Merge pull request #4110 from jestabro/distinct-api

http-api: T6736: move REST API to a node distinct from GraphQL API

17 files changed, 1500 insertions, 1057 deletions

diff --git a/src/migration-scripts/https/6-to-7 b/src/migration-scripts/https/6-to-7
new file mode 100644
index 000000000..571f3b6ae
--- /dev/null
+++ b/src/migration-scripts/https/6-to-7
@@ -0,0 +1,43 @@
+# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# T6736: move REST API to distinct node
+
+
+from vyos.configtree import ConfigTree
+
+
+base = ['service', 'https', 'api']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    # Move REST API configuration to new node
+    # REST API was previously enabled if base path exists
+    config.set(['service', 'https', 'api', 'rest'])
+    for entry in ('debug', 'strict'):
+        if config.exists(base + [entry]):
+            config.set(base + ['rest', entry])
+            config.delete(base + [entry])
+
+    # Move CORS settings under GraphQL
+    # CORS is not implemented for REST API
+    if config.exists(base + ['cors']):
+        old_base = base + ['cors']
+        new_base = base + ['graphql', 'cors']
+        config.copy(old_base, new_base)
+        config.delete(old_base)
diff --git a/src/services/api/__init__.py b/src/services/api/__init__.py
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/src/services/api/__init__.py
diff --git a/src/services/api/graphql/bindings.py b/src/services/api/graphql/bindings.py
index ef4966466..ebf745f32 100644
--- a/src/services/api/graphql/bindings.py
+++ b/src/services/api/graphql/bindings.py
@@ -1,4 +1,4 @@
-# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -13,24 +13,40 @@
 # You should have received a copy of the GNU Lesser General Public License
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
+
 import vyos.defaults
-from . graphql.queries import query
-from . graphql.mutations import mutation
-from . graphql.directives import directives_dict
-from . graphql.errors import op_mode_error
-from . graphql.auth_token_mutation import auth_token_mutation
-from . libs.token_auth import init_secret
-from . import state
-from ariadne import make_executable_schema, load_schema_from_path, snake_case_fallback_resolvers
+
+from ariadne import make_executable_schema
+from ariadne import load_schema_from_path
+from ariadne import snake_case_fallback_resolvers
+
+from .graphql.queries import query
+from .graphql.mutations import mutation
+from .graphql.directives import directives_dict
+from .graphql.errors import op_mode_error
+from .graphql.auth_token_mutation import auth_token_mutation
+from .libs.token_auth import init_secret
+
+from ..session import SessionState
+
 
 def generate_schema():
+    state = SessionState()
     api_schema_dir = vyos.defaults.directories['api_schema']
 
-    if state.settings['app'].state.vyos_auth_type == 'token':
+    if state.auth_type == 'token':
         init_secret()
 
     type_defs = load_schema_from_path(api_schema_dir)
 
-    schema = make_executable_schema(type_defs, query, op_mode_error, mutation, auth_token_mutation, snake_case_fallback_resolvers, directives=directives_dict)
+    schema = make_executable_schema(
+        type_defs,
+        query,
+        op_mode_error,
+        mutation,
+        auth_token_mutation,
+        snake_case_fallback_resolvers,
+        directives=directives_dict,
+    )
 
     return schema
diff --git a/src/services/api/graphql/graphql/auth_token_mutation.py b/src/services/api/graphql/graphql/auth_token_mutation.py
index a53fa4d60..c74364603 100644
--- a/src/services/api/graphql/graphql/auth_token_mutation.py
+++ b/src/services/api/graphql/graphql/auth_token_mutation.py
@@ -19,11 +19,12 @@ from typing import Dict
 from ariadne import ObjectType
 from graphql import GraphQLResolveInfo
 
-from .. libs.token_auth import generate_token
-from .. session.session import get_user_info
-from .. import state
+from ..libs.token_auth import generate_token
+from ..session.session import get_user_info
+from ...session import SessionState
+
+auth_token_mutation = ObjectType('Mutation')
 
-auth_token_mutation = ObjectType("Mutation")
 
 @auth_token_mutation.field('AuthToken')
 def auth_token_resolver(obj: Any, info: GraphQLResolveInfo, data: Dict):
@@ -31,10 +32,13 @@ def auth_token_resolver(obj: Any, info: GraphQLResolveInfo, data: Dict):
     user = data['username']
     passwd = data['password']
 
-    secret = state.settings['secret']
-    exp_interval = int(state.settings['app'].state.vyos_token_exp)
-    expiration = (datetime.datetime.now(tz=datetime.timezone.utc) +
-                  datetime.timedelta(seconds=exp_interval))
+    state = SessionState()
+
+    secret = getattr(state, 'secret', '')
+    exp_interval = int(state.token_exp)
+    expiration = datetime.datetime.now(tz=datetime.timezone.utc) + datetime.timedelta(
+        seconds=exp_interval
+    )
 
     res = generate_token(user, passwd, secret, expiration)
     try:
@@ -44,18 +48,9 @@ def auth_token_resolver(obj: Any, info: GraphQLResolveInfo, data: Dict):
         pass
     if 'token' in res:
         data['result'] = res
-        return {
-            "success": True,
-            "data": data
-        }
+        return {'success': True, 'data': data}
 
     if 'errors' in res:
-        return {
-            "success": False,
-            "errors": res['errors']
-        }
-
-    return {
-        "success": False,
-        "errors": ['token generation failed']
-    }
+        return {'success': False, 'errors': res['errors']}
+
+    return {'success': False, 'errors': ['token generation failed']}
diff --git a/src/services/api/graphql/graphql/mutations.py b/src/services/api/graphql/graphql/mutations.py
index d115a8e94..0b391c070 100644
--- a/src/services/api/graphql/graphql/mutations.py
+++ b/src/services/api/graphql/graphql/mutations.py
@@ -14,20 +14,23 @@
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
-from ariadne import ObjectType, convert_camel_case_to_snake
-from makefun import with_signature
 
 # used below by func_sig
-from typing import Any, Dict, Optional # pylint: disable=W0611
-from graphql import GraphQLResolveInfo # pylint: disable=W0611
+from typing import Any, Dict, Optional  # pylint: disable=W0611 # noqa: F401
+from graphql import GraphQLResolveInfo  # pylint: disable=W0611 # noqa: F401
+
+from ariadne import ObjectType, convert_camel_case_to_snake
+from makefun import with_signature
 
-from .. import state
-from .. libs import key_auth
-from api.graphql.session.session import Session
-from api.graphql.session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
 from vyos.opmode import Error as OpModeError
 
-mutation = ObjectType("Mutation")
+from ...session import SessionState
+from ..libs import key_auth
+from ..session.session import Session
+from ..session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
+
+mutation = ObjectType('Mutation')
+
 
 def make_mutation_resolver(mutation_name, class_name, session_func):
     """Dynamically generate a resolver for the mutation named in the
@@ -45,12 +48,13 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
     func_base_name = convert_camel_case_to_snake(class_name)
     resolver_name = f'resolve_{func_base_name}'
     func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Optional[Dict]=None)'
+    state = SessionState()
 
     @mutation.field(mutation_name)
     @with_signature(func_sig, func_name=resolver_name)
     async def func_impl(*args, **kwargs):
         try:
-            auth_type = state.settings['app'].state.vyos_auth_type
+            auth_type = state.auth_type
 
             if auth_type == 'key':
                 data = kwargs['data']
@@ -58,10 +62,7 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
 
                 auth = key_auth.auth_required(key)
                 if auth is None:
-                    return {
-                         "success": False,
-                         "errors": ['invalid API key']
-                    }
+                    return {'success': False, 'errors': ['invalid API key']}
 
                 # We are finished with the 'key' entry, and may remove so as to
                 # pass the rest of data (if any) to function.
@@ -76,21 +77,15 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
                 if user is None:
                     error = info.context.get('error')
                     if error is not None:
-                        return {
-                            "success": False,
-                            "errors": [error]
-                        }
-                    return {
-                        "success": False,
-                        "errors": ['not authenticated']
-                    }
+                        return {'success': False, 'errors': [error]}
+                    return {'success': False, 'errors': ['not authenticated']}
             else:
                 # AtrributeError will have already been raised if no
-                # vyos_auth_type; validation and defaultValue ensure it is
+                # auth_type; validation and defaultValue ensure it is
                 # one of the previous cases, so this is never reached.
                 pass
 
-            session = state.settings['app'].state.vyos_session
+            session = state.session
 
             # one may override the session functions with a local subclass
             try:
@@ -105,35 +100,36 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
             result = method()
             data['result'] = result
 
-            return {
-                "success": True,
-                "data": data
-            }
+            return {'success': True, 'data': data}
         except OpModeError as e:
             typename = type(e).__name__
             msg = str(e)
             return {
-                "success": False,
-                "errore": ['op_mode_error'],
-                "op_mode_error": {"name": f"{typename}",
-                                 "message": msg if msg else op_mode_err_msg.get(typename, "Unknown"),
-                                 "vyos_code": op_mode_err_code.get(typename, 9999)}
+                'success': False,
+                'errore': ['op_mode_error'],
+                'op_mode_error': {
+                    'name': f'{typename}',
+                    'message': msg if msg else op_mode_err_msg.get(typename, 'Unknown'),
+                    'vyos_code': op_mode_err_code.get(typename, 9999),
+                },
             }
         except Exception as error:
-            return {
-                "success": False,
-                "errors": [repr(error)]
-            }
+            return {'success': False, 'errors': [repr(error)]}
 
     return func_impl
 
+
 def make_config_session_mutation_resolver(mutation_name):
-    return make_mutation_resolver(mutation_name, mutation_name,
-                                  convert_camel_case_to_snake(mutation_name))
+    return make_mutation_resolver(
+        mutation_name, mutation_name, convert_camel_case_to_snake(mutation_name)
+    )
+
 
 def make_gen_op_mutation_resolver(mutation_name):
     return make_mutation_resolver(mutation_name, mutation_name, 'gen_op_mutation')
 
