API — Ports & traffic

Raises a proxy port with the given identity and behaviour.

{
  "port": 20134,
  "protocol": "socks5",
  "mode": "db",
  "browser": "chrome",
  "os": "windows",
  "upstream": "socks5://user:pass@host:1080"
}

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"port":20134,"protocol":"socks5","mode":"db","browser":"chrome","os":"windows"}' \
  http://127.0.0.1:8891/api/v1/ports/open

{
  "port": 20134,
  "protocol": "socks5",
  "status": "opened",
  "current_profile": {
    "name": "chrome_152_windows",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) …",
    "browser": "chrome",
    "os": "windows"
  }
}

• 400 “port is required” — the field is absent or 0; 400 “invalid port number: N (must be 1-65535)”.
• 400 for an invalid mode, browser, os, vdns_mode, resolver_strategy or intercept_scope — the refusal text lists what is allowed.
• 400 if mode=random is combined with a browser or os filter; 400 “require_udp_dns requires vdns_mode to be on_leak or forced”; 400 if a gateway was requested but the gateway manager is off; 400 “gateway config … not found — upload it first via POST /api/v1/ovpn” if upstream_gateway or chain_gateway names a gateway that is not in the saved list — a typo in the name gives the same refusal as a gateway that was never uploaded, so check GET /api/v1/ovpn before you blame the manager.
• 403 “the debug fingerprint port requires a Pro license” for debug_capture without Pro.
• 409 if the port is already open or taken by another program — the text comes from the port manager.
• With protocol=mtproto the response carries two more fields: tg_link (the tg://proxy… link handed to a Telegram client) and mtproto_secret (the canonical ee… secret, generated one included).

Closes an open port and drops every connection going through it.

{ "port": 20134 }

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"port":20134}' \
  http://127.0.0.1:8891/api/v1/ports/close

{
  "port": 20134,
  "status": "closed"
}

• 400 “port is required” if the field is absent or 0; 404 if the port is not open.
• A port with interception drops its interception rule as it closes — the traffic returns to its ordinary route.

Returns every open port with its full configuration and state.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/ports

{
  "ports": [
    {
      "port": 20134,
      "protocol": "socks5",
      "created_at": "2026-09-06T09:12:44Z",
      "last_activity": "2026-09-06T11:03:01Z",
      "current_profile": "chrome_152_windows",
      "mode": "db",
      "upstream": "socks5://host:1080",
      "chain_proxy": "",
      "browser_filter": "chrome",
      "os_filter": "windows",
      "h2_spoofing": true,
      "spoof_user_agent": true,
      "spoof_headers": true,
      "decompress": true,
      "max_concurrent": 0,
      "skip_retry": false,
      "retry_delay_ms": 0,
      "cache_enabled": false,
      "cache_mode": "",
      "cache_normalize_ids": false,
      "debug_capture": false,
      "capture_count": 0,
      "auto_profile_from_ua": false,
      "effective_idle_seconds": 1800,
      "js_solver": false,
      "keep_sessions": false,
      "captcha_action": "rotate_retry",
      "captcha_max_attempts": 3,
      "intercept": false,
      "vdns_active": false
    }
  ],
  "total_open": 1,
  "max_ports": 1000
}

• max_ports is the binding cap on concurrently open ports: the lower of the configured maximum (portmanager.max_ports) and your license cap. It is exactly the number GET /api/v1/status returns — the two endpoints no longer need to be cross-checked.
• 🔴 In builds before this release the field here returned the constant 1000 regardless of plan or configuration, while /status already carried the real cap under the same name. If you see exactly 1000 with a knowingly smaller limit, update the client; until then size the pool by max_ports from /status.
• There is no status field on a list item: an open port is open. The fields leak_report, last_ua, last_auto_profile, idle_override_seconds, leak_guard, upstream_gateway, chain_gateway, intercept_scope, intercept_apps, intercept_state, intercept_reason, vdns_mode, vdns_transport and vdns_udp_reason appear only when they have something to say, and on a protocol=mtproto port so do tg_link and mtproto_secret (the same two fields the open call returns). Every other field is present in EVERY item even when empty — including cache_normalize_ids, captcha_action, captcha_max_attempts and vdns_active, shown in the example above.
• effective_idle_seconds is the resolved idle threshold after the port's override is applied over the global one (30 minutes by default); 0 means never close.
• vdns_active tells you whether virtual DNS is rewriting dials RIGHT NOW — unlike vdns_mode, which only states the configured mode. vdns_transport is the transport that ACTUALLY carried the most recent successful resolution: udp, tcp, dot or doh; empty means there has not been one yet. vdns_udp_reason appears when VDNS is active but not currently on udp, and names why: refused, accepted_but_silent, control_error, chain_unsupported or not_probed.

