API reference
kimbap's REST API is served under /api/, using stdlib net/http routing
(no framework). Every endpoint returns JSON. Auth is either a session
cookie (set by /api/auth/login, used by the web UI) or an
Authorization: Bearer <key> header (an api- or both-scoped API key).
Auth
| Method & path |
Auth |
Description |
GET /api/setup/status |
none |
{"needsSetup": bool} — whether the first-admin wizard should show. |
POST /api/setup/admin |
none (only while no user exists) |
Create the first admin account + log in. |
POST /api/auth/login |
none |
{username, password} → sets session cookie. |
POST /api/auth/logout |
session |
Revoke the current session. |
GET /api/auth/me |
session or key |
Current user. |
Users & API keys
| Method & path |
Auth |
Description |
GET /api/users |
admin |
List users. |
POST /api/users |
admin |
Create a user {username, password, role}. |
GET /api/users/{id}/apikeys |
self or admin |
List a user's API keys. |
POST /api/users/{id}/apikeys |
self or admin |
Create a key {label, scope} (scope = api|mcp|both). Raw key returned once. |
DELETE /api/apikeys/{id} |
self (owner) or admin |
Revoke a key. |
Projects
| Method & path |
Description |
GET /api/projects |
List every project. |
POST /api/projects |
Create {slug, name, description, compose, env}. |
GET /api/projects/{slug} |
Details + current compose/env content + live container status. |
PUT /api/projects/{slug} |
Overwrite {compose, env}. Doesn't redeploy. |
DELETE /api/projects/{slug} |
Stop, tear down, and delete the project. |
POST /api/projects/{slug}/deploy |
docker compose up -d. |
POST /api/projects/{slug}/stop |
docker compose stop. |
POST /api/projects/{slug}/restart |
docker compose restart. |
GET /api/projects/{slug}/logs?service=&tail= |
Recent logs. |
Domains
| Method & path |
Description |
GET /api/projects/{slug}/domains |
List a project's domains. |
POST /api/projects/{slug}/domains |
Add {service, domain, containerPort, tls}. |
DELETE /api/projects/{slug}/domains/{id} |
Remove a domain. |
System
| Method & path |
Auth |
Description |
GET /api/system/status |
session or key |
Docker + Traefik status. |
POST /api/system/docker/install |
admin |
{"confirm": true} — install/update Docker (streamed response). |
POST /api/system/traefik/provision |
admin |
{"confirm": true} — (re)provision Traefik (streamed response). |
Audit
| Method & path |
Auth |
Description |
GET /api/audit?limit= |
admin |
Recent audit log entries. |
Errors
Errors are {"error": "message"} with a matching HTTP status — 400 for
bad input, 401 for missing/invalid auth, 403 for a role/ownership
check that failed, 404 for a missing resource, 409 for a conflict (e.g.
duplicate slug or domain), 422 for a lifecycle action that ran but
failed (e.g. docker compose up exiting non-zero — the response includes
the command's output), 500 for anything unexpected (internals are never
leaked in the message).
MCP
Everything above except user/API-key management is also available as MCP
tools at /mcp — see the MCP guide for the full tool list and how to
connect Claude to it.