+
 def make_composite_mutation_resolver(mutation_name):
-    return make_mutation_resolver(mutation_name, mutation_name,
-                                  convert_camel_case_to_snake(mutation_name))
+    return make_mutation_resolver(
+        mutation_name, mutation_name, convert_camel_case_to_snake(mutation_name)
+    )
diff --git a/src/services/api/graphql/graphql/queries.py b/src/services/api/graphql/graphql/queries.py
index 717098259..9303fe909 100644
--- a/src/services/api/graphql/graphql/queries.py
+++ b/src/services/api/graphql/graphql/queries.py
@@ -14,20 +14,23 @@
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
-from ariadne import ObjectType, convert_camel_case_to_snake
-from makefun import with_signature
 
 # used below by func_sig
-from typing import Any, Dict, Optional # pylint: disable=W0611
-from graphql import GraphQLResolveInfo # pylint: disable=W0611
+from typing import Any, Dict, Optional  # pylint: disable=W0611 # noqa: F401
+from graphql import GraphQLResolveInfo  # pylint: disable=W0611 # noqa: F401
+
+from ariadne import ObjectType, convert_camel_case_to_snake
+from makefun import with_signature
 
-from .. import state
-from .. libs import key_auth
-from api.graphql.session.session import Session
-from api.graphql.session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
 from vyos.opmode import Error as OpModeError
 
-query = ObjectType("Query")
+from ...session import SessionState
+from ..libs import key_auth
+from ..session.session import Session
+from ..session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
+
+query = ObjectType('Query')
+
 
 def make_query_resolver(query_name, class_name, session_func):
     """Dynamically generate a resolver for the query named in the
@@ -45,12 +48,13 @@ def make_query_resolver(query_name, class_name, session_func):
     func_base_name = convert_camel_case_to_snake(class_name)
     resolver_name = f'resolve_{func_base_name}'
     func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Optional[Dict]=None)'
+    state = SessionState()
 
     @query.field(query_name)
     @with_signature(func_sig, func_name=resolver_name)
     async def func_impl(*args, **kwargs):
         try:
-            auth_type = state.settings['app'].state.vyos_auth_type
+            auth_type = state.auth_type
 
             if auth_type == 'key':
                 data = kwargs['data']
@@ -58,10 +62,7 @@ def make_query_resolver(query_name, class_name, session_func):
 
                 auth = key_auth.auth_required(key)
                 if auth is None:
-                    return {
-                         "success": False,
-                         "errors": ['invalid API key']
-                    }
+                    return {'success': False, 'errors': ['invalid API key']}
 
                 # We are finished with the 'key' entry, and may remove so as to
                 # pass the rest of data (if any) to function.
@@ -76,21 +77,15 @@ def make_query_resolver(query_name, class_name, session_func):
                 if user is None:
                     error = info.context.get('error')
                     if error is not None:
-                        return {
-                            "success": False,
-                            "errors": [error]
-                        }
-                    return {
-                        "success": False,
-                        "errors": ['not authenticated']
-                    }
+                        return {'success': False, 'errors': [error]}
+                    return {'success': False, 'errors': ['not authenticated']}
             else:
                 # AtrributeError will have already been raised if no
-                # vyos_auth_type; validation and defaultValue ensure it is
+                # auth_type; validation and defaultValue ensure it is
                 # one of the previous cases, so this is never reached.
                 pass
 
-            session = state.settings['app'].state.vyos_session
+            session = state.session
 
             # one may override the session functions with a local subclass
             try:
@@ -105,35 +100,36 @@ def make_query_resolver(query_name, class_name, session_func):
             result = method()
             data['result'] = result
 
-            return {
-                "success": True,
-                "data": data
-            }
+            return {'success': True, 'data': data}
         except OpModeError as e:
             typename = type(e).__name__
             msg = str(e)
             return {
-                "success": False,
-                "errors": ['op_mode_error'],
-                "op_mode_error": {"name": f"{typename}",
-                                 "message": msg if msg else op_mode_err_msg.get(typename, "Unknown"),
-                                 "vyos_code": op_mode_err_code.get(typename, 9999)}
+                'success': False,
+                'errors': ['op_mode_error'],
+                'op_mode_error': {
+                    'name': f'{typename}',
+                    'message': msg if msg else op_mode_err_msg.get(typename, 'Unknown'),
+                    'vyos_code': op_mode_err_code.get(typename, 9999),
+                },
             }
         except Exception as error:
-            return {
-                "success": False,
-                "errors": [repr(error)]
-            }
+            return {'success': False, 'errors': [repr(error)]}
 
     return func_impl
 
+
 def make_config_session_query_resolver(query_name):
-    return make_query_resolver(query_name, query_name,
-                               convert_camel_case_to_snake(query_name))
+    return make_query_resolver(
+        query_name, query_name, convert_camel_case_to_snake(query_name)
+    )
+
 
 def make_gen_op_query_resolver(query_name):
     return make_query_resolver(query_name, query_name, 'gen_op_query')
 
+
 def make_composite_query_resolver(query_name):
-    return make_query_resolver(query_name, query_name,
-                               convert_camel_case_to_snake(query_name))
+    return make_query_resolver(
+        query_name, query_name, convert_camel_case_to_snake(query_name)
+    )
diff --git a/src/services/api/graphql/libs/__init__.py b/src/services/api/graphql/libs/__init__.py
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/src/services/api/graphql/libs/__init__.py
diff --git a/src/services/api/graphql/libs/key_auth.py b/src/services/api/graphql/libs/key_auth.py
index 2db0f7d48..ffd7f32b2 100644
--- a/src/services/api/graphql/libs/key_auth.py
+++ b/src/services/api/graphql/libs/key_auth.py
@@ -1,5 +1,21 @@
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from ...session import SessionState
 
-from .. import state
 
 def check_auth(key_list, key):
     if not key_list:
@@ -10,9 +26,11 @@ def check_auth(key_list, key):
             key_id = k['id']
     return key_id
 
+
 def auth_required(key):
+    state = SessionState()
     api_keys = None
-    api_keys = state.settings['app'].state.vyos_keys
+    api_keys = state.keys
     key_id = check_auth(api_keys, key)
-    state.settings['app'].state.vyos_id = key_id
+    state.id = key_id
     return key_id
diff --git a/src/services/api/graphql/libs/token_auth.py b/src/services/api/graphql/libs/token_auth.py
index 8585485c9..4f743a096 100644
--- a/src/services/api/graphql/libs/token_auth.py
+++ b/src/services/api/graphql/libs/token_auth.py
@@ -1,46 +1,67 @@
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
 import jwt
 import uuid
 import pam
 from secrets import token_hex
 
-from .. import state
+from ...session import SessionState
+
 
 def _check_passwd_pam(username: str, passwd: str) -> bool:
     if pam.authenticate(username, passwd):
         return True
     return False
 
+
 def init_secret():
-    length = int(state.settings['app'].state.vyos_secret_len)
+    state = SessionState()
+    length = int(state.secret_len)
     secret = token_hex(length)
-    state.settings['secret'] = secret
+    state.secret = secret
+
 
 def generate_token(user: str, passwd: str, secret: str, exp: int) -> dict:
     if user is None or passwd is None:
         return {}
+    state = SessionState()
     if _check_passwd_pam(user, passwd):
-        app = state.settings['app']
         try:
-            users = app.state.vyos_token_users
+            users = state.token_users
         except AttributeError:
-            app.state.vyos_token_users = {}
-            users = app.state.vyos_token_users
+            users = state.token_users = {}
         user_id = uuid.uuid1().hex
         payload_data = {'iss': user, 'sub': user_id, 'exp': exp}
-        secret = state.settings.get('secret')
+        secret = getattr(state, 'secret', None)
         if secret is None:
-            return {"errors": ['missing secret']}
-        token = jwt.encode(payload=payload_data, key=secret, algorithm="HS256")
+            return {'errors': ['missing secret']}
+        token = jwt.encode(payload=payload_data, key=secret, algorithm='HS256')
 
         users |= {user_id: user}
         return {'token': token}
     else:
-        return {"errors": ['failed pam authentication']}
+        return {'errors': ['failed pam authentication']}
+
 
 def get_user_context(request):
     context = {}
     context['request'] = request
     context['user'] = None
+    state = SessionState()
     if 'Authorization' in request.headers:
         auth = request.headers['Authorization']
         scheme, token = auth.split()
@@ -48,8 +69,8 @@ def get_user_context(request):
             return context
 
         try:
-            secret = state.settings.get('secret')
-            payload = jwt.decode(token, secret, algorithms=["HS256"])
+            secret = getattr(state, 'secret', None)
+            payload = jwt.decode(token, secret, algorithms=['HS256'])
             user_id: str = payload.get('sub')
             if user_id is None:
                 return context
@@ -59,7 +80,7 @@ def get_user_context(request):
         except jwt.PyJWTError:
             return context
         try:
-            users = state.settings['app'].state.vyos_token_users
+            users = state.token_users
         except AttributeError:
             return context
 
