IOTA REST API can be used to control the device and deploy automatic configuration. This documentation applies to IOTA 100 CORE and IOTA 10 CORE PLUS. Where an endpoint exists on only one of the two, the page says so.
When using the API remotely the expected URL looks like this:
https://<ip-address>/api/<api-call>
Most requests must carry an authorization token in the authorization HTTP header. The token is obtained from the login endpoint (see Authentication):
curl -k -X POST -H "Content-Type: application/json" -d '{"username": "<user>", "password": "<password>"}' https://<ip-address>/api/login
For example, using curl, the request to list the users of the device looks like:
curl -k -H "authorization: <token>" https://<ip-address>/api/users
Each endpoint states the minimum user role required to call it: viewer, operator or admin.