Skip to content

RADIUS#

RADIUS server pool health: live/dead state and per-server counters.

1 operation. Roles, error format and pagination are common to the whole API — see the REST API overview.

Authentication

Use a named bearer token. Every endpoint except POST /api/v1/auth/login, POST /api/v1/auth/enrol and GET /api/v1/system/health requires one. A super-user creates a token with POST /api/v1/auth/tokens; the plaintext (bngtok_…) is returned exactly once at creation and only a SHA-256 hash is stored on the appliance, so a lost token is replaced rather than recovered. Send it on every request:

Authorization: Bearer bngtok_…

Each token carries a fixed role (read-only, operator or super-user) and is exempt from CSRF checks. This is the single credential you need for scripts, integrations and monitoring.

Accounts and tokens share one identity model with the appliance CLI (login.users). Repeated authentication failures lock the account/source-IP pair out temporarily (HTTP 423 on login).

Session cookies (bundled web UI only)

The appliance also accepts an interactive session cookie, which is how the bundled web UI authenticates. It is documented for completeness — API clients should not use it. It is bound to a login session and obliges the caller to manage a CSRF token, neither of which suits automation.

POST /api/v1/auth/login with username + password (and a TOTP code when enrolled) sets the bng_session cookie and returns a csrfToken (also available from GET /api/v1/auth/whoami). Cookie-authenticated mutating requests (anything other than GET/HEAD/OPTIONS) must also send that value in the X-CSRF-Token header or they are rejected with 403.

NetavoBNG Management API v1#

Contact: Netavo

RADIUS#

GET /api/v1/radius/servers#

RADIUS server pool status.

Description

Live/dead counts for the pool and per-server health: dead-marking state, consecutive failures, request counters, and last success/failure timestamps. configured: false means no RADIUS auth driver is running on this appliance (the server list is then empty). Fleet-proxyable.

Input parameters

Parameter In Type Default Nullable Description
bearerToken header string N/A No Named API token — the recommended credential for automation. See Authentication in the API overview.

Responses

{
    "configured": true,
    "totalServers": 2,
    "liveServers": 2,
    "deadServers": 0,
    "servers": [
        {
            "host": "10.20.2.20",
            "port": 1812,
            "weight": 10,
            "isDead": false,
            "consecutiveFailures": 0,
            "requestsSent": 184203,
            "lastFailure": null,
            "lastSuccess": "2026-08-03T10:24:09Z"
        }
    ]
}
Schema of the response body 
{
    "required": [
        "configured",
        "totalServers",
        "liveServers",
        "deadServers",
        "servers"
    ],
    "type": "object",
    "properties": {
        "configured": {
            "type": "boolean",
            "description": "False when no RADIUS auth driver is running (servers then empty)."
        },
        "totalServers": {
            "pattern": "^-?(?:0|[1-9]\\d*)$",
            "description": "Configured servers in the pool.",
            "format": "int32"
        },
        "liveServers": {
            "pattern": "^-?(?:0|[1-9]\\d*)$",
            "description": "Servers currently considered live.",
            "format": "int32"
        },
        "deadServers": {
            "pattern": "^-?(?:0|[1-9]\\d*)$",
            "description": "Servers currently marked dead (skipped for new requests).",
            "format": "int32"
        },
        "servers": {
            "type": "array",
            "items": {
                "$ref": "#/components/schemas/RadiusServerHealth"
            },
            "description": "Per-server health rows."
        }
    },
    "description": "GET /api/v1/radius/servers — pool summary plus per-server health.",
    "example": {
        "configured": true,
        "totalServers": 2,
        "liveServers": 2,
        "deadServers": 0,
        "servers": [
            {
                "host": "10.20.2.20",
                "port": 1812,
                "weight": 10,
                "isDead": false,
                "consecutiveFailures": 0,
                "requestsSent": 184203,
                "lastFailure": null,
                "lastSuccess": "2026-08-03T10:24:09Z"
            }
        ]
    }
}

{
    "type": "https://tools.ietf.org/html/rfc9110#section-15.5.5",
    "title": "VRF not found",
    "status": 404,
    "detail": "No VRF named 'wholesale-b' is configured.",
    "instance": "/api/v1/vrfs/wholesale-b"
}
Schema of the response body 
{
    "type": "object",
    "properties": {
        "type": {
            "type": "string",
            "nullable": true
        },
        "title": {
            "type": "string",
            "nullable": true
        },
        "status": {
            "pattern": "^-?(?:0|[1-9]\\d*)$",
            "format": "int32",
            "nullable": true
        },
        "detail": {
            "type": "string",
            "nullable": true
        },
        "instance": {
            "type": "string",
            "nullable": true
        }
    },
    "example": {
        "type": "https://tools.ietf.org/html/rfc9110#section-15.5.5",
        "title": "VRF not found",
        "status": 404,
        "detail": "No VRF named 'wholesale-b' is configured.",
        "instance": "/api/v1/vrfs/wholesale-b"
    }
}

{
    "type": "https://tools.ietf.org/html/rfc9110#section-15.5.5",
    "title": "VRF not found",
    "status": 404,
    "detail": "No VRF named 'wholesale-b' is configured.",
    "instance": "/api/v1/vrfs/wholesale-b"
}
Schema of the response body 
{
    "type": "object",
    "properties": {
        "type": {
            "type": "string",
            "nullable": true
        },
        "title": {
            "type": "string",
            "nullable": true
        },
        "status": {
            "pattern": "^-?(?:0|[1-9]\\d*)$",
            "format": "int32",
            "nullable": true
        },
        "detail": {
            "type": "string",
            "nullable": true
        },
        "instance": {
            "type": "string",
            "nullable": true
        }
    },
    "example": {
        "type": "https://tools.ietf.org/html/rfc9110#section-15.5.5",
        "title": "VRF not found",
        "status": 404,
        "detail": "No VRF named 'wholesale-b' is configured.",
        "instance": "/api/v1/vrfs/wholesale-b"
    }
}

Schemas#

ProblemDetails#

Name Type Description
detail string | null
instance string | null
status
title string | null
type string | null

RadiusServerHealth#

Name Type Description
consecutiveFailures Consecutive request failures since the last success.
host string Server host (IP) as configured.
isDead boolean True while the server is marked dead and skipped for new requests.
lastFailure string(date-time) | null UTC time of the last failed request, or null.
lastSuccess string(date-time) | null UTC time of the last successful reply, or null.
port Authentication UDP port.
requestsSent Total requests sent to this server.
weight Load-balancing weight.

RadiusServers#

Name Type Description
configured boolean False when no RADIUS auth driver is running (servers then empty).
deadServers Servers currently marked dead (skipped for new requests).
liveServers Servers currently considered live.
servers Array<RadiusServerHealth> Per-server health rows.
totalServers Configured servers in the pool.

Security schemes#

Name Type Scheme Description
bearerToken http bearer Named API token — the recommended credential for automation. See Authentication in the API overview.
sessionCookie apiKey Interactive session cookie used by the bundled web UI. Not the integration path for API clients — use a bearer token. See Authentication in the API overview.

Tags#

Name Description
RADIUS RADIUS server pool health: live/dead state and per-server counters.