Reading the API Reference

Pano describes its own API. There is no separate reference to keep in sync: the running site answers with an OpenAPI 3.1 document, and so does every plugin.

The documents

Document	URL	Content
Core	/api/v1/openapi.json	Public operations of Pano
A plugin	/api/v1/plugins/<pluginId>/_/openapi.json	Public operations of that plugin
Panel	/api/v1/panel/openapi.json	Internal operations, panel session required

Fetch the core document from a local Pano:

curl -s http://localhost:8088/api/v1/openapi.json -o pano-openapi.json

Fetch the market plugin's:

curl -s http://localhost:8088/api/v1/plugins/pano-plugin-market/_/openapi.json -o market-openapi.json

Plugins need nothing extra: Pano builds the document from the plugin's endpoints, closed-source plugins included. Plugins that are installed but stopped have no document.

How to read an operation

• servers[0].url is the prefix: /api/v1 for core, /api/plugins/<pluginId> for a plugin. Operation paths come after it.
• operationId is the endpoint class name without API, for example GetPosts. The typed client names its functions after it.
• parameters and requestBody are JSON Schema, taken from the endpoint's own validation.
• responses lists the success body and the error envelope. The common error codes (NOT_LOGGED_IN, NO_PERMISSION, INVALID_CSRF_TOKEN, RATE_LIMIT_EXCEEDED, MAINTENANCE_MODE_ENABLED) are shared.
• deprecated: true means a replacement exists; x-pano-removal is the earliest removal date.
• x-pano-stability is public or internal. Only public operations carry the promise of API Basics.
• x-pano-undocumented: true means the author gave no description: the path and inputs are real, the response is free-form.

Look at it quickly

List every public path and method with jq:

jq -r '.paths | to_entries[] | .key as $p | .value | keys[] | "\(.) \($p)"' pano-openapi.json

Show one operation:

jq '.paths["/posts"].get' pano-openapi.json

Any OpenAPI 3.1 viewer or generator can read the files as they are.

Keeping a copy

Save the document next to your code and compare it after updates. A change that removes an operation or a response field, other than a deprecated one past its date, is a bug: report it.

For JavaScript you rarely need the file itself. pano-client pull downloads the core document and the documents of the active plugins and turns them into functions.

What is not in the documents

• Real-time sockets: see Access.
• Page routes of the front-end and /_pano/* fallback pages: see Headless Quick Start.
• Outgoing events: see Webhooks.