System Settings & Terminalv7.0.20

These endpoints configure the appliance itself: its network interfaces, hostname and the local DNS map, the monitored local networks (the ranges the discovery scanner sweeps), the system clock and time zone, the SMTP relay used to send alert email, the product license, the HTTPS certificate, the custom-protocol port labels, the downloadable satellite installers, and the running daemon services. It also exposes a few diagnostic actions — read an appliance health snapshot, restart the monitoring stack, pull a log archive, and create or download a full backup.

These endpoints belong to the system functional area; an MCP or OAuth token needs the mcp:system scope. Most endpoints additionally require the calling user to hold the system permission. Four certificate endpoints are super-admin-only and require the sa permission instead — this is called out on each. These are appliance-wide settings with no tag anchor, so tag-scoping does not apply here; every system-permission user sees the same configuration.

Services

Read the running service table and control individual daemons or the whole monitoring stack.

List services

GET/api/manageNetmonServicessystem

Returns the current state of every monitored service as reported by the service controller. Use it to render a services dashboard or to confirm a daemon is running before acting on it.

Response 200

{
  "status": 201,
  "hasError": false,
  "data": {
    "services": [
      { "name": "snmpmond", "status": "running", "pid": "4123" }
    ]
  }
}

The per-service object keys are whatever attributes the service controller reports for each entry. If the controller cannot be reached the response is {"status": false, "hasError": true, "message": "Cannot communicate with service controller."}.

Start, stop, or restart a service

POST/api/procmonsystem

Sends a control signal to a single daemon through the process supervisor.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "OK" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/procmon \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"service":"snmpmond","action":"restart"}'

Restart the monitoring stack

POST/api/restartNetmonsystem

Restarts the entire Netmon service (every daemon at once). There is no request body.

Response 200

{ "status": 200, "hasError": false, "message": "Netmon restarted successfully" }

Errors

Network interfaces

Read and write the appliance’s local network-interface configuration. Writes rewrite the per-interface config files and restart networking.

Get network interfaces

POST/api/getNetworkInfosystem

Lists every non-loopback interface with its live addresses and its persisted configuration (addressing mode, gateway, DNS servers, and whether the interface is assigned to packet capture or to the intrusion-detection engine). Despite the POST verb it takes no request body.

Response 200

{
  "status": 201,
  "hasError": false,
  "interfaces": [
    {
      "name": "eth0",
      "ipv4": [ { "address": "10.0.0.5", "netmask": "255.255.255.0" } ],
      "ipv6": [],
      "online": true,
      "config": {
        "allow-hotplug": false,
        "auto": true,
        "type": "static",
        "address": "10.0.0.5",
        "netmask": "255.255.255.0",
        "gateway": "10.0.0.1",
        "dns-nameservers": ["10.0.0.1", "1.1.1.1"],
        "use_sniffer": true,
        "use_suricata": false
      }
    }
  ]
}

An interface with no saved config file reports config.type as "unconfigured" with empty addressing fields. On failure the response is {"status": false, "hasError": true, "message": "..."}.

Set network interfaces

POST/api/setNetworkInfosystem

Rewrites the configuration for one or more interfaces and restarts networking. Submit the same shape returned by getNetworkInfo — an interfaces array, each element carrying a name and a config object.

Request body

All operator-supplied fields are validated against strict patterns; an invalid value rejects the whole request (no partial writes). Addressing values must be real IP literals.

Response 200

{ "status": 201, "hasError": false }

On error (validation failure or a failed systemctl restart networking) the response is {"status": false, "hasError": true, "message": "..."}.

Hostname & DNS

Set the appliance hostname and maintain the local hostname-to-IP map used to resolve names that aren’t in DNS.

Get hostname

GET/api/getHostnamesystem

Returns the appliance’s current hostname.

Response 200

{ "status": 200, "hasError": false, "hostname": "netmon-prod" }

Set hostname

POST/api/setHostnamesystem

Changes the appliance hostname via hostnamectl.

Request body

Response 200

{ "status": 201, "message": "Hostname successfully updated", "hostname": "netmon-prod" }

Errors

List host map entries

POST/api/getHostnamessystem

Returns the local hostname database (static name-to-IP records), paginated.

