Public reference
NAS
Every endpoint in this group. Open one for its parameters and a worked example.
NAS
69GET /api/v1/admin/nas List NAS devices
Every NAS registered to the caller's tenant, with its reachability cache and the count of sessions currently on it.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Un-paginated, and there is no meta block at all. Do not write a paging loop against it. ping_status is a cached verdict from the background sweep, not a probe performed by your request — it is 'unknown' until the first sweep classifies the device.
{
"data": [
{
"id": 3,
"tenant_id": 12,
"nas_identifier": "cairo-edge-1",
"nas_ip": "10.20.0.1",
"description": "Nasr City edge",
"vendor": "mikrotik",
"model": "CCR2004",
"coa_port": 3799,
"ssh_port": 22,
"winbox_port": 8291,
"ip_accounting_enabled": true,
"ping_status": "up",
"last_ping_at": "2026-09-20 09:07:30",
"last_rtt_ms": 4.2,
"online_users": 118,
"ping_fail_count": 0,
"wg_enabled": true,
"tunnel_transport": "wireguard",
"active_tunnel_ip": "10.8.0.14",
"zerologin_enabled": true,
"needs_onboarding": false,
"created_at": "2026-04-11 10:02:00"
}
]
}
POST /api/v1/admin/nas Register a NAS
Creates the device record and its RADIUS shared secret. At least one of nas_identifier, nas_ip and called_station_id must be present — that is what an incoming RADIUS packet will be matched on.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_createAdd NAS - Rate limit
t_mutate
A 409 here can be caused by a device belonging to a tenant you cannot see. The three identity columns are globally unique because RADIUS resolves on the bare key before any tenant is known, so "already taken" does not mean "already in your list".
Parameters
| Parameter | Description |
|---|---|
shared_secretrequired
body · string
|
The RADIUS shared secret. Required. |
nas_identifier
body · string
|
NAS-Identifier. Unique across the whole platform. |
nas_ip
body · string
|
NAS-IP-Address. Unique across the whole platform. |
called_station_id
body · string
|
Called-Station-Id. Unique across the whole platform. |
vendor
body · string
|
Device vendor. Validated against the known-vendor catalogue. |
coa_port
body · integer
|
RFC 5176 port. Omit for the schema default of 3799. |
ip_accounting_enabled
body · boolean
|
Defaults to true when omitted. An explicit false is honoured. |
POST /api/v1/admin/nas/bulk-apply-hotspot Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/bulk-apply-parental Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/bulk-delete Delete NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_deleteDelete NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/bulk-enable-zerologin Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/catalog List supported NAS vendors and models
The vendor and model catalogue the create and update endpoints validate against. Static data, safe to cache.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
GET /api/v1/admin/nas/device-groups View LAN devices
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_devices_indexView LAN devices
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/device-groups Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/device-groups/bulk-delete Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
DELETE /api/v1/admin/nas/device-groups/{id} Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
PATCH /api/v1/admin/nas/device-groups/{id} Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/device-groups/{id}/managers Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
PUT /api/v1/admin/nas/device-groups/{id}/managers Manage LAN device groups & manager access
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_device_groupsManage LAN device groups & manager access - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/devices View LAN devices
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_devices_indexView LAN devices
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/devices/bulk-delete Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/devices/bulk-group Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
DELETE /api/v1/admin/nas/devices/{id} Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
PATCH /api/v1/admin/nas/devices/{id} Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/devices/{id}/console Remote console to a LAN device
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_devices_remoteRemote console to a LAN device - Rate limit
t_probe
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/management-credentials/bulk-delete Delete NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_deleteDelete NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
DELETE /api/v1/admin/nas/management-credentials/{id} Delete NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_deleteDelete NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/management-credentials/{id} View NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/management-credentials/{id}/rotate Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/onboard Add NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_createAdd NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/ping Ping every NAS
Probes all of the tenant's devices from the platform and reports reachability. An operator action.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS - Rate limit
t_probe
On the per-tenant probe budget — 10 a minute on a standard licence, shared with every other probe endpoint. For continuous reachability, read ping_status off the NAS list instead: the background sweep maintains it for free.
