API Documentation

Welcome to the olson.at API documentation. This reference guide provides comprehensive information about all available API endpoints, including request/response formats, authentication requirements, and example usage.

Base URL

All API endpoints are relative to: https://olson.at/api

Authentication Levels

Endpoints require different levels of authentication:

Level	Description	Indicator
Public	No authentication required	Open access
Authenticated	Valid session cookie required	Login required
Admin	Admin privileges required	Admin panel access

Response Format

All API responses are JSON. Successful responses typically include a success field, while errors include an error field with a descriptive message.

Success Response

{
  "success": true,
  "data": { ... }
}

Error Response

{
  "error": "Error message description"
}

Authentication

The API uses cookie-based session authentication. After logging in, the server sets an admin_session cookie that must be included in subsequent requests.

Session Cookie

Include credentials: 'include' in fetch requests to send cookies automatically.

Login Flow

POST credentials to /api/auth/login
Server validates and sets session cookie
Include cookie in all subsequent requests
Call POST /api/auth/logout to end session

Token-Based Access

For external services (like browser access), use the token-for-service endpoint to generate short-lived tokens:

GET /api/auth/token-for-service?service=browser

Response:
{
  "token": "eyJhbGciOiJIUzI1NiIs..."
}

Python Playground API

Create, manage, and execute Python projects directly on the server.

GET /python/projects Admin

List all Python projects with their files.

Response

{
  "projects": [
    {
      "name": "my-project",
      "files": [
        { "name": "main.py", "path": "my-project/main.py", "size": 256 }
      ],
      "created": "2026-01-20T10:00:00Z"
    }
  ]
}

POST /python/projects Admin

Create a new Python project with a default main.py file.

Request Body

Field	Type	Description
name	string required	Project name (letters, numbers, -, _)

DELETE /python/projects/:name Admin

Delete a project and all its files.

GET /python/files/:project/:file Admin

Get the content of a file.

Response

{
  "content": "print('Hello, World!')",
  "name": "main.py"
}

POST /python/files/:project/:file Admin

Save file content.

Request Body

Field	Type	Description
content	string required	File content

POST /python/projects/:name/files Admin

Create a new file in a project.

Request Body

Field	Type	Description
fileName	string required	Filename ending in .py

DELETE /python/files/:project/:file Admin

Delete a file from a project.

POST /python/execute Admin

Execute a Python file. Runs with 30-second timeout and 1MB output limit.

Request Body

Field	Type	Description
projectName	string required	Project containing the file
fileName	string required	File to execute

Response

{
  "success": true,
  "output": "Hello, World!\\n",
  "error": ""
}

Browser Management API

Control remote browser containers (Firefox and Chromium) for secure web browsing.

GET /admin/browser/status Admin

Check the running status of browser containers.

Response

{
  "firefox": true,
  "chromium": false
}

POST /admin/browser/start Admin

Start a browser container.

Request Body

Field	Type	Description
browser	string required	"firefox" or "chromium"

POST /admin/browser/stop Admin

Stop a browser container.

Request Body

Field	Type	Description
browser	string required	"firefox" or "chromium"

Browser Access

Access running browsers at /admin/browser/ (Firefox) or /admin/browser-chromium/ (Chromium). Requires authentication via query token or session cookie.

Authentication API

Manage user sessions, passwords, and API tokens.

POST /auth/login Public

Authenticate and create a session.

Request Body

Field	Type	Description
username	string required	Username
password	string required	Password

Response

{
  "success": true,
  "message": "Login successful",
  "isFirstTime": false
}

POST /auth/logout Authenticated

End the current session.

GET /auth/status Public

Check if first-time setup is needed.

Response

{
  "needsSetup": false,
  "authenticated": true,
  "admin": true
}

GET /auth/validate Admin

Validate the current admin session.

Response

{
  "valid": true,
  "user": { "admin": true, "username": "admin" }
}

POST /auth/change-password Admin

Change the admin password.

Request Body

Field	Type	Description
currentPassword	string required	Current password
newPassword	string required	New password

GET /auth/token-for-service Admin

Generate a short-lived token for external services (5-minute expiry).

Query Parameters

Field	Type	Description
service	string optional	Service name (e.g., "browser", "terminal")

Response

{
  "token": "eyJhbGciOiJIUzI1NiIs..."
}

API Token Management

GET /auth/tokens Admin

List all API tokens.

