# NAS - X-Radius API > Base URL: https://x-radius.com/api/v1 > Auth: Authorization: Bearer xrt_... (a manager API token) > Envelope: {"data": ...}; lists add {"meta":{page,page_size,total,has_next}} > Errors: {"error":{"code","message","request_id"}} - branch on code, never on message > Timestamps: yyyy-MM-dd HH:mm:ss, UTC > Money: a bare JSON number in major units, with an ISO-4217 currency code beside it > Idempotency: redeem and activate endpoints take a client-supplied request_id (UUID) > > This page: https://x-radius.com/docs/api/nas > Every group: https://x-radius.com/llms.txt 69 endpoints in 1 resource groups. 12 carry a hand-written reference entry with examples; the remaining 57 are generated from the running router and carry method, path, authentication, permission and rate-limit bucket, but no request or response example. ### List NAS devices `GET /api/v1/admin/nas` Every NAS registered to the caller's tenant, with its reachability cache and the count of sessions currently on it. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read #### Response — 200 OK ```json { "data": [ { "id": 3, "tenant_id": 12, "nas_identifier": "cairo-edge-1", "nas_ip": "10.20.0.1", "description": "Nasr City edge", "vendor": "mikrotik", "model": "CCR2004", "coa_port": 3799, "ssh_port": 22, "winbox_port": 8291, "ip_accounting_enabled": true, "ping_status": "up", "last_ping_at": "2026-09-20 09:07:30", "last_rtt_ms": 4.2, "online_users": 118, "ping_fail_count": 0, "wg_enabled": true, "tunnel_transport": "wireguard", "active_tunnel_ip": "10.8.0.14", "zerologin_enabled": true, "needs_onboarding": false, "created_at": "2026-04-11 10:02:00" } ] } ``` #### Note Un-paginated, and there is no meta block at all. Do not write a paging loop against it. ping_status is a cached verdict from the background sweep, not a probe performed by your request — it is 'unknown' until the first sweep classifies the device. ### Register a NAS `POST /api/v1/admin/nas` Creates the device record and its RADIUS shared secret. At least one of nas_identifier, nas_ip and called_station_id must be present — that is what an incoming RADIUS packet will be matched on. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_create` (Add NAS) - Risk: write - Rate limit bucket: `t_mutate` #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `shared_secret` | body | string | yes | The RADIUS shared secret. Required. | | `nas_identifier` | body | string | no | NAS-Identifier. Unique across the whole platform. | | `nas_ip` | body | string | no | NAS-IP-Address. Unique across the whole platform. | | `called_station_id` | body | string | no | Called-Station-Id. Unique across the whole platform. | | `vendor` | body | string | no | Device vendor. Validated against the known-vendor catalogue. | | `coa_port` | body | integer | no | RFC 5176 port. Omit for the schema default of 3799. | | `ip_accounting_enabled` | body | boolean | no | Defaults to true when omitted. An explicit false is honoured. | #### Request ```json { "nas_identifier": "cairo-edge-2", "nas_ip": "10.20.0.2", "shared_secret": "a-long-random-secret", "description": "Nasr City edge 2", "vendor": "mikrotik", "coa_port": 3799 } ``` #### Errors | Code | Status | When | | --- | --- | --- | | `ERR_VALIDATION` | 400 | shared_secret missing, no identity field supplied, or an unknown vendor | | `ERR_CONFLICT` | 409 | the nas_ip, nas_identifier or called_station_id is already registered — possibly by another tenant | #### Note A 409 here can be caused by a device belonging to a tenant you cannot see. The three identity columns are globally unique because RADIUS resolves on the bare key before any tenant is known, so "already taken" does not mean "already in your list". ### Edit NAS `POST /api/v1/admin/nas/bulk-apply-hotspot` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/bulk-apply-parental` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Delete NAS `POST /api/v1/admin/nas/bulk-delete` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_delete` (Delete NAS) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/bulk-enable-zerologin` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### List supported NAS vendors and models `GET /api/v1/admin/nas/catalog` The vendor and model catalogue the create and update endpoints validate against. Static data, safe to cache. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read ### View LAN devices `GET /api/v1/admin/nas/device-groups` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_devices_index` (View LAN devices) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `POST /api/v1/admin/nas/device-groups` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `POST /api/v1/admin/nas/device-groups/bulk-delete` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `DELETE /api/v1/admin/nas/device-groups/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `PATCH /api/v1/admin/nas/device-groups/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `GET /api/v1/admin/nas/device-groups/{id}/managers` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Manage LAN device groups & manager access `PUT /api/v1/admin/nas/device-groups/{id}/managers` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_device_groups` (Manage LAN device groups & manager access) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### View LAN devices `GET /api/v1/admin/nas/devices` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_devices_index` (View