API overview

Overview of the FeatherPanel REST API. Route groups, authentication options, the response format, the OpenAPI spec and where to find every endpoint.

Everything the FeatherPanel frontend does goes through the same REST API under /api, so anything you can click you can script. The endpoint reference lists every route with its method, auth type and permission.

Route groups

Admin routes check a permission node such as admin.users.list. See the permissions reference.

Authentication

Send an API key as a Bearer token:

curl -H "Authorization: Bearer YOUR_PRIVATE_KEY" https://panel.example.com/api/user/session

API keys act as the user who created them. Details, OAuth2 and IP allow lists are on Authentication.

Response format

Every response is JSON with the same envelope:

{
  "success": true,
  "message": "OK",
  "data": { },
  "error": false,
  "error_message": null,
  "error_code": null
}

Errors set success to false, fill error_message and error_code (for example INVALID_API_KEY or RATE_LIMITED) and add an errors array with code, detail and status. Always branch on error_code, not the message text.

OpenAPI

GET /api/openapi.json returns the OpenAPI document built from the route annotations. Load it into Postman, Insomnia or a code generator.

Rate limits

Routes can carry a rate limit. When you hit one, the panel answers 429 with error_code RATE_LIMITED, a retry_after value in data and a Retry-After header in seconds. Back off for that long before retrying.

Other ways in

• FeatherCli wraps the user API for servers, files, backups and more.
• The MCP server exposes panel actions to AI assistants.