Status API

Status API

The dashboard exposes small read-only endpoints on the private dashboard listener.

Base URL:

http://TAILSCALE_IP:8090

No endpoint accepts writes. Tailnet reachability is the trust boundary.

GET /api/status

Always returns HTTP 200 when the dashboard itself is running, including when MediaMTX is offline. Responses use Cache-Control: no-store.

Example shape:

{
  "online": true,
  "ready": false,
  "readers": 0,
  "bytes": 0,
  "bytes_sent": 0,
  "ready_since": null,
  "tracks": [],
  "stream_health": {
    "state": "idle",
    "bitrate_bps": 0,
    "stalled_seconds": 0
  },
  "history": {
    "disconnects_24h": 0,
    "last_live_at": null,
    "events": [
      {"type": "server_online", "at": "2026-10-12T12:00:00Z"}
    ]
  },
  "storage": {
    "available": true,
    "level": "ok",
    "total_bytes": 494384795648,
    "free_bytes": 129278515200,
    "used_percent": 73.9,
    "recording_files": 8,
    "recording_bytes": 13260718080
  }
}

Notes:

• online means the local MediaMTX API answered with a valid response.
• ready means the live path currently has a publisher.
• bytes and bytes_sent are cumulative MediaMTX path counters.
• ready_since is an ISO-8601 timestamp when available.
• stream_health.state is offline, idle, starting, receiving or stalled.
• bitrate_bps is calculated on the server from consecutive MediaMTX inbound-byte samples.
• stalled means MediaMTX still reports a ready publisher but the inbound counter has not advanced for at least eight seconds.
• stalled_seconds remains 0 outside the stalled state and increases until media resumes.
• events contains at most the ten most recent retained events.
• A stream_stopped event can include duration_seconds.
• Storage data contains aggregates only; no recording names or paths are exposed.

GET /healthz

Returns the same JSON shape as /api/status.

Condition	HTTP status
Dashboard and MediaMTX API available	200
Dashboard available, MediaMTX API unavailable	503

Use this endpoint for service health checks. An idle but healthy stream server returns 200 with ready: false.

GET /api/version

{
  "name": "Tailnet IRL Server",
  "version": "1.8.0"
}

The endpoint can be cached for five minutes.

PWA assets

• GET /manifest.webmanifest
• GET /icon.svg

Security headers

The dashboard sends a restrictive Content Security Policy, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer and a Permissions Policy that disables camera, microphone and geolocation access for the page.

Example check

curl -fsS "http://100.x.y.z:8090/api/status" | python3 -m json.tool

Do not publish response data containing private Tailnet addresses without redaction.