Session endpoints (Client API: account)

20 FeatherPanel Client API: account endpoints from user/session.php: methods, paths, auth, permissions, rate limits, parameters and responses.

Last synced from FeatherPanel 15b94e9 on 23 Oct 2026.

On this page

Defined in backend/app/routes/user/session.php. Authentication used here: Signed-in user. Read Authentication for how to send credentials and Rate limits and errors for the response envelope.

Paths, methods, permissions and rate limits come from the route file. Summaries, parameters and response codes come from the OpenAPI annotations on the controllers; endpoints without annotations show only what the route file declares.

Endpoints

GET`/api/user/session`

Auth: Signed-in userDefault rate limit: 60 / minute (user-session)Route name: sessionController: SessionController::getroute source

Get user session Retrieve current user session information including user details, permissions, activities, and mail data.

Response data: SessionResponse

Response `data` field	Type	Description
`user_info`	object	User information
`permissions`	string[]	User permissions
`preferences`	UserPreferences

curl -X GET "$PANEL_URL/api/user/session" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Session information retrieved successfully · 400 Bad request - Invalid authentication token · 401 Unauthorized - User not authenticated · 500 Internal server error - Failed to retrieve session

PATCH`/api/user/session`

Auth: Signed-in userDefault rate limit: 30 / minute (user-session)Route name: session-updateController: SessionController::putroute source

Update user session Update user profile information including username, email, password, avatar, and 2FA settings. Includes CloudFlare Turnstile validation if enabled.

Request body: SessionUpdateRequest (application/json) · Response data: SessionUpdateResponse

Body field	Type	Required	Description
`username`	string	no	Username (alphanumeric and underscores only)
`email`	string (email)	no	User email address
`first_name`	string	no	User first name
`last_name`	string	no	User last name
`password`	string	no	User password
`avatar`	string (uri)	no	Avatar URL (must start with https://)
`ticket_signature`	string	no	Ticket signature (supports Markdown)
`two_fa_enabled`	boolean	no	Two-factor authentication enabled status
`turnstile_token`	string	no	CloudFlare Turnstile token (required if Turnstile is enabled)

Response `data` field	Type	Description
`message`	string	Success message

curl -X PATCH "$PANEL_URL/api/user/session" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"username":"","email":"","first_name":"","last_name":"","password":"","avatar":"","ticket_signature":"","two_fa_enabled":false,"turnstile_token":""}'

Plugin events: featherpanel:auth:email:changed, featherpanel:auth:password:changed, featherpanel:user:update

Responses: 200 Session updated successfully · 400 Bad request - Invalid authentication token, request data, field validation, Turnstile validation failed, or Turnstile keys not set · 409 Conflict - Username or email already exists · 500 Internal server error - Failed to update session

POST`/api/user/avatar`

Auth: Signed-in userDefault rate limit: 5 / minute (user-session)Route name: avatar-uploadController: SessionController::uploadAvatarroute source

Upload user avatar Upload a new avatar image for the current user. Accepts image files up to 5MB in size.

Body field	Type	Required	Description
`avatar`	string (binary)	yes	Avatar image file

Response `data` field	Type	Description
`success`	boolean	Success status
`message`	string	Success message
`avatar_url`	string	URL to the uploaded avatar

curl -X POST "$PANEL_URL/api/user/avatar" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json" \
  -F "avatar=@./file"

Responses: 200 Avatar uploaded successfully · 400 Bad request - Invalid file, file too large, or invalid authentication · 500 Internal server error - Failed to save avatar

GET`/api/user/preferences`

Auth: Signed-in userRoute name: preferences-getController: SessionController::getPreferencesroute source

Get user preferences Retrieve current user UI/UX preferences including theme, language, sidebar state, and other settings.

Response data: PreferencesResponse

Response `data` field	Type	Description
`preferences`	UserPreferences

curl -X GET "$PANEL_URL/api/user/preferences" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Preferences retrieved successfully · 400 Bad request - Invalid authentication token · 401 Unauthorized - User not authenticated

PATCH`/api/user/preferences`

Auth: Signed-in userDefault rate limit: 30 / minute (user-session)Route name: preferences-updateController: SessionController::updatePreferencesroute source

Update user preferences Update current user UI/UX preferences. Any preference fields can be provided and will be merged with existing preferences.

