API

ABM has a REST API under /api. The interactive reference is at /api/docs (Swagger) and /api/redoc, and the schema at /api/openapi.json. Set DOCS_ENABLED=false to remove all three. The docs pages are served from copies bundled in the image, so they work offline and load nothing from a third party. A source checkout needs sh scripts/fetch_docs_assets.sh once, or they come up blank.

Authenticating

• API key: send X-Api-Key: <key> or ?apikey=<key>. Find or regenerate it under Settings > General > Security. See Security.
• Bearer token from signing in.
• A credential you present wins over a bypass, so a keyed request from the LAN counts as an API request.

Conventions

• Errors come back as {"detail": ...}.
• Secrets are never returned. A response says whether one is set.
• A state-changing browser request needs a matching origin. Scripts using a key are exempt.
• Request bodies are capped at 10 MiB (MAX_REQUEST_BODY_BYTES). Backup restore and cover upload have larger limits. Over the cap is HTTP 413.
• Validation errors never echo back what you sent.
• A 500 from the security and backup settings routes says what failed in general terms and does not include the exception text. The detail goes to the log files.

Metadata outages

A book search that gets no answer from Libex returns 502 with “Libex search failed”. An author or series search returns 503 with “Libex could not be reached; try again shortly”. Some lookup routes still return an empty result in an outage.

If you know Sonarr: the API is not v3-compatible. Prowlarr can sync indexers into ABM through its Prowlarr connection.