Uptime-Kuma-Web-API 2.0.0

The first release since 1.2.2. It closes a serious security hole, replaces every outdated
dependency and makes the connection to Uptime Kuma reliable. It contains breaking changes: read
"Upgrading" before you deploy.

docker pull medaziz11/uptimekuma_restapi:v2.0.0

Supported Uptime Kuma versions: 1.21.3 – 1.23.x. Uptime Kuma 2.x is not supported.

Security

• Sign-up is no longer open. In 1.x, POST /users required no authentication: anyone who could
  reach the API could create an account and then control Uptime Kuma. Creating, listing and deleting
  users now requires the admin user's token.
• Tokens no longer contain the Uptime Kuma session token. A JWT is signed, not encrypted, so 1.x
  handed that token to every client.
• Error responses no longer include raw exception text.
• A deleted user's token stops working immediately. The admin user can no longer be deleted.

If your 1.x API was reachable from an untrusted network, review the accounts returned by
GET /users after upgrading and change your Uptime Kuma password.

Highlights

• One shared connection to Uptime Kuma that reconnects and logs in again on its own. 1.x opened
  a new Socket.IO connection on every request and never closed it.
• Starts without Uptime Kuma. The API connects on the first request, so the "start Kuma, create
  the user, restart the stack" dance is gone.
• Tokens survive restarts: when SECRET_KEY is not set, a key is generated once and stored in
  the /db volume.
• New endpoints: /notifications, /proxies, /docker_hosts, PATCH /tags/{id},
  GET /users/me, GET /health.
• Newer monitor types and options from Uptime Kuma 1.22/1.23 (groups, JSON query, Kafka, gRPC,
  ...), and cron-based maintenances.
• Consistent errors: {"detail": "..."} with 400 / 401 / 403 / 404 / 422 / 503 / 504.
• Python 3.13, FastAPI 0.162, pydantic 2; Docker health check; amd64 and arm64 images.

Upgrading from 1.x

1. Check your Uptime Kuma version. It must be 1.21.3 or newer in the 1.x line.
2. Set the required variables. KUMA_SERVER, KUMA_USERNAME, KUMA_PASSWORD and
   ADMIN_PASSWORD are mandatory and the bundled docker-compose.yml no longer ships default
   credentials. The Uptime Kuma account must not use two-factor authentication.
3. Keep your /db volume. The user database is reused as-is, and existing password hashes keep
   working.
4. ADMIN_PASSWORD now wins. At every start the admin password is set to ADMIN_PASSWORD.
5. Log in again. Tokens issued by 1.x are rejected.
6. Update your clients for the changes below.

Docker image tags

New settings

KUMA_TIMEOUT, KUMA_SSL_VERIFY, DB_PATH, LOG_LEVEL; BACKEND_CORS_ORIGINS is now applied.
See the README.

Full list of changes

See the changelog.

Thanks to nida for adding the MIT license
(MedAziz11/Uptime-Kuma-Web-API#91).