diff --git a/src/services/api/graphql/routers.py b/src/services/api/graphql/routers.py
new file mode 100644
index 000000000..ed3ee1e8c
--- /dev/null
+++ b/src/services/api/graphql/routers.py
@@ -0,0 +1,77 @@
+# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# pylint: disable=import-outside-toplevel
+
+
+import typing
+
+from ariadne.asgi import GraphQL
+from starlette.middleware.cors import CORSMiddleware
+
+
+if typing.TYPE_CHECKING:
+    from fastapi import FastAPI
+
+
+def graphql_init(app: 'FastAPI'):
+    from ..session import SessionState
+    from .libs.token_auth import get_user_context
+
+    state = SessionState()
+
+    # import after initializaion of state
+    from .bindings import generate_schema
+
+    schema = generate_schema()
+
+    in_spec = state.introspection
+
+    # remove route and reinstall below, for any changes; alternatively, test
+    # for config_diff before proceeding
+    graphql_clear(app)
+
+    if state.origins:
+        origins = state.origins
+        app.add_route(
+            '/graphql',
+            CORSMiddleware(
+                GraphQL(
+                    schema,
+                    context_value=get_user_context,
+                    debug=True,
+                    introspection=in_spec,
+                ),
+                allow_origins=origins,
+                allow_methods=('GET', 'POST', 'OPTIONS'),
+                allow_headers=('Authorization',),
+            ),
+        )
+    else:
+        app.add_route(
+            '/graphql',
+            GraphQL(
+                schema,
+                context_value=get_user_context,
+                debug=True,
+                introspection=in_spec,
+            ),
+        )
+
+
+def graphql_clear(app: 'FastAPI'):
+    for r in app.routes:
+        if r.path == '/graphql':
+            app.routes.remove(r)
diff --git a/src/services/api/graphql/session/session.py b/src/services/api/graphql/session/session.py
index 6ae44b9bf..619534f43 100644
--- a/src/services/api/graphql/session/session.py
+++ b/src/services/api/graphql/session/session.py
@@ -28,34 +28,45 @@ from api.graphql.libs.op_mode import normalize_output
 
 op_mode_include_file = os.path.join(directories['data'], 'op-mode-standardized.json')
 
-def get_config_dict(path=[], effective=False, key_mangling=None,
-                     get_first_key=False, no_multi_convert=False,
-                     no_tag_node_value_mangle=False):
+
+def get_config_dict(
+    path=[],
+    effective=False,
+    key_mangling=None,
+    get_first_key=False,
+    no_multi_convert=False,
+    no_tag_node_value_mangle=False,
+):
     config = Config()
-    return config.get_config_dict(path=path, effective=effective,
-                                  key_mangling=key_mangling,
-                                  get_first_key=get_first_key,
-                                  no_multi_convert=no_multi_convert,
-                                  no_tag_node_value_mangle=no_tag_node_value_mangle)
+    return config.get_config_dict(
+        path=path,
+        effective=effective,
+        key_mangling=key_mangling,
+        get_first_key=get_first_key,
+        no_multi_convert=no_multi_convert,
+        no_tag_node_value_mangle=no_tag_node_value_mangle,
+    )
+
 
 def get_user_info(user):
     user_info = {}
-    info = get_config_dict(['system', 'login', 'user', user],
-                           get_first_key=True)
+    info = get_config_dict(['system', 'login', 'user', user], get_first_key=True)
     if not info:
-        raise ValueError("No such user")
+        raise ValueError('No such user')
 
     user_info['user'] = user
     user_info['full_name'] = info.get('full-name', '')
 
     return user_info
 
+
 class Session:
     """
     Wrapper for calling configsession functions based on GraphQL requests.
     Non-nullable fields in the respective schema allow avoiding a key check
     in 'data'.
     """
+
     def __init__(self, session, data):
         self._session = session
         self._data = data
@@ -138,7 +149,6 @@ class Session:
         return res
 
     def show_user_info(self):
-        session = self._session
         data = self._data
 
         user_info = {}
@@ -151,10 +161,9 @@ class Session:
         return user_info
 
     def system_status(self):
-        import api.graphql.session.composite.system_status as system_status
+        from api.graphql.session.composite import system_status
 
         session = self._session
-        data = self._data
 
         status = {}
         status['host_name'] = session.show(['host', 'name']).strip()
@@ -165,7 +174,6 @@ class Session:
         return status
 
     def gen_op_query(self):
-        session = self._session
         data = self._data
         name = self._name
         op_mode_list = self._op_mode_list
@@ -189,7 +197,6 @@ class Session:
         return res
 