Request body: UserPreferences (application/json)

Body field	Type	Required	Description
`timezone`	string	no	IANA timezone identifier used for date rendering; null means browser default
`favorite_server_uuids`	string (uuid)[]	no	Pinned server UUIDs (max 50)
`hide_server_ips`	boolean	no	Mask server IP addresses in the panel UI for this account only

Response `data` field	Type	Description
`preferences`	UserPreferences
`message`	string	Success message

curl -X PATCH "$PANEL_URL/api/user/preferences" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"timezone":"","favorite_server_uuids":[],"hide_server_ips":false}'

Responses: 200 Preferences updated successfully · 400 Bad request - Invalid authentication token or request data · 401 Unauthorized - User not authenticated · 500 Internal server error - Failed to update preferences

GET`/api/user/notification-settings`

Auth: Signed-in userRoute name: notification-settings-getController: NotificationSettingsController::getroute source

Get email and Discord notification settings

curl -X GET "$PANEL_URL/api/user/notification-settings" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Settings retrieved

PUT`/api/user/notification-settings`

Auth: Signed-in userDefault rate limit: 30 / minute (user-session)Route name: notification-settings-updateController: NotificationSettingsController::updateroute source

Save email and Discord notification settings

curl -X PUT "$PANEL_URL/api/user/notification-settings" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Settings saved · 400 Invalid webhook URL

POST`/api/user/notification-settings/test-discord`

Auth: Signed-in userDefault rate limit: 5 / minute (user-session)Route name: notification-settings-test-discordController: NotificationSettingsController::testDiscordroute source

Send a test message to the saved Discord webhook

curl -X POST "$PANEL_URL/api/user/notification-settings/test-discord" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Test sent

GET`/api/user/preferences/ui`

Auth: Signed-in userDefault rate limit: 60 / minute (user-ui-preferences)Route name: preferences-uiController: UiPreferencesController::getroute source

Get synced UI state Browser UI state stored for the current user, keyed by storage key. Each entry has its value (null when removed) and the server time in milliseconds it was written.

curl -X GET "$PANEL_URL/api/user/preferences/ui" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 UI state retrieved · 401 Unauthorized

PATCH`/api/user/preferences/ui`

Auth: Signed-in userDefault rate limit: 60 / minute (user-ui-preferences)Route name: preferences-ui-updateController: UiPreferencesController::updateroute source

Save changed UI state entries Merges the given entries into the stored UI state. Send {"entries": {"key": "value"}}; a null value removes the key.

curl -X PATCH "$PANEL_URL/api/user/preferences/ui" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 UI state saved · 400 Invalid entries · 413 UI state too large

POST`/api/user/data-request`

Auth: Signed-in userDefault rate limit: 2 / minute (user-session)Route name: data-request-createController: SessionController::requestDataExportroute source

Request account data export Create a support ticket requesting a personal data export for the authenticated user.

curl -X POST "$PANEL_URL/api/user/data-request" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Plugin events: featherpanel:ticket:created

Responses: 201 Data request ticket created successfully · 400 Bad request - Missing ticket configuration · 401 Unauthorized - User not authenticated · 403 Forbidden - Ticket system disabled or open ticket limit reached · 500 Internal server error - Failed to create request

GET`/api/user/mails`

Auth: Signed-in userDefault rate limit: 30 / minute (user-session)Route name: mails-getController: SessionController::getMailsroute source

Get user mails with pagination Retrieve paginated mail list for the current user with optional search functionality.

Parameter	In	Type	Required	Description
`page`	query	integer	no	Page number (default: 1)
`limit`	query	integer	no	Number of records per page (default: 10, max: 100)
`search`	query	string	no	Search query to filter mails by subject or body

Response `data` field	Type	Description
`mails`	object[]	Array of mail items
`pagination`	object
`search`	object

curl -X GET "$PANEL_URL/api/user/mails" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Mails retrieved successfully · 400 Bad request - Invalid authentication token · 401 Unauthorized - User not authenticated · 500 Internal server error - Failed to retrieve mails

POST`/api/user/mails/{id}/resend`

Auth: Signed-in userDefault rate limit: 10 / minute (user-session)Route name: mails-resendController: SessionController::resendMailroute source

Resend a failed email Re-queue a failed system email for delivery to the current user.

Parameter	In	Type	Required	Description
`id`	path	integer	yes	Mail list entry ID

curl -X POST "$PANEL_URL/api/user/mails/$ID/resend" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Email queued for resend · 400 Bad request - Mail cannot be resent or SMTP disabled · 401 Unauthorized - User not authenticated · 404 Mail not found · 500 Internal server error - Failed to resend mail

GET`/api/user/activities`

Auth: Signed-in userRoute name: activities-getController: SessionController::getActivitiesroute source

Get user activities with pagination Retrieve paginated activity list for the current user with optional search functionality.

