Search aliases with advanced filtering options

Add or remove addresses from an existing alias

Create a new firewall alias

Update an existing alias by ID

Delete an alias by ID. WARNING: This is irreversible.

Search certificates configured on pfSense with optional filtering

Create or import a certificate on pfSense

Import and internal generation use different API endpoints with different required fields, so this routes on method.

Update an existing certificate by ID (idempotent)

Delete a certificate by ID. WARNING: This is irreversible.

Generate a new certificate signed by an existing CA on pfSense

Renew an existing certificate by ID

Export a certificate in PKCS#12 format

Search Certificate Authorities (CAs) configured on pfSense

Create or import a Certificate Authority on pfSense

Import and internal generation use different API endpoints; this routes on method.

Update an existing Certificate Authority by ID (idempotent)

Delete a Certificate Authority by ID. WARNING: This is irreversible.

Search Certificate Revocation Lists (CRLs) configured on pfSense

Create a Certificate Revocation List (CRL) on pfSense

Update a Certificate Revocation List (CRL) by ID

Delete a Certificate Revocation List (CRL) by ID. WARNING: This is irreversible.

Search DHCP leases with advanced filtering

Search DHCP static mappings (reservations) with filtering

Create a DHCP static mapping (reservation)

Update an existing DHCP static mapping by ID

Delete a DHCP static mapping by ID. WARNING: This is irreversible.

Get DHCP server configuration including pool ranges, lease times, etc.

Update DHCP server configuration (pool range, lease times, etc.)

Search DHCP server address pools with filtering and pagination

Create a DHCP address pool for an interface

Update an existing DHCP address pool by ID

Delete a DHCP address pool by ID. WARNING: This is irreversible.

Search DHCP server custom options with filtering and pagination

Create a DHCP custom option

Update an existing DHCP custom option by ID

Delete a DHCP custom option by ID. WARNING: This is irreversible.

Apply pending DHCP server changes

Use this after making changes with apply_immediately=False to batch-apply them.

Update the DHCP server backend (ISC DHCP vs Kea)

Run a ping diagnostic from the pfSense firewall

Reboot the pfSense system. WARNING: This will cause a service interruption.

Halt (shut down) the pfSense system. WARNING: This will power off the system.

Get configuration history revisions with pagination

Get a specific configuration history revision by ID

Delete a configuration history revision by ID. WARNING: This is irreversible.

Search pf firewall tables with filtering and pagination

Get the contents of a specific pf firewall table

Restore pfSense configuration to a previous revision. WARNING: This replaces the running config.

Every destructive operation automatically captures the pre-change config revision ID. Use get_config_history to find the revision to restore.

Compare two configuration revisions to see what changed.

If revision_id_after is not provided, compares against the current running config.

Get the DNS Forwarder (dnsmasq) service settings

Search DNS Forwarder host overrides with filtering and pagination

Create a DNS Forwarder host override entry

Update an existing DNS Forwarder host override by ID

Delete a DNS Forwarder host override by ID. WARNING: This is irreversible.

Search aliases for a DNS Forwarder host override

Add or remove an alias for a DNS Forwarder host override

Apply pending DNS Forwarder changes

Use this after making changes with apply_immediately=False to batch-apply them.

Get the current DNS Resolver (Unbound) settings

Returns the full Unbound configuration including enable state, DNSSEC, forwarding mode, DHCP registration, and custom options.

Update DNS Resolver (Unbound) settings

Search DNS host overrides with filtering and pagination

Create a DNS host override entry

Update an existing DNS host override by ID

Delete a DNS host override by ID. WARNING: This is irreversible.

Search aliases for a specific DNS host override

Search DNS domain overrides with filtering and pagination

Create a DNS domain override entry

Update an existing DNS domain override by ID

Delete a DNS domain override by ID. WARNING: This is irreversible.

Search DNS Resolver access lists with pagination

Create a DNS Resolver access list entry

Apply pending DNS Resolver configuration changes

Sends a POST to the DNS Resolver apply endpoint to activate any pending host override, domain override, access list, or settings changes.

Update an existing DNS Resolver access list

Delete a DNS Resolver access list. WARNING: This is irreversible.

Search firewall rules with advanced filtering and pagination.

Find all firewall rules that block or reject traffic

Create a firewall rule on the live pfSense appliance.

WARNING: This modifies the running firewall configuration.

Move a firewall rule to a new position in the rule order

Update an existing firewall rule by ID

Delete a firewall rule from the live pfSense appliance. WARNING: This is irreversible.

Block multiple IP addresses on the live pfSense firewall. WARNING: Creates block rules.

Force apply pending firewall changes and recompile the pf ruleset.

Use this after any firewall config change to ensure the compiled ruleset (/tmp/rules.debug) matches the configuration. The apply_immediately parameter on other tools doesn't always trigger full recompilation.

Read the compiled pf ruleset (/tmp/rules.debug) to verify what pf is actually enforcing vs what's in config.xml.

Returns the raw compiled rules that the packet filter is using.

Search firewall schedules with filtering and pagination

Create a firewall schedule with an initial time range.

The pfSense API requires at least one time range at creation. Use create_schedule_time_range to add further ranges afterwards.

Update an existing firewall schedule by ID

Delete a firewall schedule by ID. WARNING: This is irreversible.

Search time ranges within a firewall schedule

Create a time range within a firewall schedule

Update an existing time range within a firewall schedule by ID

Delete a time range from a firewall schedule by ID. WARNING: This is irreversible.

Search firewall states (active connections) with filtering and pagination

Delete a specific firewall state (active connection) by ID. WARNING: This is irreversible.

Terminating a state will immediately drop the associated connection.

Get the current firewall state table size and limits

Returns the current number of active states and the configured maximum.

Get firewall advanced settings

Returns advanced firewall configuration including optimization mode, state timeout values, and other tuning parameters.

Search interface configurations with filtering and pagination

Create (assign) a network interface

Update an existing interface by ID

Delete (unassign) an interface by ID. WARNING: This is irreversible.

Apply pending interface changes

Use this after making changes with apply_immediately=False to batch-apply them.

Search VLANs with filtering and pagination

Create a VLAN

Update an existing VLAN by ID