GET /api/v1/admin/nas/vpn/peers
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/vpn/peers/bulk-delete
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/vpn/peers/bulk-reassign All VPN accounts (tenant-wide, incl. reassign)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpn_peers_allAll VPN accounts (tenant-wide, incl. reassign) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
DELETE /api/v1/admin/nas/vpn/peers/{peerID}
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/vpn/peers/{peerID}/credentials
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/vpn/peers/{peerID}/history
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/vpn/peers/{peerID}/reassign All VPN accounts (tenant-wide, incl. reassign)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpn_peers_allAll VPN accounts (tenant-wide, incl. reassign) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/vpn/peers/{peerID}/rotate
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/vpn/servers
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
DELETE /api/v1/admin/nas/{id} Delete a NAS
Removes the device record. Sessions already open on it are not affected.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_deleteDelete NAS - Rate limit
t_mutate
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
GET /api/v1/admin/nas/{id} Fetch one NAS
The full device record, including tunnel and operator-VPN configuration.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read tunnel_transport to decide how to render a device, never "whichever tunnel IP is non-null". A NAS keeps its standby allocations after switching transport, so more than one of wg_tunnel_ip, ovpn_tunnel_ip and sstp_tunnel_ip is set on any device that ever changed. active_tunnel_ip is the database's own resolution of that question.
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
PATCH /api/v1/admin/nas/{id} Update a NAS
Partial update; an omitted field is left alone. The shared secret is not editable here — rotating it has its own endpoint, because it must be pushed to the device in step with the change.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
POST /api/v1/admin/nas/{id}/apply-hotspot Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/apply-parental Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/console Remote console (WebFig/SSH/Winbox) to a NAS router
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_remoteRemote console (WebFig/SSH/Winbox) to a NAS router - Rate limit
t_probe
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/devices List devices behind a NAS
Customer-premises and infrastructure devices discovered or registered under this NAS, as the monitoring and topology views see them.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_devices_indexView LAN devices
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
POST /api/v1/admin/nas/{id}/devices Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/enable-zerologin Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/hotspot-preflight View NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/management-credentials View NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/management-credentials Add NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_createAdd NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/management-script Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/onboarding-script Render the onboarding script for a NAS
Returns the RouterOS script that configures the device to talk to this platform: RADIUS client, accounting, the management tunnel and the captive portal redirect. Rendered for this specific device.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS
The script contains the device's shared secret and tunnel credentials in the clear, because the router needs them. Treat the response as a secret, and do not log it.
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
GET /api/v1/admin/nas/{id}/parental-script View NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/ping-history View NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_indexView NAS
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/provision-tunnel Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/revert-hotspot Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/rotate-secret Rotate a NAS shared secret
Issues a new shared secret for the device. The router must be updated to match, or it stops authenticating — this endpoint changes the platform side only.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
There is no overlap window. From the moment this returns, RADIUS packets signed with the old secret are rejected. Push the new secret to the device in the same maintenance step.
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
POST /api/v1/admin/nas/{id}/scan View LAN devices
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_devices_indexView LAN devices - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/test Test a NAS connection
Checks that the platform can reach the device's management interface.
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_probe
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
NAS id. |
POST /api/v1/admin/nas/{id}/test-ssh Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_probe
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/transport Edit NAS
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_updateEdit NAS - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/vpn Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs)
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
PATCH /api/v1/admin/nas/{id}/vpn Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/vpn/disable Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/vpn/enable Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/vpn/history Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs)
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/vpn/peers
- Authentication
- Staff token or session
- Requires any one of
-
prm_nas_vpn_peers_ownprm_nas_vpn_peers_all - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/admin/nas/{id}/vpn/script All VPN accounts (tenant-wide, incl. reassign)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpn_peers_allAll VPN accounts (tenant-wide, incl. reassign)
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
POST /api/v1/admin/nas/{id}/vpn/zerotier/install-package Operator VPN access to NAS (issue/revoke VPN configs)
- Authentication
- Staff token or session
- Requires permission
-
prm_nas_vpnOperator VPN access to NAS (issue/revoke VPN configs) - Rate limit
t_mutate
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/nas/hotspot-asset
- Authentication
- Public
- Rate limit
nas_provision
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
GET /api/v1/nas/provision
- Authentication
- Public
- Rate limit
nas_provision
Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.
No endpoint matches that search.
Written to be read by machines too
The reference is public and needs no account, so a tool that has never seen X-Radius can reach a correct first call on its own.
- /llms.txt
- An index of every page, with one-line summaries.
- /llms-full.txt
- The whole reference as one Markdown file, with no navigation to crawl.
- /openapi.json
- OpenAPI 3.1, generated from the router that serves this instance.
- /skill.md
- A ready-made skill file for an assistant: authentication, the response envelope and the error codes in one page.
<page-url>.md- Append .md to any reference URL for the same page as Markdown.
Accept: text/markdown- Send this header on the ordinary URL and the answer comes back as Markdown instead.
Read https://x-radius.com/llms.txt, then fetch the endpoint you need as Markdown by appending .md to its URL.