API Reference

Fabrik's backend is a Django REST Framework API behind a Daphne ASGI server. Everything the frontend does — login, run a query, schedule a task, talk to AWX — goes through the same JSON HTTP API documented here. There is nothing the UI can do that a script can't.

Base URL

All endpoints live under /api/:

https://your-fabrik-host/api/<app>/<resource>/

The frontend Vite dev server proxies /api/* to the backend container in development; production deployments route it through nginx (see Production setup).

The OpenAPI schema

Fabrik generates an OpenAPI 3.0 schema from the code at runtime using drf-spectacular. Three endpoints expose it:

Authentication

Fabrik uses JWT bearer tokens. All endpoints require authentication unless explicitly noted. Pass the access token in the Authorization header:

GET /api/queries/saved-queries/ HTTP/1.1
Host: fabrik.example.com
Authorization: Bearer <access_token>

Access tokens live 15 minutes; refresh tokens live 7 days. See Authentication for the full login flow, refresh mechanics, and MFA.

Content types

• Requests: application/json for everything. Multipart uploads (e.g. MIM dump files) use multipart/form-data — the endpoint docs call that out where it matters.
• Responses: application/json, UTF-8. Dates are ISO 8601 with timezone (2026-04-22T14:30:00+00:00). UUIDs are lowercase hex strings with dashes.

Pagination

List endpoints paginate with DRF's PageNumberPagination:

• Default page size: 50 items.
• Max page size: 200 (enforced per-endpoint where it matters).
• Query params: ?page=<n>&page_size=<n>.

Response envelope:

{
  "count": 142,
  "next": "https://fabrik.example.com/api/queries/saved-queries/?page=3",
  "previous": "https://fabrik.example.com/api/queries/saved-queries/?page=1",
  "results": [ /* 50 objects */ ]
}

Some endpoints (stats, aggregates) don't paginate — they return a bare object. Endpoint docs mark these.

Filtering and ordering

Where supported:

• ?search=<term> — full-text search across documented fields.
• ?ordering=<field> or ?ordering=-<field> — sort ascending / descending.
• ?<field>=<value> — exact-match filter on indexed fields.

Each endpoint page lists the supported filters for that resource.

Throttling

Two layers of rate limiting apply:

Application-level (DRF throttles):

Reverse-proxy (nginx):

Exceeding either returns 429 Too Many Requests with a Retry-After header.

Error format

Successful responses vary by endpoint. Errors follow a consistent shape:

// 400 Bad Request — validation error
{
  "field_name": ["This field is required."],
  "another_field": ["Must be a valid UUID."]
}

// 401 Unauthorized — missing or invalid token
{ "detail": "Authentication credentials were not provided." }

// 403 Forbidden — authenticated but not allowed
{ "detail": "You do not have permission to perform this action." }

// 404 Not Found
{ "detail": "Not found." }

// 429 Too Many Requests
{ "detail": "Request was throttled. Expected available in 42 seconds." }

// 500 Internal Server Error
{ "detail": "Internal server error.", "request_id": "..." }

Every 5xx response carries a request_id — include it when reporting bugs.

HTTP verbs

Standard REST semantics everywhere:

WebSockets

Long-running operations (query execution, AWX job monitoring, MIM import) stream progress over WebSocket. Connections are short-lived JWT-authenticated using a one-shot ticket exchanged through /api/ws-ticket/. See WebSockets.

Where to go next