App endpoints

Apps (the fork's name for add-ons — the Supervisor module is apps) are managed under the v1 prefix /addons and the v2 prefix /apps. Both prefixes are served by the same handlers; only the list-payload key differs (addons on v1, apps on v2). This page uses the v1 paths.

The path parameter {app} is an app slug. The special slug self refers to the calling app itself, and most self endpoints are token-bypass paths usable by any installed app (see overview).

Minimum role: manager for everything under /addons, with two exceptions: POST /addons/{app}/security requires admin, and POST /addons/{app}/sys_options is callable only by ApexOS Core. GET /addons/{app}/info is also readable via the info-path rule by any role.

Method	Path	Role	Description
GET	/addons	default¹	List installed apps
GET	/addons/{app}/info	default	App details (store fallback for not-installed apps)
POST	/addons/{app}/uninstall	manager	Uninstall app
POST	/addons/{app}/start	manager	Start app
POST	/addons/{app}/stop	manager	Stop app
POST	/addons/{app}/restart	manager	Restart app
POST	/addons/{app}/options	manager	Set user options
POST	/addons/{app}/sys_options	core only	Set system-managed flags
POST	/addons/{app}/options/validate	manager	Validate an options payload
GET	/addons/{app}/options/config	self only	Validated options of the calling app
POST	/addons/{app}/rebuild	manager	Rebuild a locally-built app
POST	/addons/{app}/stdin	manager	Write raw bytes to the app's stdin
POST	/addons/{app}/security	admin	Toggle the protected flag
GET	/addons/{app}/stats	manager	Container resource statistics
GET	/addons/{app}/logs	manager	Journal logs (text/plain)
GET	/addons/{app}/logs/follow	manager	Streamed logs
GET	/addons/{app}/logs/latest	manager	Logs since last container start
GET	/addons/{app}/logs/boots/{bootid}	manager	Logs for a specific boot
GET	/addons/{app}/logs/boots/{bootid}/follow	manager	Streamed logs for a boot

¹ GET /addons is not an info path; in practice listing requires manager unless called via /addons/self/... bypass semantics. The /info sub-paths follow the info rule.

Store-related legacy routes registered under /addons (/addons/reload, /addons/{app}/install, /addons/{app}/update, icon/logo/changelog/documentation) are documented with the store endpoints.

GET /addons

Response data: {"addons": [...]} (v2: {"apps": [...]}). Each entry: name, slug, description, advanced (deprecated), stage, version, version_latest, update_available, available, detached, apexos (minimum Core version), state, repository, build, url, icon, logo, system_managed.

GET /addons/{app}/info

Response data keys: name, slug, hostname, dns, description, long_description, advanced (deprecated), stage, repository, version_latest, protected, rating, boot_config, boot, options, schema, arch, machine, apexos, url, detached, available, build, network, network_description, host_network, host_pid, host_ipc, host_uts, host_dbus, privileged, full_access, apparmor, icon, logo, changelog, documentation, stdin, supervisor_api, supervisor_role, auth_api, apexos_api, gpio, usb, uart, kernel_modules, devicetree, udev, docker_api, video, audio, startup, services, discovery, translations, ingress, signed, state, webui, ingress_entry, ingress_url, ingress_port, ingress_panel, audio_input, audio_output, auto_update, ip_address, version, update_available, watchdog, devices, system_managed, system_managed_config_entry.

options is redacted to {} when a different app with a role below manager reads another app's info (options may contain secrets). If the app is known in the store but not installed, the store info is returned with state: "unknown" and the store defaults as options.

POST /addons/{app}/options

All fields optional; null resets a field to its default:

Field	Type	Description
boot	"auto" | "manual"	Boot mode (rejected if the app pins manual_only)
network	dict | null	Docker port mappings
auto_update	boolean	Enable auto-update
audio_output	string | null	Audio output device
audio_input	string | null	Audio input device
ingress_panel	boolean	Show ingress panel entry
watchdog	boolean	Enable watchdog
options	dict | null	App configuration (validated against the app's schema)

POST /addons/{app}/sys_options (core only)

Field	Type
system_managed	boolean
system_managed_config_entry	string | null

POST /addons/{app}/options/validate

Body: an options object to validate (or empty to validate the currently stored options). Response data: message (string), valid (boolean), pwned (boolean or null). When pwned-secret enforcement is active, options containing compromised secrets are reported invalid.

GET /addons/{app}/options/config

Only callable with the literal slug self; returns the calling app's validated options object.

POST /addons/{app}/security (admin)

Field	Type	Description
protected	boolean	Toggle the protection flag

POST /addons/{app}/uninstall

Field	Type	Default	Description
remove_config	boolean	false	Also delete the app's config folder

POST /addons/{app}/rebuild

Field	Type	Default
force	boolean	false

POST /addons/{app}/stdin

Raw request body is forwarded to the app's stdin. Fails unless the app declares stdin support.

GET /addons/{app}/stats

Response data keys: cpu_percent, memory_usage, memory_limit, memory_percent, network_rx, network_tx, blk_read, blk_write.

Logs

Log routes return text/plain and match the app's journal identifiers (addon_{slug} and app_{slug}). The query options described for core logs apply.