RDS Proxy REST API

Manage the RDS Proxy members, targets, policies, sessions and videos from scripts.

Every function of the RDS Proxy console is available through the Artica REST API. Requests go to the Web API port of the appliance (9503 by default) from an allowed network, or with the Web API key in the X-Auth-Token header. Bodies are JSON objects whose values are strings; responses contain Status, Error and the requested data.

curl -s -H 'X-Auth-Token: <web-api-key>' https://artica.example.com:9503/rdpproxy/state

Service

Method	Path	Effect
GET	/rdpproxy/state	Installation, versions, listening port, open sessions, policies, video support, title recognition engine (`ocr_engine`: `tesseract`, `available_off` or `legacy`)
GET	/rdpproxy/status	Service status
GET	/rdpproxy/restart	Restart the gateway (progress in the console)
POST	/rdpproxy/config/apply	Rewrite the gateway configuration and certificate from the current settings, without a restart (after changing settings with `/setinfo`)

Members, targets and policies

Method	Path	Effect
GET / POST	/rdpproxy/members	List / create members
GET / PUT / DELETE	/rdpproxy/members/{id}	Read / replace / delete a member
GET / POST	/rdpproxy/targets	List / create targets
GET / PUT / DELETE	/rdpproxy/targets/{id}	Read / replace / delete a target (passwords are never returned)
POST	/rdpproxy/targets/{id}/enable, /disable	Enable or disable a target
GET / POST	/rdpproxy/policies	List / create policies
GET / PUT / DELETE	/rdpproxy/policies/{id}	Read / replace / delete a policy (session rights are the `allow_*` fields)
POST	/rdpproxy/policies/{id}/enable, /disable	Enable or disable a policy
POST / DELETE	/rdpproxy/policies/{id}/{networks\|schedules\|members\|targets}[/{sub}]	Link or unlink a network, schedule, member or target
GET / POST	/rdpproxy/patterns?policy=N	List / create detection patterns (`policy=0` for all policies)
PUT / DELETE	/rdpproxy/patterns/{id}	Replace / delete a pattern

Sessions, videos and events

Method	Path	Effect
GET	/rdpproxy/sessions	Open sessions
POST	/rdpproxy/sessions/{id}/disconnect	Disconnect a session
GET	/rdpproxy/videos	Recorded videos
DELETE	/rdpproxy/videos/{id}	Delete a video
GET	/rdpproxy/events?user=&reason=&limit=	Access events (up to 500)

Second factor, SIEM and TLS

Method	Path	Effect
GET	/rdpproxy/mfa/users	Second-factor users (secrets are never returned)
POST	/rdpproxy/mfa/reset, /unlock, /exempt	Body `{"username":"…"}`
GET	/rdpproxy/siem/status	SIEM connection state
GET / POST	/rdpproxy/tls/ciphers	Cipher suites offered to the targets

See Web network and proxies, Web PAC files and Target name banner.

Method	Path	Effect
GET / POST	/rdpproxy/webproxies	List / create upstream proxies. A proxy created without `enabled` is enabled.
GET	/rdpproxy/webproxies/{id}	Read a proxy. The password is never returned, only `password_set`.
PUT	/rdpproxy/webproxies/{id}	Replace a proxy. Without `enabled` in the body, the proxy keeps its current state. An absent or empty `password` keeps the password, `password_clear=1` removes it.
DELETE	/rdpproxy/webproxies/{id}	Delete a proxy. Refused with `proxy_in_use` while a policy uses it as its route. Refused with `proxy_in_pac` while the PAC file of a policy cites its `host:port`.
GET / POST	/rdpproxy/web-pac	List the PAC files without their content / create one with `name` and `content`, `content_base64` or `source_url`. With `id`, the file is replaced.
GET / DELETE	/rdpproxy/web-pac/{id}	Read a PAC file with its content / delete it. Deletion is refused with `pac_in_use` while a policy uses it.
POST	/rdpproxy/web-pac/{id}/test	Body `{"url":"…","host":"…"}`. Evaluates the file without opening any connection and returns the routes.
PUT	/rdpproxy/policies/{id}	Fields `web_proxy`, `web_pac` (0 = none) and `web_pac_fail_direct`. A proxy and a PAC file together are refused with `proxy_and_pac_exclusive`.
POST / PUT	/rdpproxy/targets[/{id}]	Field `web_banner` of a web target (1 by default, absent = unchanged).
GET	/rdpproxy/targets/{id}/reachability	Reachability of a target seen from the bastion. Returns `mode` (direct, proxy, pac, tunnel, ad_group, disabled), `ok`, `latency_ms`, `detail`, `via` and `address`.

Tunnel agents

See Tunnel agents.

Method	Path	Effect
GET	/rdpproxy/tunnel/status	State of the receiver: enabled, installed, running, port, allowed sources and connected agents.
POST	/rdpproxy/tunnel/enable	Body `{"enabled":true}` or `false`. Starts or stops the receiver and its firewall rule. When the call starts the receiver, it waits up to 3 seconds for the receiver to be ready before it answers.
POST	/rdpproxy/tunnel/settings	Body `{"port":…,"allowed_sources":["CIDR"]}`, port 1024 to 65535. A new port restarts the receiver.
GET	/rdpproxy/tunnel/downloads	Agent packages: file, system, architecture, size, SHA-256, kind and `signed` for the MSI.
GET / POST	/rdpproxy/tunnel/agents	List the agents and their state / create an enrollment code with `{"id":"…","ttl_hours":…}` (0 to 168). The code is returned once only.
DELETE	/rdpproxy/tunnel/agents/{id}/token	Cancel a pending enrollment code.
POST	/rdpproxy/tunnel/agents/{id}/revoke	Revoke every valid certificate of the agent and close its connection.
POST / PUT	/rdpproxy/targets[/{id}]	Field `tunnel_agent`, accepted on RDP and VNC targets only.

Example: create a member and link it to a policy

curl -s -H 'X-Auth-Token: <key>' -X POST https://artica:9503/rdpproxy/members \
  -d '{"username":"jsmith","password":"S3cret!","endoflife":"1798761600"}'
# {"Status":true,"Error":"","ID":12}
curl -s -H 'X-Auth-Token: <key>' -X POST https://artica:9503/rdpproxy/policies/1/members \
  -d '{"id":"12"}'