Skip to main content
ClosedVPN is a secure, enterprise-grade VPN built by OneFirewall for hybrid and remote teams. It combines fast private access with AI-powered threat prevention across Windows, macOS, iOS and Android. The ClosedVPN API gives you full programmatic control — provision VPN certificates, manage organizations and members, monitor live connection stats, and automate access workflows from your own scripts, CI pipelines or integrations.

​
Base URL

All endpoints are served from a single host and prefixed with /auth.

​
Authentication

Every endpoint except /auth/send-magic-link, /auth/verify-magic-link and /auth/logout requires a Personal Access Token (PAT) in the Authorization header.
You can create a token from the Profile page in the ClosedVPN web application, or programmatically with POST /auth/generate-pat. The plaintext token is returned once and stored only as a bcrypt hash — it cannot be recovered later.
Save the token the moment you create it. If you lose it, revoke it and issue a new one — there is no way to read it back.
For the full sign-in flow, token lifecycle and role-based access rules, see the Authorization guide.

​
Your first request

Confirm your token works by validating it. This returns the authenticated user and their currently selected organization.

​
Organization context

Most resources belong to an organization. Endpoints that operate on one either take an explicit org_id query parameter, or fall back to the caller’s selected organization. Retrieve your organizations with GET /auth/get-orgs, then set the active one with POST /auth/select-org. Endpoints like GET /auth/vpn-exit-nodes and GET /auth/threat-prevention-stats depend on that selection.

​
Conventions

Every timestamp is a Unix epoch value in milliseconds, returned as a number rather than an ISO-8601 string. For example 1735689600000.
Resource identifiers are MongoDB ObjectIds, returned as 24-character hexadecimal strings such as 60c72b2f5f1b2c001c8e4b1a.
Errors return a JSON body with a message field describing the failure. A request with no credential returns 401. A credential that is present but invalid, expired or inactive returns 403.

​
Endpoints

Authentication

Magic link sign-in, session validation and sign-out.

Personal Access Tokens

Create, list and revoke the tokens used for API access.

Organizations

Create, update, select and delete organizations.

Members

Add members, change roles and remove access.

VPN Certificates

Issue and download OpenVPN client profiles.

VPN Configurations

Manage VPN servers and run their predefined commands.

VPN Exit Nodes

List the exit nodes available to your organization.

Statistics

Connection status, traffic reporting and threat prevention.

Notifications

Read in-app notifications and mark them as read.

Activity Logs

Retrieve recent activity for your account.
The VPN capability previously delivered through the OneFirewall Application at https://app.onefirewall.com/api/v1/vpn now runs on ClosedVPN and is served from https://closedvpn.io. The legacy OneFirewall VPN endpoints are deprecated and are replaced by the operations documented in this tab.