Supervisor, plugins & misc endpoints

Root

Method	Path	Role	Description
GET	/info	any app	System overview
POST	/reload_updates	admin (v2: manager)	Refresh updater information
POST	/refresh_updates	manager	Refresh updater and store (v1 only, discouraged)
GET	/available_updates	manager	Pending updates (v1 only)

GET /supervisor/available_updates is a deprecated alias of /available_updates.

GET /info response data: supervisor, apexos (Core version), apexos_os, docker, hostname, operating_system, features, machine, machine_id, arch, state, supported_arch, supported, channel, logging, timezone. /info is a token-bypass path — every installed app may call it.

GET /available_updates response data: available_updates — entries with update_type (core | supervisor | os | addon), panel_path, version_latest, plus name/icon for apps.

Supervisor

Method	Path	Role	Description
GET	/supervisor/ping	none	Liveness check (no auth)
GET	/supervisor/info	default	Supervisor details
GET	/supervisor/stats	manager	Container resource statistics
POST	/supervisor/update	manager	Update the Supervisor
POST	/supervisor/reload	manager	Reload updater, secrets, and evaluations
POST	/supervisor/restart	manager	Soft-restart the Supervisor
POST	/supervisor/options	manager	Change Supervisor settings
POST	/supervisor/repair	manager	Repair the local container setup
GET	/supervisor/logs[...]	manager	Journal logs — same sub-paths as core logs (/follow, /latest, /boots/{bootid}, /boots/{bootid}/follow); falls back to container logs if the journal gateway is unavailable

GET /supervisor/info response data: version, version_latest, update_available, channel, arch, supported, healthy, ip_address, timezone, logging, debug, debug_block, diagnostics, auto_update, detect_blocking_io, country, feature_flags, wait_boot (deprecated), addons (installed apps: name, slug, version, version_latest, update_available, state, repository, icon), addons_repositories (name, slug).

POST /supervisor/options fields (all optional): channel (stable|beta|dev), addons_repositories (list, deprecated), timezone (string), wait_boot (deprecated), logging (debug|info|warning|error|critical), debug (bool), debug_block (bool), diagnostics (bool), auto_update (bool), detect_blocking_io (off|on|on-at-startup), country (string), feature_flags (map of flag name to bool; currently supervisor_v2_api).

POST /supervisor/update fields: version (version tag; only honored in dev channel — otherwise the updater's version is used, and the call fails when no update is available).

Jobs

Method	Path	Role	Description
GET	/jobs/info	manager	Job tree and ignored conditions
POST	/jobs/options	manager	Set ignore_conditions (list of job conditions)
POST	/jobs/reset	manager	Reset job manager options
GET	/jobs/{uuid}	manager	Single job subtree
DELETE	/jobs/{uuid}	manager	Remove a completed job (errors if not done)

GET /jobs/info response data: ignore_conditions and jobs — a tree of job objects (newest roots first) each carrying child_jobs; internal jobs are hidden and parent_id is stripped.

Resolution center

Method	Path	Role	Description
GET	/resolution/info	manager	Issues, suggestions, checks, health flags
POST	/resolution/check/{check}/options	manager	Enable/disable a check (enabled bool)
POST	/resolution/check/{check}/run	manager	Run a check now
POST	/resolution/suggestion/{suggestion}	manager	Apply a suggestion
DELETE	/resolution/suggestion/{suggestion}	manager	Dismiss a suggestion
DELETE	/resolution/issue/{issue}	manager	Dismiss an issue
GET	/resolution/issue/{issue}/suggestions	manager	Suggestions fixing an issue
POST	/resolution/healthcheck	manager	Run backend healthcheck

GET /resolution/info response data: unsupported, unhealthy, suggestions (each with an auto flag when an automatic fix exists), issues, checks (enabled, slug).

Mounts

Method	Path	Role	Description
GET	/mounts	manager	Mounts and default backup mount
POST	/mounts/options	manager	Set default_backup_mount (name or null)
POST	/mounts	manager	Create a mount
PUT	/mounts/{mount}	manager	Replace a mount's configuration
DELETE	/mounts/{mount}	manager	Remove a mount
POST	/mounts/{mount}/reload	manager	Remount

Mount configuration body (create/update):

Field	Type	Required	Notes
name	string [A-Za-z0-9_]+	yes	Immutable on update
type	"cifs" | "nfs"	yes
usage	string	yes	e.g. backup, media, share; backup mounts cannot be read-only
read_only	boolean	no (default false)
server	string	yes
port	int (port)	no
share	string	CIFS
username / password	string	CIFS, optional (paired)
version	string | null	CIFS, optional	CIFS protocol version
path	string	NFS

GET /mounts response entries add state and user_path to the stored configuration.

