Apache APISIX Admin API

Retrieve all configured routes. Supports filtering by name, label, uri, or filter expression. Results include full route configuration and metadata (creation/update timestamps).

Create a new route with an auto-generated ID. A route must include at least a uri and one of: upstream (inline), upstreamid, serviceid, or plugins.

Create a new route with a specified ID, or fully replace an existing route. Note: This is a full replacement — all fields must be provided. Use PATCH for partial updates.

Retrieve a single route by its ID.

Partially update a route's configuration. Only the fields included in the request body are modified; all other fields remain unchanged. Tip: Use this to update a single field (e.g., change the upstream) without resending the entire route configuration.

Delete a route by its ID. This action is irreversible.

Replaces the value at subpath within the route document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve all configured upstreams.

Create a new upstream with an auto-generated ID.

Create a new upstream with a specified ID, or fully replace an existing upstream.

Partially update an upstream's configuration.

Retrieve a single upstream by its ID.

Delete an upstream by its ID. Fails if the upstream is still referenced by a route or service.

Replaces the value at subpath within the upstream document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve all configured services.

Create a new service with an auto-generated ID.

Retrieve a single service by its ID.

Create a new service with a specified ID, or fully replace an existing service.

Partially update a service's configuration.

Delete a service by its ID.

List decorations owned by this service. A service with no decorations returns 404 rather than an empty list.

Create a decoration with an automatically generated ID. The service must exist. Ownership is taken from the URL; omit serviceid in the body. Keep fieldpath unique within a service, and serialize concurrent writes for the service.

Replace the complete decoration or create it if absent. The service must exist. Ownership is taken from the URL; a conflicting serviceid in the body is rejected. Keep fieldpath unique within a service, and serialize concurrent writes for the service.

Merge fields into an existing decoration. serviceid cannot be patched, even to its existing value. A changed fieldpath must not duplicate another decoration on the service. JSON subpath patching is not supported for this subresource.

Replaces the value at subpath within the service document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Create a new consumer or update an existing one. The consumer is identified by username in the request body.

Retrieve all configured consumers.

Retrieve a single consumer by username.

Delete a consumer by username. This also deletes all associated credentials.

Retrieve all configured consumer groups.

Create a new consumer group with a specified ID, or fully replace an existing one.

Retrieve a single consumer group by its ID.

Partially update a consumer group's configuration.

Delete a consumer group by its ID.

Replaces the value at subpath within the consumer group document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve all credentials for a specific consumer.

Retrieve a specific credential for a consumer.

Create a new credential for a consumer with a specified ID, or replace an existing one. Each credential holds exactly one authentication plugin.

Delete a specific credential from a consumer.

Get a list of all available plugin names, optionally filtered by subsystem (http or stream).

Retrieve the JSON Schema definition for a specific plugin. This is useful for validating plugin configurations before applying them.

Get attributes of all plugins configured on the APISIX instance. > Deprecated: This endpoint is being replaced. Use GET /plugins/list and GET /plugins/{pluginname} instead.

Trigger a hot reload of all plugins. This re-reads plugin configurations from etcd without restarting APISIX. Important: Only the PUT method is accepted.

Retrieve all configured plugin configs.

Create a new plugin config with a specified ID, or fully replace an existing one.

Retrieve a single plugin config by its ID.

Partially update a plugin config's configuration.

Delete a plugin config by its ID.

Replaces the value at subpath within the plugin config document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve metadata for all plugins that have metadata configured.

Set metadata for a specific plugin. This applies to all instances of the plugin across the cluster.

Retrieve metadata for a specific plugin by plugin name.

Delete metadata for a specific plugin.

Retrieve all configured global rules.

Create a new global rule with a specified ID, or fully replace an existing one.

Retrieve a single global rule by its ID.

Partially update a global rule's configuration.

Delete a global rule by its ID.

Replaces the value at subpath within the global rule document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve all configured stream (L4) routes. Prerequisite: Stream mode must be enabled in config.yaml.

Create a new stream route with an auto-generated ID.

Get stream route by ID.

Create a stream route with a specified ID.

Delete a stream route by ID.

Retrieve all configured SSL certificates. Private keys are not included in the response for security.

Upload a new SSL certificate with an auto-generated ID.

Upload a new SSL certificate with a specified ID, or replace an existing one.

Retrieve a single SSL certificate by its ID. The private key is not included in the response.

Partially update an SSL certificate's configuration. Only the fields included in the request body are modified; all other fields remain unchanged.

Delete an SSL certificate by its ID.

Replaces the value at subpath within the SSL certificate document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Retrieve all configured secret manager integrations.

Retrieve a specific secret manager configuration.

Configure a secret manager integration with a specified ID.

Partially update a secret manager configuration.

Delete a secret manager configuration.

Returns secrets registered under the given manager (vault, aws, or gcp). For listing across all managers, use GET /apisix/admin/secrets.

Replaces the value at subpath within the secret document with the request body. The body is any valid JSON value, not necessarily an object. The updated complete resource must pass validation.

Upload a protobuf definition with a specified ID, or replace an existing one.

Retrieve a single protobuf definition by its ID.

Delete a protobuf definition by its ID.

Retrieve all stored protobuf definitions.

Upload a new protobuf definition with an auto-generated ID.

Validate a resource configuration against APISIX's JSON Schema without creating the resource. Useful for dry-run validation in CI/CD pipelines. The {resource} path parameter specifies the resource type (e.g., routes, upstreams, services, etc.).

Validates a declarative APISIX configuration when the deployment uses either the etcd or yaml configuration provider. The endpoint accepts JSON and YAML request bodies up to 1.5 MiB and uses the normal Admin API authentication. Validation covers known resource arrays, numeric confversion fields, duplicate resource identifiers, resource JSON Schemas, and plugin checkschema functions. All detected errors are returned together. Cross-resource existence is not checked, so a reference such as an upstreamid can pass even when the referenced resource is absent. The operation does not persist or apply any configuration.

Returns the JSON Schema document used internally by APISIX to validate the named resource type.

Equivalent to GET /apisix/admin/plugins/{pluginname}. Provided for symmetry with GET /apisix/admin/schema/{resource}.

Returns 200 OK if the Admin API is reachable. Useful as a Kubernetes liveness probe target. This endpoint does not require authentication.

Available in API-driven standalone mode, with the YAML configuration provider and Admin API enabled. Returns the accepted configuration snapshot and its version and digest metadata, not a worker synchronization report. See API-Driven Standalone Mode Usage.

Replace the complete configuration snapshot in API-driven standalone mode. Omitted resources are removed unless their resource type's configuration version is explicitly retained. Validate the complete document before applying it. A client-supplied X-Digest is required and must change when the intended configuration changes. APISIX compares the supplied identifier, not a computed hash. A matching digest skips the update and any wait. APISIX supports an optional bounded wait for local worker synchronization; this does not verify other instances or upstream health. See API-Driven Standalone Mode Usage.

Returns 200 OK when the API-driven standalone configuration endpoint is reachable, including before any snapshot is loaded. When available, digest and last-modified metadata are returned in headers. This endpoint does not confirm worker synchronization.