Admin API: reverse proxy nodes and Cloudflare

The API offers the same actions as the Reverse proxy nodes section of the panel: add a node, check it, delete it, connect and disconnect a Cloudflare account. All methods require a token with Full access («Полный доступ») (full). Authorization is described on the Admin API: overview and authorization page, and the request and error format on the Request, response and error format page.

General rules

• Records belong to the team: a token sees and changes only the nodes and accounts of its own team.
• Neither nodes nor Cloudflare accounts have an edit method. To change the parameters, delete the record and create a new one.
• The lists have no pagination and no filters.
• The SSH password and the Cloudflare token are accepted only on creation. No method returns them.
• If the address contains a value that is not a UUID in place of {id}, the response is 400 with code bad_request and the message некорректный идентификатор или значение (invalid ID or value).
• When the license is inactive, the methods respond 402 — see Expired license.

Pointing domains to a node is done by separate methods, POST /api/v1/domains/{id}/route and POST /api/v1/domains/route-bulk; they are described on the Admin API: domains page.

Reverse proxy nodes

Node object

status values:

List nodes

GET /api/v1/proxy-nodes

Returns all of the team's nodes.

Token scope: full. There are no parameters.

Response — code 200 and an array of node objects. The newest nodes come first. If there are no nodes, you get an empty array [].

[
  {
    "id": "5d2f8c14-9a3b-4e7d-b1c6-0f8e7d6c5b4a",
    "workspace_id": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "label": "DE-1",
    "ip": "203.0.113.10",
    "ssh_port": 22,
    "ssh_user": "root",
    "status": "ready",
    "last_seen": "2026-10-04T09:15:42.118204Z",
    "created_at": "2026-10-04T09:14:10.552871Z",
    "host_key_fingerprint": "SHA256:Zk3v0q1mYb7Qe2xL9aHn4TtR8sWc5uJd6oPfGiK1lMw"
  }
]

Add a node

POST /api/v1/proxy-nodes

Creates a node and starts setting it up over SSH. Server requirements are listed on the Reverse proxy nodes page.

Token scope: full. The body is a JSON object:

Response — code 201:

The setup runs in the background, with up to 3 minutes allotted to it. The response comes immediately and does not contain the setup result. Request the node list and wait until status changes to ready or error. After ready, wait about a minute: the tracker server will start accepting requests from this node on its own.

Errors:

Errors of the setup itself — a wrong password, an unreachable server, a fingerprint mismatch — do not get into the response. They are written to the node's last_error, and the node gets the error status. The texts are explained on the Reverse proxy nodes page.

Example request:

curl -X POST https://panel.example.com/api/v1/proxy-nodes \
  -H "Api-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{"label":"DE-1","ip":"203.0.113.10","ssh_port":22,"ssh_user":"root","ssh_password":"<SSH password>"}'

Check a node

POST /api/v1/proxy-nodes/{id}/health

Connects to the node over SSH with the saved key and checks that the web server on it is running. The check takes up to 25 seconds.

Token scope: full. There is no request body. {id} in the address is the node ID from the list.

Response — code 200 in both cases, the result is in the status field:

{"status": "ready"}

On success, the node's last_seen is updated, its status becomes ready, and last_error is cleared. On failure, the error text with the ручная проверка: (manual check:) prefix is written to last_error, and the status of the node itself does not change. Automatic node monitoring and moving domains are described on the Reverse proxy nodes page.

Errors:

Example request:

curl -X POST https://panel.example.com/api/v1/proxy-nodes/5d2f8c14-9a3b-4e7d-b1c6-0f8e7d6c5b4a/health \
  -H "Api-Key: <token>"

Delete a node

DELETE /api/v1/proxy-nodes/{id}

Deletes the node from the tracker and unbinds its domains.

Token scope: full. There is no request body. {id} in the address is the node ID from the list.

Response — code 204 with no body.

If there is no node with this ID or it has already been deleted, the response is 404 with code not_found.

Cloudflare accounts

An account is a saved Cloudflare API token. Through it, the tracker sets a domain's A record to the node's IP. The permissions the token needs and what the tracker does in DNS are described on the Working with Cloudflare page.

Account object

List accounts

GET /api/v1/cf-accounts

Returns the team's connected Cloudflare accounts, without tokens.

Token scope: full. There are no parameters.

Response — code 200 and an array of account objects in the order they were added. If there are no accounts, you get an empty array [].

Connect an account

POST /api/v1/cf-accounts

Checks the Cloudflare token by requesting the list of zones and saves it.

Token scope: full. The body is a JSON object:

Response — code 201:

Errors:

Example request:

curl -X POST https://panel.example.com/api/v1/cf-accounts \
  -H "Api-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{"label":"Main account","token":"<Cloudflare API token>"}'

Disconnect an account

DELETE /api/v1/cf-accounts/{id}

Deletes the saved Cloudflare token.

Token scope: full. There is no request body. {id} in the address is the account ID from the list.

Response — code 204 with no body. DNS records in Cloudflare do not change. The tracker will no longer be able to point the domains of this account to nodes.

If there is no account with this ID or it has already been deleted, the response is 404 with code not_found.

When the feature is disabled

Code 503 with code = disabled means that the reverse proxy node parameters are not set on the tracker server: NODE_ENC_KEY or NODE_ORIGIN_HOST. The installer writes both parameters itself, so this response does not appear on an installation deployed according to the Installation page.

When a node is added, the text in message depends on which parameter is missing:

• фича прокси-нод выключена: задайте NODE_ENC_KEY (openssl rand -hex 32) (the proxy node feature is off: set NODE_ENC_KEY);
• NODE_ORIGIN_HOST не задан (адрес origin для нод) (NODE_ORIGIN_HOST is not set — the origin address for the nodes).

The lists and deletion work without these parameters too: GET and DELETE do not return disabled.