Returns the lowest number in the range 20000–29999 that is neither taken by the manager nor unbindable at the OS level.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/ports/suggest

{
  "port": 20134
}

• 503 “no_free_port” if nothing free was found in the whole range.
• Between the suggestion and the open, someone else may take the port — that is normal: the open then answers 409 and you simply ask for the next one.

Checks that the egress is reachable, that UDP over SOCKS5 works, and that DNS and IPv6 do not leak.

{
  "checks": ["http", "udp", "leak"],
  "protocol": "socks5",
  "upstream": "socks5://user:pass@host:1080"
}

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"checks":["http","leak"],"upstream":"socks5://user:pass@host:1080"}' \
  http://127.0.0.1:8891/api/v1/upstream/test

{
  "http": { "ok": true, "detail": "200 in 45ms" },
  "udp": { "ok": false, "detail": "UDP ASSOCIATE granted but nothing came back",
            "code": "accepted_but_silent" },
  "leak": { "ok": true, "detail": "no DNS/IPv6 leak — exit 203.0.113.45" }
}

• Besides ok and detail, each probe may carry skipped (the probe did not run) and code — a machine-readable reason convenient to branch on.
• 403 if the license is inactive: this endpoint sits behind the license. 400 “invalid JSON body”; 405 for any method other than POST. The body is capped at 64 KiB.

A summary of the live port: identity, behaviour, egress, refusal counters and the time of last activity.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/status

{
  "port": 20134,
  "protocol": "socks5",
  "mode": "db",
  "browser_filter": "chrome",
  "os_filter": "windows",
  "h2_spoofing": true,
  "spoof_user_agent": true,
  "spoof_headers": true,
  "session_resumption": true,
  "max_concurrent": 0,
  "sem_timeout_seconds": 30,
  "connect_timeout_seconds": 5,
  "request_timeout_seconds": 30,
  "skip_retry": false,
  "retry_delay_ms": 0,
  "cache_enabled": false,
  "cache_mode": "",
  "traffic_log": false,
  "tls_passthrough": false,
  "tls_mirror": false,
  "cache_ignore_no_cache": false,
  "allow_mitm_upstream": false,
  "mitm_blocked": 0,
  "current_profile": { "name": "chrome_152_windows", "user_agent": "Mozilla/5.0 …",
                       "browser": "chrome", "os": "windows" },
  "upstream": "socks5://host:1080",
  "chain_proxy": "",
  "created_at": "2026-09-06T09:12:44Z",
  "last_activity": "2026-09-06T11:03:01Z"
}

• mitm_blocked and mitm_last_issuer are read as one snapshot: they change together, and reading them separately would show the count of one refusal next to the culprit of another.
• last_activity is moved not only by traffic but by any call to this port's endpoints.

A full snapshot of the port's configuration — all sixty-odd keys, including those with no endpoint of their own. Keys with no value are left out of the snapshot.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/config

{
  "port": 20134,
  "protocol": "socks5",
  "upstream": "socks5://host:1080",
  "mode": "db",
  "browser": "chrome",
  "os": "windows",
  "timeout_seconds": 0,
  "connect_timeout_seconds": 5,
  "request_timeout_seconds": 30,
  "egress_force_ipv4": true,
  "block_private_targets": true,
  "js_solver": false,
  "keep_sessions": false,
  "sessions_per_port": 1,
  "captcha_action": "rotate_retry",
  "captcha_max_attempts": 3,
  "ecs_enabled": true
}

• The response is trimmed for the example, but the keys shown are ones a port really returns. Keys with no value are omitted entirely: leak_guard, vdns_mode and resolver_strategy are absent at their defaults rather than returned as empty strings; idle_seconds appears only on a port with its OWN idle threshold — when it inherits the global one the key is missing, and null is never sent; intercept and intercept_scope appear only on a port opened with interception, and intercept is then always true while intercept_scope is system or process. So cfg.intercept === false and cfg.idle_seconds === null read undefined: test for the key instead, e.g. "intercept" in cfg.
• The port's boolean and numeric settings, by contrast, ALWAYS come back — zero and false included: js_solver, keep_sessions, timeout_seconds, egress_force_ipv4 and the rest. The key names match the body fields of POST /api/v1/ports/open — and the merge in PUT /config goes by the same names.

Changes the configuration of a live port. The fields you send are MERGED onto the current snapshot: what is not in the body stays as it was.

{ "mode": "auto", "browser": "firefox", "os": "macos" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"mode":"auto","browser":"firefox","os":"macos"}' \
  http://127.0.0.1:8891/api/v1/port/20134/config

{
  "port": 20134,
  "protocol": "socks5",
  "status": "reconfigured",
  "current_profile": { "name": "firefox_152_macos", "user_agent": "Mozilla/5.0 …",
                       "browser": "firefox", "os": "macos" }
}

• 🔴 The status field in the response is not the port's state but the name of the action performed: this endpoint always returns exactly reconfigured, while POST /api/v1/ports/open returns opened. Checking either response against open never matches.
• It takes the same fields and values as POST /api/v1/ports/open, and refuses with the same 400s — including the ban on combining mode=random with the filters.
• 500 “cannot read the port's current configuration” if the snapshot could not be read — the merge is then impossible and the port is left untouched.
• This is the only way to change js_solver, keep_sessions, leak_guard, vdns_mode, resolver_strategy, custom_resolvers, ecs_enabled, timeout_seconds, connect_timeout_seconds, request_timeout_seconds, intercept and the other keys with no endpoint of their own.

