Public reference

NAS

Every endpoint in this group. Open one for its parameters and a worked example.

69 Endpoints

View as Markdown

NAS

69
GET /api/v1/admin/nas List NAS devices prm_nas_index

Every NAS registered to the caller's tenant, with its reachability cache and the count of sessions currently on it.

Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Un-paginated, and there is no meta block at all. Do not write a paging loop against it. ping_status is a cached verdict from the background sweep, not a probe performed by your request — it is 'unknown' until the first sweep classifies the device.

Response 200 OK
{
  "data": [
    {
      "id": 3,
      "tenant_id": 12,
      "nas_identifier": "cairo-edge-1",
      "nas_ip": "10.20.0.1",
      "description": "Nasr City edge",
      "vendor": "mikrotik",
      "model": "CCR2004",
      "coa_port": 3799,
      "ssh_port": 22,
      "winbox_port": 8291,
      "ip_accounting_enabled": true,
      "ping_status": "up",
      "last_ping_at": "2026-09-20 09:07:30",
      "last_rtt_ms": 4.2,
      "online_users": 118,
      "ping_fail_count": 0,
      "wg_enabled": true,
      "tunnel_transport": "wireguard",
      "active_tunnel_ip": "10.8.0.14",
      "zerologin_enabled": true,
      "needs_onboarding": false,
      "created_at": "2026-04-11 10:02:00"
    }
  ]
}
POST /api/v1/admin/nas Register a NAS prm_nas_create

Creates the device record and its RADIUS shared secret. At least one of nas_identifier, nas_ip and called_station_id must be present — that is what an incoming RADIUS packet will be matched on.

Authentication
Staff token or session
Requires permission
prm_nas_create Add NAS
Rate limit
t_mutate

A 409 here can be caused by a device belonging to a tenant you cannot see. The three identity columns are globally unique because RADIUS resolves on the bare key before any tenant is known, so "already taken" does not mean "already in your list".

Parameters

Parameter Description
shared_secretrequired body · string The RADIUS shared secret. Required.
nas_identifier body · string NAS-Identifier. Unique across the whole platform.
nas_ip body · string NAS-IP-Address. Unique across the whole platform.
called_station_id body · string Called-Station-Id. Unique across the whole platform.
vendor body · string Device vendor. Validated against the known-vendor catalogue.
coa_port body · integer RFC 5176 port. Omit for the schema default of 3799.
ip_accounting_enabled body · boolean Defaults to true when omitted. An explicit false is honoured.
POST /api/v1/admin/nas/bulk-apply-hotspot Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/bulk-apply-parental Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/bulk-delete Delete NAS prm_nas_delete
Authentication
Staff token or session
Requires permission
prm_nas_delete Delete NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/bulk-enable-zerologin Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/catalog List supported NAS vendors and models prm_nas_index

The vendor and model catalogue the create and update endpoints validate against. Static data, safe to cache.

Authentication
Staff token or session
Requires permission
prm_nas_index View NAS
GET /api/v1/admin/nas/device-groups View LAN devices prm_nas_devices_index
Authentication
Staff token or session
Requires permission
prm_nas_devices_index View LAN devices

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/device-groups Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/device-groups/bulk-delete Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

DELETE /api/v1/admin/nas/device-groups/{id} Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

PATCH /api/v1/admin/nas/device-groups/{id} Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/device-groups/{id}/managers Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

PUT /api/v1/admin/nas/device-groups/{id}/managers Manage LAN device groups & manager access prm_nas_device_groups
Authentication
Staff token or session
Requires permission
prm_nas_device_groups Manage LAN device groups & manager access
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/devices View LAN devices prm_nas_devices_index
Authentication
Staff token or session
Requires permission
prm_nas_devices_index View LAN devices

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/devices/bulk-delete Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/devices/bulk-group Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

DELETE /api/v1/admin/nas/devices/{id} Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