     def gen_op_mutation(self):
-        session = self._session
         data = self._data
         name = self._name
         op_mode_list = self._op_mode_list
diff --git a/src/services/api/graphql/state.py b/src/services/api/graphql/state.py
deleted file mode 100644
index 63db9f4ef..000000000
--- a/src/services/api/graphql/state.py
+++ /dev/null
@@ -1,4 +0,0 @@
-
-def init():
-    global settings
-    settings = {}
diff --git a/src/services/api/rest/__init__.py b/src/services/api/rest/__init__.py
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/src/services/api/rest/__init__.py
diff --git a/src/services/api/rest/models.py b/src/services/api/rest/models.py
new file mode 100644
index 000000000..23ae9be9d
--- /dev/null
+++ b/src/services/api/rest/models.py
@@ -0,0 +1,299 @@
+# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+# pylint: disable=too-few-public-methods
+
+import json
+from html import escape
+from enum import Enum
+from typing import List
+from typing import Union
+from typing import Dict
+from typing import Self
+
+from pydantic import BaseModel
+from pydantic import StrictStr
+from pydantic import field_validator
+from pydantic import model_validator
+from fastapi.responses import HTMLResponse
+
+
+def error(code, msg):
+    msg = escape(msg, quote=False)
+    resp = {'success': False, 'error': msg, 'data': None}
+    resp = json.dumps(resp)
+    return HTMLResponse(resp, status_code=code)
+
+
+def success(data):
+    resp = {'success': True, 'data': data, 'error': None}
+    resp = json.dumps(resp)
+    return HTMLResponse(resp)
+
+
+# Pydantic models for validation
+# Pydantic will cast when possible, so use StrictStr validators added as
+# needed for additional constraints
+# json_schema_extra adds anotations to OpenAPI to add examples
+
+
+class ApiModel(BaseModel):
+    key: StrictStr
+
+
+class BasePathModel(BaseModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    @field_validator('path')
+    @classmethod
+    def check_non_empty(cls, path: str) -> str:
+        if not len(path) > 0:
+            raise ValueError('path must be non-empty')
+        return path
+
+
+class BaseConfigureModel(BasePathModel):
+    value: StrictStr = None
+
+
+class ConfigureModel(ApiModel, BaseConfigureModel):
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'set | delete | comment',
+                'path': ['config', 'mode', 'path'],
+            }
+        }
+
+
+class ConfigureListModel(ApiModel):
+    commands: List[BaseConfigureModel]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'commands': 'list of commands',
+            }
+        }
+
+
+class BaseConfigSectionModel(BasePathModel):
+    section: Dict
+
+
+class ConfigSectionModel(ApiModel, BaseConfigSectionModel):
+    pass
+
+
+class ConfigSectionListModel(ApiModel):
+    commands: List[BaseConfigSectionModel]
+
+
+class BaseConfigSectionTreeModel(BaseModel):
+    op: StrictStr
+    mask: Dict
+    config: Dict
+
+
+class ConfigSectionTreeModel(ApiModel, BaseConfigSectionTreeModel):
+    pass
+
+
+class RetrieveModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+    configFormat: StrictStr = None
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'returnValue | returnValues | exists | showConfig',
+                'path': ['config', 'mode', 'path'],
+                'configFormat': 'json (default) | json_ast | raw',
+            }
+        }
+
+
+class ConfigFileModel(ApiModel):
+    op: StrictStr
+    file: StrictStr = None
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'save | load',
+                'file': 'filename',
+            }
+        }
+
+
+class ImageOp(str, Enum):
+    add = 'add'
+    delete = 'delete'
+    show = 'show'
+    set_default = 'set_default'
+
+
+class ImageModel(ApiModel):
+    op: ImageOp
+    url: StrictStr = None
+    name: StrictStr = None
+
+    @model_validator(mode='after')
+    def check_data(self) -> Self:
+        if self.op == 'add':
+            if not self.url:
+                raise ValueError('Missing required field "url"')
+        elif self.op in ['delete', 'set_default']:
+            if not self.name:
+                raise ValueError('Missing required field "name"')
+
+        return self
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'add | delete | show | set_default',
+                'url': 'imagelocation',
+                'name': 'imagename',
+            }
+        }
+
+
+class ImportPkiModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+    passphrase: StrictStr = None
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'import_pki',
+                'path': ['op', 'mode', 'path'],
+                'passphrase': 'passphrase',
+            }
+        }
+
+
+class ContainerImageModel(ApiModel):
+    op: StrictStr
+    name: StrictStr = None
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'add | delete | show',
+                'name': 'imagename',
+            }
+        }
+
+
+class GenerateModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'generate',
+                'path': ['op', 'mode', 'path'],
+            }
+        }
+
+
+class ShowModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'show',
+                'path': ['op', 'mode', 'path'],
+            }
+        }
+
+
+class RebootModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'reboot',
+                'path': ['op', 'mode', 'path'],
+            }
+        }
+
+
+class ResetModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'reset',
+                'path': ['op', 'mode', 'path'],
+            }
+        }
+
+
+class PoweroffModel(ApiModel):
+    op: StrictStr
+    path: List[StrictStr]
+
+    class Config:
+        json_schema_extra = {
+            'example': {
+                'key': 'id_key',
+                'op': 'poweroff',
+                'path': ['op', 'mode', 'path'],
+            }
+        }
+
+
+class Success(BaseModel):
+    success: bool
+    data: Union[str, bool, Dict]
+    error: str
+
+
+class Error(BaseModel):
+    success: bool = False
+    data: Union[str, bool, Dict]
+    error: str
+
+
+responses = {
+    200: {'model': Success},
+    400: {'model': Error},
+    422: {'model': Error, 'description': 'Validation Error'},
+    500: {'model': Error},
+}
diff --git a/src/services/api/rest/routers.py b/src/services/api/rest/routers.py
new file mode 100644
index 000000000..da981d5bf
--- /dev/null
+++ b/src/services/api/rest/routers.py
@@ -0,0 +1,754 @@
+# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+# pylint: disable=line-too-long,raise-missing-from,invalid-name
+# pylint: disable=wildcard-import,unused-wildcard-import
+# pylint: disable=broad-exception-caught
+
+import json
+import copy
+import logging
+import traceback
+from threading import Lock
+from typing import Union
+from typing import Callable
+from typing import TYPE_CHECKING
+
+from fastapi import Depends
+from fastapi import Request
+from fastapi import Response
+from fastapi import HTTPException
+from fastapi import APIRouter
+from fastapi import BackgroundTasks
+from fastapi.routing import APIRoute
+from starlette.datastructures import FormData
+from starlette.formparsers import FormParser
+from starlette.formparsers import MultiPartParser
+from starlette.formparsers import MultiPartException
+from multipart.multipart import parse_options_header
+
+from vyos.config import Config
+from vyos.configtree import ConfigTree
+from vyos.configdiff import get_config_diff
+from vyos.configsession import ConfigSessionError
+
+from ..session import SessionState
+from .models import success
+from .models import error
+from .models import responses
+from .models import ApiModel
+from .models import ConfigureModel
+from .models import ConfigureListModel
+from .models import ConfigSectionModel
+from .models import ConfigSectionListModel
+from .models import ConfigSectionTreeModel
+from .models import BaseConfigSectionTreeModel
+from .models import BaseConfigureModel
+from .models import BaseConfigSectionModel
+from .models import RetrieveModel
+from .models import ConfigFileModel
+from .models import ImageModel
+from .models import ContainerImageModel
+from .models import GenerateModel
+from .models import ShowModel
+from .models import RebootModel
+from .models import ResetModel
+from .models import ImportPkiModel
+from .models import PoweroffModel
+
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+
+
+LOG = logging.getLogger('http_api.routers')
+
+lock = Lock()
+
+
+def check_auth(key_list, key):
+    key_id = None
+    for k in key_list:
+        if k['key'] == key:
+            key_id = k['id']
+    return key_id
+
+
+def auth_required(data: ApiModel):
+    session = SessionState()
+    key = data.key
+    api_keys = session.keys
+    key_id = check_auth(api_keys, key)
+    if not key_id:
+        raise HTTPException(status_code=401, detail='Valid API key is required')
+    session.id = key_id
+
+
+# override Request and APIRoute classes in order to convert form request to json;
+# do all explicit validation here, for backwards compatability of error messages;
+# the explicit validation may be dropped, if desired, in favor of native
+# validation by FastAPI/Pydantic, as is used for application/json requests
+class MultipartRequest(Request):
+    """Override Request class to convert form request to json"""
+
+    # pylint: disable=attribute-defined-outside-init
+    # pylint: disable=too-many-branches,too-many-statements
+
+    _form_err = ()
+
+    @property
+    def form_err(self):
+        return self._form_err
+
+    @form_err.setter
+    def form_err(self, val):
+        if not self._form_err:
+            self._form_err = val
+
+    @property
+    def orig_headers(self):
+        self._orig_headers = super().headers
+        return self._orig_headers
+
+    @property
+    def headers(self):
+        self._headers = super().headers.mutablecopy()
+        self._headers['content-type'] = 'application/json'
+        return self._headers
+
+    async def _get_form(
+        self, *, max_files: int | float = 1000, max_fields: int | float = 1000
+    ) -> FormData:
+        if self._form is None:
+            assert (
+                parse_options_header is not None
+            ), 'The `python-multipart` library must be installed to use form parsing.'
+            content_type_header = self.orig_headers.get('Content-Type')
+            content_type: bytes
+            content_type, _ = parse_options_header(content_type_header)
+            if content_type == b'multipart/form-data':
+                try:
+                    multipart_parser = MultiPartParser(
+                        self.orig_headers,
+                        self.stream(),
+                        max_files=max_files,
+                        max_fields=max_fields,
+                    )
+                    self._form = await multipart_parser.parse()
+                except MultiPartException as exc:
+                    if 'app' in self.scope:
+                        raise HTTPException(status_code=400, detail=exc.message)
+                    raise exc
+            elif content_type == b'application/x-www-form-urlencoded':
+                form_parser = FormParser(self.orig_headers, self.stream())
+                self._form = await form_parser.parse()
+            else:
+                self._form = FormData()
+        return self._form
+
+    async def body(self) -> bytes:
+        if not hasattr(self, '_body'):
+            forms = {}
+            merge = {}
+            body = await super().body()
+            self._body = body
+
+            form_data = await self.form()
+            if form_data:
+                endpoint = self.url.path
+                LOG.debug('processing form data')
+                for k, v in form_data.multi_items():
+                    forms[k] = v
+
+                if 'data' not in forms:
+                    self.form_err = (422, 'Non-empty data field is required')
+                    return self._body
+                try:
+                    tmp = json.loads(forms['data'])
+                except json.JSONDecodeError as e:
+                    self.form_err = (400, f'Failed to parse JSON: {e}')
+                    return self._body
+                if isinstance(tmp, list):
+                    merge['commands'] = tmp
+                else:
+                    merge = tmp
+
+                if 'commands' in merge:
+                    cmds = merge['commands']
+                else:
+                    cmds = copy.deepcopy(merge)
+                    cmds = [cmds]
+
+                for c in cmds:
+                    if not isinstance(c, dict):
+                        self.form_err = (
+                            400,
+                            f"Malformed command '{c}': any command must be JSON of dict",
+                        )
+                        return self._body
+                    if 'op' not in c:
+                        self.form_err = (
+                            400,
+                            f"Malformed command '{c}': missing 'op' field",
+                        )
+                    if endpoint not in (
+                        '/config-file',
+                        '/container-image',
+                        '/image',
+                        '/configure-section',
+                    ):
+                        if 'path' not in c:
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{c}': missing 'path' field",
+                            )
+                        elif not isinstance(c['path'], list):
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{c}': 'path' field must be a list",
+                            )
+                        elif not all(isinstance(el, str) for el in c['path']):
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{0}': 'path' field must be a list of strings",
+                            )
+                    if endpoint in ('/configure'):
+                        if not c['path']:
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{c}': 'path' list must be non-empty",
+                            )
+                        if 'value' in c and not isinstance(c['value'], str):
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{c}': 'value' field must be a string",
+                            )
+                    if endpoint in ('/configure-section'):
+                        if 'section' not in c and 'config' not in c:
+                            self.form_err = (
+                                400,
