API

English | 简体中文

API model

m-ui exposes a small JSON API for its own web UI. The API is protected by the panel session cookie created at login. There is no general-purpose API token or Swagger page in the current release. Do not expose the API to untrusted networks.

The panel API is relative to the panel listener and hidden panel path behavior. Every path below is relative to the panel base URL. For example, if the panel path is /secret/, /api/state is requested publicly as /secret/api/state. Browser code uses relative URLs so a non-root panel path continues to work.

Authentication

Log in with:

POST /api/auth/login
Content-Type: application/json

{"username":"admin","password":"your-password"}

The response sets an mui_session HttpOnly cookie. Send that cookie with subsequent protected requests. Log out with:

POST /api/auth/logout

Common endpoints

Method	Endpoint	Purpose
GET	/api/state	Authenticated dashboard and panel state snapshot.
GET / PUT	/api/config	Read or save Panel Settings.
POST	/api/panel/restart	Request a panel listener restart.
GET / POST / DELETE	/api/inbounds	List, create/update, or delete inbounds.
GET / PUT	/api/mihomo/settings	Read or save Basics, Outbounds, and Routing Rules.
GET	/api/raw-config	Read generated YAML.
POST	/api/raw-config	Regenerate generated YAML.
POST	/api/core/start	Start Mihomo.
POST	/api/core/stop	Stop Mihomo.
POST	/api/core/restart	Restart Mihomo.
POST	/api/core/test	Validate the generated Mihomo configuration.
GET	/api/core/logs	Read retained Mihomo logs.
DELETE	/api/core/connections	Close all or one Mihomo connection.
GET	/api/core/releases	List stable Mihomo releases.
POST	/api/core/install	Install a selected Mihomo release.
POST	/api/geofiles/update	Update official geofiles.
GET	/api/backup	Download a ZIP backup.
POST	/api/backup	Restore an uploaded backup multipart field named backup.
POST	/api/traffic/reset	Reset inbound or client traffic counters.

The exact JSON shape follows the State, Settings, Inbound, MihomoOutbound, and MihomoRoutingRule structures in the source. Unknown or invalid fields are rejected rather than silently passed to Mihomo.

Mihomo Settings example

PUT /api/mihomo/settings
Content-Type: application/json
Cookie: mui_session=...

{
  "basics": {
    "mode": "rule",
    "directIpVersion": "dual",
    "ipv6": true,
    "outboundTestUrl": "https://www.gstatic.com/generate_204"
  },
  "outbounds": [],
  "routingRules": [
    {"id":"default-match","type":"MATCH","target":"DIRECT"}
  ]
}

Multi-control endpoints

The authenticated UI endpoint is:

GET  /api/multi-control
PUT  /api/multi-control/settings
POST /api/multi-control/token
POST /api/multi-control/connect
POST /api/multi-control/disconnect

Pairing tokens should only be sent over HTTPS or a trusted private network. The peer wire protocol is not a public REST API.

Sync and cross-panel endpoints

GET  /api/inbound-sync
POST /api/inbound-sync
GET  /api/inbound-sync?job=<id>
GET  /api/cross-subscriptions
POST /api/cross-subscriptions
DELETE /api/cross-subscriptions
GET  /api/cross-subscriptions?job=<id>

These endpoints start asynchronous jobs and return progress records. The fixed peer wire paths are separate:

/_m-ui/peer/v1
/_m-ui/peer/inbound/v1

They use signed peer messages, replay protection, and encrypted payloads. Do not proxy them to a public subscription listener.

Error responses

Errors use the common response shape:

{
  "ok": false,
  "message": "human-readable error"
}

Successful responses generally use:

{
  "ok": true,
  "data": {},
  "message": "optional message"
}

Do not build automation around translated message text. Use HTTP status and stable data fields when possible.