Skip to content

JSON API

REST API for external frontend apps with JWT token authentication.

Overview

FastAPI Admin Kit provides a JSON API alongside the HTML admin panel. The API shares the same RBAC system, making it easy to build custom frontends or mobile apps.

Endpoints

The API is mounted at /admin/api/ by default.

Authentication

Method Endpoint Description
POST /admin/api/auth/login Obtain JWT token pair
POST /admin/api/auth/refresh Refresh access token
POST /admin/api/auth/logout Invalidate refresh token
GET /admin/api/auth/me Get current user info

CRUD

Method Endpoint Description
GET /admin/api/{model}/ List records
POST /admin/api/{model}/ Create record
GET /admin/api/{model}/{id} Get single record
PUT /admin/api/{model}/{id} Update record
PATCH /admin/api/{model}/{id} Partially update record (only provided fields)
DELETE /admin/api/{model}/{id} Delete record

Roles

Method Endpoint Description
GET /admin/api/roles/ List roles
POST /admin/api/roles/ Create role
GET /admin/api/roles/{id} Get role
PUT /admin/api/roles/{id} Update role
DELETE /admin/api/roles/{id} Delete role
Method Endpoint Description
GET /admin/api/search?q={query} Search across models

Excluded models

Models whose admin class sets skip_auto_routes = True are not exposed over the JSON API. This includes the built-in internal tables (admin_refresh_tokens, admin_user_permissions, admin_user_totp, admin_ai_attachments) and any model gated behind a feature flag (e.g. the admin_ai_* tables when ai_enabled=False). To opt a custom model out of the JSON API, set skip_auto_routes = True on its ModelAdmin:

class SecretAdmin(ModelAdmin):
    skip_auto_routes = True

Per-model endpoint control (export_endpoint)

ModelAdmin.export_endpoint controls which routers are auto-built for a model. It only affects the routers generated by admin.setup() — admin HTML routes are never shown in the /openapi.json Swagger doc, only JSON API routes are.

Value Admin (HTML) router JSON API router
None built built
"html" built skipped
"api" skipped built 
@admin.register(Product)
class ProductAdmin(ModelAdmin):
    export_endpoint = "api"  # JSON API only — no /admin/products pages

With export_endpoint = "api" the model is also hidden from the sidebar and topbar search suggestions (it has no HTML pages).

Standalone router export

You can build a model's routers without calling admin.register() at all using export_api_route() / export_admin_route():

from fastapi_admin_kit import ModelAdmin

class ProductAdmin(ModelAdmin):
    export_endpoint = "api"

app.include_router(ProductAdmin().export_api_route(Product))
app.include_router(ProductAdmin().export_admin_route(Product), prefix="/admin")
  • export_api_route(model, prefix="") — JSON CRUD router (appears in Swagger).
  • export_admin_route(model, prefix="") — HTML admin router (hidden from Swagger).

These helpers build the routers directly and do not write to the admin registry, so no admin.register() (and no sidebar entry) is created.

Authentication

Token Obtain

curl -X POST http://localhost:8000/admin/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "mypassword"}'

Response:

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "token_type": "bearer"
}

Using the Token

curl http://localhost:8000/admin/api/products/ \
  -H "Authorization: Bearer eyJ..."

Token Refresh

curl -X POST http://localhost:8000/admin/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "eyJ..."}'

Requirements

The JSON API requires the pyjwt package:

pip install fastapi-admin-kit[full]

Or with uv:

uv add fastapi-admin-kit[full]

RBAC

The API uses the same permission system as the HTML admin:

  • Users can only access models they have view permission for
  • Create/edit/delete require corresponding permissions
  • Superusers bypass all permission checks

Schema Generation

Auto-generated JSON schemas are available for each model:

curl http://localhost:8000/admin/api/schema/products/

Next Steps