Request body

The body is a JSON-encoded paginated result of host rows (id, ip, hostname, host_name_type, node_type, timestamp). On error the {"status": false, "hasError": true, "message": "..."} envelope is returned.

Create a host map entry

POST/api/createHostnamesystem

Adds a static hostname record. The combination of ip + hostname + host_name_type + node_type is checked for duplicates first.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

If a matching record already exists the response is {"status": false, "hasError": true, "message": "..."} (already exists).

Update a host map entry

POST/api/updateHostnamesystem

Updates an existing host record by id.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

Delete a host map entry

POST/api/deleteHostsystem

Removes a host record by id.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

A non-positive id returns {"message": "..."} (invalid identifier); a missing record returns {"hasError": true, "message": "..."}.

Local networks

Local networks (“localnets”) are the IP ranges the discovery scanner sweeps for new hosts. Each carries a label, a network/broadcast pair, a scan interval, and toggles for discovery and port scanning.

List local networks

GET/api/getLocalnetssystem

Returns every non-ephemeral local network with its settings, associated credential ids, and any attached legacy alerts.

Response 200

{
  "data": [
    {
      "id": 7,
      "label": "Office LAN",
      "network": "10.0.0.0",
      "broadcast": "10.0.0.255",
      "interval": 3600,
      "enable_discovery": true,
      "enable_portscan": false,
      "cred_ids": [3, 5],
      "alerts": null,
      "timestamp": 1718000000
    }
  ]
}

If there are no rows the endpoint returns false. On error it returns the {"status": false, "hasError": true, "message": "..."} envelope.

Create or update local networks

POST/api/updateLocalnetsystem

Upserts one or more local networks in a single call. Each element with no id is created; each with an id is updated. Credential associations are replaced wholesale from cred_ids.

Request body

The subnet size (broadcast − network + 1) is capped at /16 (65,536 addresses); larger ranges must be split into multiple rows. One out-of-spec row rejects the whole batch.

Response 200

{ "status": 201, "hasError": false, "message": "OK" }

Errors

Reset discovery timestamp

POST/api/resetDiscoveryTssystem

Forces a full re-scan of one local network on the next discovery cycle by zeroing its last-scanned timestamp.

Request body

Response 200

{ "status": 201, "hasError": false }

A missing id returns {"status": false, "hasError": true, "message": "Invalid request parameters"}.

Delete a local network

POST/api/deleteLocalnetsystem

Removes a local network by id.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

A non-positive id returns {"message": "..."} (invalid identifier); a missing record returns {"hasError": true, "message": "..."}.

System time

Read the time configuration (time zone, NTP vs. manual mode, available zones) and set it.

Get time settings

GET/api/getTimeSettingssystem

Returns the current time zone, sync mode, configured NTP server (if any), the list of selectable time zones, and the appliance’s current Unix time.

Response 200

{
  "status": 201,
  "hasError": false,
  "data": {
    "tzs": ["Africa/Abidjan", "America/New_York", "..."],
    "tz": "America/New_York",
    "type": "ntp",
    "ntpserver": "pool.ntp.org",
    "time": 1718000000
  }
}

type is ntp or manual. ntpserver is present only in NTP mode. On error the {"status": false, "hasError": true, "message": "..."} envelope is returned.

Set time settings

POST/api/setTimeSettingssystem

Sets the time zone and either enables NTP with a server list or sets the clock manually.

Request body

In NTP mode each server entry is validated as a hostname or IP literal. In manual mode NTP is disabled and the clock is set directly.

Response 200

{ "status": 201, "hasError": false, "message": "..." }

On any failure the {"status": false, "hasError": true, "message": "..."} envelope is returned.

SMTP / email

A single endpoint handles reading, writing, and testing the SMTP relay used to send alert email. The behavior is selected by the action field.

Read, set, or test SMTP settings

POST/api/smtpSettingssystem

One endpoint, three actions:

• action: "get" — return the current SMTP configuration (with the password masked).
• action: "set" — persist new SMTP configuration.
• action: "test" — queue a test email to the calling user’s address.

