Skip to content

Tools

Eleven tools, all against the wg-easy v15 REST API. Every payload that comes back from wg-easy carries the untrusted-data marker and the 60 000-character budget described in Security.

ToolAnnotationSummary
list_clientsreadOnlyHintAll clients, optionally filtered and sorted
get_clientreadOnlyHintOne client in full
create_clientCreate a client
update_clientChange selected fields of a client
enable_clientidempotentHintLet a client connect again
disable_clientidempotentHintBlock a client, keeping its config
delete_clientdestructiveHintDelete a client — two-step
get_client_configreadOnlyHintThe client's .conf file
get_client_qrcodereadOnlyHintThe client config as an SVG QR code
generate_one_time_linkA shareable one-time config download link
get_server_inforeadOnlyHintRelease, settings and interface config

list_clients

Lists all WireGuard clients with status, addresses and traffic statistics.

ArgumentTypeRequiredDescription
filterstringnoSubstring match on the name
sort'asc' | 'desc'noSort by name

get_client

Full details of a single client.

ArgumentTypeRequiredDescription
clientIdpositive integeryesNumeric ID from list_clients

create_client

Creates a client. wg-easy generates the keys and IP addresses; the new client ID comes back in the response.

ArgumentTypeRequiredDescription
namestringyesDisplay name
expiresAtstringnoISO date, e.g. 2026-12-31. Omit for no expiry

update_client

Changes only the fields you pass; everything else keeps its current value.

Why it reads before it writes

wg-easy's update endpoint expects the complete client object, so this tool fetches the current state and merges your changes into it. Fields outside the schema below — including the preUp/postUp/preDown/postDown shell hooks, which run as root on the wg-easy host — are dropped and can never be set here.

ArgumentTypeDescription
clientIdpositive integerRequired. Which client
namestringNew display name
enabledbooleanEnable or disable
expiresAtstring | nullISO date, or null to remove the expiry
ipv4AddressstringClient IPv4 address
ipv6AddressstringClient IPv6 address
allowedIpsstring[] | nullCIDRs routed through the tunnel client-side
serverAllowedIpsstring[]Extra CIDRs the server routes to this client
dnsstring[] | nullDNS servers, or null for the server default
mtuintegerMTU
persistentKeepaliveintegerKeepalive interval in seconds (0 disables it)

enable_client / disable_client

Both take only clientId. A disabled client keeps its configuration and keys but cannot connect, which makes disable_client the reversible alternative to deleting.

delete_client

Permanently deletes a client. Irreversible — the peer loses access and its keys cannot be restored.

ArgumentTypeRequiredDescription
clientIdpositive integeryesWhich client
confirmTokenstringnoToken from the first call. Omit on that call

The flow:

  1. Call without confirmToken. The tool checks the client exists and returns an error result carrying a random token, valid 5 minutes, bound to that client ID.
  2. Confirm with the user.
  3. Call again with the exact token. The token is consumed on use.

A token issued for one client ID will not delete another, and an expired token simply starts the flow over.

get_client_config

Returns the WireGuard .conf file for a client.

Contains the private key

The configuration includes the client's private key in plain text. It is not redacted — handing a peer its config is the purpose of this tool — so treat the output as a credential.

get_client_qrcode

The same configuration as SVG QR code markup, for the WireGuard mobile apps. It encodes the same private key and deserves the same handling.

Generates a link that lets someone download a client configuration once, without authenticating, so it can be sent to the end user. Requires WG_ENABLE_ONE_TIME_LINKS on the wg-easy instance.

Returns the link value and its path (/cnf/<link>). Anyone who has the URL before the intended recipient does gets the config, so share it over a channel you trust.

get_server_info

Aggregates three admin endpoints — release/update status, general settings and the WireGuard interface configuration. Secret fields are redacted.

Takes no arguments. Each section is fetched independently, so one failing endpoint returns an error for that section instead of failing the whole call — /api/information in particular returns HTTP 500 when the wg-easy container cannot reach GitHub.

Released under the MIT License.