All endpoints are prefixed with /api/v1/. Authentication required for all except login.
Include the access token as Authorization: Bearer <token>.
Authentication
#| Method | Endpoint | Description |
|---|
| POST | /auth/login | Login with {"username", "password"}. Returns {access_token, refresh_token, expires_at, user_id, username, role}. |
| POST | /auth/refresh | Refresh tokens with {"refresh_token"}. Returns new token pair. Old refresh token is consumed. |
| POST | /auth/logout | Revoke current access token. |
| POST | /auth/force-logout | Admin only. Revoke all tokens for {"operator_id"}. |
Example
#1
2
3
4
5
| curl -X POST http://localhost:8443/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"username": "admin", "password": "password"}'
# Returns: {"access_token": "...", "refresh_token": "...", ...}
|
Engagements
#| Method | Endpoint | Description |
|---|
| POST | /engagements/ | Create {"name", "description", "passphrase"}. Admin. |
| GET | /engagements/ | List (filtered by access). |
| GET | /engagements/<id> | Detail. |
| PUT | /engagements/<id>/activate | Activate. Admin. |
| PUT | /engagements/<id>/deactivate | Deactivate. Admin. |
| POST | /engagements/<id>/archive | Archive {"passphrase", "output_path?"}. Admin. |
| POST | /engagements/import | Import {"archive_path", "passphrase", "name?"}. Admin. |
Operators
#| Method | Endpoint | Description |
|---|
| POST | /operators/ | Create {"username", "password", "role?"}. Admin. |
| GET | /operators/ | List all. Admin. |
| GET | /operators/<id> | Detail. Admin or self. |
| PUT | /operators/<id> | Update {"role?", "is_active?", "password?"}. Admin. |
| DELETE | /operators/<id> | Delete. Admin. Last admin protected. |
| POST | /operators/<id>/grant-access | Grant {"engagement_id"}. Admin. |
| DELETE | /operators/<id>/revoke-access | Revoke {"engagement_id"}. Admin. |
Agents
#| Method | Endpoint | Description |
|---|
| GET | /agents/ | List. Filter: ?status=active|dormant|dead|killed. |
| GET | /agents/<id> | Detail. |
| POST | /agents/<id>/tasks | Create task {"task_type", "payload?"}. Operator+. |
| GET | /agents/<id>/tasks | List tasks. Filter: ?status=. |
| GET | /agents/<id>/tasks/<tid>/result | Task result. |
| GET | /agents/<id>/tasks/<tid>/results | All results for task (supports streaming/multiple results). |
| POST | /agents/<id>/kill | Kill agent. Operator+. |
| PATCH | /agents/<id>/tags | Update tags {"tags": [...]}. Operator+. |
| PATCH | /agents/<id>/notes | Update notes {"notes": "..."}. Operator+. |
Agent Capabilities & Modules
#| Method | Endpoint | Description |
|---|
| GET | /agents/<id>/capabilities | Agent package capabilities (module formats, built-in commands, daemonize/relay support). |
| GET | /agents/<id>/modules/loaded | List modules loaded in agent. Filter: ?status=. |
| POST | /agents/<id>/modules/load | Load module {"module_name", "module_format", "daemonize?", "options?"}. Operator+. |
| POST | /agents/<id>/modules/unload | Unload managed module {"loaded_module_id"}. Operator+. |
P2P Relay & Topology
#| Method | Endpoint | Description |
|---|
| GET | /agents/topology | Get current P2P topology (all active links). |
| POST | /agents/<id>/relay | Set relay {"relay_agent_id"}. Operator+. |
| DELETE | /agents/<id>/relay | Remove relay (switch to direct). Operator+. |
| GET | /agents/<id>/chain | Get full relay chain path. |
File Transfers
#| Method | Endpoint | Description |
|---|
| POST | /agents/<id>/files/upload | Upload {"file_data" (base64), "remote_path"}. Operator+. |
| POST | /agents/<id>/files/download | Request download {"remote_path"}. Operator+. |
| GET | /agents/<id>/files/ | List transfers. Filter: ?direction=&status=. |
| GET | /agents/<id>/files/<tid> | Transfer details. |
| GET | /agents/<id>/files/<tid>/content | Download stored file content. |
Server Modules
#| Method | Endpoint | Description |
|---|
| GET | /modules/ | List all server modules with metadata. |
| GET | /modules/<name> | Module detail. |
| POST | /modules/<name>/execute | Execute {"agent_id", "options?"}. Operator+. |
| POST | /modules/refresh | Hot-reload server modules. Operator+. |
Agent Modules
#| Method | Endpoint | Description |
|---|
| GET | /agent-modules/ | List all agent-loadable modules with metadata. |
| GET | /agent-modules/<name> | Agent module detail. |
| GET | /agent-modules/compatible/<agent_id> | List modules compatible with agent (filtered by format/platform/arch). |
| POST | /agent-modules/refresh | Refresh agent module registry. Operator+. |
Credentials
#| Method | Endpoint | Description |
|---|