LAN devices) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/devices/bulk-delete` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/devices/bulk-group` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `DELETE /api/v1/admin/nas/devices/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `PATCH /api/v1/admin/nas/devices/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Remote console to a LAN device `POST /api/v1/admin/nas/devices/{id}/console` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_devices_remote` (Remote console to a LAN device) - Risk: danger - Rate limit bucket: `t_probe` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Delete NAS `POST /api/v1/admin/nas/management-credentials/bulk-delete` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_delete` (Delete NAS) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Delete NAS `DELETE /api/v1/admin/nas/management-credentials/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_delete` (Delete NAS) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### View NAS `GET /api/v1/admin/nas/management-credentials/{id}` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/management-credentials/{id}/rotate` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Add NAS `POST /api/v1/admin/nas/onboard` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_create` (Add NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Ping every NAS `GET /api/v1/admin/nas/ping` Probes all of the tenant's devices from the platform and reports reachability. An operator action. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read - Rate limit bucket: `t_probe` #### Note On the per-tenant probe budget — 10 a minute on a standard licence, shared with every other probe endpoint. For continuous reachability, read ping_status off the NAS list instead: the background sweep maintains it for free. ### GET /api/v1/admin/nas/vpn/peers `GET /api/v1/admin/nas/vpn/peers` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### POST /api/v1/admin/nas/vpn/peers/bulk-delete `POST /api/v1/admin/nas/vpn/peers/bulk-delete` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### All VPN accounts (tenant-wide, incl. reassign) `POST /api/v1/admin/nas/vpn/peers/bulk-reassign` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn_peers_all` (All VPN accounts (tenant-wide, incl. reassign)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### DELETE /api/v1/admin/nas/vpn/peers/{peerID} `DELETE /api/v1/admin/nas/vpn/peers/{peerID}` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### GET /api/v1/admin/nas/vpn/peers/{peerID}/credentials `GET /api/v1/admin/nas/vpn/peers/{peerID}/credentials` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### GET /api/v1/admin/nas/vpn/peers/{peerID}/history `GET /api/v1/admin/nas/vpn/peers/{peerID}/history` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### All VPN accounts (tenant-wide, incl. reassign) `POST /api/v1/admin/nas/vpn/peers/{peerID}/reassign` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn_peers_all` (All VPN accounts (tenant-wide, incl. reassign)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### POST /api/v1/admin/nas/vpn/peers/{peerID}/rotate `POST /api/v1/admin/nas/vpn/peers/{peerID}/rotate` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### GET /api/v1/admin/nas/vpn/servers `GET /api/v1/admin/nas/vpn/servers` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Delete a NAS `DELETE /api/v1/admin/nas/{id}` Removes the device record. Sessions already open on it are not affected. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_delete` (Delete NAS) - Risk: danger - Rate limit bucket: `t_mutate` #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | ### Fetch one NAS `GET /api/v1/admin/nas/{id}` The full device record, including tunnel and operator-VPN configuration. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | #### Errors | Code | Status | When | | --- | --- | --- | | `ERR_NOT_FOUND` | 404 | no such NAS in this tenant | #### Note Read tunnel_transport to decide how to render a device, never "whichever tunnel IP is non-null". A NAS keeps its standby allocations after switching transport, so more than one of wg_tunnel_ip, ovpn_tunnel_ip and sstp_tunnel_ip is set on any device that ever changed. active_tunnel_ip is the database's own resolution of that question. ### Update a NAS `PATCH /api/v1/admin/nas/{id}` Partial update; an omitted field is left alone. The shared secret is not editable here — rotating it has its own endpoint, because it must be pushed to the device in step with the change. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | #### Errors | Code | Status | When | | --- | --- | --- | | `ERR_CONFLICT` | 409 | an identity field would clash with another device, anywhere on the platform | ### Edit NAS `POST /api/v1/admin/nas/{id}/apply-hotspot` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/{id}/apply-parental` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Remote console (WebFig/SSH/Winbox) to a NAS router `POST /api/v1/admin/nas/{id}/console` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_remote` (Remote console (WebFig/SSH/Winbox) to a NAS router) - Risk: danger - Rate limit bucket: `t_probe` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### List devices behind a NAS `GET /api/v1/admin/nas/{id}/devices` Customer-premises and infrastructure devices discovered or registered under this NAS, as the monitoring and topology views see them. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_devices_index` (View LAN devices) - Risk: read #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | ### Edit NAS `POST /api/v1/admin/nas/{id}/devices` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/{id}/enable-zerologin` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### View NAS `GET /api/v1/admin/nas/{id}/hotspot-preflight` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### View NAS `GET /api/v1/admin/nas/{id}/management-credentials` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Add NAS `POST /api/v1/admin/nas/{id}/management-credentials` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_create` (Add NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `GET /api/v1/admin/nas/{id}/management-script` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Render the onboarding script for a NAS `GET /api/v1/admin/nas/{id}/onboarding-script` Returns the RouterOS script that configures the device to talk to this platform: RADIUS client, accounting, the management tunnel and the captive portal redirect. Rendered for this specific device. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | #### Note The script contains the device's shared secret and tunnel credentials in the clear, because the router needs them. Treat the response as a secret, and do not log it. ### View NAS `GET /api/v1/admin/nas/{id}/parental-script` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### View NAS `GET /api/v1/admin/nas/{id}/ping-history` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_index` (View NAS) - Risk: read _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/{id}/provision-tunnel` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/{id}/revert-hotspot` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Rotate a NAS shared secret `POST /api/v1/admin/nas/{id}/rotate-secret` Issues a new shared secret for the device. The router must be updated to match, or it stops authenticating — this endpoint changes the platform side only. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | #### Note There is no overlap window. From the moment this returns, RADIUS packets signed with the old secret are rejected. Push the new secret to the device in the same maintenance step. ### View LAN devices `POST /api/v1/admin/nas/{id}/scan` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_devices_index` (View LAN devices) - Risk: read - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Reveal a NAS shared secret `GET /api/v1/admin/nas/{id}/shared-secret` Returns the device's RADIUS shared secret in the clear, for an operator re-entering it on the router. Gated on the NAS update permission rather than the read one, because seeing it is equivalent to being able to change it. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | ### Test a NAS connection `POST /api/v1/admin/nas/{id}/test` Checks that the platform can reach the device's management interface. - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_probe` #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `id` | path | integer | yes | NAS id. | ### Edit NAS `POST /api/v1/admin/nas/{id}/test-ssh` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_probe` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Edit NAS `POST /api/v1/admin/nas/{id}/transport` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_update` (Edit NAS) - Risk: write - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `GET /api/v1/admin/nas/{id}/vpn` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `PATCH /api/v1/admin/nas/{id}/vpn` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `POST /api/v1/admin/nas/{id}/vpn/disable` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `POST /api/v1/admin/nas/{id}/vpn/enable` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `GET /api/v1/admin/nas/{id}/vpn/history` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### POST /api/v1/admin/nas/{id}/vpn/peers `POST /api/v1/admin/nas/{id}/vpn/peers` - Authentication: manager session (JWT) or API token - Permission: any one of `prm_nas_vpn_peers_own`, `prm_nas_vpn_peers_all` - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### All VPN accounts (tenant-wide, incl. reassign) `GET /api/v1/admin/nas/{id}/vpn/script` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn_peers_all` (All VPN accounts (tenant-wide, incl. reassign)) - Risk: danger _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### Operator VPN access to NAS (issue/revoke VPN configs) `POST /api/v1/admin/nas/{id}/vpn/zerotier/install-package` - Authentication: manager session (JWT) or API token - Permission: `prm_nas_vpn` (Operator VPN access to NAS (issue/revoke VPN configs)) - Risk: danger - Rate limit bucket: `t_mutate` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### GET /api/v1/nas/hotspot-asset `GET /api/v1/nas/hotspot-asset` - Authentication: none - Rate limit bucket: `nas_provision` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._ ### GET /api/v1/nas/provision `GET /api/v1/nas/provision` - Authentication: none - Rate limit bucket: `nas_provision` _This endpoint has no hand-written reference entry yet. The method, path, authentication, permission and rate limit above are generated from the running router and are accurate; there is no request or response example._