The Dashboard API provides real-time visibility into system performance, health, user activity, and cache efficiency. These endpoints power the dashboard widgets in the admin Studio.

All dashboard routes require an authenticated session and the dashboard:read permission (admins bypass via the fast-path). Use kebab-case paths (system-info, last5-content, system-messages, online-user).

Quick Reference

| Recent Content | /api/dashboard/last5-content | GET | dashboard:read | | Recent Media | /api/dashboard/last5media | GET | dashboard:read | | Online Users | /api/dashboard/online-user | GET | dashboard:read | | System Messages | /api/dashboard/system-messages | GET | dashboard:read |

1. Core Metrics

Dashboard Stats

Returns a unified snapshot of content, user, and media counts plus system health.

Endpoint: GET /api/dashboard/stats

Response:

{
  "contentCount": 42,
  "userCount": 15,
  "mediaCount": 128,
  "storageUsed": "0 MB",
  "healthStatus": "healthy",
  "uptime": 12345.678,
  "timestamp": "2026-06-15T10:00:00.000Z"
}

Metrics Report

Returns the full MetricsService report with API hits, cache statistics, and error rates.

Endpoint: GET /api/dashboard/metrics

Parameters: ?detailed=true — Includes additional system information (memory, uptime, Node version).

Health Check

Returns the system health status from the core health service.

Endpoint: GET /api/dashboard/health

2. System Monitoring

System Information

Returns OS, CPU, memory, and disk information. Filter by type for specific subsystems.

Endpoint: GET /api/dashboard/system-info

Parameters: ?type=cpu|memory|os|disk — Filter to a specific subsystem.

{
  "osInfo": { "platform": "linux", "arch": "x64" },
  "cpuInfo": { "model": "...", "cores": 8 },
  "memoryInfo": { "total": 16384, "free": 8192 },
  "diskInfo": { "root": { "totalGb": 256, "usedGb": 45 } }
}

Cache Metrics

Returns cache performance statistics including hit rate, operations count, and per-category breakdown.

Endpoint: GET /api/dashboard/cache-metrics

Response:

{
  "overall": {
    "hits": 15420,
    "misses": 342,
    "hitRate": 97.83,
    "sets": 450,
    "deletes": 120,
    "size": 89,
    "totalOperations": 15762
  },
  "byCategory": {},
  "byTenant": {},
  "timestamp": 1717298400000
}

3. Activity & Logging

Audit Logs (paginated)

Returns paginated audit log entries with severity filtering and text search.

Endpoint: GET /api/dashboard/logs

Parameters:

• limit (max 100) — Number of entries per page
• page — Page number (1-based)
• level — Filter by severity (low, medium, high, critical)
• search — Full-text search across message and action fields

Audit Events (widget feed)

Returns a flat array of recent audit events for dashboard widgets.

Endpoint: GET /api/dashboard/audit

Parameters: ?limit=50 (max 100)

Security Overview

Returns security incident statistics and active threat data from securityResponseService.

Endpoint: GET /api/dashboard/security

SCIM Status

Returns SCIM provisioning health derived from tenant user records.

Endpoint: GET /api/dashboard/scim

System Messages

Returns recent system messages derived from audit logs, categorized by severity.

Endpoint: GET /api/dashboard/system-messages

Parameters: ?limit=10 — Number of messages (default: 10)

Recent Content

Returns the most recently updated content entries across all collections (via LocalCMS.collections.search).

Endpoint: GET /api/dashboard/last5-content

Parameters: ?limit=5 — Number of entries (default: 5, max: 50)

Recent Media

Returns the most recently uploaded media items.

Endpoint: GET /api/dashboard/last5media

Online Users

Returns users with active sessions. Session duration is estimated from expiry minus the configured session TTL (no Math.random()).

Endpoint: GET /api/dashboard/online-user

4. Dashboard Widgets (UI)

The admin dashboard is composed of modular Svelte 5 widget packages (one folder per widget), each backed by one or more API endpoints. The widget catalog is install-specific — the core packages bundled with SveltyCMS are listed below, and the marketplace can add more (counts are never fixed):

Widget Discovery (dual registration + package folders)

Each dashboard widget is a self-contained package in its own kebab-case folder under src/routes/(app)/dashboard/widgets/<folder>/, containing the entry component index.svelte, a widget.json manifest, and the required readme.mdx marketplace description (validated manually via bun run lint:widgets):

widgets/system-health/
  index.svelte   # entry component (fixed name)
  widget.json    # marketplace manifest
  readme.mdx     # marketplace description (fixed name)

Widgets are registered in two places:

1. Client runtime — +page.svelte uses import.meta.glob("./widgets/*/*.svelte") to build the widget registry for rendering and lazy loading. The registry is keyed by the folder id (widget.json.id); each entry stores its entry filename for the dynamic import.
2. Server metadata — +page.server.ts eagerly globs the same pattern and pre-computes availableWidgets (name, icon, description, folder) for the widget picker.

The folder id (not the filename) is the registry key persisted in system-preferences, so saved layouts survive entry renames. In dev, the Vite plugin watches src/routes/(app)/dashboard/widgets/** and full-reloads on package add/remove so new widgets appear without a manual restart. The widget.json manifest drives the marketplace catalog and telemetry via manifest-registry.ts. See Dashboard Widget Development.

Each widget exports optional widgetMeta for display metadata:

export const widgetMeta = {
  name: "System Health",
  icon: "mdi:heart-pulse",
  description: "Real-time system health status",
  defaultSize: { w: 2, h: 2 },
};

Generative Dashboard

generativedashboard.svelte provides an AI-assisted layout builder on the dashboard page. It consumes JSON render specs and integrates with the same widget registry — layouts are persisted via system-preferences.

🔑 Licensing & Monetization for Dashboard Widgets

Certain advanced dashboard widgets are designated as premium features (e.g. SCIM Status, Unified Metrics, DB Pool Diagnostics, Security Overview). Their widget.json manifest declares license: "freemium" | "paid".

• 14-day trials: Like plugins and custom collection widgets, all premium dashboard widgets feature a built-in key-less 14-day trial period from initial installation.
• Licensing check: Premium widgets are gated on both sides, mirroring custom widgets and plugins:
  • Client-side gating: Each widget checks checkExtensionLicense("dashboard", widgetId) (via GET /api/system/license-status?type=dashboard&id=<widget-id>) and renders an upgrade prompt instead of dashboard content when the trial expired and no SLM-/SLM-DEMO- key is configured.
  • Server-side gating: The backing API endpoints call checkExtensionLicense and return 403 LICENSE_REQUIRED when the check fails — premium data is never served without entitlement. See dashboard-license.ts in the dashboard handler for the endpoint → widget-id map:

Free widgets (health, system-info, last5-content, last5media, system-messages, tenant-analytics, media-storage-analytics) are not gated. Endpoints consumed by multiple widgets use the install-wide trial model, so one gate covers them all (e.g. metrics powers both Unified Metrics and Performance).

5. The Mechanics

Data Aggregation

The Dashboard handler aggregates data from multiple internal services:

Authorization

The dashboard namespace is mapped in ENDPOINT_PERMISSIONS to dashboard:read. Unmapped namespaces fail closed (403). Admins and users with the dashboard:read core permission (see core-permissions.ts) may access these endpoints.

Performance Impact

Dashboard endpoints use lightweight queries and cached data where possible.

The metrics and cache-metrics endpoints aggregate pre-computed statistics rather than scanning large datasets.

Recent content uses cross-collection search with a configurable limit (default 5).

Related Documents

• Dashboard System Architecture
• System Reference (system.ts)
• Content Reference (content.ts)
• API Coverage Report