| GET | /credentials/ | List. Filter: ?cred_type=&username=&domain=&source_host=&source_module=&limit=&offset=. |
| GET | /credentials/<id> | Detail with decrypted secret. |
| POST | /credentials/ | Create {"cred_type", "username", "secret", "domain?", "notes?"}. Operator+. |
| PATCH | /credentials/<id> | Update fields. Operator+. |
| DELETE | /credentials/<id> | Delete. Operator+. |
| GET | /credentials/export | Export all. ?format=json|csv|hashcat&cred_type=&username=&domain=. |
Listeners
#| Method | Endpoint | Description |
|---|
| POST | /listeners/ | Create {"name", "transport_type", "host", "port", "tls_enabled?", "tls_cert_file?", "tls_key_file?", "callback_protocol?", "options?"}. Operator+. |
| GET | /listeners/ | List. Filter: ?engagement_id=. |
| GET | /listeners/<id> | Detail. |
| POST | /listeners/<id>/start | Start. Operator+. |
| POST | /listeners/<id>/stop | Stop. Operator+. |
| DELETE | /listeners/<id> | Remove. Operator+. |
Builds
#| Method | Endpoint | Description |
|---|
| GET | /builds/packages | List buildable packages with templates. |
| GET | /builds/packages/<name>/templates | Templates for a package. |
| GET | /builds/packages/<name>/schema | Build config schema. |
| POST | /builds/ | Create {"package_name", "template_name", "callbacks", "kill_date", "beacon_interval?", "beacon_jitter?"}. Operator+. |
| GET | /builds/ | List build records. |
| GET | /builds/<id> | Build detail. |
| GET | /builds/<id>/download | Download binary. Operator+. |
Tools
#| Method | Endpoint | Description |
|---|
| GET | /agentless/modules/ | List modules. |
| GET | /agentless/modules/<name> | Module detail. |
| POST | /agentless/modules/<name>/execute | Execute {"operation", "targets", "options?", "proxy_config_id?"}. Operator+. |
| POST | /agentless/modules/refresh | Hot-reload. Operator+. |
| GET | /agentless/executions/ | List executions. |
| GET | /agentless/executions/<id> | Execution with results. |
Interactive Sessions
#| Method | Endpoint | Description |
|---|
| POST | /agentless/sessions | Create session {"target_host", "target_port", "username", "password?", "private_key?", "credential_id?", "proxy_config_id?", "module_name?"}. Operator+. |
| GET | /agentless/sessions | List active sessions. |
| DELETE | /agentless/sessions/<id> | Close session. Operator+. |
| GET | /agentless/sessions/<id>/output | Poll for output (drains buffer). |
| POST | /agentless/sessions/<id>/input | Send input {"data"}. |
Proxy Configuration
#| Method | Endpoint | Description |
|---|
| GET | /agentless/proxies/ | List proxies. |
| POST | /agentless/proxies/ | Create {"name", "proxy_type", "host", "port"}. Operator+. Types: socks4, socks5, ssh_tunnel. |
| GET | /agentless/proxies/<id> | Proxy detail. |
| PATCH | /agentless/proxies/<id> | Update proxy. Operator+. |
| DELETE | /agentless/proxies/<id> | Delete proxy. Operator+. |
Agent Filesystem
#| Method | Endpoint | Description |
|---|
| GET | /agents/<id>/filesystem | Get agent filesystem tree (from cached ls results). |
Collection Requests
#| Method | Endpoint | Description |
|---|
| POST | /collection-requests/ | Create request {"agent_id", "remote_path", "justification?"}. Collector+. |
| GET | /collection-requests/ | List requests. Filter: ?status=pending|approved|denied. |
| GET | /collection-requests/<id> | Request detail. |
| POST | /collection-requests/<id>/approve | Approve request. Operator+. |
| POST | /collection-requests/<id>/deny | Deny request {"reason?"}. Operator+. |
| GET | /collection-requests/pending-count | Count of pending requests. |
Plugins
#| Method | Endpoint | Description |
|---|
| GET | /plugins/ | List all registered plugins. |
| POST | /plugins/refresh | Refresh all plugin registries. Operator+. |
Audit Log
#| Method | Endpoint | Description |
|---|
| GET | /audit/ | Query. Required: ?engagement_id=. Optional: principal=, action=, since=, until=, security_only=, limit=, offset=. |
Task Archival
#| Method | Endpoint | Description |
|---|
| POST | /tasks/archive | Trigger archival {"engagement_id", "older_than?"}. Admin. |
| GET | /tasks/archived | List ?engagement_id=&agent_id=. |
| GET | /tasks/archived/<id> | Detail ?engagement_id=. |
Collector Grants
#| Method | Endpoint | Description |
|---|
| POST | /collectors/grants | Grant {"collector_id", "permission", "agent_ids?", "expires_at?"}. Operator+. |
| DELETE | /collectors/grants/<grant_id> | Revoke. Operator+. |
| GET | /collectors/grants/<collector_id> | List active grants. |
System
#| Method | Endpoint | Description |
|---|
| GET | /version | Returns {"version": "...", "name": "TantoC2"}. |
| GET | /health | Returns {"status": "ok"}. |