# FeatherQuilld API

> All 113 FeatherQuilld HTTP endpoints for WebSpaces, files, mail, DNS and the system, with authentication, generated from the Quilld controllers.

Source: https://featherpanel.com/docs/quilld/api/

FeatherQuilld exposes this API for the panel. Users should go through the [panel API](https://featherpanel.com/docs/api/). When`api.docs.enabled` is true, a node serves interactive docs at `/scalar` and the OpenAPI document at`/openapi/v1.json`.

## Authentication

-   **Node token**: `Authorization: Bearer <token_id>.<token>` using the values in `/etc/featherquilld/config.yml`, compared in constant time.
-   Only the console websocket (`…/ws`) also accepts the node token as `?token=`, because browsers cannot set headers on a websocket upgrade. Browser clients instead send `{"event":"auth","args":["<jwt>"]}` as the first message.
-   Signed uploads (`upload-signed`) carry their own upload token.

## Endpoints

### Deauthorize

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| POST  | `/api/deauthorize-user` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/ws/permissions` | Node token |  |

### Dns

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/dns/probe` | Node token |  |
| GET  | `/api/dns/zones` | Node token |  |
| POST  | `/api/dns/zones` | Node token |  |
| GET  | `/api/dns/zones/{zone}/records` | Node token |  |
| POST  | `/api/dns/zones/{zone}/records` | Node token |  |
| PATCH  | `/api/dns/zones/{zone}/records/{recordId}` | Node token |  |
| DELETE  | `/api/dns/zones/{zone}/records/{recordId}` | Node token |  |
| POST  | `/api/dns/zones/{zone}/txt` | Node token |  |
| DELETE  | `/api/dns/zones/{zone}/txt` | Node token |  |

### Home

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/` | None / own check | Serves the main page at /. |

### Mail

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/mail/probe` | Node token |  |
| GET  | `/api/mail/domains` | Node token |  |
| POST  | `/api/mail/domains` | Node token |  |
| DELETE  | `/api/mail/domains/{name}` | Node token |  |
| POST  | `/api/mail/provision` | Node token |  |
| GET  | `/api/mail/dns-hints/{domain}` | Node token |  |
| GET  | `/api/mail/mailboxes/{email}/spam` | Node token |  |
| GET  | `/api/mail/lists` | Node token |  |
| GET  | `/api/mail/deliverability` | Node token |  |
| GET  | `/api/mail/webmail` | Node token |  |
| POST  | `/api/mail/webmail/configure` | Node token |  |

### System

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/system` | Node token | Daemon identity (Calagopus Wings-compatible shape). |
| GET  | `/api/system/health` | Node token | Health probe used by FeatherPanel admin. |
| GET  | `/api/system/utilization` | Node token | Host utilization in panel-friendly flat shape. |
| GET  | `/api/system/stats` | Node token | Calagopus-style nested stats. |
| GET  | `/api/system/diagnostics` | Node token | Diagnostics / self-test snapshot. |
| GET  | `/api/system/info` | Node token | Basic daemon identity (non-secret). |
| GET  | `/api/system/plugins` | Node token | Loaded plugins (non-secret metadata). |
| DELETE  | `/api/system/plugins/{pluginId}` | Node token | Soft-unload a plugin (subscriptions + routes). MVC application parts require a process restart. |
| GET  | `/api/system/packages/ws` | Node token | Live package install/remove output (bearer via Authorization header or ?token=). |
| GET  | `/api/system/packages` | Node token | List installable host packages (reverse proxy, Docker). |
| POST  | `/api/system/packages/{packageId}/install` | Node token | Install a supported host package. |
| POST  | `/api/system/packages/{packageId}/remove` | Node token | Remove a supported host package. |
| GET  | `/api/system/version-status` | Node token | Compare installed version with upstream (GitHub latest). |
| POST  | `/api/system/self-update` | Node token | Download and replace the running FeatherQuilld binary. |
| GET  | `/api/system/logs` | Node token | List daemon log files (latest.log and archived \*.log.gz). |
| GET  | `/api/system/logs/{fileName}` | Node token | Tail lines from a daemon log file. |

### Transfers

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/transfers/{uuid:guid}/status` | Node token | Transfer progress for a WebSpace UUID (outgoing or incoming). |
| POST  | `/api/transfers` | Node token | Accept a gzipped tar archive (raw body or multipart field archive). Headers: X-WebSpace-Uuid, optional X-Start-On-Completion=1. |