Request body (get)

Request body (set)

Request body (test)

Response 200 (get)

{
  "status": 201,
  "hasError": false,
  "smtp": {
    "sender": "Netmon Alerts",
    "email": "alerts@example.com",
    "server": "smtp.example.com",
    "port": "587",
    "auth": "1",
    "usessl": "1",
    "authname": "alerts@example.com",
    "authpass": { "__encrypted__": true }
  }
}

Response 200 (set / test)

{ "status": 201, "hasError": false, "smtp": "Success" }

For a test, smtp is a message such as "Test email queued (id: 42)". An unknown action, a missing mail daemon, or an encryption failure returns {"status": false, "hasError": true, "message": "..."}.

Example (read SMTP settings)

curl -sS -X POST https://APPLIANCE/api/smtpSettings \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"action":"get"}'

Example (write SMTP settings)

curl -sS -X POST https://APPLIANCE/api/smtpSettings \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"action":"set","sender":"Netmon Alerts","email":"alerts@example.com",
       "smtpserver":"smtp.example.com","port":587,"auth":true,"usessl":true,
       "authname":"alerts@example.com","authpass":"s3cret"}'

Licensing

Read the product license and activate the appliance with a registration key.

Get license info

GET/api/getLicenseInfosystem

Returns the license record(s): company, license type, and the end-of-license / end-of-maintenance dates.

Response 200

{
  "status": 201,
  "hasError": false,
  "data": [
    {
      "company_name": "Acme Corp",
      "user_name": "admin",
      "user_email": "admin@example.com",
      "activation_key": "ABCDEF-012345-6789AB-CDEF01-234567-89ABCD",
      "license_type": "perpetual",
      "active": true,
      "activation_time": 1700000000,
      "end_of_license": 1800000000,
      "end_of_maintenance": 1800000000
    }
  ]
}

data is an empty array when the appliance is unlicensed. On error the response is {"status": false, "message": "..."}.

Example

curl -sS https://APPLIANCE/api/getLicenseInfo \
  -H "Authorization: Bearer $TOKEN"

Validate / apply a registration key

POST/api/validateLicensesystem

Stores a new activation key and restarts the monitoring stack so the new license takes effect.

Request body

Response 200

{ "status": 201, "hasError": false, "message": { "activation_key": "ABCDEF-..." } }

Errors

HTTPS certificate

The certificate endpoints manage the TLS certificate Apache serves the web UI and API over. All four require the sa (super-admin) permission, not the system permission used by the rest of these endpoints, and they return real HTTP status codes.

Get certificate info

GET/api/getCertificatesa

Permission sa (super-admin)

Returns parsed details of the installed certificate.

Response 200

{
  "subject": { "CN": "netmon.example.com" },
  "issuer": { "CN": "Let's Encrypt R3", "O": "Let's Encrypt" },
  "validFrom": "2026-01-01 00:00:00",
  "validTo": "2026-04-01 00:00:00"
}

Errors

Extract a certificate file

POST/api/extractCertificatesa

Permission sa (super-admin)

Parses an uploaded certificate file — a PEM (optionally with an encrypted key), a DER certificate, or a PKCS#12 (.pfx/.p12) bundle — and returns the extracted PEM certificate chain and private key for review before saving. Nothing is persisted. Send the file as multipart/form-data.

Request body (multipart/form-data)

Response 200

{
  "status": 200,
  "certificate": "-----BEGIN CERTIFICATE-----\n...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n..."
}

Errors

Verify a certificate and key

POST/api/verifyCertificatesa

Permission sa (super-admin)

Validates that a certificate (or full chain) and a private key are well-formed and that they match — without saving anything.

Request body

Response 200

{ "status": 200, "message": "ok" }

Errors

Save a certificate

POST/api/saveCertificatesa

Permission sa (super-admin)

Verifies the certificate and key (same checks as verifyCertificate) and, if they pass, writes them to disk so Apache serves them after its next restart.

Request body

Response 201

{ "status": 201, "message": "ok" }

Errors

Returns the same 400 verification errors as verifyCertificate when the certificate/key fail validation.