• 400 if the body changes interception on an already-open port: it cannot be switched on, off or reconfigured on a live port — close the port and open it again. A body that does not mention interception passes: states are compared, not the presence of a key.

Returns the profile selection mode.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/mode

{
  "mode": "db"
}

Changes the profile selection mode on a live port.

{ "mode": "specific", "specific_profile": "chrome_152_windows" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"mode":"specific","specific_profile":"chrome_152_windows"}' \
  http://127.0.0.1:8891/api/v1/port/20134/mode

{
  "mode": "specific"
}

• This endpoint does NOT accept custom, even though the refusal text names it: “mode must be one of: random, db, auto, specific, custom”. A port enters custom only through PUT /custom_tls or PUT /config.
• 400 if the port carries a browser or os filter and the mode is switched to random: a synthetic fingerprint belongs to no real browser and cannot honour them. Clear the filters with an empty string first.
• 400 with the engine's own text if specific_profile is unknown — but the mode has ALREADY been switched by then. After that error re-read GET /api/v1/port/{port}/config: the port is left in specific with the old name.
• The new value takes effect from the next connection: already-open keep-alive connections are not dropped.

Returns the browser filter. An empty string means no filter.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/browser

{
  "browser": "chrome"
}

Narrows the profile choice to one browser, or removes the narrowing.

{ "browser": "chrome_145" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"browser":"chrome_145"}' \
  http://127.0.0.1:8891/api/v1/port/20134/browser

{
  "browser": "chrome_145"
}

• 400 “browser must be one of: "", random, chrome, firefox, safari, edge (optionally with version: chrome_145)” for anything else.
• 400 if the port is in random mode: it builds a synthetic fingerprint and cannot honour a filter. Clearing the filter with an empty string on a random port is still allowed.
• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Returns the operating-system filter.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/os

{
  "os": "windows"
}

Narrows the profile choice to one operating system, or removes the narrowing.

{ "os": "macos" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"os":"macos"}' \
  http://127.0.0.1:8891/api/v1/port/20134/os

{
  "os": "macos"
}

• 400 “os must be one of: "", random, windows, macos, linux, ios, android” for anything else.
• 400 on a random-mode port — for the same reason as the browser filter.
• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Returns the profile the port presents right now. Read-only: a PUT to this path gives 405.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/profile

{
  "name": "chrome_152_windows",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) …",
  "browser": "chrome",
  "os": "windows"
}

• To pin a profile by name use PUT /api/v1/port/{port}/mode with the body {"mode":"specific","specific_profile":"…"}, or PUT /api/v1/port/{port}/config.

Feeds the port a fingerprint captured elsewhere, as a whole, and switches it into custom mode. This is how a port takes a shape captured from a real browser — through ChromeApi or tls.peet.ws, say.

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  --data-binary @captured.json \
  http://127.0.0.1:8891/api/v1/port/20134/custom_tls

{
  "ok": true,
  "mode": "custom",
  "profile": {
    "name": "custom_1757116800123",
    "ja3_hash": "cd08e31494f9531f560d64c695473da9",
    "ja4": "t13d1516h2_8daaf6152771_b0da82dd1658",
    "userAgent": "Mozilla/5.0 …"
  }
}

• Side effect: h2_spoofing and spoof_user_agent are forced off — spoofing HTTP/2 on top of the supplied shape broke redialling. If you need them, turn them on with their own endpoints AFTER this request.
• Second side effect: the port's previous custom profiles are deleted and existing connections are closed — otherwise part of the traffic would keep going with the old shape.
• Third side effect: the port's solved challenges are dropped — the new TLS shape and User-Agent invalidate the clearance harvested under the previous identity, so the next request to a protected site goes through a challenge again. An ACTUAL address change in PUT /api/v1/port/{port}/upstream does the same.
• 400 “invalid JSON: …” if the body does not parse, and 400 “failed to set custom TLS: …” if the engine rejects the shape. The commonest cause of the second is a body with no ciphers, or with names outside the table: 400 “failed to set custom TLS: building custom profile: building ClientHelloSpec: no recognized cipher suites”. A trimmed dump of ja3, ja4 and userAgent alone is not enough; POST /api/v1/fingerprint/parse returns a body of the right shape.
• There is no GET on this path, and the request falls through to the dashboard catch-all: you get 404 as the plain string “404 page not found”, not JSON, and that 404 does NOT mean the port is closed — do not reopen the port on the strength of it. Read the current composition via /profile/view; other methods (POST, DELETE) give 405.
• 🔴 The profile name in the response is not custom: the server builds a fresh one on every request as custom_<unix-milliseconds> (custom_1757116800123, say) and returns that same name from GET /api/v1/port/{port}/profile and GET /api/v1/port/{port}/profile/view. Do not compare it against a fixed string, and do not try to pin it with mode=specific plus specific_profile=custom — that returns 400 “fingerprint: profile "custom" not found”.

