Everlock One server for your digital life

Documentation

Last updated: 2026-08-05

Admin over HTTP

The backend-admin-http outlet serves two surfaces on its pinned vhost: the web dashboard at /admin and the HTTP API at /api. Both run every action through the same command engine as the SSH console and MCP — the same commands, the same typed inputs, the same per-resource authorization.

The HTTP API

Every admin command is one POST operation whose URL path is the command's verb path:

POST /api/users/list
POST /api/dns/records/create
POST /api/site/log/enable

The request body is the command's JSON arguments (an absent body reads as {}, so argument-free commands POST without one). The response is the same structured JSON the MCP outlet returns:

{ "command": "/users list", "control": "continue", "result": [ … ] }

200 means the command ran successfully; 400 carries the error items — including the command's usage: line for invalid arguments. A control of restart means the server is restarting to apply the change.

OpenAPI and Swagger UI

The complete OpenAPI 3.1 document is served at /api/openapi.json, and /api itself serves Swagger UI over it — the whole command set explorable and callable from a browser. The document is generated from the same command registry as the MCP tool catalog: operation ids equal the MCP tool names (dns_records_create), request schemas are each command's typed-input schema verbatim, and every operation carries an x-safety marker (read-only, mutating, destructive) derived from its verb.

Enabling and pinning

/backends enable admin-http
/server settings set admin.http.vhost admin.example.org

The vhost lives in the server settings registry and applies at the next restart; once served it is published, the HTTPS listener binds it, and ACME issues its certificate. --backend-admin-http-vhost / EVERLOCK_BACKEND_ADMIN_HTTP_VHOST provide the bootstrap value; the setting wins.

Authentication

Both surfaces accept either credential; each resolves to the same user:

  • HTTP Basic — everlock login and password, the browser path. Visiting /api or /admin triggers the browser's native credentials prompt.
  • Bearer API key — Authorization: Bearer evapi_<key_id>.<secret>, the programmatic path, identical to MCP. Keys are minted with /users apikey create <login> [alias].

Any authenticated user gets in; the engine authorizes each command exactly as over SSH or MCP — actor-scoped reads answer with the actor's own resources, every remaining command requires system admin (*/*/*).

curl -u jens -X POST https://admin.example.org/api/users/list

curl -H "Authorization: Bearer evapi_…" \
  -X POST -H "Content-Type: application/json" \
  -d '{"login":"mika","password":"a strong passphrase"}' \
  https://admin.example.org/api/users/add
admin http api