Custom protocols

Custom protocols are operator-defined labels that name a port/protocol pair so traffic to that port is shown with a friendly name throughout the UI.

List custom protocols

POST/api/getProtocolssystem

Returns the protocol labels, paginated. Despite the POST verb this is a read.

Request body

The body is a JSON-encoded paginated result of protocol rows (id, port, protocol, name). On error the {"status": false, "hasError": true, "message": "..."} envelope is returned.

Get one custom protocol

POST/api/getProtocolsForSinglesystem

Fetches a single protocol label by id.

Request body

Response 200

{
  "status": 201,
  "hasError": false,
  "data": { "id": 12, "port": 8443, "protocol": "tcp", "name": "Admin Console" }
}

A missing record returns {"status": false, "hasError": true, "message": "..."}.

Create a custom protocol

POST/api/createProtocolssystem

Adds a protocol label. The protocol + port + name combination is checked for duplicates first.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

A duplicate returns {"status": false, "hasError": true, "message": "..."} (already exists).

Update a custom protocol

POST/api/updateProtocolsystem

Updates a protocol label by id.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

Delete a custom protocol

POST/api/deleteProtocolsystem

Removes a protocol label by id.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "..." }

A non-positive id returns {"message": "..."} (invalid identifier); a missing record returns {"hasError": true, "message": "..."}.

Downloadables

The appliance bundles operator-facing satellite installers and reference documents (the Windows agent, the Wireshark plugin, the product guide, the API reference). These two endpoints list and stream them.

List downloadables

GET/api/downloadablessystem

Returns the catalog grouped by category, each with the files staged on the appliance.

Response 200

{
  "categories": [
    {
      "key": "windows-agent",
      "label": "Windows Agent",
      "description": "Installer for the Netmon Windows agent.",
      "files": [
        { "filename": "netmon-agent-installer-7.0.20-amd64.exe", "size": 5242880, "mtime": 1718000000 }
      ]
    }
  ]
}

A category with nothing staged returns an empty files array.

Download a file

GET/api/downloadables/{category}/{filename}system

Streams one staged file as a binary download.

Path parameters

Response 200 — the file body, Content-Type: application/octet-stream, served as an attachment named after the file.

Errors

Example

curl -sS https://APPLIANCE/api/downloadables/windows-agent/netmon-agent-installer-7.0.20-amd64.exe \
  -H "Authorization: Bearer $TOKEN" -o netmon-agent.exe

System health

A read-only self-diagnostic snapshot of the appliance, plus the one repair it offers. These are the endpoints behind the Settings → System → System Health card.

Get the health snapshot

GET/api/system/healthsystem

Runs every appliance self-check and returns one snapshot. Unlike most endpoints in this chapter it uses a plain JSON envelope, not {"status":201,...}. The call never fails on a bad probe: a check that cannot be evaluated is reported with severity unknown rather than raising an error, and the whole snapshot is bounded by a short wall-clock budget so it stays fast on loaded hardware.

Checks are grouped into four groups — scheduler (Scheduled Maintenance), storage (Storage), alerts (Alert Delivery), and platform (Platform). Every check and group carries a severity from ok, warn, crit, unknown — a group takes the worst severity among its checks, and overall the worst among the groups.

Response 200

{
  "overall": "warn",
  "generated_at": "2026-08-10T14:02:11+00:00",
  "groups": [
    {
      "id": "scheduler",
      "label": "Scheduled Maintenance",
      "severity": "warn",
      "checks": [
        {
          "id": "cron.parked",
          "label": "Scheduled jobs enabled",
          "severity": "warn",
          "summary": "3 of 11 scheduled jobs are disabled.",
          "detail": "Disabled: rotate_syslog_partition, cleanup_db, cleanup_hosts_geoip",
          "hint": "This is the signature of an interrupted package upgrade. …",
          "action": "cron-reenable"
        }
      ]
    },
    {
      "id": "storage",
      "label": "Storage",
      "severity": "ok",
      "checks": [
        {
          "id": "storage.backups",
          "label": "Database backups",
          "severity": "ok",
          "summary": "Most recent backup is 2 days old.",
          "link": { "kind": "anchor", "target": "nm-sys-card-backups" }
        }
      ]
    }
  ]
}

Check fields

Example

curl -sS https://APPLIANCE/api/system/health \
  -H "Authorization: Bearer $TOKEN"

Re-enable parked scheduled jobs

POST/api/system/health/cron-reenablesystem

Re-enables every disabled database scheduled job. An interrupted package upgrade can leave them all switched off, which stops partition rotation and every retention janitor. This is the remediation behind the cron-reenable action. Takes no request body, and is idempotent — a second call re-enables nothing and reports 0.