POST /auth/tokens Admin

Create a new API token.

Request Body

Field	Type	Description
name	string required	Token name/description

DELETE /auth/tokens/:id Admin

Revoke an API token.

Resume/Portfolio API

Manage resume and portfolio content.

GET /resume Public

Get the current resume data.

PUT /resume Admin

Update resume data. Creates a new version automatically.

GET /resume/history Admin

Get version history of resume changes.

GET /resume/version/:id Admin

Get a specific version by ID.

Honeypot API

Monitor and analyze honeypot events and attacker activity.

GET /honeypot/public-stats Public

Get public honeypot statistics (no auth required).

GET /honeypot/stats Admin

Get detailed honeypot statistics.

GET /honeypot/events Admin

Query honeypot events with filtering.

Query Parameters

Field	Type	Description
limit	number optional	Number of results (default: 100)
offset	number optional	Offset for pagination
eventType	string optional	Filter by event type
sourceIp	string optional	Filter by source IP
startDate	string optional	Start date (ISO format)
endDate	string optional	End date (ISO format)

GET /honeypot/sessions Admin

Get honeypot session data.

GET /honeypot/map Admin

Get attacker geolocation data for map visualization.

GET /honeypot/attacker/:ip Admin

Get detailed information about a specific attacker IP.

POST /honeypot/report-ip Admin

Report an IP address for abuse.

GET /honeypot/reported-ips Admin

Get list of reported IPs.

POST /honeypot/event Public

Submit a honeypot event (used by Cowrie sensor).

File Share API

End-to-end encrypted file sharing.

POST /fileshare/upload Public

Upload an encrypted file. Files are client-side encrypted before upload.

Request Body (multipart/form-data)

Field	Type	Description
file	file required	Encrypted file data
metadata	string required	JSON-encoded metadata (filename, mimeType, key)
maxDownloads	number optional	Maximum download limit (0 = unlimited)
expiresIn	number optional	Expiration in hours (default: 168 = 7 days)

Response

{
  "success": true,
  "id": "abc123xyz",
  "url": "https://olson.at/api/fileshare/download/abc123xyz"
}

GET /fileshare/info/:id Public

Get file metadata (without downloading).

GET /fileshare/download/:id Public

Download an encrypted file. Client must decrypt after download.

Image Decoder API

Advanced image steganography and forensic analysis.

POST /decode/generic Public

Extract hidden data from images using various methods.

Request Body

Field	Type	Description
imageData	string required	Base64-encoded image
bitPlane	number optional	Bit plane to extract (0-7, default: 0)
channels	string optional	Channels: "rgb", "rgba", "r", "g", "b", "a"
maxBits	number optional	Maximum bits to extract

POST /decode/openstego Public

Extract OpenStego hidden data (RandomLSB algorithm).

Request Body

Field	Type	Description
imageData	string required	Base64-encoded image
password	string optional	Password for extraction (default seed if empty)

POST /decode/bruteforce Public

Brute-force extraction with multiple bit plane/channel combinations.

SSH Terminal API

Web-based SSH terminal management.

GET /admin/ssh/status Admin

Get SSH server status.

GET /admin/ssh/sessions Admin

List active SSH sessions.

GET /admin/ssh/history Admin

Get SSH command history.

Terminal Access

Access the web-based terminal at /admin/terminal-auth. Requires authentication token in query string.

System API

Health checks and system utilities.

GET /health Public

Health check endpoint.

Response

{
  "status": "ok",
  "timestamp": "2026-01-20T10:00:00Z"
}

GET /ssl-check Public

Check SSL certificate for a domain.

Query Parameters

Field	Type	Description
domain	string required	Domain to check

Overview

Services

API Documentation

Authentication Levels

Response Format

Success Response

Error Response

Authentication

Login Flow

Token-Based Access

Python Playground API

Response

Request Body

Response

Request Body

Request Body

Request Body

Response

Browser Management API

Response

Request Body

Request Body

Authentication API

Request Body

Response

Response

Response

Request Body

Query Parameters

Response

API Token Management

Request Body

Resume/Portfolio API

Honeypot API

Query Parameters

File Share API

Request Body (multipart/form-data)

Response

Image Decoder API

Request Body

Request Body

SSH Terminal API

System API

Response

Query Parameters