Returns the port's egress proxy. Empty values mean direct egress.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/upstream

{
  "socks5_addr": "socks5://user:pass@host:1080",
  "upstream": "socks5://user:pass@host:1080"
}

• The socks5_addr field is a legacy name kept for older clients; it always repeats upstream.

Changes the egress proxy on a live port — this is how proxies are rotated without closing the port.

{ "upstream": "socks5://user:pass@host:1080" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"upstream":"socks5://user:pass@host:1080"}' \
  http://127.0.0.1:8891/api/v1/port/20134/upstream

{
  "socks5_addr": "socks5://user:pass@host:1080",
  "upstream": "socks5://user:pass@host:1080"
}

• Side effect when the address ACTUALLY changes: the port's solved challenges are dropped, because the clearance was issued to the previous egress address and does not work from the new one. The next request to a protected site will go through a challenge again.
• The cached dial is reset and idle connections to the previous egress are closed.

Returns the intermediate proxy — the first link of the chain in front of the egress one.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/chain_proxy

{
  "chain_proxy": "http://10.0.0.5:3128"
}

Sets or clears the intermediate proxy: traffic goes client → chain → egress → site.

{ "chain_proxy": "http://10.0.0.5:3128" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"chain_proxy":"http://10.0.0.5:3128"}' \
  http://127.0.0.1:8891/api/v1/port/20134/chain_proxy

{
  "chain_proxy": "http://10.0.0.5:3128"
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether an egress that substitutes TLS is allowed, and how many connections have already been refused for that reason.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/allow_mitm_upstream

{
  "allow_mitm_upstream": false,
  "mitm_blocked": 17,
  "mitm_last_issuer": "CN=Corporate Proxy CA"
}

• mitm_blocked and mitm_last_issuer answer the question “why doesn't the fingerprint arrive” outright: the issuer of the last substituted certificate is named.

Allows or forbids working through an egress that opens and re-assembles TLS.

{ "allow_mitm_upstream": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"allow_mitm_upstream":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/allow_mitm_upstream

{
  "allow_mitm_upstream": true,
  "mitm_blocked": 17,
  "mitm_last_issuer": "CN=Corporate Proxy CA"
}

• 400 “allow_mitm_upstream is required” if the field is absent. This is the only boolean port endpoint that tells “not sent” from false and refuses instead of silently turning off.

Reports whether HTTP/2 settings are spoofed to match the chosen browser.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/h2_spoofing

{
  "enabled": true
}

Turns HTTP/2 settings spoofing on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/h2_spoofing

{
  "enabled": true
}

• PUT /custom_tls forces this off — turn it on AFTER supplying your own fingerprint.
• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether the request User-Agent is spoofed.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/spoof_user_agent

{
  "enabled": true
}

Turns User-Agent spoofing on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/spoof_user_agent

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether the header set and order are brought in line with the browser's.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/spoof_headers

{
  "enabled": true
}

Turns browser-shaped headers on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/spoof_headers

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether TLS is passed through without being opened.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/tls_passthrough

{
  "enabled": true
}

Turns TLS pass-through on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/tls_passthrough

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether the client's own TLS parameters are mirrored instead of the profile's.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/tls_mirror

{
  "enabled": true
}

Turns mirroring of the client's TLS parameters on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/tls_mirror

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether HTTP/3 (QUIC) is allowed on the port.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/http3

{
  "enabled": true
}

Allows or forbids HTTP/3 (QUIC).

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/http3

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether TLS session resumption is allowed.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/session_resumption

{
  "enabled": true
}

Allows or forbids TLS session resumption (tickets).

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/session_resumption

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether compressed response bodies are decoded for the client.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/decompress

{
  "enabled": true
}

Turns body decoding on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/decompress

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether responses are cached in spite of a no-cache header.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/cache_ignore_no_cache

{
  "enabled": true
}

Turns caching in spite of no-cache on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/cache_ignore_no_cache

{
  "enabled": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Reports whether the profile is picked from the request User-Agent, and shows the last such header.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/auto_profile_from_ua

{
  "enabled": true,
  "last_ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) …"
}

Turns picking the profile from the request User-Agent on or off.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/auto_profile_from_ua

{
  "enabled": true
}

• The PUT response carries no last_ua — it appears only in the GET response, and only after the port has seen its first request. This is the only way to check that the mode fires on live traffic.
• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Returns the cap on concurrent requests on the port.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/max_concurrent

{
  "max_concurrent": 32
}

Changes the cap on concurrent requests.

