Search OPNsense API endpoints by words in the path, description or model (e.g. "alias", "kea reservation", "unbound host override", "wireguard peer").

Method, path args, body fields (types, required, options) and search params of an endpoint, e.g. "firewall/alias/add_item".

Call any endpoint: path is module/controller/action plus positional args, e.g. "core/service/restart/unbound" or "firewall/alias/set_item/". The method defaults to what the endpoint expects. POST bodies are checked against the model unless strict=false. dry_run=true shows the request without sending it. Changes saved this way are not active until the controller's apply/reconfigure runs (see opn_items).

Work with the items of any OPNsense model controller. controller + item name the endpoints: ("firewall/alias", "item") -> firewall/alias/search_item, add_item, ...; ("firewall/filter", "rule"), ("firewall/d_nat", "rule"), ("unbound/settings", "host_override"), ("dnsmasq/settings", "host"), ("kea/dhcpv4", "reservation"), ("nginx/settings", "upstream"). data holds just the item's fields (see opn_api_describe on the add_ endpoint). apply=true runs the controller's apply/reconfigure afterwards; for firewall rules that arms the auto-revert (confirm with opn_firewall_confirm). del needs confirm=true.

Read a controller's whole settings model (controller/get), or change part of it: data is merged into the model and saved with controller/set, e.g. opn_settings("unbound/settings", {"general": {"port": "53"}}). apply=true then runs the service reconfigure.

Keep the applied firewall changes and cancel the pending auto-revert.

Revert the pending firewall changes immediately instead of waiting for the timer.

Config history (newest first: id, time, description, user). With diff_with=, the diff between that backup and the newest one.

Restore config.xml from a history entry (id from opn_config_history). Services other than the firewall keep running with their old config until reconfigured. Needs confirm=true.

Version, update status, interfaces, gateways and services in one call, plus whether writes are enabled.

List services (no name), or start/stop/restart one by name (e.g. "unbound", "dhcpd", "openvpn" with service_id for multi-instance services). stop needs confirm=true.

ARP (ipv4) or NDP (ipv6) table, optionally filtered by IP/MAC/hostname substring.

Recent firewall log entries (newest first), optionally filtered by a substring (IP, port, interface).

Ping a host from the firewall and return loss and round-trip times. Works in read-only mode: it only runs a temporary diagnostics job, which is removed afterwards.