+                                f"Malformed command '{c}': missing 'section' or 'config' field",
+                            )
+
+                if 'key' not in forms and 'key' not in merge:
+                    self.form_err = (401, 'Valid API key is required')
+                if 'key' in forms and 'key' not in merge:
+                    merge['key'] = forms['key']
+
+                new_body = json.dumps(merge)
+                new_body = new_body.encode()
+                self._body = new_body
+
+        return self._body
+
+
+class MultipartRoute(APIRoute):
+    """Override APIRoute class to convert form request to json"""
+
+    def get_route_handler(self) -> Callable:
+        original_route_handler = super().get_route_handler()
+
+        async def custom_route_handler(request: Request) -> Response:
+            request = MultipartRequest(request.scope, request.receive)
+            try:
+                response: Response = await original_route_handler(request)
+            except HTTPException as e:
+                return error(e.status_code, e.detail)
+            except Exception as e:
+                form_err = request.form_err
+                if form_err:
+                    return error(*form_err)
+                raise e
+
+            return response
+
+        return custom_route_handler
+
+
+router = APIRouter(
+    route_class=MultipartRoute,
+    responses={**responses},
+    dependencies=[Depends(auth_required)],
+)
+
+
+self_ref_msg = 'Requested HTTP API server configuration change; commit will be called in the background'
+
+
+def call_commit(s: SessionState):
+    try:
+        s.session.commit()
+    except ConfigSessionError as e:
+        s.session.discard()
+        if s.debug:
+            LOG.warning(f'ConfigSessionError:\n {traceback.format_exc()}')
+        else:
+            LOG.warning(f'ConfigSessionError: {e}')
+
+
+def _configure_op(
+    data: Union[
+        ConfigureModel,
+        ConfigureListModel,
+        ConfigSectionModel,
+        ConfigSectionListModel,
+        ConfigSectionTreeModel,
+    ],
+    _request: Request,
+    background_tasks: BackgroundTasks,
+):
+    # pylint: disable=too-many-branches,too-many-locals,too-many-nested-blocks,too-many-statements
+    # pylint: disable=consider-using-with
+
+    state = SessionState()
+    session = state.session
+    env = session.get_session_env()
+
+    # Allow users to pass just one command
+    if not isinstance(data, (ConfigureListModel, ConfigSectionListModel)):
+        data = [data]
+    else:
+        data = data.commands
+
+    # We don't want multiple people/apps to be able to commit at once,
+    # or modify the shared session while someone else is doing the same,
+    # so the lock is really global
+    lock.acquire()
+
+    config = Config(session_env=env)
+
+    status = 200
+    msg = None
+    error_msg = None
+    try:
+        for c in data:
+            op = c.op
+            if not isinstance(c, BaseConfigSectionTreeModel):
+                path = c.path
+
+            if isinstance(c, BaseConfigureModel):
+                if c.value:
+                    value = c.value
+                else:
+                    value = ''
+                # For vyos.configsession calls that have no separate value arguments,
+                # and for type checking too
+                cfg_path = ' '.join(path + [value]).strip()
+
+            elif isinstance(c, BaseConfigSectionModel):
+                section = c.section
+
+            elif isinstance(c, BaseConfigSectionTreeModel):
+                mask = c.mask
+                config = c.config
+
+            if isinstance(c, BaseConfigureModel):
+                if op == 'set':
+                    session.set(path, value=value)
+                elif op == 'delete':
+                    if state.strict and not config.exists(cfg_path):
+                        raise ConfigSessionError(
+                            f'Cannot delete [{cfg_path}]: path/value does not exist'
+                        )
+                    session.delete(path, value=value)
+                elif op == 'comment':
+                    session.comment(path, value=value)
+                else:
+                    raise ConfigSessionError(f"'{op}' is not a valid operation")
+
+            elif isinstance(c, BaseConfigSectionModel):
+                if op == 'set':
+                    session.set_section(path, section)
+                elif op == 'load':
+                    session.load_section(path, section)
+                else:
+                    raise ConfigSessionError(f"'{op}' is not a valid operation")
+
+            elif isinstance(c, BaseConfigSectionTreeModel):
+                if op == 'set':
+                    session.set_section_tree(config)
+                elif op == 'load':
+                    session.load_section_tree(mask, config)
+                else:
+                    raise ConfigSessionError(f"'{op}' is not a valid operation")
+        # end for
+        config = Config(session_env=env)
+        d = get_config_diff(config)
+
+        if d.is_node_changed(['service', 'https']):
+            background_tasks.add_task(call_commit, state)
+            msg = self_ref_msg
+        else:
+            # capture non-fatal warnings
+            out = session.commit()
+            msg = out if out else msg
+
+        LOG.info(f"Configuration modified via HTTP API using key '{state.id}'")
+    except ConfigSessionError as e:
+        session.discard()
+        status = 400
+        if state.debug:
+            LOG.critical(f'ConfigSessionError:\n {traceback.format_exc()}')
+        error_msg = str(e)
+    except Exception:
+        session.discard()
+        LOG.critical(traceback.format_exc())
+        status = 500
+
+        # Don't give the details away to the outer world
+        error_msg = 'An internal error occured. Check the logs for details.'
+    finally:
+        lock.release()
+
+    if status != 200:
+        return error(status, error_msg)
+
+    return success(msg)
+
+
+def create_path_import_pki_no_prompt(path):
+    correct_paths = ['ca', 'certificate', 'key-pair']
+    if path[1] not in correct_paths:
+        return False
+    path[1] = '--' + path[1].replace('-', '')
+    path[3] = '--key-filename'
+    return path[1:]
+
+
+@router.post('/configure')
+def configure_op(
+    data: Union[ConfigureModel, ConfigureListModel],
+    request: Request,
+    background_tasks: BackgroundTasks,
+):
+    return _configure_op(data, request, background_tasks)
+
+
+@router.post('/configure-section')
+def configure_section_op(
+    data: Union[ConfigSectionModel, ConfigSectionListModel, ConfigSectionTreeModel],
+    request: Request,
+    background_tasks: BackgroundTasks,
+):
+    return _configure_op(data, request, background_tasks)
+
+
+@router.post('/retrieve')
+async def retrieve_op(data: RetrieveModel):
+    state = SessionState()
+    session = state.session
+    env = session.get_session_env()
+    config = Config(session_env=env)
+
+    op = data.op
+    path = ' '.join(data.path)
+
+    try:
+        if op == 'returnValue':
+            res = config.return_value(path)
+        elif op == 'returnValues':
+            res = config.return_values(path)
+        elif op == 'exists':
+            res = config.exists(path)
+        elif op == 'showConfig':
+            config_format = 'json'
+            if data.configFormat:
+                config_format = data.configFormat
+
+            res = session.show_config(path=data.path)
+            if config_format == 'json':
+                config_tree = ConfigTree(res)
+                res = json.loads(config_tree.to_json())
+            elif config_format == 'json_ast':
+                config_tree = ConfigTree(res)
+                res = json.loads(config_tree.to_json_ast())
+            elif config_format == 'raw':
+                pass
+            else:
+                return error(400, f"'{config_format}' is not a valid config format")
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/config-file')
+def config_file_op(data: ConfigFileModel, background_tasks: BackgroundTasks):
+    state = SessionState()
+    session = state.session
+    env = session.get_session_env()
+    op = data.op
+    msg = None
+
+    try:
+        if op == 'save':
+            if data.file:
+                path = data.file
+            else:
+                path = '/config/config.boot'
+            msg = session.save_config(path)
+        elif op == 'load':
+            if data.file:
+                path = data.file
+            else:
+                return error(400, 'Missing required field "file"')
+
+            session.migrate_and_load_config(path)
+
+            config = Config(session_env=env)
+            d = get_config_diff(config)
+
+            if d.is_node_changed(['service', 'https']):
+                background_tasks.add_task(call_commit, state)
+                msg = self_ref_msg
+            else:
+                session.commit()
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(msg)
+
+
+@router.post('/image')
+def image_op(data: ImageModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+
+    try:
+        if op == 'add':
+            res = session.install_image(data.url)
+        elif op == 'delete':
+            res = session.remove_image(data.name)
+        elif op == 'show':
+            res = session.show(['system', 'image'])
+        elif op == 'set_default':
+            res = session.set_default_image(data.name)
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/container-image')
+def container_image_op(data: ContainerImageModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+
+    try:
+        if op == 'add':
+            if data.name:
+                name = data.name
+            else:
+                return error(400, 'Missing required field "name"')
+            res = session.add_container_image(name)
+        elif op == 'delete':
+            if data.name:
+                name = data.name
+            else:
+                return error(400, 'Missing required field "name"')
+            res = session.delete_container_image(name)
+        elif op == 'show':
+            res = session.show_container_image()
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/generate')
+def generate_op(data: GenerateModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    try:
+        if op == 'generate':
+            res = session.generate(path)
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/show')
+def show_op(data: ShowModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    try:
+        if op == 'show':
+            res = session.show(path)
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/reboot')
+def reboot_op(data: RebootModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    try:
+        if op == 'reboot':
+            res = session.reboot(path)
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/reset')
+def reset_op(data: ResetModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    try:
+        if op == 'reset':
+            res = session.reset(path)
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+@router.post('/import-pki')
+def import_pki(data: ImportPkiModel):
+    # pylint: disable=consider-using-with
+
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    lock.acquire()
+
+    try:
+        if op == 'import-pki':
+            # need to get rid or interactive mode for private key
+            if len(path) == 5 and path[3] in ['key-file', 'private-key']:
+                path_no_prompt = create_path_import_pki_no_prompt(path)
+                if not path_no_prompt:
+                    return error(400, f"Invalid command: {' '.join(path)}")
+                if data.passphrase:
+                    path_no_prompt += ['--passphrase', data.passphrase]
+                res = session.import_pki_no_prompt(path_no_prompt)
+            else:
+                res = session.import_pki(path)
+            if not res[0].isdigit():
+                return error(400, res)
+            # commit changes
+            session.commit()
+            res = res.split('. ')[0]
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+    finally:
+        lock.release()
+
+    return success(res)
+
+
+@router.post('/poweroff')
+def poweroff_op(data: PoweroffModel):
+    state = SessionState()
+    session = state.session
+
+    op = data.op
+    path = data.path
+
+    try:
+        if op == 'poweroff':
+            res = session.poweroff(path)
+        else:
+            return error(400, f"'{op}' is not a valid operation")
+    except ConfigSessionError as e:
+        return error(400, str(e))
+    except Exception:
+        LOG.critical(traceback.format_exc())
+        return error(500, 'An internal error occured. Check the logs for details.')
+
+    return success(res)
+
+
+def rest_init(app: 'FastAPI'):
+    if all(r in app.routes for r in router.routes):
+        return
+    app.include_router(router)
+
+
+def rest_clear(app: 'FastAPI'):
+    for r in router.routes:
+        if r in app.routes:
+            app.routes.remove(r)
diff --git a/src/services/api/session.py b/src/services/api/session.py
new file mode 100644
index 000000000..ad3ef660c
--- /dev/null
+++ b/src/services/api/session.py
@@ -0,0 +1,41 @@
+# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+class SessionState:
+    # pylint: disable=attribute-defined-outside-init
+    # pylint: disable=too-many-instance-attributes,too-few-public-methods
+
+    _instance = None
+
+    def __new__(cls):
+        if cls._instance is None:
+            cls._instance = super(SessionState, cls).__new__(cls)
+            cls._instance._initialize()
+        return cls._instance
+
+    def _initialize(self):
+        self.session = None
+        self.keys = []
+        self.id = None
+        self.rest = False
+        self.debug = False
+        self.strict = False
+        self.graphql = False
+        self.origins = []
+        self.introspection = False
+        self.auth_type = None
+        self.token_exp = None
+        self.secret_len = None
diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index 91100410c..558561182 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -17,917 +17,51 @@
 import os
 import sys
 import grp
-import copy
 import json
 import logging
 import signal
-import traceback
-import threading
-from enum import Enum
-
 from time import sleep
-from typing import List, Union, Callable, Dict, Self
 