Parameter	In	Type	Required	Description
`page`	query	integer	no	Page number (default: 1)
`limit`	query	integer	no	Number of records per page (default: 10, max: 100)
`search`	query	string	no	Search query to filter activities by name, context, or IP address

Response `data` field	Type	Description
`activities`	object[]	Array of activity items
`pagination`	object
`search`	object

curl -X GET "$PANEL_URL/api/user/activities" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Activities retrieved successfully · 400 Bad request - Invalid authentication token · 401 Unauthorized - User not authenticated · 500 Internal server error - Failed to retrieve activities

DELETE`/api/user/auth/discord/unlink`

Auth: Signed-in userDefault rate limit: 5 / minute (user-auth-discord)Route name: discord-unlinkController: DiscordController::unlinkroute source

curl -X DELETE "$PANEL_URL/api/user/auth/discord/unlink" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

POST`/api/user/sign-api-key`

Auth: Signed-in userDefault rate limit: 10 / minute (user-api-key-sign)Route name: sign-api-keyController: SessionController::signApiKeyroute source

Sign API key Sign an API key

Request body: SignApiKeyRequest (application/json) · Response data: SignApiKeyResponse

Body field	Type	Required	Description
`api_key`	string	no	API key to sign

Response `data` field	Type	Description
`signature`	string	Signature
`api_key`	string	API key

curl -X POST "$PANEL_URL/api/user/sign-api-key" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"api_key":""}'

Responses: 200 API key signed successfully · 400 Bad request - Invalid request data, API key cannot be empty, or Invalid API key · 401 Unauthorized - User not authenticated · 500 Internal server error - Failed to sign API key

GET`/api/user/account/deletion`

Auth: Signed-in userDefault rate limit: 30 / minute (user-account-deletion)Route name: account-deletion-statusController: AccountDeletionController::statusroute source

Get account deletion status Returns whether self-service account deletion is enabled, verification requirements, mode, and any pending deletion.

curl -X GET "$PANEL_URL/api/user/account/deletion" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Deletion status retrieved successfully · 401 Unauthorized

POST`/api/user/account/deletion/otp`

Auth: Signed-in userDefault rate limit: 3 / minute (user-account-deletion)Route name: account-deletion-otpController: AccountDeletionController::sendOtproute source

Send account deletion email OTP Send a one-time email code required to confirm account deletion when email OTP verification is enabled.

curl -X POST "$PANEL_URL/api/user/account/deletion/otp" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 OTP sent successfully · 403 Feature disabled or email OTP not required · 429 Rate limited

POST`/api/user/account/deletion/confirm`

Auth: Signed-in userDefault rate limit: 5 / minute (user-account-deletion)Route name: account-deletion-confirmController: AccountDeletionController::confirmroute source

Confirm account deletion Verify identity (2FA and/or email OTP) and process the deletion according to admin configuration.

curl -X POST "$PANEL_URL/api/user/account/deletion/confirm" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Account deleted or scheduled · 400 Validation failed · 403 Feature disabled · 409 Active services block deletion

DELETE`/api/user/account/deletion`

Auth: Signed-in userDefault rate limit: 10 / minute (user-account-deletion)Route name: account-deletion-cancelController: AccountDeletionController::cancelroute source

Cancel pending account deletion Cancel a pending delayed or after-services account deletion request.

curl -X DELETE "$PANEL_URL/api/user/account/deletion" \
  -H "Authorization: Bearer $FEATHERPANEL_API_KEY" \
  -H "Accept: application/json"

Responses: 200 Pending deletion cancelled · 404 No pending deletion

Session endpoints (Client API: account)

Endpoints

GET/api/user/session

PATCH/api/user/session

POST/api/user/avatar

GET/api/user/preferences

PATCH/api/user/preferences

GET/api/user/notification-settings

PUT/api/user/notification-settings

POST/api/user/notification-settings/test-discord

GET/api/user/preferences/ui

PATCH/api/user/preferences/ui

POST/api/user/data-request

GET/api/user/mails

POST/api/user/mails/{id}/resend

GET/api/user/activities

DELETE/api/user/auth/discord/unlink

POST/api/user/sign-api-key

GET/api/user/account/deletion

POST/api/user/account/deletion/otp

POST/api/user/account/deletion/confirm

DELETE/api/user/account/deletion