API documentation for the EngineScript admin control panel. All endpoints are served from /api/ on the control panel host.

• Authentication & Security
• Rate Limiting
• Caching
• Endpoints
  • CSRF Token
  • System Info
  • Service Status
  • Sites
  • Sites Count
  • File Manager Status
  • Uptime Status
  • Uptime Monitors
  • Cache Clear
  • Cache Status
  • Batch Requests
• Error Responses

All API requests require an active PHP session (session-based authentication). Requests without a valid session receive a 403 Forbidden response.

CSRF Protection: State-changing methods (POST, PUT, DELETE, PATCH) require a valid CSRF token sent via:

• X-CSRF-Token request header, or
• _csrf_token parameter in the request body

Obtain a token from the GET /csrf-token endpoint. Token validation uses timing-safe comparison (hash_equals).

CORS: Same-origin only. Requests are restricted to the server's HTTP_HOST, localhost, and 127.0.0.1.

Security Headers: All responses include X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Content Security Policy.

• Limit: 100 requests per minute per IP address
• Tracking: Session-based with SHA-256 hashed IP
• Exceeded: Returns 429 Too Many Requests

Responses are cached using a file-based cache at /var/cache/enginescript/api/. Cache TTLs vary per endpoint (noted below). Cached responses include a X-Cache: HIT header.

Retrieve a CSRF token for use with state-changing requests.

{
  "csrf_token": "a1b2c3d4e5f6...64-char-hex-string",
  "token_name": "_csrf_token"
}

Get server operating system, kernel, and network information.

{
  "os": "Ubuntu 24.04 LTS",
  "kernel": "6.8.0-40-generic",
  "network": "hostname (192.168.1.1)"
}

Get status of core LEMP stack services (Nginx, PHP-FPM, MariaDB, Redis).

{
  "nginx": { "status": "online", "version": "1.27.4", "online": true },
  "php":   { "status": "online", "version": "8.4.1", "online": true },
  "mysql": { "status": "online", "version": "11.8.1", "online": true },
  "redis": { "status": "online", "version": "7.4.2", "online": true }
}

Note: The mysql key reports MariaDB status. The php key dynamically discovers the active php*-fpm service.

List all WordPress sites managed by EngineScript.

[
  {
    "domain": "example.com",
    "status": "online",
    "wp_version": "6.7.1",
    "ssl_status": "Enabled"
  }
]

Get the total number of managed WordPress sites.

{
  "count": 3
}

Note: /sites/ (with trailing slash) is an alias for /sites.

Check availability and configuration of the Tiny File Manager integration.

{
  "available": true,
  "config_exists": true,
  "writable_dirs": {
    "/var/www": true,
    "/tmp": true
  },
  "url": "/tinyfilemanager/tinyfilemanager.php",
  "version": "2.5.3"
}

Get a summary of UptimeRobot monitor status.

{
  "enabled": true,
  "overall_status": "healthy",
  "total_monitors": 5,
  "up": 4,
  "down": 1,
  "paused": 0
}

overall_status values: healthy, critical, partial, unknown

{
  "enabled": false,
  "reason": "UptimeRobot API not configured"
}

Get detailed information for each individual UptimeRobot monitor.

{
  "enabled": true,
  "total": 5,
  "monitors": [
    {
      "id": 12345,
      "name": "example.com",
      "url": "https://example.com",
      "status": 2,
      "status_text": "Up",
      "uptime_day": 99.99,
      "uptime_week": 99.95,
      "uptime_month": 99.90,
      "last_check": 1709300000
    }
  ]
}

Monitor status codes: 0 Paused, 1 Not checked yet, 2 Up, 8 Seems down, 9 Down

Clear one or more server-side caches. Requires CSRF token.

type may be sent as a query parameter or JSON body field. types is accepted for JSON clients. One of type or types is required.

{
  "success": true,
  "cleared": ["redis", "fastcgi"],
  "results": {
    "redis": { "success": true, "message": "Redis cache cleared successfully" },
    "fastcgi": { "success": true, "message": "FastCGI cache cleared successfully" }
  }
}

If invalid types are included, a warnings field is added:

{
  "warnings": {
    "invalid_types": ["foo"],
    "message": "Some requested cache types were invalid and ignored"
  }
}

Errors: 400 if type is empty or all types invalid. 405 if not POST.

Get the current status of all cache systems (Redis, FastCGI, OPcache).

{
  "redis": { ... },
  "fastcgi": { ... },
  "opcache": { ... }
}

Execute multiple API calls in a single request. Requires CSRF token.

{
  "requests": ["/system/info", "/services/status", "/sites"]
}

• Maximum 10 requests per batch
• Allowed endpoints: /system/info, /services/status, /sites, /sites/count, /tools/filemanager/status, /monitoring/uptime, /monitoring/uptime/monitors, /cache/status

{
  "results": {
    "/system/info": { "os": "Ubuntu 24.04 LTS", "kernel": "...", "network": "..." },
    "/services/status": { "nginx": { ... }, "php": { ... } }
  },
  "errors": {
    "/bad/endpoint": "Endpoint not allowed in batch requests"
  },
  "cached_count": 1
}

Errors: 400 if body invalid, missing requests array, or batch size exceeds 10. 405 if not POST.

All errors follow a consistent JSON structure:

{
  "error": "Error message description"
}