API Reference

API Reference

All endpoints (except /api/login and stager delivery) require a valid JWT in the Authorization: Bearer <token> header.

Authentication

POST /api/login
Content-Type: application/json

{ "username": "admin", "password": "yourpassword" }

Returns { "token": "..." }.

Sessions

Method	Endpoint	Description
GET	/api/sessions	List all sessions
GET	/api/sessions/{id}	Get session detail
DELETE	/api/sessions/{id}	Delete session
PATCH	/api/sessions/{id}	Update tags, notes, detection status

Tasking

Method	Endpoint	Description
POST	/api/sessions/{id}/task	Send a task
GET	/api/sessions/{id}/tasks	List task history

File operations

Method	Endpoint	Description
POST	/api/sessions/{id}/upload	Stage a file for upload
GET	/api/sessions/{id}/download/{filename}	Download exfiltrated file

Stager

Method	Endpoint	Description
POST	/api/stager	Create a stager token
GET	/api/stager	List active tokens
DELETE	/api/stager/{token}	Revoke a token

Reports

Method	Endpoint	Description
POST	/api/report	Generate report

Body: { "session_ids": [...], "format": "md|html|pdf", "start": "ISO date", "end": "ISO date" }

Topology

Method	Endpoint	Description
GET	/api/topology	Get full network topology graph

WebSocket

Real-time updates are pushed over WebSocket at /ws. Events include:

• agent_checkin — new beacon checked in
• task_result — task output available
• pty_output — PTY data chunk
• tunnel_status — SOCKS5 tunnel state change
• chat_message — operator chat message