### WebSpace Files

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/webspaces/{uuid:guid}/files/capabilities` | Node token | List files and directories under a path. |
| GET  | `/api/webspaces/{uuid:guid}/files/list` | Node token | List files and directories under a path. |
| GET  | `/api/webspaces/{uuid:guid}/files/contents` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/write` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/create-directory` | Node token |  |
| PUT  | `/api/webspaces/{uuid:guid}/files/rename` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/copy` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/copy-many` | Node token | Copy multiple files into a destination directory. |
| POST  | `/api/webspaces/{uuid:guid}/files/create-symlink` | Node token | Create a symbolic link within the WebSpace filesystem. |
| GET  | `/api/webspaces/{uuid:guid}/files/fingerprints` | Node token | Compute content fingerprints (hashes) for selected files. |
| POST  | `/api/webspaces/{uuid:guid}/files/delete` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/trash` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/trash/restore` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/trash/delete` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/trash/empty` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/download` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/upload` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/compress` | Node token | Compress selected paths into an archive. |
| POST  | `/api/webspaces/{uuid:guid}/files/decompress` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/chmod` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/search` | Node token | Search file names under a directory. |
| POST  | `/api/webspaces/{uuid:guid}/files/pull` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/pull-jobs` | Node token |  |
| DELETE  | `/api/webspaces/{uuid:guid}/files/pull-jobs/{identifier}` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/download-directory` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/archive-list` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/extract-archive-selection` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/files/search-advanced` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/wipe` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/files/upload-signed` | None / own check |  |

### WebSpace Schedules

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| POST  | `/api/webspaces/{uuid}/schedules/sync` | Node token | Pull schedule definitions from the panel and apply them locally. |
| POST  | `/api/webspaces/{uuid}/schedules/{scheduleId:int}/trigger` | Node token | Trigger a schedule task immediately. |
| POST  | `/api/webspaces/{uuid}/schedules/abort` | Node token | Abort a running scheduled task for this WebSpace. |

### WebSpaces

| Method | Path | Auth | Description |
| --- | --- | --- | --- |
| GET  | `/api/webspaces` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/status` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/logs` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/proxy-logs` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/proxy-logs/rotate` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/exec` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/logs/install` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/ssl` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/ssl/renew` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/redis` | Node token |  |
| PUT  | `/api/webspaces/{uuid:guid}/redis` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/ssl/custom` | Node token |  |
| PUT  | `/api/webspaces/{uuid:guid}/ssl/custom` | Node token |  |
| DELETE  | `/api/webspaces/{uuid:guid}/ssl/custom` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/ws` | None / own check | Interactive console WebSocket. Browser clients auth via first message {"event":"auth","args":\["<jwt>"\]}; panel proxies may pass node bearer via Authorization / ?token= and skip the JWT event. After auth, clients may send {"event":"send command","args":\["<line>"\]}. |
| POST  | `/api/webspaces` | Node token | Panel create body: { "uuid": "...", "start\_on\_completion": false, "skip\_scripts": false }. |
| POST  | `/api/webspaces/{uuid:guid}/power` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/reinstall` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/install/abort` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/sync` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/recreate-runtime` | Node token |  |
| GET  | `/api/webspaces/{uuid:guid}/backups` | Node token | List backups for a WebSpace. |
| POST  | `/api/webspaces/{uuid:guid}/backup` | Node token | Create a backup (sync or async job). |
| GET  | `/api/webspaces/{uuid:guid}/backups/jobs/{jobId:guid}` | Node token | Get status of an async backup/restore job. |
| GET  | `/api/webspaces/{uuid:guid}/utilization` | Node token |  |
| POST  | `/api/webspaces/{uuid:guid}/bandwidth/reset` | Node token |  |
| DELETE  | `/api/webspaces/{uuid:guid}/backups/{backupUuid:guid}` | Node token | Delete a backup archive. |
| GET  | `/api/webspaces/{uuid:guid}/backups/{backupUuid:guid}/download` | Node token | Download a backup archive as gzip. |
| GET  | `/api/webspaces/{uuid:guid}/backups/{backupUuid:guid}/files` | Node token | List files inside a backup archive (immediate children of directory). |
| POST  | `/api/webspaces/{uuid:guid}/backups/{backupUuid:guid}/restore` | Node token | Restore a backup into the WebSpace filesystem. |
| POST  | `/api/webspaces/{uuid:guid}/backups/import` | Node token | Import an uploaded tar.gz archive as a new backup. |
| POST  | `/api/webspaces/{uuid:guid}/backups/reconcile` | Node token | Rebuild local sidecar backup index from the remote provider (restic/PBS). |
| GET  | `/api/webspaces/malware-scan/probe` | Node token | ClamAV availability on this node. |
| GET  | `/api/webspaces/{uuid:guid}/malware-scan/last` | Node token | Last malware scan result for a WebSpace. |
| POST  | `/api/webspaces/{uuid:guid}/malware-scan` | Node token | Run a filesystem malware scan (async job). |
| GET  | `/api/webspaces/{uuid:guid}/malware-scan/jobs/{jobId:guid}` | Node token | Get status of an async malware scan job. |
| POST  | `/api/webspaces/{uuid:guid}/transfer` | Node token | Outgoing transfer to another Quilld node. |
| DELETE  | `/api/webspaces/{uuid:guid}` | Node token |  |