API & Usage Guide

Roles

• Super-admin (administrator) — creates resellers, sees everything, manages POPs/plans.
• Reseller — creates and manages their own clients and VPN accounts; cannot see other resellers' data.
• Client — sees only accounts assigned to them: download config / QR, view usage.

Dashboard workflow (end to end)

1. Admin → Resellers → Create reseller (email + password).
2. Reseller signs in → Clients → Create client login (optional).
3. Accounts → Create account: username, protocol (WireGuard / L2TP / both), POP (or auto-assign), optional client, and Duration (1, 2, 3, 6 or 12 months). Auto-expires at the end of the duration.
4. Config on the row → QR / .conf / MikroTik .rsc / Ubuntu bash (WG) or details / .rsc / bash (L2TP).
5. Extend / Renew pushes expiry out (reactivates expired). Suspend / Resume toggles access instantly. Migrate moves a WireGuard account to a different exit IP.

API authentication

Create a token under API Tokens (admin/reseller). It acts as you — same permissions and tenant scoping as your dashboard. Send it as a bearer header:

BASE=https://vpnpanel.lfait.com/api/v1
TOKEN=vlf_xxxxxxxxxxxxxxxxxxxxxxxx

curl -s $BASE/clients -H "Authorization: Bearer $TOKEN"

Clients

Method	Path	Description
GET	/clients	List your clients
POST	/clients	Create a client login
DELETE	/clients/{id}	Remove a client login (accounts survive)

curl -s $BASE/clients -H "Authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"Str0ng-Pass-123"}'

Accounts

Method	Path	Description
GET	/accounts	List accounts (your scope)
POST	/accounts	Create + provision
GET	/accounts/{id}	Account detail
PATCH	/accounts/{id}	status, expires_at, data_cap_bytes, max_sessions
POST	/accounts/{id}/migrate	Move a WG account to another POP
DELETE	/accounts/{id}	Deprovision + delete

# WireGuard account, expires in 1 year, assigned to client 5
curl -s $BASE/accounts -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{
  "username":"cust-001", "protocol":"wireguard",
  "client_user_id":5, "expires_at":"2027-06-21T00:00:00Z",
  "data_cap_bytes":107374182400 }'

# Suspend / resume
curl -s -X PATCH $BASE/accounts/42 -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"status":"suspended"}'

Configs

GET /accounts/{id}/config returns the WireGuard .conf and a base64 QR PNG. The dashboard config page also renders ready-to-paste MikroTik RouterOS commands and Ubuntu bash scripts for both WireGuard and L2TP.

curl -s $BASE/accounts/42/config -H "Authorization: Bearer $TOKEN"
# { "config": "[Interface]...", "qr_png_base64": "iVBOR...", "filename": "cust-001.conf" }

Account durations & expiry

Set expires_at (RFC 3339 UTC) on create, or pick a Duration in the dashboard. A job runs every ~60s: past its expiry, an account is disabled automatically — WireGuard peer disabled, L2TP rejected (RADIUS Expiration + Disconnect), status expired. Extend/Renew reactivates it.

Usage

curl -s $BASE/me/usage -H "Authorization: Bearer $TOKEN"
# [ { "account_id":42, "username":"cust-001", "rx_bytes":..., "tx_bytes":..., "total_bytes":..., "data_cap_bytes":... } ]

Tokens

Method	Path	Description
GET	/tokens	List your tokens
POST	/tokens	Create ({"label":"...","expires_days":365}) — returns it once
DELETE	/tokens/{id}	Revoke

Admin only

Method	Path	Description
GET	/admin/overview	Platform stats
GET/POST	/admin/resellers	List / create resellers
PATCH	/admin/resellers/{id}	Suspend / credit / default POP
GET	/admin/pops · /admin/plans · /admin/audit	Infra + audit log

Interactive schema: /docs (OpenAPI).