Overview

Catalyst exposes a REST API for everything the panel does, plus realtime streams for console output, server events, and metrics.

Start here

1. Authentication — create an API key and send it as a bearer token.
2. Authorization — the permission model and every permission string.
3. Errors — stable codes you can branch on.
4. Pagination and rate limits.
5. Realtime events — console, server events, metrics.
6. Guides — common workflows end to end.
7. Plugin development — extend the panel itself.
8. API reference — generated endpoint documentation.

Conventions

• Base path /api (for example /api/servers, /api/nodes), over HTTPS.
• JSON bodies, UTF-8.
• API keys are created in the panel and sent as Authorization: Bearer <key>. A request without that header falls back to session-cookie auth.
• Pagination differs per endpoint — some use page/limit, GET /api/servers uses limit/offset. Check Pagination before writing a generic page walker.
• Errors carry a stable machine-readable code in addition to the message — branch on the code, never on English text.

Source of truth

The API reference is generated from the backend’s route definitions, so it tracks the code. The same document is served raw at /openapi.json. If a guide here disagrees with the reference, the reference and the actual behaviour win — report the mismatch so the guide gets fixed.