Audio plugin

Method	Path	Role	Description
GET	/audio/info	default	Plugin version and sound topology (host, audio.card/input/output/application)
GET	/audio/stats	manager	Container resource statistics
POST	/audio/update	manager	Update plugin (version optional)
POST	/audio/restart	manager	Restart plugin
POST	/audio/reload	manager	Re-read sound state
POST	/audio/profile	manager	Activate a card profile — body: card (string), name (string)
POST	/audio/volume/{source}	manager	Set volume — body: index (int), volume (float)
POST	/audio/volume/{source}/application	manager	Same, for an application stream
POST	/audio/mute/{source}	manager	Mute — body: index (int), active (bool)
POST	/audio/mute/{source}/application	manager	Same, for an application stream
POST	/audio/default/{source}	manager	Set default stream — body: name (string)
GET	/audio/logs[...]	manager	Journal logs (same sub-paths as core logs)

{source} is the stream type (input or output).

DNS plugin

Method	Path	Role	Description
GET	/dns/info	default	version, version_latest, update_available, host, servers, locals, mdns, llmnr, fallback
GET	/dns/stats	manager	Container resource statistics
POST	/dns/update	manager	Update plugin (version optional)
POST	/dns/options	manager	servers (DNS server list), fallback (bool); changes trigger a restart
POST	/dns/restart	manager	Restart plugin
POST	/dns/reset	manager	Reset plugin configuration
GET	/dns/logs[...]	manager	Journal logs (same sub-paths as core logs)

CLI plugin

Method	Path	Role	Description
GET	/cli/info	default	version, version_latest, update_available
GET	/cli/stats	manager	Container resource statistics
POST	/cli/update	manager	Update plugin (version optional)

Observer plugin

Method	Path	Role	Description
GET	/observer/info	default	host, version, version_latest, update_available
GET	/observer/stats	manager	Container resource statistics
POST	/observer/update	manager	Update plugin (version optional)

Multicast plugin

Method	Path	Role	Description
GET	/multicast/info	default	version, version_latest, update_available
GET	/multicast/stats	manager	Container resource statistics
POST	/multicast/update	manager	Update plugin (version optional)
POST	/multicast/restart	manager	Restart plugin
GET	/multicast/logs[...]	manager	Journal logs (same sub-paths as core logs)

Hardware

Method	Path	Role	Description
GET	/hardware/info	default	devices (name, sysfs, dev_path, subsystem, by_id, attributes, children) and drives (vendor, model, revision, serial, id, size, time_detected, connection_bus, seat, removable, ejectable, filesystems)
GET	/hardware/audio	manager	Sound input/output profile maps

Docker

Method	Path	Role	Description
GET	/docker/info	default	version, enable_ipv6, mtu, storage, logging, registries (usernames only)
POST	/docker/options	manager	enable_ipv6 (bool | null), mtu (int 68–65535 | null); changes create a reboot-required issue
POST	/docker/migrate-storage-driver	manager	storage_driver (only "overlayfs"); requires a recent OS, creates a reboot-required issue
GET	/docker/registries	manager	Configured registries
POST	/docker/registries	manager	Add registries — body: { "<hostname>": {"username": "...", "password": "..."} }
DELETE	/docker/registries/{hostname}	manager	Remove a registry

Security

Method	Path	Role	Description
GET	/security/info	default	pwned, force_security
POST	/security/options	manager	pwned (bool), force_security (bool)
POST	/security/integrity	manager	Always returns an error — the integrity-check feature has been removed (HTTP 410 semantics)

Services

Token-bypass paths — any installed app may call them; per-service roles from the app's configuration are enforced in the handler (write/delete require the provider role).

Method	Path	Description
GET	/services	List services: slug, available, providers
GET	/services/{service}	Read service data (v1 key addon, v2 key app)
POST	/services/{service}	Publish service data (validated per-service schema)
DELETE	/services/{service}	Remove the calling app's service data

Discovery

Token-bypass paths with handler-level restrictions: all reads (GET) are restricted to ApexOS Core; POST requires the calling app to declare the service in its config; DELETE only works on the app's own messages.

Method	Path	Caller	Description
GET	/discovery	core	Messages for started apps plus available services (v1 key addon, v2 key app)
POST	/discovery	app	Send a message — body: service (string, required), config (dict, required); returns {"uuid": "..."}
GET	/discovery/{uuid}	core	Read one message
DELETE	/discovery/{uuid}	owning app	Remove a message

Auth

/auth is a token-bypass path; the handler additionally requires the calling app to have auth-API access. /auth/reset and /auth/list require admin; /auth/cache requires manager.

Method	Path	Role	Description
GET/POST	/auth	app with auth API	Validate user credentials via Basic auth header, JSON body (username/user + password), or form-encoded body
POST	/auth/reset	admin	Change a user's password — body: username, password (both required)
DELETE	/auth/cache	manager	Clear the credential cache
GET	/auth/list	admin	Users: username, name, is_owner, is_active, local_only, group_ids

Ingress

Method	Path	Caller	Description
POST	/ingress/session	core only	Create a session — optional body user_id; returns {"session": "..."}
POST	/ingress/validate_session	core only	Validate/extend a session — body: session
GET	/ingress/panels	manager	Panel metadata per app: title, icon, admin, enable
ANY	/ingress/{token}/{path}	session cookie	Proxy into the app's web UI (HTTP and WebSocket); authenticated by the ingress_session cookie, not by bearer token

The ingress proxy injects remote-user headers from the session data and updates X-Forwarded-For; the Supervisor token header is stripped before forwarding.