Admin API Reference

Admin API — 181 IPTV Panel Actions

The Admin API exposes the full management surface of the XUI.live panel — 181 actions covering every resource an operator touches. If you can do it in the panel, you can do it here.

Authentication and response conventions are covered in the API overview. Every example below assumes:

BASE="https://your-panel.com/YOUR_ACCESS_CODE"
KEY="YOUR_API_KEY"

The CRUD pattern

Resources follow one uniform scheme, so once you know one, you know them all:

Operation	Action
List	`get_<plural>` — paginated with `start` / `limit`
Read one	`get_<singular>&id=N`
Create	`create_<x>`
Update	`edit_<x>&id=N`
Delete	`delete_<x>&id=N`

For create and edit, the accepted parameters are the columns of the underlying table, mapped automatically — plus the JSON selectors described in the gotchas below.

Lines — subscriber accounts

get_lines · get_line&id= · create_line · edit_line&id= · delete_line&id= · ban_line&id= · unban_line&id= · enable_line&id= · disable_line&id= · kill_connection

# Create a line (minimal)
curl "$BASE/?api_key=$KEY&action=create_line&username=client01&password=Secret123&member_id=3"
# => {"status":"STATUS_SUCCESS","data":{"id":"42","username":"client01"}}

curl "$BASE/?api_key=$KEY&action=get_line&id=42"
curl "$BASE/?api_key=$KEY&action=ban_line&id=42"
curl "$BASE/?api_key=$KEY&action=delete_line&id=42"

The parameters you will use most on create_line / edit_line: username, password, member_id (the owning account), package, exp_date, max_connections, is_trial, bouquets_selected (JSON array), allowed_ips, allowed_ua.

MAG devices

get_mags · get_mag&id= · create_mag · edit_mag&id= · delete_mag&id= · ban_mag&id= · unban_mag&id= · enable_mag&id= · disable_mag&id= · convert_mag&id= · mag_events

curl "$BASE/?api_key=$KEY&action=create_mag&mac=00:1A:79:AA:BB:CC&member_id=3"

Enigma2 devices

get_enigmas · get_enigma&id= · create_enigma · edit_enigma&id= · delete_enigma&id= · ban_enigma&id= · unban_enigma&id= · enable_enigma&id= · disable_enigma&id= · convert_enigma&id=

Panel users — admins, resellers, sub-resellers

get_users · get_user&id= · create_user · edit_user&id= · delete_user&id= · enable_user&id= · disable_user&id= · adjust_credits

curl "$BASE/?api_key=$KEY&action=create_user&username=reseller1&password=Secret123&member_group_id=2"
curl "$BASE/?api_key=$KEY&action=adjust_credits&id=7&credits=100"

Live streams

get_streams · get_stream&id= · create_stream · edit_stream&id= · delete_stream&id= · start_stream&id= · stop_stream&id=

curl "$BASE/?api_key=$KEY&action=create_stream&stream_display_name=My+Channel"
curl "$BASE/?api_key=$KEY&action=start_stream&id=10"   # starts the encoder
curl "$BASE/?api_key=$KEY&action=stop_stream&id=10"

Add the source in the create payload or afterwards with edit_stream (stream_source as JSON).

Channels, movies, series, episodes, radio

The same CRUD scheme, plus start_ / stop_ where a process is involved:

Channels — get_channels, get_channel&id=, create_channel, edit_channel&id=, delete_channel&id=, start_channel&id=, stop_channel&id=
Movies (VOD) — get_movies, get_movie&id=, create_movie, edit_movie&id=, delete_movie&id=, start_movie&id=, stop_movie&id=
Series — get_series_list, get_series&id=, create_series, edit_series&id=, delete_series&id=
Episodes — get_episodes, get_episode&id=, create_episode, edit_episode&id=, delete_episode&id=, start_episode&id=, stop_episode&id=
Radio stations — get_stations, get_station&id=, create_station, edit_station&id=, delete_station&id=, start_station&id=, stop_station&id=

create_channel and create_station return STATUS_NO_SOURCES when no source is supplied. create_episode requires series, season_num and a valid source.