{ "max_concurrent": 32 }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"max_concurrent":32}' \
  http://127.0.0.1:8891/api/v1/port/20134/max_concurrent

{
  "max_concurrent": 32
}

• 400 “max_concurrent must be >= 0 (0 = unlimited)” for a negative value.
• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Returns how many seconds a request waits for a free slot within the concurrency cap.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/sem_timeout

{
  "timeout_seconds": 30
}

Changes the wait for a free slot. 🔴 The field is called timeout_seconds, not sem_timeout.

{ "timeout_seconds": 30 }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"timeout_seconds":30}' \
  http://127.0.0.1:8891/api/v1/port/20134/sem_timeout

{
  "timeout_seconds": 30
}

• 400 “timeout_seconds must be >= 1” for zero and negatives.
• A body of {"sem_timeout": 30} — named after the path rather than the field — silently means 0 and is refused with 400.

Reports whether a request is retried after a network error.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/skip_retry

{
  "skip_retry": false
}

Turns skipping retries on or off.

{ "skip_retry": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"skip_retry":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/skip_retry

{
  "skip_retry": true
}

• The field must be named exactly this. The server drops unknown names silently and the request applies the zero value instead: false for booleans, an empty string for strings — with a 200 response.

Returns the pause between retries, in milliseconds.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/retry_delay

{
  "retry_delay_ms": 500
}

Changes the pause between retries. 🔴 The field is called retry_delay_ms, not retry_delay.

{ "retry_delay_ms": 500 }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"retry_delay_ms":500}' \
  http://127.0.0.1:8891/api/v1/port/20134/retry_delay

{
  "retry_delay_ms": 500
}

• 400 “retry_delay_ms must be >= 0” for a negative value.
• A body of {"retry_delay": 500} passes validation as 0 and SETS a 0 ms pause with a 200 response.

Sets the idle timeout of THIS port, overriding the global one. It has no GET — the current value is visible as idle_seconds in the response of GET /api/v1/port/{port}/config.

{ "seconds": 1800 }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"seconds":1800}' \
  http://127.0.0.1:8891/api/v1/port/20134/idle

{
  "status": "ok"
}

• The response does NOT contain the value that was set — only status. Verify through GET /config.
• 400 “seconds must be >= 0” for a negative value; 404 if the port is closed.
• This is the only per-port endpoint that does NOT count the call as activity: it parses the port number itself, bypassing the shared helper.

Returns the fingerprints captured by a debug capture port, oldest first.

curl -H "X-API-Key: YOUR_API_KEY" \
  "http://127.0.0.1:8891/api/v1/port/20134/captures?since=0&limit=50"

{
  "count": 128,
  "captures": [
    {
      "seq": 1,
      "time": "2026-09-06T12:34:56.789+03:00",
      "domain": "example.com",
      "client_addr": "127.0.0.1:54321",
      "alpn": "h2",
      "method": "GET",
      "path": "/",
      "ua": "Mozilla/5.0 …",
      "status": "ok",
      "tls": {
        "ja3": "771,4865-4866-4867-…",
        "ja3_hash": "cd08e31494f9531f560d64c695473da9",
        "ja4": "t13d1516h2_8daaf6152771_b0da82dd1658",
        "client_hello_hex": "16030103…"
      },
      "h2": {
        "available": true,
        "akamai": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
        "settings": [ { "id": 1, "val": 65536 } ],
        "window_update": 15663105,
        "pseudo_order": ["m", "a", "s", "p"],
        "header_order": ["accept", "user-agent", "accept-encoding"]
      }
    }
  ]
}

• 🔴 The fingerprint lives INSIDE the capture: TLS in captures[].tls (ja3, ja3_hash, ja4, client_hello_hex), HTTP/2 in captures[].h2 (available, akamai, settings, window_update, pseudo_order, header_order), and the User-Agent is captures[].ua. There are NO top-level ja3_hash, ja4 or user_agent fields.
• status is ok when both TLS and HTTP/2 were captured, and tls-only when the client never completed the h2 handshake (cert pinning, or plain HTTP/1.1): then captures[].h2.available is false and the rest of the h2 block is absent.
• method, path, ua, tls.client_hello_hex and every h2 field except available are optional: when a value was not captured, the key is simply missing from the response.
• count is how many captures the buffer holds IN TOTAL, regardless of since and limit.
• 400 “port is not a debug fingerprint-capture port” if the port was opened without debug_capture.
• The ring size is set when the port is opened, with the debug_capture_n field, 500 captures by default; an overflow evicts the oldest.

Clears the capture ring of a debug capture port.

