The administration interface exposes both observations and actions. Some documented operations change state through a GET request. Do not place those URLs in a public page, monitoring probe or automatically prefetched link and assume GET means read-only.
Endpoint reference
| Path | Parameters | Effect |
|---|---|---|
/admin/stats | Optional filtering depends on the endpoint/version | Read server statistics |
/admin/listmounts | None for the basic listing | Read available mountpoints |
/admin/listclients | mount | Read listeners and their identifiers |
/admin/metadata | mount, mode=updinfo, song | Change metadata |
/admin/fallbacks | mount, fallback | Change fallback routing |
/admin/moveclients | mount, destination | Move existing listeners |
/admin/killclient | mount, id | Disconnect one listener |
/admin/killsource | mount | Disconnect the stream’s source |
The table describes the documented classic endpoints, not every internal command in 2.5.0. A listener identifier is a runtime identifier, not a permanent user account. Moving clients requires an active suitable destination. Killing a source can trigger configured fallback behaviour and affects real listeners.
Make a read-only request
The following local request prompts for a password instead of embedding it in a URL:
curl --fail --show-error --user admin --get --data-urlencode 'mount=/live.ogg' http://127.0.0.1:8000/admin/listclientsFor remote use, choose TLS and your own server address. Check HTTP status and the XML result. A successful transport response does not necessarily mean a requested mutation succeeded. Treat listener addresses and session details as operational data with restricted access.
Understand the web interface
/admin/stats.xsl provides the human-facing administration view. The shipped transforms render server data; their presence does not create arbitrary new API commands. General operations require administration credentials, while certain mount-scoped operations can accept the relevant source policy. Test the actual account and action rather than assuming that one successful login grants every permission.
Use only read endpoints for routine monitoring. Exercise destructive actions solely against a disposable mount with known test listeners. Record the before/after source and listener state when validating an integration.