-from fastapi import FastAPI, Depends, Request, Response, HTTPException
-from fastapi import BackgroundTasks
-from fastapi.responses import HTMLResponse
+from fastapi import FastAPI
 from fastapi.exceptions import RequestValidationError
-from fastapi.routing import APIRoute
-from pydantic import BaseModel, StrictStr, validator, model_validator
-from starlette.middleware.cors import CORSMiddleware
-from starlette.datastructures import FormData
-from starlette.formparsers import FormParser, MultiPartParser
-from multipart.multipart import parse_options_header
 from uvicorn import Config as UvicornConfig
 from uvicorn import Server as UvicornServer
 
-from ariadne.asgi import GraphQL
-
-from vyos.config import Config
-from vyos.configtree import ConfigTree
-from vyos.configdiff import get_config_diff
 from vyos.configsession import ConfigSession
-from vyos.configsession import ConfigSessionError
 from vyos.defaults import api_config_state
 
-import api.graphql.state
+from api.session import SessionState
+from api.rest.models import error
 
 CFG_GROUP = 'vyattacfg'
 
 debug = True
 
-logger = logging.getLogger(__name__)
+LOG = logging.getLogger('http_api')
 logs_handler = logging.StreamHandler()
-logger.addHandler(logs_handler)
+LOG.addHandler(logs_handler)
 
 if debug:
-    logger.setLevel(logging.DEBUG)
+    LOG.setLevel(logging.DEBUG)
 else:
-    logger.setLevel(logging.INFO)
+    LOG.setLevel(logging.INFO)
 
-# Giant lock!
-lock = threading.Lock()
 
 def load_server_config():
     with open(api_config_state) as f:
         config = json.load(f)
     return config
 
-def check_auth(key_list, key):
-    key_id = None
-    for k in key_list:
-        if k['key'] == key:
-            key_id = k['id']
-    return key_id
-
-def error(code, msg):
-    resp = {"success": False, "error": msg, "data": None}
-    resp = json.dumps(resp)
-    return HTMLResponse(resp, status_code=code)
-
-def success(data):
-    resp = {"success": True, "data": data, "error": None}
-    resp = json.dumps(resp)
-    return HTMLResponse(resp)
-
-# Pydantic models for validation
-# Pydantic will cast when possible, so use StrictStr
-# validators added as needed for additional constraints
-# schema_extra adds anotations to OpenAPI, to add examples
-
-class ApiModel(BaseModel):
-    key: StrictStr
-
-class BasePathModel(BaseModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    @validator("path")
-    def check_non_empty(cls, path):
-        if not len(path) > 0:
-            raise ValueError('path must be non-empty')
-        return path
-
-class BaseConfigureModel(BasePathModel):
-    value: StrictStr = None
-
-class ConfigureModel(ApiModel, BaseConfigureModel):
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "set | delete | comment",
-                "path": ['config', 'mode', 'path'],
-            }
-        }
-
-class ConfigureListModel(ApiModel):
-    commands: List[BaseConfigureModel]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "commands": "list of commands",
-            }
-        }
-
-class BaseConfigSectionModel(BasePathModel):
-    section: Dict
-
-class ConfigSectionModel(ApiModel, BaseConfigSectionModel):
-    pass
-
-class ConfigSectionListModel(ApiModel):
-    commands: List[BaseConfigSectionModel]
-
-class BaseConfigSectionTreeModel(BaseModel):
-    op: StrictStr
-    mask: Dict
-    config: Dict
-
-class ConfigSectionTreeModel(ApiModel, BaseConfigSectionTreeModel):
-    pass
-
-class RetrieveModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-    configFormat: StrictStr = None
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "returnValue | returnValues | exists | showConfig",
-                "path": ['config', 'mode', 'path'],
-                "configFormat": "json (default) | json_ast | raw",
-
-            }
-        }
-
-class ConfigFileModel(ApiModel):
-    op: StrictStr
-    file: StrictStr = None
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "save | load",
-                "file": "filename",
-            }
-        }
-
-
-class ImageOp(str, Enum):
-    add = "add"
-    delete = "delete"
-    show = "show"
-    set_default = "set_default"
-
-
-class ImageModel(ApiModel):
-    op: ImageOp
-    url: StrictStr = None
-    name: StrictStr = None
-
-    @model_validator(mode='after')
-    def check_data(self) -> Self:
-        if self.op == 'add':
-            if not self.url:
-                raise ValueError("Missing required field \"url\"")
-        elif self.op in ['delete', 'set_default']:
-            if not self.name:
-                raise ValueError("Missing required field \"name\"")
-
-        return self
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "add | delete | show | set_default",
-                "url": "imagelocation",
-                "name": "imagename",
-            }
-        }
-
-class ImportPkiModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-    passphrase: StrictStr = None
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "import_pki",
-                "path": ["op", "mode", "path"],
-                "passphrase": "passphrase",
-            }
-        }
-
-
-class ContainerImageModel(ApiModel):
-    op: StrictStr
-    name: StrictStr = None
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "add | delete | show",
-                "name": "imagename",
-            }
-        }
-
-class GenerateModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "generate",
-                "path": ["op", "mode", "path"],
-            }
-        }
-
-class ShowModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "show",
-                "path": ["op", "mode", "path"],
-            }
-        }
-
-class RebootModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "reboot",
-                "path": ["op", "mode", "path"],
-            }
-        }
-
-class ResetModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "reset",
-                "path": ["op", "mode", "path"],
-            }
-        }
-
-class PoweroffModel(ApiModel):
-    op: StrictStr
-    path: List[StrictStr]
-
-    class Config:
-        schema_extra = {
-            "example": {
-                "key": "id_key",
-                "op": "poweroff",
-                "path": ["op", "mode", "path"],
-            }
-        }
-
-
-class Success(BaseModel):
-    success: bool
-    data: Union[str, bool, Dict]
-    error: str
-
-class Error(BaseModel):
-    success: bool = False
-    data: Union[str, bool, Dict]
-    error: str
-
-responses = {
-    200: {'model': Success},
-    400: {'model': Error},
-    422: {'model': Error, 'description': 'Validation Error'},
-    500: {'model': Error}
-}
-
-def auth_required(data: ApiModel):
-    key = data.key
-    api_keys = app.state.vyos_keys
-    key_id = check_auth(api_keys, key)
-    if not key_id:
-        raise HTTPException(status_code=401, detail="Valid API key is required")
-    app.state.vyos_id = key_id
-
-# override Request and APIRoute classes in order to convert form request to json;
-# do all explicit validation here, for backwards compatability of error messages;
-# the explicit validation may be dropped, if desired, in favor of native
-# validation by FastAPI/Pydantic, as is used for application/json requests
-class MultipartRequest(Request):
-    _form_err = ()
-    @property
-    def form_err(self):
-        return self._form_err
-
-    @form_err.setter
-    def form_err(self, val):
-        if not self._form_err:
-            self._form_err = val
-
-    @property
-    def orig_headers(self):
-        self._orig_headers = super().headers
-        return self._orig_headers
-
-    @property
-    def headers(self):
-        self._headers = super().headers.mutablecopy()
-        self._headers['content-type'] = 'application/json'
-        return self._headers
-
-    async def form(self) -> FormData:
-        if self._form is None:
-            assert (
-                parse_options_header is not None
-            ), "The `python-multipart` library must be installed to use form parsing."
-            content_type_header = self.orig_headers.get("Content-Type")
-            content_type, options = parse_options_header(content_type_header)
-            if content_type == b"multipart/form-data":
-                multipart_parser = MultiPartParser(self.orig_headers, self.stream())
-                self._form = await multipart_parser.parse()
-            elif content_type == b"application/x-www-form-urlencoded":
-                form_parser = FormParser(self.orig_headers, self.stream())
-                self._form = await form_parser.parse()
-            else:
-                self._form = FormData()
-        return self._form
-
-    async def body(self) -> bytes:
-        if not hasattr(self, "_body"):
-            forms = {}
-            merge = {}
-            body = await super().body()
-            self._body = body
-
-            form_data = await self.form()
-            if form_data:
-                endpoint = self.url.path
-                logger.debug("processing form data")
-                for k, v in form_data.multi_items():
-                    forms[k] = v
-
-                if 'data' not in forms:
-                    self.form_err = (422, "Non-empty data field is required")
-                    return self._body
-                else:
-                    try:
-                        tmp = json.loads(forms['data'])
-                    except json.JSONDecodeError as e:
-                        self.form_err = (400, f'Failed to parse JSON: {e}')
-                        return self._body
-                    if isinstance(tmp, list):
-                        merge['commands'] = tmp
-                    else:
-                        merge = tmp
-
-                if 'commands' in merge:
-                    cmds = merge['commands']
-                else:
-                    cmds = copy.deepcopy(merge)
-                    cmds = [cmds]
-
-                for c in cmds:
-                    if not isinstance(c, dict):
-                        self.form_err = (400,
-                        f"Malformed command '{c}': any command must be JSON of dict")
-                        return self._body
-                    if 'op' not in c:
-                        self.form_err = (400,
-                        f"Malformed command '{c}': missing 'op' field")
-                    if endpoint not in ('/config-file', '/container-image',
-                                        '/image', '/configure-section'):
-                        if 'path' not in c:
-                            self.form_err = (400,
-                            f"Malformed command '{c}': missing 'path' field")
-                        elif not isinstance(c['path'], list):
-                            self.form_err = (400,
-                            f"Malformed command '{c}': 'path' field must be a list")
-                        elif not all(isinstance(el, str) for el in c['path']):
-                            self.form_err = (400,
-                            f"Malformed command '{0}': 'path' field must be a list of strings")
-                    if endpoint in ('/configure'):
-                        if not c['path']:
-                            self.form_err = (400,
-                            f"Malformed command '{c}': 'path' list must be non-empty")
-                        if 'value' in c and not isinstance(c['value'], str):
-                            self.form_err = (400,
-                            f"Malformed command '{c}': 'value' field must be a string")
-                    if endpoint in ('/configure-section'):
-                        if 'section' not in c and 'config' not in c:
-                            self.form_err = (400,
-                            f"Malformed command '{c}': missing 'section' or 'config' field")
-
-                if 'key' not in forms and 'key' not in merge:
-                    self.form_err = (401, "Valid API key is required")
-                if 'key' in forms and 'key' not in merge:
-                    merge['key'] = forms['key']
-
-                new_body = json.dumps(merge)
-                new_body = new_body.encode()
-                self._body = new_body
-
-        return self._body
-
-class MultipartRoute(APIRoute):
-    def get_route_handler(self) -> Callable:
-        original_route_handler = super().get_route_handler()
-
-        async def custom_route_handler(request: Request) -> Response:
-            request = MultipartRequest(request.scope, request.receive)
-            try:
-                response: Response = await original_route_handler(request)
-            except HTTPException as e:
-                return error(e.status_code, e.detail)
-            except Exception as e:
-                form_err = request.form_err
-                if form_err:
-                    return error(*form_err)
-                raise e
-
-            return response
-
-        return custom_route_handler
 
