API reference

Lists all interfaces, with optional filtering by type, name, or running/disabled state.

Returns detailed information about a single interface by exact name.

Bring an interface up or take it down without removing it.

Reads real-time PoE-out telemetry — status, voltage, current, and power — for one or more ethernet interfaces. Runs /interface ethernet poe monitor … once.

Lists the PoE-out configuration (PoE-out mode, priority) of PoE-capable ethernet interfaces. Runs /interface ethernet poe print.

Gets the detailed PoE-out settings of a specific ethernet interface — mode, priority, voltage, and low/high thresholds. Runs /interface ethernet poe print detail where name=….

Creates a VLAN interface on a parent port.

Lists VLAN interfaces, optionally filtered.

Returns full details for a specific VLAN interface.

Updates an existing VLAN interface in place. Pass only the fields you want to change.

Removes a VLAN interface. Dependent IP addresses, DHCP servers, and firewall rules that reference the interface will be orphaned — clean them up first.

Bind an address to an interface.

Inspect bindings — list takes optional filters (by interface, address, or dynamic flag); get returns one address record by ID.

Inspect pool definitions, fetch a single pool by name, plus the live used-address table (which addresses are currently leased from a pool).

update edits a pool's name, ranges, or next-pool chain; expand appends additional ranges without disrupting existing leases.

Remove a pool. Servers using it will refuse new leases.

Build a DHCP service for a subnet in three steps. create_dhcp_server takes name + interface (plus optional lease_time defaulting to "1d", address_pool, authoritative, …).

List all DHCP servers or fetch one by name.

Removes a DHCP server. The underlying pool and network records survive.

Configure upstream resolvers, add static records, and define regex-based blocklists. set_dns_servers also accepts allow_remote_requests, cache sizing, and DoH options (use_doh, doh_server, verify_doh_cert).

Inspect resolver settings, list or fetch static records, dump the cache and its statistics, and run a live test query.

Edit a static record, enable/disable it without deleting, clear the resolver cache, or dump the full DNS configuration to a file.

Three flavors of route creation. add_route takes dst_address + gateway (plus optional distance, scope, routing_mark, pref_src, check_gateway, …).

Inspect the routing table from several angles: list all, single route, traceroute-style path check, full table dump (table_name defaults to "main"), the kernel route cache, and aggregate statistics.

Edit a route in place, toggle individual routes by ID, or flush the route cache.

Creates a new firewall filter rule. Most match parameters are optional — combine them to build whatever predicate you need.

List rules with optional filters (chain, action, addresses, protocol, interface, disabled/invalid/dynamic), or fetch a single rule by ID.

Edit a rule in place, reorder it within its chain (critical for ordered evaluation), or toggle it on/off without removing it.

Creates a sensible baseline: accept established/related, drop invalid, accept ICMP, drop everything else on input. Useful for fresh routers.

Creates a NAT rule on the srcnat or dstnat chain.

Inspect NAT rules — optionally filtered by chain. get returns one rule's full record.

Same edit / reorder / toggle surface as the firewall counterparts.

Stands up a WireGuard interface. If no private key is supplied, one is generated; read the matching public key back via get_wireguard_interface.

List all WireGuard interfaces or fetch one — the latter includes the device's public key for clients to use.

Edit, toggle, or remove an interface.

Attaches a peer to an interface.

Inspect peers and their handshake state.

Edit, toggle, or remove peers. Identifiers are RouterOS peer IDs.

Produces a complete client .conf (the [Interface] / [Peer] blocks) ready to paste into a WireGuard client.

Creates / configures a wireless interface (SSID, band, channel, mode, and an attached security profile).

List wireless interfaces or fetch one's full configuration.

Edit, toggle, or remove a wireless interface.

Full lifecycle for security profiles — WPA/WPA2/WPA3 modes, passphrases, encryption. set attaches a profile to an interface.

Scan for nearby networks (optional duration) and list currently-associated clients with signal data.

MAC-based allow/deny entries with optional signal-range and time constraints.

Reports whether the device's RouterOS build supports the wireless tooling. Call this first.

Per-target rate limits — the simplest way to throttle a host or subnet. max_limit takes an upload/download pair like "10M/20M".

Hierarchical HTB shaping. Attach to a parent, match traffic by packet_mark, set max_limit / limit_at / burst, and priority (1–8).

Define reusable queue disciplines. kind is one of cake, fq-codel, sfq, red, pcq, pfifo, bfifo, …

Create users and permission groups. Groups take a policy list (e.g. read,write,ssh).

Inspect users, groups, and currently-connected sessions.

Edit users / groups, toggle accounts, or forcibly disconnect an active session.

Import a user's SSH public key (key-based auth), list installed keys, or remove one by ID.

Dumps the full user / group configuration to a file.

Remove a user or a group.

Three formats: a binary .backup (full snapshot), a .rsc export (declarative, choose rsc/json/xml and full/compact/verbose), or a single-section dump.

List backup files, inspect a backup's metadata, and download files off the device.

Restore a binary backup, import a .rsc config, or upload an arbitrary file (base64) to the device.

Removes any file from the device's filesystem.

Seven lenses on the log buffer — by topic, by severity (debug/info/warning/error/critical), free-text search, system events, the security topic, or aggregate stats.

Live-tail logs for a duration, or dump them to plain / csv.

Clears the in-memory log buffer. Doesn't affect file-backed logs.

Starts a safe-mode session. Subsequent changes are journaled and will roll back automatically if the connection drops before commit.

Persist the journaled changes, or revert them immediately.

Reports whether a safe-mode session is currently active.