records require their corresponding cloud lock to be enabled; blocked-device records do not.

{
  "name": "API configuration",
  "message": "Welcome",
  "support_contact": "[email protected]",
  "sharing": {"allow_reshare": false},
  "owner": {"device_hwid": null},
  "revision": {"code": 1, "name": "1.0"},
  "settings": {
    "updates": {"mode": "cloud"},
    "access": {
      "mode": "restricted",
      "password": {"mode": "cloud"},
      "hwid": {"mode": "cloud"}
    },
    "restrictions": {"block_root": true, "blocked_apps": ["com.example.capture"]}
  },
  "servers": [],
  "tweaks": [],
  "device_ids": [{"device_id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "note": "Allowed", "is_active": true, "delete_after_used": false, "expire_date": null}],
  "passwords": [{"password": "secret123", "type": "reusable"}],
  "blocked_device_ids": [{"device_id": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"}]
}

HTTP 201 · Location · configuration: unique_key, settings, servers_count, tweaks_count, device_ids_count, passwords_count, blocked_device_ids_count.

Read saved resources / Update specific fields

• GET /api/v1/configs/{config_key}
• PATCH /api/v1/configs/{config_key}

PATCH changes only the fields you send and preserves omitted settings. A supplied list replaces the entire list. If an updates, access.password, or access.hwid object includes mode, that entire object is replaced, clearing values from the previous mode.

List configurations

GET /api/v1/configs

curl --fail-with-body "$API_BASE/configs" \
  --header 'Accept: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY"

Returns configurations, total, max_configurations, and remaining_configurations. Each entry includes id, name, unique_key, servers_count, tweaks_count, is_cloud_hwid_lock, is_cloud_password, created_at, and updated_at. The cloud booleans describe whether those access modes are enabled.

The list includes all configurations belonging to the account, ordered by most recently updated, then highest ID. This endpoint does not paginate.

List a configuration's resources

GET /api/v1/configs/{config_key}/resources

curl --fail-with-body "$API_BASE/configs/$CONFIG_KEY/resources" \
  --header 'Accept: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY"

Returns configuration_id, configuration_name, config_unique_key, servers, and tweaks alongside success and message.

These are summary lists. Connection credentials, full profiles, and method values are omitted. Carrier and method settings may appear as empty objects. Use the individual server or tweak endpoint for editable details; do not submit a summary as a replacement document.

Read the message

GET /api/v1/configs/{config_key}/message

curl --fail-with-body "$API_BASE/configs/$CONFIG_KEY/message" \
  --header 'Accept: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY"

The message is returned as config_message, with configuration_id, configuration_name, and config_unique_key.

Update the message

PUT /api/v1/configs/{config_key}/message

curl --fail-with-body --request PUT "$API_BASE/configs/$CONFIG_KEY/message" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY" \
  --data '{"message":"Welcome to my configuration."}'

Returns the updated config_message and the same configuration identifiers. Text placeholders such as {config_name}, {server_count}, and {server_list} are resolved during export; the message endpoint stores the template.

Message placeholders use curly braces only, such as {config_name}.

Delete a configuration

DELETE /api/v1/configs/{config_key}

This permanently removes the saved configuration and its dependent resources. Only call it when you intend to delete the configuration.

curl --fail-with-body --request DELETE "$API_BASE/configs/$CONFIG_KEY" \
  --header 'Accept: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY"

Returns success: true, configuration_deleted: true, and a configuration object containing the deleted record's id, name, and unique_key. For multiple configurations, see batch deletion.

Message placeholders

Use these tokens in either a saved configuration message or a Business generation request's message. Placeholders are case-sensitive. Unknown tokens remain unchanged; empty server or tweak lists resolve to an empty string. The Client message endpoint stores and returns the template unchanged. Business generation resolves it before returning encrypted import text.

Get panel changes into the app

The panel stores the source configuration; an app import stores a local copy. A server or tweak is identified by its own unique_key inside that configuration. Updating an existing key preserves that identity; deleting and recreating without the key creates a different resource.

1. POST /api/v1/configs → configuration.unique_key.
2. settings.updates.mode = cloud → POST /api/v1/configs/{config_key}/export → .ht.
3. Change the existing resources through the Client API. Resource changes also update the parent configuration's timestamp and invalidate its cached export.
4. Let the app perform its configured update check, or use its update action. Automatic updates depend on app preferences and lifecycle; the API response is not a device delivery receipt.

Without an update source, export and import the changed configuration again. A cloud share is an export snapshot: making a share does not itself enable cloud updates. If you enable updates after distributing a file with updates disabled, distribute a new export containing that setting.

Both Android and iOS require the remote configuration's unique_key to match the imported one. They compare updated_at to detect a change; increasing a displayed revision alone is not the update contract. A custom URL must serve a valid app configuration with the same key, not a Client API resource-list response. Changes to live tunnel settings take effect when the app builds a new connection.

Business generation creates fresh keys and therefore cannot replace this saved-configuration update workflow.

Support contact (optional)

Contact details shown in password, HWID, and expiry prompts. Max 100 characters.

GET /api/v1/configs/{config_key}/support-contact

curl --fail-with-body "$API_BASE/configs/$CONFIG_KEY/support-contact" \
  --header 'Accept: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY"

PUT /api/v1/configs/{config_key}/support-contact

curl --fail-with-body --request PUT "$API_BASE/configs/$CONFIG_KEY/support-contact" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-API-Key: $CLIENT_API_KEY" \
  --data '{"support_contact":"[email protected]"}'

Send support_contact as a string of up to 100 characters. Send null or an empty string to clear it; omitting the field is invalid. Both endpoints return support_contact with the configuration identifiers. The configuration list also includes support_contact. Updating it leaves the message unchanged.

Optional: export for the app

POST /api/v1/configs/{config_key}/export

Send an empty request body to the export endpoint. It returns encrypted configuration text that can be imported into the VPN app.