Management API

The console is a client of this API. Unlike the inference endpoints, it does not take an API key. It uses a console session: sign in, keep the cookie, send it on every call.

curl -c cookies.txt -H 'Content-Type: application/json' \
  -d '{"user": "admin", "password": "choose-a-password"}' http://localhost:8080/api/auth/login
curl -b cookies.txt http://localhost:8080/api/admin/models

A call without a valid session gets 401. The routes are the console's own and may change between releases. The inference routes are the stable surface for applications.

Authentication

Method and route	What it does
`POST /api/auth/login`	Signs in and sets the session cookie.
`POST /api/auth/logout`	Ends the session.
`GET /api/auth/status`	Whether the session is signed in.

Models, runners and devices

Method and route	What it does
`GET /api/admin/overview`	The server's usage, runners, devices and recent activity.
`GET /api/admin/models`, `GET /api/admin/model?id=`	The library and one model.
`POST /api/admin/model/update`	Saves a model's alias and settings.
`POST /api/admin/model/load`, `.../unload?id=`	Load or unload a model.
`POST /api/admin/model/clear-cache`	Deletes a model's KV snapshots.
`POST /api/admin/model/delete`	Deletes a model's files and record.
`GET /api/admin/projectors`	The vision projector files found.
`GET /api/admin/runners`, `GET /api/admin/runners/log`	Runners and a runner's log.
`POST /api/admin/runners/kill`	Kills a runner. It restarts and reloads its model.
`GET /api/admin/devices`, `POST /api/admin/devices/probe`	The CUDA devices, and a new probe.

Discover and downloads

Method and route	What it does
`GET /api/admin/hf/search`	Searches Hugging Face for GGUF repositories.
`GET /api/admin/hf/repository`	A repository's files, with quantization, size and whether they are downloaded.
`GET /api/admin/downloads`	Download jobs.
`POST /api/admin/downloads/start`, `.../cancel`, `.../clear`, `.../resume`	Start, cancel, clear and resume a download.

Request log, keys and activity

Method and route	What it does
`GET /api/admin/requests`, `GET /api/admin/request?id=`	Request log entries and one entry with its timeline.
`POST /api/admin/requests/clear`	Clears the request log.
`GET /api/admin/keys`, `POST /api/admin/keys/create`	List keys. Create one with `{ "Name", "ZeroRetention" }`. The secret is in the answer once.
`POST /api/admin/keys/disable?id=&disabled=`, `POST /api/admin/keys/delete?id=`	Disable, enable or delete a key.
`GET /api/admin/events`	Activity entries.
`GET /api/admin/settings`	The effective settings.
`POST /api/admin/playground/chat/completions`	The playground's chat, with the console session in place of a key.

Fleet

Method and route	What it does
`GET /api/admin/nodes`, `POST /api/admin/nodes/disable`, `POST /api/admin/nodes/delete`	Nodes.
`GET /api/admin/join-tokens`, `POST /api/admin/join-tokens/create`, `POST /api/admin/join-tokens/delete`	Join tokens. A new one is shown once, with the command to run.

The routes /api/fleet/* and /api/node/* carry the fleet's own signed traffic. Do not call them from scripts.