PATCH /api/v1/admin/nas/devices/{id} Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/devices/{id}/console Remote console to a LAN device prm_nas_devices_remote
Authentication
Staff token or session
Requires permission
prm_nas_devices_remote Remote console to a LAN device
Rate limit
t_probe

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/management-credentials/bulk-delete Delete NAS prm_nas_delete
Authentication
Staff token or session
Requires permission
prm_nas_delete Delete NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

DELETE /api/v1/admin/nas/management-credentials/{id} Delete NAS prm_nas_delete
Authentication
Staff token or session
Requires permission
prm_nas_delete Delete NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/management-credentials/{id} View NAS prm_nas_index
Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/management-credentials/{id}/rotate Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/onboard Add NAS prm_nas_create
Authentication
Staff token or session
Requires permission
prm_nas_create Add NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/ping Ping every NAS prm_nas_index

Probes all of the tenant's devices from the platform and reports reachability. An operator action.

Authentication
Staff token or session
Requires permission
prm_nas_index View NAS
Rate limit
t_probe

On the per-tenant probe budget — 10 a minute on a standard licence, shared with every other probe endpoint. For continuous reachability, read ping_status off the NAS list instead: the background sweep maintains it for free.

GET /api/v1/admin/nas/vpn/peers
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/vpn/peers/bulk-delete
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/vpn/peers/bulk-reassign All VPN accounts (tenant-wide, incl. reassign) prm_nas_vpn_peers_all
Authentication
Staff token or session
Requires permission
prm_nas_vpn_peers_all All VPN accounts (tenant-wide, incl. reassign)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

DELETE /api/v1/admin/nas/vpn/peers/{peerID}
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/vpn/peers/{peerID}/credentials
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/vpn/peers/{peerID}/history
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/vpn/peers/{peerID}/reassign All VPN accounts (tenant-wide, incl. reassign) prm_nas_vpn_peers_all
Authentication
Staff token or session
Requires permission
prm_nas_vpn_peers_all All VPN accounts (tenant-wide, incl. reassign)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/vpn/peers/{peerID}/rotate
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/vpn/servers
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

DELETE /api/v1/admin/nas/{id} Delete a NAS prm_nas_delete

Removes the device record. Sessions already open on it are not affected.

Authentication
Staff token or session
Requires permission
prm_nas_delete Delete NAS
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer NAS id.
GET /api/v1/admin/nas/{id} Fetch one NAS prm_nas_index

The full device record, including tunnel and operator-VPN configuration.

Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read tunnel_transport to decide how to render a device, never "whichever tunnel IP is non-null". A NAS keeps its standby allocations after switching transport, so more than one of wg_tunnel_ip, ovpn_tunnel_ip and sstp_tunnel_ip is set on any device that ever changed. active_tunnel_ip is the database's own resolution of that question.

Parameters

Parameter Description
idrequired path · integer NAS id.
PATCH /api/v1/admin/nas/{id} Update a NAS prm_nas_update

Partial update; an omitted field is left alone. The shared secret is not editable here — rotating it has its own endpoint, because it must be pushed to the device in step with the change.

Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer NAS id.
POST /api/v1/admin/nas/{id}/apply-hotspot Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/apply-parental Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/console Remote console (WebFig/SSH/Winbox) to a NAS router prm_nas_remote
Authentication
Staff token or session
Requires permission
prm_nas_remote Remote console (WebFig/SSH/Winbox) to a NAS router
Rate limit
t_probe

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/devices List devices behind a NAS prm_nas_devices_index

Customer-premises and infrastructure devices discovered or registered under this NAS, as the monitoring and topology views see them.

Authentication
Staff token or session
Requires permission
prm_nas_devices_index View LAN devices

Parameters

Parameter Description
idrequired path · integer NAS id.
POST /api/v1/admin/nas/{id}/devices Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/enable-zerologin Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/hotspot-preflight View NAS prm_nas_index
Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/management-credentials View NAS prm_nas_index
Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/management-credentials Add NAS prm_nas_create
Authentication
Staff token or session
Requires permission
prm_nas_create Add NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/management-script Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/onboarding-script Render the onboarding script for a NAS prm_nas_update

Returns the RouterOS script that configures the device to talk to this platform: RADIUS client, accounting, the management tunnel and the captive portal redirect. Rendered for this specific device.

Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS

The script contains the device's shared secret and tunnel credentials in the clear, because the router needs them. Treat the response as a secret, and do not log it.

Parameters

Parameter Description
idrequired path · integer NAS id.
GET /api/v1/admin/nas/{id}/parental-script View NAS prm_nas_index
Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/ping-history View NAS prm_nas_index
Authentication
Staff token or session
Requires permission
prm_nas_index View NAS

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/provision-tunnel Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/revert-hotspot Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/rotate-secret Rotate a NAS shared secret prm_nas_update

Issues a new shared secret for the device. The router must be updated to match, or it stops authenticating — this endpoint changes the platform side only.

Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

There is no overlap window. From the moment this returns, RADIUS packets signed with the old secret are rejected. Push the new secret to the device in the same maintenance step.

Parameters

Parameter Description
idrequired path · integer NAS id.
POST /api/v1/admin/nas/{id}/scan View LAN devices prm_nas_devices_index
Authentication
Staff token or session
Requires permission
prm_nas_devices_index View LAN devices
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/shared-secret Reveal a NAS shared secret prm_nas_update

Returns the device's RADIUS shared secret in the clear, for an operator re-entering it on the router. Gated on the NAS update permission rather than the read one, because seeing it is equivalent to being able to change it.

Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS

Parameters

Parameter Description
idrequired path · integer NAS id.
POST /api/v1/admin/nas/{id}/test Test a NAS connection prm_nas_update

Checks that the platform can reach the device's management interface.

Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_probe

Parameters

Parameter Description
idrequired path · integer NAS id.
POST /api/v1/admin/nas/{id}/test-ssh Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_probe

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/transport Edit NAS prm_nas_update
Authentication
Staff token or session
Requires permission
prm_nas_update Edit NAS
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/vpn Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

PATCH /api/v1/admin/nas/{id}/vpn Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/vpn/disable Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/vpn/enable Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/vpn/history Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/vpn/peers
Authentication
Staff token or session
Requires any one of
prm_nas_vpn_peers_own prm_nas_vpn_peers_all
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/admin/nas/{id}/vpn/script All VPN accounts (tenant-wide, incl. reassign) prm_nas_vpn_peers_all
Authentication
Staff token or session
Requires permission
prm_nas_vpn_peers_all All VPN accounts (tenant-wide, incl. reassign)

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

POST /api/v1/admin/nas/{id}/vpn/zerotier/install-package Operator VPN access to NAS (issue/revoke VPN configs) prm_nas_vpn
Authentication
Staff token or session
Requires permission
prm_nas_vpn Operator VPN access to NAS (issue/revoke VPN configs)
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/nas/hotspot-asset
Authentication
Public
Rate limit
nas_provision

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

GET /api/v1/nas/provision
Authentication
Public
Rate limit
nas_provision

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Written to be read by machines too

The reference is public and needs no account, so a tool that has never seen X-Radius can reach a correct first call on its own.

/llms.txt
An index of every page, with one-line summaries.
/llms-full.txt
The whole reference as one Markdown file, with no navigation to crawl.
/openapi.json
OpenAPI 3.1, generated from the router that serves this instance.
/skill.md
A ready-made skill file for an assistant: authentication, the response envelope and the error codes in one page.
<page-url>.md
Append .md to any reference URL for the same page as Markdown.
Accept: text/markdown
Send this header on the ordinary URL and the answer comes back as Markdown instead.
Hand this to your assistant
Read https://x-radius.com/llms.txt, then fetch the endpoint you need as Markdown by appending .md to its URL.

Try it on your own network.

50 subscribers for 7 days. You pay nothing.