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/captures

{
  "count": 0,
  "captures": []
}

• 400 “port is not a debug fingerprint-capture port” on an ordinary port.

The state of the port's cache: whether it is on, in which mode, and how much it has already saved.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/cache

{
  "enabled": true,
  "mode": "hard",
  "hits": 18420,
  "misses": 2210,
  "entries": 1842,
  "used_bytes": 268435456,
  "max_bytes": 2147483648,
  "saved_bytes": 913000000
}

• mode is empty when the cache is off. saved_bytes is how many bytes did not have to be downloaded again.

Turns the cache on or off, or switches its mode, on a live port.

{ "mode": "hard-media" }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"mode":"hard-media"}' \
  http://127.0.0.1:8891/api/v1/port/20134/cache

{
  "enabled": true,
  "mode": "hard-media",
  "hits": 18420,
  "misses": 2210,
  "entries": 1842,
  "used_bytes": 268435456,
  "max_bytes": 2147483648,
  "saved_bytes": 913000000
}

• 🔴 There is exactly one body that turns the cache off: {"enabled": false} with no mode. Any other body — an empty {} included — TURNS THE CACHE ON in normal mode.
• 400 “invalid cache mode: must be one of normal, hard, hard-media, hard-autowarm” for any other mode.
• 🔴 The response carries the EXACT mode name: hard-media and hard-autowarm do NOT collapse to hard. Check that the mode was applied by comparing mode to the value you SENT, not to the string hard. The same string comes back from GET /api/v1/port/{port}/cache and in the cache_mode field of /status and /ports.
• The response is the same state GET returns: the handler answers with it.

Clears this port's cache without touching the others.

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/cache

{
  "status": "cleared"
}

• A port in a hard mode clears the SHARED hard store — the same one DELETE /api/v1/cache/hard clears.

The state of the hard cache as a whole: how many entries, how much space, and how much has been saved.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/cache/hard

{
  "enabled": true,
  "mode": "hard",
  "hits": 18420,
  "misses": 2210,
  "entries": 1842,
  "used_bytes": 268435456,
  "max_bytes": 2147483648,
  "saved_bytes": 913000000
}

Clears the hard cache as a whole — for every port at once.

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/cache/hard

{
  "status": "hard cache cleared"
}

Evicts entries from the hard cache by a list of patterns — surgically, instead of clearing everything.

{ "patterns": ["example.com", "https://cdn.example.net/img/logo.png"] }

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"patterns":["example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/hard/evict

{
  "evicted": 37
}

• 400 “patterns list is required” for an empty list. There is no domain field on this endpoint.

The same for the ordinary cache: evicts entries by a list of patterns.

{ "patterns": ["example.com"] }

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"patterns":["example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/evict

{
  "evicted": 12
}

• 400 “patterns list is required” for an empty list.

Kept for older clients: the hard cache lives in SQLite and is written to disk on every put, so there is nothing to flush. The endpoint simply reports the state.

curl -X POST -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/cache/hard/save

{
  "status": "persisted",
  "entries": 1842,
  "info": "SQLite-backed cache is already persistent"
}

The domains and addresses the hard cache steers clear of.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/cache/hard/exclusions

{
  "exclusions": ["api.example.com", "*.example.net/checkout"]
}

APPENDS the given patterns to the hard cache exclusion list rather than replacing it.

{ "exclusions": ["api.example.com"] }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"exclusions":["api.example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/hard/exclusions

{
  "exclusions": ["api.example.com", "*.example.net/checkout"]
}

• 🔴 A shortened list sent with PUT does NOT remove anything: the list only grows, and what you send is merged with what was there, without duplicates. Removal is what DELETE is for.
• The response is the full list after the merge.

Removes the LISTED patterns from the hard cache exclusion list. A body is required.

{ "exclusions": ["api.example.com"] }

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"exclusions":["api.example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/hard/exclusions

{
  "exclusions": ["*.example.net/checkout"]
}

• 🔴 This is NOT “clear the list”. A DELETE with no body answers 400 “invalid JSON body”. To empty the list, name everything GET returned in the body.
• 🔴 If you name everything and the list ends up empty, the answer is {"exclusions": null}, not an empty array — exactly as with the ordinary cache.

The same for the ordinary cache: the exclusion list.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/cache/exclusions

{
  "exclusions": ["login.example.com"]
}

APPENDS patterns to the ordinary cache exclusion list.

{ "exclusions": ["login.example.com"] }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"exclusions":["login.example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/exclusions

{
  "exclusions": ["login.example.com"]
}

• 🔴 This endpoint's response shows only WHAT YOU SENT, not the full list after the merge — unlike the hard cache one. GET returns the full list.

Removes the listed patterns from the ordinary cache exclusion list. A body is required.