Response 200

{ "ok": true, "reenabled": 3 }

Example

curl -sS -X POST https://APPLIANCE/api/system/health/cron-reenable \
  -H "Authorization: Bearer $TOKEN"

Diagnostics & logs

Pull a diagnostic log archive and manage full appliance backups.

Download log archive

GET/api/downloadLogssystem

Builds and streams a ZIP of every file under the appliance log directory. Useful when attaching diagnostics to a support ticket.

Response 200 — a ZIP file, Content-Type: application/zip, attachment named logs.zip.

Errors

Example

curl -sS https://APPLIANCE/api/downloadLogs \
  -H "Authorization: Bearer $TOKEN" -o logs.zip

Create a full backup

POST/api/createFullBackupsystem

Dumps the database and the appliance configuration into a compressed archive in the backup directory. Guarded by an advisory lock so concurrent calls don’t collide.

Response 200

{ "status": 201, "hasError": false, "message": "Backup created successfully" }

If a backup is already running, or the database dump / archiving step fails, the response is {"hasError": true, "message": "..."}.

List backups

GET/api/backupssystem

Lists the backup archives on disk with their sizes and timestamps.

Response 200

{
  "backups": [
    { "name": "bk-1718000000.tgz", "size": 10485760, "date": "2026-06-10 04:00:00" }
  ]
}

Download a backup

GET/api/backups/{filename}system

Streams one backup archive as a binary download.

Path parameters

Response 200 — the file body, Content-Type: application/octet-stream, served as an attachment named after the file.

Errors

Delete a backup

DELETE/api/backups/{filename}system

Deletes a backup archive from disk.

Path parameters

Response 200

{ "message": "Backup deleted successfully.", "hasError": false }

Errors

Alert templates

Read and edit the saved alert email templates (the per-alert-type message bodies). These are exposed here because they are configured from the system settings surface.

List alert templates

GET/api/getAlertTemplatessystem

Returns every alert type with its template fields.

Response 200

{
  "status": 200,
  "hasError": false,
  "data": [
    { "id": 1, "name": "Device Down", "template_up": "...", "template_down": "..." }
  ]
}

Update an alert template field

POST/api/setAlertTemplatesystem

Updates a single template field on one alert type.

Request body

Response 200

{ "status": 201, "hasError": false, "data": { "id": 1, "template_up": "..." } }

An unknown alert type or an invalid field returns {"status": 400, "hasError": true, "message": "..."}.

System Terminal

The appliance ships an in-browser terminal — a web shell rendered inside the Netmon UI. The single endpoint below is the reverse proxy that bridges the browser to that on-box terminal service. It is not a REST endpoint and is not meant for scripting; it exists so the SPA’s Terminal pane can talk to the local terminal over the same authenticated origin as the rest of the UI.

This endpoint belongs to the system functional area (mcp:system scope), but unlike the rest of the API it authenticates against a browser web session, not a bearer token, and is gated by the system permission.

Proxy to the on-box terminal

ANY/api/term/proxy/{path?}system

Permission system

A transparent reverse proxy to the appliance’s local terminal service. Every HTTP method is accepted, and the optional trailing {path?} (including slashes) is forwarded verbatim along with the request method, headers, body, and query string. The upstream response — status, headers, and body — is returned unchanged. This carries the terminal’s HTML, JavaScript, and its interactive request/response traffic; the payloads are terminal protocol data, not JSON.

Path parameters

Response

The upstream terminal service’s response, proxied through unchanged (status code, headers, and body). Content type is whatever the terminal emits (HTML, JavaScript, or terminal stream data) — not a JSON envelope.

Errors