> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Manage organizations, members, VPN configurations and certificates over HTTP.

**ClosedVPN** is a secure, enterprise-grade VPN built by [OneFirewall](https://onefirewall.com) for hybrid and remote teams. It combines fast private access with AI-powered threat prevention across Windows, macOS, iOS and Android.

The ClosedVPN API gives you full programmatic control — provision VPN certificates, manage organizations and members, monitor live connection stats, and automate access workflows from your own scripts, CI pipelines or integrations.

## Base URL

All endpoints are served from a single host and prefixed with `/auth`.

```
https://closedvpn.io
```

## Authentication

Every endpoint except `/auth/send-magic-link`, `/auth/verify-magic-link` and
`/auth/logout` requires a **Personal Access Token (PAT)** in the
`Authorization` header.

```
Authorization: Bearer YOUR_PAT_HERE
```

You can create a token from the **Profile** page in the [ClosedVPN web application](https://closedvpn.io),
or programmatically with [`POST /auth/generate-pat`](/closedvpn/endpoint/personal-access-tokens/generate-pat).
The plaintext token is returned **once** and stored only as a bcrypt hash — it
cannot be recovered later.

<Warning>
  Save the token the moment you create it. If you lose it, revoke it and issue a
  new one — there is no way to read it back.
</Warning>

For the full sign-in flow, token lifecycle and role-based access rules, see the
[Authorization](/closedvpn/authorization) guide.

## Your first request

Confirm your token works by validating it. This returns the authenticated user
and their currently selected organization.

```bash theme={null}
curl https://closedvpn.io/auth/validate-token \
  -H "Authorization: Bearer YOUR_PAT_HERE"
```

```json theme={null}
{
  "success": true,
  "user": {
    "userId": "60c72b2f5f1b2c001c8e4b1b",
    "name": "John Doe",
    "email": "john@example.com",
    "avatar": "JD",
    "selectedOrg": "60c72b2f5f1b2c001c8e4b1a"
  }
}
```

## Organization context

Most resources belong to an organization. Endpoints that operate on one either
take an explicit `org_id` query parameter, or fall back to the caller's
**selected organization**.

Retrieve your organizations with
[`GET /auth/get-orgs`](/closedvpn/endpoint/organizations/get-orgs), then set
the active one with
[`POST /auth/select-org`](/closedvpn/endpoint/organizations/select-org).
Endpoints like `GET /auth/vpn-exit-nodes` and `GET /auth/threat-prevention-stats`
depend on that selection.

## Conventions

<AccordionGroup>
  <Accordion title="Timestamps">
    Every timestamp is a Unix epoch value in **milliseconds**, returned as a
    number rather than an ISO-8601 string. For example `1735689600000`.
  </Accordion>

  <Accordion title="Identifiers">
    Resource identifiers are MongoDB ObjectIds, returned as 24-character
    hexadecimal strings such as `60c72b2f5f1b2c001c8e4b1a`.
  </Accordion>

  <Accordion title="Errors">
    Errors return a JSON body with a `message` field describing the failure. A
    request with **no** credential returns `401`. A credential that is present
    but invalid, expired or inactive returns `403`.
  </Accordion>
</AccordionGroup>

## Endpoints

<CardGroup cols={2}>
  <Card title="Authentication" icon="key" href="/closedvpn/endpoint/authentication/validate-token">
    Magic link sign-in, session validation and sign-out.
  </Card>

  <Card title="Personal Access Tokens" icon="code" href="/closedvpn/endpoint/personal-access-tokens/generate-pat">
    Create, list and revoke the tokens used for API access.
  </Card>

  <Card title="Organizations" icon="building" href="/closedvpn/endpoint/organizations/get-orgs">
    Create, update, select and delete organizations.
  </Card>

  <Card title="Members" icon="users" href="/closedvpn/endpoint/members/add-user">
    Add members, change roles and remove access.
  </Card>

  <Card title="VPN Certificates" icon="certificate" href="/closedvpn/create-vpn-cert">
    Issue and download OpenVPN client profiles.
  </Card>

  <Card title="VPN Configurations" icon="server" href="/closedvpn/endpoint/vpn-configurations/list-vpn-configs">
    Manage VPN servers and run their predefined commands.
  </Card>

  <Card title="VPN Exit Nodes" icon="globe" href="/closedvpn/endpoint/vpn-exit-nodes/vpn-exit-nodes">
    List the exit nodes available to your organization.
  </Card>

  <Card title="Statistics" icon="chart-line" href="/closedvpn/endpoint/statistics/vpn-user-stats">
    Connection status, traffic reporting and threat prevention.
  </Card>

  <Card title="Notifications" icon="bell" href="/closedvpn/endpoint/notifications/get-notifications">
    Read in-app notifications and mark them as read.
  </Card>

  <Card title="Activity Logs" icon="clock-rotate-left" href="/closedvpn/endpoint/activity-logs/activity-logs">
    Retrieve recent activity for your account.
  </Card>
</CardGroup>

<Note>
  The VPN capability previously delivered through the OneFirewall Application at
  `https://app.onefirewall.com/api/v1/vpn` now runs on ClosedVPN and is served
  from `https://closedvpn.io`. The legacy OneFirewall VPN endpoints are
  deprecated and are replaced by the operations documented in this tab.
</Note>