Netbird

NetBird builds a WireGuard-based overlay network where any peer can connect to any other with automatic NAT traversal — no central VPN server bottleneck. For infrastructure agents, the Management API enables: adding new peers, creating access control policies, configuring DNS, managing network routes, and grouping peers for policy targeting. Self-hostable for air-gapped environments. Confidence is docs-derived.

REST Management API at api.netbird.io/api. Resources: peers, policies, routes, dns-nameservers, groups, users, setup-keys. GET /peers lists all peers. POST /setup-keys creates a setup key for peer registration. POST /policies creates an access control policy. POST /routes creates a network route (subnet CIDR → peer gateway). GET /groups lists groups. Response payloads are JSON.

Personal Access Token (PAT) auth: Authorization: Token {pat}. PATs from NetBird Dashboard → Profile → Access Tokens. Account-scoped. HTTPS enforced. No OAuth2. Service accounts supported via dedicated service user accounts. Token rotation: delete old PAT, create new via API or Dashboard.

Standard HTTP status codes with JSON error bodies. 401 for invalid PAT, 403 for insufficient permissions, 400 for validation errors. Policy changes applied within seconds to connected peers. NetBird Cloud uptime at status.netbird.io. Signal/STUN/relay server availability critical for NAT traversal.

docs.netbird.io/api/reference provides clean API reference with all endpoints, schemas, and examples. Getting started guides for self-hosting and Cloud. Terraform provider available. Community via NetBird Slack and GitHub. Open-source (MIT license).