 app = FastAPI(debug=True,
               title="VyOS API",
-              version="0.1.0",
-              responses={**responses},
-              dependencies=[Depends(auth_required)])
-
-app.router.route_class = MultipartRoute
+              version="0.1.0")
 
 @app.exception_handler(RequestValidationError)
-async def validation_exception_handler(request, exc):
+async def validation_exception_handler(_request, exc):
     return error(400, str(exc.errors()[0]))
 
-self_ref_msg = "Requested HTTP API server configuration change; commit will be called in the background"
-
-def call_commit(s: ConfigSession):
-    try:
-        s.commit()
-    except ConfigSessionError as e:
-        s.discard()
-        if app.state.vyos_debug:
-            logger.warning(f"ConfigSessionError:\n {traceback.format_exc()}")
-        else:
-            logger.warning(f"ConfigSessionError: {e}")
-
-def _configure_op(data: Union[ConfigureModel, ConfigureListModel,
-                              ConfigSectionModel, ConfigSectionListModel,
-                              ConfigSectionTreeModel],
-                  request: Request, background_tasks: BackgroundTasks):
-    session = app.state.vyos_session
-    env = session.get_session_env()
-
-    endpoint = request.url.path
-
-    # Allow users to pass just one command
-    if not isinstance(data, (ConfigureListModel, ConfigSectionListModel)):
-        data = [data]
-    else:
-        data = data.commands
-
-    # We don't want multiple people/apps to be able to commit at once,
-    # or modify the shared session while someone else is doing the same,
-    # so the lock is really global
-    lock.acquire()
-
-    config = Config(session_env=env)
-
-    status = 200
-    msg = None
-    error_msg = None
-    try:
-        for c in data:
-            op = c.op
-            if not isinstance(c, BaseConfigSectionTreeModel):
-                path = c.path
-
-            if isinstance(c, BaseConfigureModel):
-                if c.value:
-                    value = c.value
-                else:
-                    value = ""
-                # For vyos.configsession calls that have no separate value arguments,
-                # and for type checking too
-                cfg_path = " ".join(path + [value]).strip()
-
-            elif isinstance(c, BaseConfigSectionModel):
-                section = c.section
-
-            elif isinstance(c, BaseConfigSectionTreeModel):
-                mask = c.mask
-                config = c.config
-
-            if isinstance(c, BaseConfigureModel):
-                if op == 'set':
-                    session.set(path, value=value)
-                elif op == 'delete':
-                    if app.state.vyos_strict and not config.exists(cfg_path):
-                        raise ConfigSessionError(f"Cannot delete [{cfg_path}]: path/value does not exist")
-                    session.delete(path, value=value)
-                elif op == 'comment':
-                    session.comment(path, value=value)
-                else:
-                    raise ConfigSessionError(f"'{op}' is not a valid operation")
-
-            elif isinstance(c, BaseConfigSectionModel):
-                if op == 'set':
-                    session.set_section(path, section)
-                elif op == 'load':
-                    session.load_section(path, section)
-                else:
-                    raise ConfigSessionError(f"'{op}' is not a valid operation")
-
-            elif isinstance(c, BaseConfigSectionTreeModel):
-                if op == 'set':
-                    session.set_section_tree(config)
-                elif op == 'load':
-                    session.load_section_tree(mask, config)
-                else:
-                    raise ConfigSessionError(f"'{op}' is not a valid operation")
-        # end for
-        config = Config(session_env=env)
-        d = get_config_diff(config)
-
-        if d.is_node_changed(['service', 'https']):
-            background_tasks.add_task(call_commit, session)
-            msg = self_ref_msg
-        else:
-            # capture non-fatal warnings
-            out = session.commit()
-            msg = out if out else msg
-
-        logger.info(f"Configuration modified via HTTP API using key '{app.state.vyos_id}'")
-    except ConfigSessionError as e:
-        session.discard()
-        status = 400
-        if app.state.vyos_debug:
-            logger.critical(f"ConfigSessionError:\n {traceback.format_exc()}")
-        error_msg = str(e)
-    except Exception as e:
-        session.discard()
-        logger.critical(traceback.format_exc())
-        status = 500
-
-        # Don't give the details away to the outer world
-        error_msg = "An internal error occured. Check the logs for details."
-    finally:
-        lock.release()
-
-    if status != 200:
-        return error(status, error_msg)
-
-    return success(msg)
-
-def create_path_import_pki_no_prompt(path):
-    correct_paths = ['ca', 'certificate', 'key-pair']
-    if path[1] not in correct_paths:
-        return False
-    path[1] = '--' + path[1].replace('-', '')
-    path[3] = '--key-filename'
-    return path[1:]
-
-@app.post('/configure')
-def configure_op(data: Union[ConfigureModel,
-                             ConfigureListModel],
-                       request: Request, background_tasks: BackgroundTasks):
-    return _configure_op(data, request, background_tasks)
-
-@app.post('/configure-section')
-def configure_section_op(data: Union[ConfigSectionModel,
-                                     ConfigSectionListModel,
-                                     ConfigSectionTreeModel],
-                               request: Request, background_tasks: BackgroundTasks):
-    return _configure_op(data, request, background_tasks)
-
-@app.post("/retrieve")
-async def retrieve_op(data: RetrieveModel):
-    session = app.state.vyos_session
-    env = session.get_session_env()
-    config = Config(session_env=env)
-
-    op = data.op
-    path = " ".join(data.path)
-
-    try:
-        if op == 'returnValue':
-            res = config.return_value(path)
-        elif op == 'returnValues':
-            res = config.return_values(path)
-        elif op == 'exists':
-            res = config.exists(path)
-        elif op == 'showConfig':
-            config_format = 'json'
-            if data.configFormat:
-                config_format = data.configFormat
-
-            res = session.show_config(path=data.path)
-            if config_format == 'json':
-                config_tree = ConfigTree(res)
-                res = json.loads(config_tree.to_json())
-            elif config_format == 'json_ast':
-                config_tree = ConfigTree(res)
-                res = json.loads(config_tree.to_json_ast())
-            elif config_format == 'raw':
-                pass
-            else:
-                return error(400, f"'{config_format}' is not a valid config format")
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/config-file')
-def config_file_op(data: ConfigFileModel, background_tasks: BackgroundTasks):
-    session = app.state.vyos_session
-    env = session.get_session_env()
-    op = data.op
-    msg = None
-
-    try:
-        if op == 'save':
-            if data.file:
-                path = data.file
-            else:
-                path = '/config/config.boot'
-            msg = session.save_config(path)
-        elif op == 'load':
-            if data.file:
-                path = data.file
-            else:
-                return error(400, "Missing required field \"file\"")
-
-            session.migrate_and_load_config(path)
-
-            config = Config(session_env=env)
-            d = get_config_diff(config)
-
-            if d.is_node_changed(['service', 'https']):
-                background_tasks.add_task(call_commit, session)
-                msg = self_ref_msg
-            else:
-                session.commit()
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(msg)
-
-@app.post('/image')
-def image_op(data: ImageModel):
-    session = app.state.vyos_session
-
-    op = data.op
-
-    try:
-        if op == 'add':
-            res = session.install_image(data.url)
-        elif op == 'delete':
-            res = session.remove_image(data.name)
-        elif op == 'show':
-            res = session.show(["system", "image"])
-        elif op == 'set_default':
-            res = session.set_default_image(data.name)
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/container-image')
-def container_image_op(data: ContainerImageModel):
-    session = app.state.vyos_session
-
-    op = data.op
-
-    try:
-        if op == 'add':
-            if data.name:
-                name = data.name
-            else:
-                return error(400, "Missing required field \"name\"")
-            res = session.add_container_image(name)
-        elif op == 'delete':
-            if data.name:
-                name = data.name
-            else:
-                return error(400, "Missing required field \"name\"")
-            res = session.delete_container_image(name)
-        elif op == 'show':
-            res = session.show_container_image()
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/generate')
-def generate_op(data: GenerateModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
-
-    try:
-        if op == 'generate':
-            res = session.generate(path)
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/show')
-def show_op(data: ShowModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
-
-    try:
-        if op == 'show':
-            res = session.show(path)
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/reboot')
-def reboot_op(data: RebootModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
-
-    try:
-        if op == 'reboot':
-            res = session.reboot(path)
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/reset')
-def reset_op(data: ResetModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
-
-    try:
-        if op == 'reset':
-            res = session.reset(path)
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-@app.post('/import-pki')
-def import_pki(data: ImportPkiModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
 
