PLUSInsights Plus

API Reference

All REST API endpoints served on port 8090.

Supported Version3.3.0
OpenAPI Spec

Breaking Change

Authentication was introduced in version 3.3.0. If you are upgrading from an earlier version, any existing API integrations must be updated to include a bearer token.

Authentication

When authentication is enabled, most API endpoints require a valid session cookie or a bearer token in the Authorization header. Tokens are created in Settings → API.

Endpoints marked PUBLIC in the table below do not require authentication. These include the health check, authentication flow, and initial setup endpoints.

Example: Authenticated Request

Terminal
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://your-host:8090/api/logs

Endpoints

GET
/api/logs

Paginated log list with all filters (prefix any filter with ! to negate)

GET
/api/logs/aggregate

Aggregate logs by dimension with CIDR grouping and HAVING thresholds

GET
/api/logs/{id}

Single log detail with threat data

GET
/api/stats

Dashboard aggregations (pass ?time_range=24h)

GET
/api/export

CSV export with current filters (up to 100K rows)

GET
/api/healthPUBLIC

Health check with total count and latest timestamp

GET
/api/auth/statusPUBLIC

Current authentication state (logged in, auth enabled, setup complete)

POST
/api/auth/loginPUBLIC

Authenticate with username and password

POST
/api/auth/logoutPUBLIC

End the current session

POST
/api/auth/setupPUBLIC

Create the first admin account (one-time)

GET
/api/setup/statusPUBLIC

Whether initial setup has been completed

GET
/api/services

Distinct service names for filter dropdown

GET
/api/protocols

Distinct protocols seen in logs

GET
/api/interfaces

Distinct interfaces seen in logs

GET
/api/config

Current system configuration (WAN, labels, setup status)

POST
/api/setup/complete

Save wizard configuration

GET
/api/setup/wan-candidates

Auto-detected WAN interface candidates

GET
/api/setup/network-segments

Discovered network segments with suggested labels

POST
/api/enrich/{ip}

Force fresh AbuseIPDB lookup for an IP

GET
/api/settings/unifi

Current UniFi API settings

PUT
/api/settings/unifi

Update UniFi API settings

POST
/api/settings/unifi/test

Test UniFi connection and save on success

GET
/api/settings/ui

Current UI display preferences

PUT
/api/settings/ui

Update UI display preferences

GET
/api/firewall/policies

All firewall policies with zone data

PATCH
/api/firewall/policies/{id}

Toggle syslog on a firewall policy

POST
/api/firewall/policies/bulk-logging

Bulk-toggle syslog on multiple policies

GET
/api/unifi/clients

Cached UniFi client list

GET
/api/unifi/devices

Cached UniFi infrastructure devices

GET
/api/unifi/status

UniFi polling status

GET
/api/config/export

Export all settings as JSON

POST
/api/config/import

Import settings from JSON backup

POST
/api/config/vpn-networks

Save VPN network configuration

GET
/api/config/retention

Current retention configuration

POST
/api/config/retention

Update retention settings

POST
/api/config/retention/cleanup

Run retention cleanup immediately

GET
/api/threats

Threat intelligence cache with IP/date filters

GET
/api/threats/geo

Geo-aggregated threat data for Threat Map (GeoJSON)

POST
/api/logs/batch

Fetch multiple logs by ID (max 50)

POST
/api/mcp

MCP JSON-RPC endpoint (bearer token required)

GET
/api/mcp

MCP SSE streaming endpoint (bearer token required)

GET
/api/settings/mcp

MCP server settings

PUT
/api/settings/mcp

Update MCP settings

GET
/api/tokens

List API tokens (filter by client_type: mcp, extension, api)

POST
/api/tokens

Create a new API token

DELETE
/api/tokens/{id}

Revoke an API token

GET
/api/settings/mcp/scopes

List available permission scopes

GET
/api/settings/mcp/audit

MCP audit trail with pagination

DNS LoggingUnraid Setup