List all WireGuard clients of the wg-easy instance, including their status (enabled/expired), addresses and traffic statistics.

Get the full details of a single WireGuard client.

Create a new WireGuard client. Keys and IP addresses are generated by wg-easy. Returns the new client ID.

Update a WireGuard client. Only the provided fields are changed; all other settings are preserved.

Enable a WireGuard client so it can connect again.

Disable a WireGuard client. The client keeps its configuration but can no longer connect.

Permanently delete a WireGuard client. This is irreversible: the client loses VPN access and its keys cannot be restored. The first call returns a short-lived confirmation token; ask the user for confirmation, then call again with confirmToken.

Get the WireGuard configuration file (wg .conf format) for a client. SENSITIVE: the output contains the client private key — treat it as a secret and do not repeat it unnecessarily.

Get the client configuration as a QR code (SVG markup) for scanning with the WireGuard mobile app. SENSITIVE: the QR code encodes the client private key — treat it as a secret.

Generate a one-time download link for a client configuration that can be shared with the end user. Requires WG_ENABLE_ONE_TIME_LINKS to be enabled on the wg-easy instance. SENSITIVE: anyone with the link can download the full client configuration without authentication — share it only with the intended user.

Get information about the wg-easy instance: release/update status, general settings and the WireGuard interface configuration. Secret fields (private keys, passwords) are redacted.