{ "exclusions": ["login.example.com"] }

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"exclusions":["login.example.com"]}' \
  http://127.0.0.1:8891/api/v1/cache/exclusions

{
  "exclusions": null
}

• 🔴 When nothing is left after the removal the field comes back as null, NOT as []. This endpoint never returns an empty array, so a client written as resp.exclusions.map(…) or for … of throws on exactly the successful full clear — test for null. A GET of the same list in that state returns []: GET and DELETE have DIFFERENT response shapes.
• A DELETE with no body — 400 “invalid JSON body”.

Reports whether the log is on, where the file is, and how many records it holds.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/traffic_log

{
  "enabled": true,
  "path": "data/traffic_port_20134.jsonl",
  "entries": 4821
}

• 🔴 entries is the NUMBER of records, not the records themselves. The records come from /traffic_log/download.
• The counter describes the FILE, not the session: after a restart it shows everything already on disk.
• When the log is off the response is {"enabled": false, "entries": 0}: path is absent, but entries is ALWAYS there and reads 0. Tell off from on-but-empty by enabled — not by whether the entries key is present.

Turns the log on or off on a live port. Enabling creates the file if it is not there yet.

{ "enabled": true }

curl -X PUT -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true}' \
  http://127.0.0.1:8891/api/v1/port/20134/traffic_log

{
  "enabled": true,
  "path": "data/traffic_port_20134.jsonl",
  "entries": 4821
}

• The response is the same state GET returns.
• 500 “failed to create traffic log: …” if the file could not be created — the data directory is not writable, say.
• The field must be named enabled: an unknown name means false, which TURNS THE LOG OFF with a 200 response.

Returns the whole log file — one JSON line per request (NDJSON).

curl -H "X-API-Key: YOUR_API_KEY" -o traffic.jsonl \
  http://127.0.0.1:8891/api/v1/port/20134/traffic_log/download

{"ts":"2026-09-06T11:22:33Z","method":"GET","scheme":"https","host":"example.com",
 "path":"/static/app.js","status":200,"content_type":"application/javascript",
 "content_len":184320,"cache_control":"max-age=31536000","cache":"hit","proto":"h2","port":20134}

• The Content-Type is application/x-ndjson and the attachment is named traffic_port_<port>.jsonl. The cache field takes the values hit, miss, stale, excluded and skip.
• 400 “traffic logging is not enabled” if the log is off.

Empties the log file, leaving logging switched on.

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/traffic_log

{
  "status": "cleared"
}

• 400 “traffic logging is not enabled” if the log is off: this endpoint cannot empty the file of a switched-off log — turn it on first.

Whether the privileged interception service is available right now. Ask this BEFORE opening a port: otherwise the refusal arrives only after the form is filled in.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/system/intercept

{
  "available": false,
  "code": "not_installed",
  "reason": "привилегированная служба перехвата не установлена — установите её из установщика BlankTrail"
}

• The code and reason fields are not duplicates: a program branches on code, a person reads reason. Both fields are always present — with available=true they are empty.
• The code values: off — interception is unavailable in this build or on this platform; not_installed — the service is not installed; unreachable — the service does not answer; busy — another copy of the application already drives interception, and the service serves one client at a time.

The list of applications from which per-process interception targets are chosen.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/system/processes

[
  { "name": "chrome.exe", "path": "C:\\Program Files\\Google\\Chrome\\chrome.exe",
    "count": 7 },
  { "name": "curl.exe", "path": "C:\\Windows\\System32\\curl.exe", "count": 1 }
]

• A list item is an EXECUTABLE, not a process: an interception rule attaches to the exe, so seven browser windows give one row with count = 7. The path is normalised — that is exactly what goes into intercept_apps.
• 501 on a platform that cannot enumerate processes: an empty array would be indistinguishable from “there are no processes”, and a person would see an empty selection table instead of an explanation.

Starts an observation session: it watches whether the chosen program goes around the interception.

{ "exe_paths": ["C:\\Program Files\\App\\app.exe"], "policy": "observe" }

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"exe_paths":["C:\\Program Files\\App\\app.exe"],"policy":"observe"}' \
  http://127.0.0.1:8891/api/v1/system/leak-audit

{
  "started": true,
  "code": "",
  "reason": ""
}

• 🔴 A refusal to start arrives with a 200 and started=false: a 200 here does NOT mean observation began. Check the started field, not the response status.
• The refusal codes with a 200: ipv6_present — the machine has a live global IPv6 that the route capture does not cover; session_active — a session is already running; rule_conflict — the rule conflicts with the current interception; service_outdated and service_version_unknown — the service is old, or its version could not be determined.
• 400 with the code no_paths for an empty list, and invalid_request when the body does not parse or the policy is neither observe nor block. 503 if the port manager is not up.