-    lock.acquire()
-
-    try:
-        if op == 'import-pki':
-            # need to get rid or interactive mode for private key
-            if len(path) == 5 and path[3] in ['key-file', 'private-key']:
-                path_no_prompt = create_path_import_pki_no_prompt(path)
-                if not path_no_prompt:
-                    return error(400, f"Invalid command: {' '.join(path)}")
-                if data.passphrase:
-                    path_no_prompt += ['--passphrase', data.passphrase]
-                res = session.import_pki_no_prompt(path_no_prompt)
-            else:
-                res = session.import_pki(path)
-            if not res[0].isdigit():
-                return error(400, res)
-            # commit changes
-            session.commit()
-            res = res.split('. ')[0]
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-    finally:
-        lock.release()
-
-    return success(res)
-
-@app.post('/poweroff')
-def poweroff_op(data: PoweroffModel):
-    session = app.state.vyos_session
-
-    op = data.op
-    path = data.path
-
-    try:
-        if op == 'poweroff':
-            res = session.poweroff(path)
-        else:
-            return error(400, f"'{op}' is not a valid operation")
-    except ConfigSessionError as e:
-        return error(400, str(e))
-    except Exception as e:
-        logger.critical(traceback.format_exc())
-        return error(500, "An internal error occured. Check the logs for details.")
-
-    return success(res)
-
-
-###
-# GraphQL integration
-###
-
-def graphql_init(app: FastAPI = app):
-    from api.graphql.libs.token_auth import get_user_context
-    api.graphql.state.init()
-    api.graphql.state.settings['app'] = app
-
-    # import after initializaion of state
-    from api.graphql.bindings import generate_schema
-    schema = generate_schema()
-
-    in_spec = app.state.vyos_introspection
-
-    if app.state.vyos_origins:
-        origins = app.state.vyos_origins
-        app.add_route('/graphql', CORSMiddleware(GraphQL(schema,
-                                                         context_value=get_user_context,
-                                                         debug=True,
-                                                         introspection=in_spec),
-                                                 allow_origins=origins,
-                                                 allow_methods=("GET", "POST", "OPTIONS"),
-                                                 allow_headers=("Authorization",)))
-    else:
-        app.add_route('/graphql', GraphQL(schema,
-                                          context_value=get_user_context,
-                                          debug=True,
-                                          introspection=in_spec))
 ###
 # Modify uvicorn to allow reloading server within the configsession
 ###
@@ -935,30 +69,41 @@ def graphql_init(app: FastAPI = app):
 server = None
 shutdown = False
 
+
 class ApiServerConfig(UvicornConfig):
     pass
 
+
 class ApiServer(UvicornServer):
     def install_signal_handlers(self):
         pass
 
+
 def reload_handler(signum, frame):
+    # pylint: disable=global-statement
+
     global server
-    logger.debug('Reload signal received...')
+    LOG.debug('Reload signal received...')
     if server is not None:
         server.handle_exit(signum, frame)
         server = None
-        logger.info('Server stopping for reload...')
+        LOG.info('Server stopping for reload...')
     else:
-        logger.warning('Reload called for non-running server...')
+        LOG.warning('Reload called for non-running server...')
+
 
 def shutdown_handler(signum, frame):
+    # pylint: disable=global-statement
+
     global shutdown
-    logger.debug('Shutdown signal received...')
+    LOG.debug('Shutdown signal received...')
     server.handle_exit(signum, frame)
-    logger.info('Server shutdown...')
+    LOG.info('Server shutdown...')
     shutdown = True
 
+# end modify uvicorn
+
+
 def flatten_keys(d: dict) -> list[dict]:
     keys_list = []
     for el in list(d['keys'].get('id', {})):
@@ -967,49 +112,87 @@ def flatten_keys(d: dict) -> list[dict]:
             keys_list.append({'id': el, 'key': key})
     return keys_list
 
-def initialization(session: ConfigSession, app: FastAPI = app):
+
+def regenerate_docs(app: FastAPI) -> None:
+    docs = ('/openapi.json', '/docs', '/docs/oauth2-redirect', '/redoc')
+    remove = []
+    for r in app.routes:
+        if r.path in docs:
+            remove.append(r)
+    for r in remove:
+        app.routes.remove(r)
+
+    app.openapi_schema = None
+    app.setup()
+
+
+def initialization(session: SessionState, app: FastAPI = app):
+    # pylint: disable=global-statement,broad-exception-caught,import-outside-toplevel
+
     global server
     try:
         server_config = load_server_config()
     except Exception as e:
-        logger.critical(f'Failed to load the HTTP API server config: {e}')
+        LOG.critical(f'Failed to load the HTTP API server config: {e}')
         sys.exit(1)
 
-    app.state.vyos_session = session
-    app.state.vyos_keys = []
-
     if 'keys' in server_config:
-        app.state.vyos_keys = flatten_keys(server_config)
+        session.keys = flatten_keys(server_config)
+
+    rest_config = server_config.get('rest', {})
+    session.debug = bool('debug' in rest_config)
+    session.strict = bool('strict' in rest_config)
+
+    graphql_config = server_config.get('graphql', {})
+    session.origins = graphql_config.get('cors', {}).get('allow_origin', [])
+
+    if 'rest' in server_config:
+        session.rest = True
+    else:
+        session.rest = False
 
-    app.state.vyos_debug = bool('debug' in server_config)
-    app.state.vyos_strict = bool('strict' in server_config)
-    app.state.vyos_origins = server_config.get('cors', {}).get('allow_origin', [])
     if 'graphql' in server_config:
-        app.state.vyos_graphql = True
+        session.graphql = True
         if isinstance(server_config['graphql'], dict):
             if 'introspection' in server_config['graphql']:
-                app.state.vyos_introspection = True
+                session.introspection = True
             else:
-                app.state.vyos_introspection = False
+                session.introspection = False
             # default values if not set explicitly
-            app.state.vyos_auth_type = server_config['graphql']['authentication']['type']
-            app.state.vyos_token_exp = server_config['graphql']['authentication']['expiration']
-            app.state.vyos_secret_len = server_config['graphql']['authentication']['secret_length']
+            session.auth_type = server_config['graphql']['authentication']['type']
+            session.token_exp = server_config['graphql']['authentication']['expiration']
+            session.secret_len = server_config['graphql']['authentication']['secret_length']
+    else:
+        session.graphql = False
+
+    # pass session state
+    app.state = session
+
+    # add REST routes
+    if session.rest:
+        from api.rest.routers import rest_init
+        rest_init(app)
     else:
-        app.state.vyos_graphql = False
+        from api.rest.routers import rest_clear
+        rest_clear(app)
 
-    if app.state.vyos_graphql:
+    # add GraphQL route
+    if session.graphql:
+        from api.graphql.routers import graphql_init
         graphql_init(app)
+    else:
+        from api.graphql.routers import graphql_clear
+        graphql_clear(app)
+
+    regenerate_docs(app)
+
+    LOG.debug('Active routes are:')
+    for r in app.routes:
+        LOG.debug(f'{r.path}')
 
     config = ApiServerConfig(app, uds="/run/api.sock", proxy_headers=True)
     server = ApiServer(config)
 
-def run_server():
-    try:
-        server.run()
-    except OSError as e:
-        logger.critical(e)
-        sys.exit(1)
 
 if __name__ == '__main__':
     # systemd's user and group options don't work, do it by hand here,
@@ -1024,13 +207,14 @@ if __name__ == '__main__':
     signal.signal(signal.SIGHUP, reload_handler)
     signal.signal(signal.SIGTERM, shutdown_handler)
 
-    config_session = ConfigSession(os.getpid())
+    session_state = SessionState()
+    session_state.session = ConfigSession(os.getpid())
 
     while True:
-        logger.debug('Enter main loop...')
+        LOG.debug('Enter main loop...')
         if shutdown:
             break
         if server is None:
-            initialization(config_session)
+            initialization(session_state)
             server.run()
         sleep(1)