Providers

get_providers · get_provider&id= · create_provider · edit_provider&id= · delete_provider&id= · reload_provider&id= · get_provider_streams

curl "$BASE/?api_key=$KEY&action=create_provider&name=MyProvider&ip=1.2.3.4&port=8080&username=u&password=p"

Categories, bouquets, packages, groups

Categories — get_categories, get_category&id=, create_category (category_name, category_type = live / movie / series / radio), edit_category&id=, delete_category&id=
Bouquets — get_bouquets, get_bouquet&id=, create_bouquet (bouquet_name), edit_bouquet&id=, delete_bouquet&id=
Packages — get_packages, get_package&id=, create_package (package_name plus groups_selected, bouquets_selected), edit_package&id=, delete_package&id=
Groups — get_groups, get_group&group_id=, create_group (group_name plus permissions_selected, groups_selected, packages_selected), edit_group&group_id=, delete_group&id=

EPG, transcode profiles, access codes, HMAC, RTMP, watch folders

EPG — get_epgs, get_epg&id=, create_epg (epg_name, epg_file), edit_epg&id=, delete_epg&id=, reload_epg
Transcode profiles — get_transcode_profiles, get_transcode_profile&id=, create_transcode_profile (profile_name), edit_transcode_profile&id=, delete_transcode_profile&id=
Access codes — get_access_codes, get_access_code&id=, create_access_code (code, minimum 8 characters unless type is 2, plus type), edit_access_code&id=, delete_access_code&id=
HMAC — get_hmacs, get_hmac&id=, create_hmac (requires key), edit_hmac&id=, delete_hmac&id=
RTMP IPs — get_rtmp_ips, get_rtmp_ip&id=, create_rtmp_ip (ip), edit_rtmp_ip&id=, delete_rtmp_ip&id=, get_rtmp_stats
Watch folders — get_watch_folders, get_watch_folder&id=, create_watch_folder, edit_watch_folder&id=, delete_watch_folder&id=, reload_watch_folder

Servers and system

get_servers · get_server&id= · install_server · edit_server&id= · delete_server&id= · get_server_stats · get_certificate_info · get_free_space · get_fpm_status · get_pids · install_proxy · edit_proxy

curl "$BASE/?api_key=$KEY&action=get_server_stats"   # cpu, cpu_cores, ram, network...
curl "$BASE/?api_key=$KEY&action=get_free_space"

Blocking

get_blocked_ips · add_blocked_ip (ip) · delete_blocked_ip · flush_blocked_ips · get_blocked_isps · add_blocked_isp · delete_blocked_isp · get_blocked_uas · add_blocked_ua (ua) · delete_blocked_ua

Logs and monitoring

activity_logs · client_logs · credit_logs · login_logs · user_logs · system_logs · restream_logs · stream_errors · live_connections · watch_output · mag_events

All paginated with start / limit, all in the envelope shape with recordsTotal.

Settings and utilities

get_settings / edit_settings — read and write panel settings
get_directory&path=/... — list a directory through the panel’s file browser
reload_cache, reload_nginx, reload_epg, clear_streams, clear_temp — maintenance
kill_pid&pid=, kill_connection — force-stop a process or a connection
mysql_query&query=... — run raw SQL against the panel database, admin only

Destructive actions run immediately, with no confirmation step: delete_server, install_server, install_proxy, reload_nginx, kill_pid, clear_streams, clear_temp, flush_blocked_ips and any non-SELECT mysql_query. Point your integration at a test panel first.

Developer notes

delete_group and delete_transcode_profile take id, even though their create, get and edit counterparts use group_id / profile_id. Send id= when deleting.
JSON selectors — bouquets_selected, groups_selected, packages_selected, permissions_selected, devices_selected, users_selected — are JSON array strings: bouquets_selected=[1,2,3]. On edit, omitting a selector resets it to empty, so always send the full desired state, exactly as the panel form does.
create_access_code — code must be at least 8 characters when type is not 2; pass groups[] for types 0, 1, 3 and 4.
create_hmac requires key; create_channel and create_station require a source.
Pagination applies to table endpoints — get_lines, get_streams, get_users, the logs. Lookup getters return the full raw array in one response.
Trim payloads with show_columns / hide_columns when polling frequently.

Building reseller-facing tools instead? The Reseller API is the same mechanism, scoped to a reseller’s own clients.