The state of the live session: the verdict, the aggregates, the honesty limits and a fresh tail of events.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/system/leak-audit

{
  "exe_paths": ["C:\\Program Files\\App\\app.exe"],
  "policy": "observe",
  "started_at": "2026-09-06T11:00:00Z",
  "verdict": "leaking",
  "confirmed": true,
  "by_class": { "dns_direct": 12, "ip_direct": 3 },
  "top_targets": [ { "addr": "203.0.113.7:443", "count": 9 } ],
  "dropped": 0,
  "udp_exhausted": 0,
  "client_trimmed": 0,
  "connection_interrupted": false,
  "audit_unavailable": false,
  "stopped_by": "",
  "limits": ["attribution_by_exe"],
  "recent_events": []
}

• verdict takes three values: clean, leaking and inconclusive. The last is an honest “we do not know” — when the audit log was unavailable or events were dropped, say.
• limits lists the honesty limits of this run: attribution_by_exe (the rule attaches to an exe rather than a process), start_window (the window between requesting the rule and applying it), events_dropped, udp_exhausted, connection_interrupted, audit_unavailable, stopped_by_watchdog and others. The verdict must not be read without them.
• 404 “сеанс аудита утечек не запущен” — сообщение приходит по-русски — until one is started: an empty report would be no more honest than silence.

The report without the event feed — this is what you export. With no live session it returns the last finished one.

curl -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/system/leak-audit/report

• 404 “аудит утечек ни разу не запускался” — the message comes in Russian — if there is no finished report either.

Stops the session and returns the final report in the same shape as GET.

curl -X DELETE -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/system/leak-audit

• 404 if there is no session. On a stopped session the stopped_by field says who ended it — a person, or the watchdog that cuts an overlong observation short by itself.

The full configuration test of a port: egress leaks, the through-port fingerprint and UDP support.

curl -X POST -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/test

{
  "leak": {
    "exit_ip": "203.0.113.45",
    "egress_resolver": "203.0.113.53",
    "host_resolver": "192.0.2.1",
    "dns": "pass",
    "ipv6": "pass",
    "latency_ms": 214,
    "checked_at": "2026-09-06T11:03:01Z"
  },
  "leak_skipped": false,
  "fingerprint": {
    "ran": true,
    "skipped": false,
    "observed_ja3": "cd08e31494f9531f560d64c695473da9",
    "observed_ja4": "t13d1516h2_8daaf6152771_b0da82dd1658",
    "observed_ua": "Mozilla/5.0 …",
    "expected_ja4": "t13d1516h2_8daaf6152771_b0da82dd1658",
    "expected_ua": "Mozilla/5.0 …",
    "match": true
  },
  "udp": { "checked": true, "supported": true, "detail": "DNS round-trip via UDP ASSOCIATE",
           "verdict": "relays" },
  "ok": true,
  "messages": [],
  "checked_at": "2026-09-06T11:03:01Z"
}

• The fingerprint check visits an external fingerprinting service through the port itself: match=false means what went out was not what the port promised.
• leak_skipped=true with leak_skip_reason tells two things apart: disabled — the check is off in the port settings, direct — the egress is direct and there is nothing to probe. It is NOT “no leaks”.
• fingerprint.skipped with the reason passthrough is not a failure: with TLS pass-through there is no substitution to observe.
• udp.supported=true means a completed DNS round-trip through the egress. A granted UDP ASSOCIATE with no answer does NOT count as support — the verdict is accepted_but_silent.
• The test is capped at 15 seconds.

The egress leak check alone: it compares whose resolver answers and whose IPv6 is visible.

curl -X POST -H "X-API-Key: YOUR_API_KEY" \
  http://127.0.0.1:8891/api/v1/port/20134/leakcheck

{
  "report": {
    "exit_ip": "203.0.113.45",
    "egress_resolver": "203.0.113.53",
    "host_resolver": "192.0.2.1",
    "dns": "pass",
    "ipv6": "leak",
    "ipv6_addr": "2001:db8::1",
    "host_ipv6": "2001:db8::1",
    "latency_ms": 214,
    "checked_at": "2026-09-06T11:03:01Z"
  }
}

• The dns and ipv6 fields take three values: pass, leak and inconclusive. This endpoint has no webrtc and no verdict field.
• 🔴 On a port with direct egress the answer is {"skipped": true} with NO report, and a 200 code. That means “not checked”, not “no leaks”.
• ipv6_addr next to host_ipv6 is the proof itself: if they match, the machine's own address is visible outside, meaning the tunnel was bypassed. The check is capped at 12 seconds.

Builds a profile for the requested browser and version and puts it on the port.

{ "browser": "chrome", "version": 152, "os": "windows", "save": true }

curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"browser":"chrome","version":152,"os":"windows"}' \
  http://127.0.0.1:8891/api/v1/port/20134/generate

• 400 “browser is required (chrome, firefox, safari, edge)”, 400 “browser must be one of: chrome, firefox, safari, edge”, 400 “os must be one of: windows, macos, linux, ios, android”; 500 with the engine's text if the profile could not be built.