API

Everything the dashboard does goes through the REST API; you can call it yourself with the same account.

Base URLs

Environment	API base	Interactive reference
Production	https://api.molehash.com/api/v1	not exposed (see below)
Preprod	https://preprod-api.molehash.com/api/v1	https://preprod-api.molehash.com/docs (Swagger UI), /redoc

The interactive OpenAPI reference (/docs, /redoc, /api/v1/openapi.json) is served on non-production environments only. Use preprod to explore the schema; the routes are identical.

Authentication

1. POST /auth/login with {"username", "password"} → {"access_token", "requires_2fa", "first_login", "user"}. If requires_2fa is true, call POST /auth/login-2fa with the 6-digit code to obtain the token.
2. Send the token as Authorization: Bearer <access_token> on every request.

Tokens act as the user: the same sites, the same permissions (see Permissions matrix). A 403 means the role lacks the permission; a 402 means the site's plan does not include the feature.

Route groups

Prefix	What it covers
/auth	login, register, e-mail verification, password reset, 2FA setup/enable/disable
/users	user accounts, change-password (owner/superuser may set a member's password without the current one)
/sites, /site-access, /site-settings	sites, members and roles, per-site settings
/miners	miner list, detail, update (edit form), bulk commands with stagger_seconds, in-flight
/telemetry	snapshots, components, detail/{miner_id} (boards, chip summary, PCB sensors, fans, pools, events)
/statistics	overview, site-day, production, reboots series
/issues, /alerts, /triggers	issue scan, alert list, notification triggers
/repair-tickets, /repair-flow, /work-orders, /manual-tasks	maintenance
/inventory	parts and stock
/power-events, /energy, /transformers	curtailments, energy data, electrical topology
/cron-jobs, /scheduled-reports	scheduled commands and e-mailed reports
/firmwares	Happy Mining firmware library, install, share links
/moles, /discovery, /agent, /cron-data	Mole agents: registration, heartbeat, miner reports, command queue
/pools, /pow	pool stats, PoW market
/billing	plans and Stripe checkout
/mcp	Model Context Protocol endpoint (below)

Agent endpoints

The Mole agent authenticates with its own API key (Authorization: Bearer <agent key> plus X-Client-Id) and uses only the /cron-data/*/pickaxe/{id} routes: miner-data (scan results), heartbeat, commands (claim / report), settings, firmware, ip-report. See Mole Agents.

MCP (connect Claude)

The API exposes a Model Context Protocol server so an AI assistant can query and act on your fleet with your rights.

• claude.ai — Settings → Connectors → Add custom connector and paste the URL returned by GET /mcp/token: https://<api>/api/v1/mcp/<your-token>.
• Claude Code / other clients — POST https://<api>/api/v1/mcp with Authorization: Bearer <your-token> (Streamable HTTP transport).

The token is personal (acts as you, same sites and permissions) and can be rotated at any time with POST /mcp/token/rotate; the previous one stops working immediately. The dashboard's /mcp page shows the same URL and a copy button.

Rate limits and caching

Heavy statistics (/statistics/overview, /statistics/site-day) are cached server-side in Redis for 60 s (300 s for closed days); a response may be up to a minute old. Bulk commands are queued and executed by the agent, so POST /miners/bulk-command returns a batch_id immediately — follow progress through GET /miners/in-flight?site_id= and the Activity panel.