MikroTik API for ISPs: Automate Router Management at Scale

Why Automate MikroTik Management

If you are managing more than a handful of MikroTik routers, manual configuration through Winbox becomes a bottleneck. Adding a new subscriber means logging into each router, creating the PPP secret, setting up the queue, and hoping you did not make a typo. Multiply that by 10 routers and 50 new subscribers per week.

The MikroTik RouterOS API provides programmatic access to every router function. Combined with a billing platform like ISPbills, you can fully automate subscriber lifecycle management.

RouterOS API Basics

The RouterOS API runs on port 8728 (plaintext) or 8729 (SSL). It uses a sentence-based protocol where each command is a sequence of words. The API supports all CLI commands in a structured format.

# Enable API access (restrict to management IPs)
/ip service
set api address=10.10.0.0/24 disabled=no port=8728
set api-ssl address=10.10.0.0/24 disabled=no port=8729

# Create a dedicated API user with limited permissions
/user group
add name=api-group policy=read,write,api,sensitive,test

/user
add name=api-user password=StrongAPIpass123 group=api-group

Connecting to the API with Python

The routeros_api Python library provides a clean interface to the MikroTik API.

import routeros_api

# Connect to the router
connection = routeros_api.RouterOsApiPool(
    '10.10.0.1',
    username='api-user',
    password='StrongAPIpass123',
    port=8728,
    plaintext_login=True
)
api = connection.get_api()

# List all PPP active connections
ppp_active = api.get_resource('/ppp/active')
for session in ppp_active.get():
    print(f"{session['name']} - {session['address']} - {session['uptime']}")

# Create a new PPP secret
ppp_secret = api.get_resource('/ppp/secret')
ppp_secret.add(
    name='new-subscriber-001',
    password='SubPass123',
    service='pppoe',
    profile='10Mbps',
    comment='John Doe - Basic Plan'
)

connection.disconnect()

Common Automation Tasks

Here are the operations ISPs automate most frequently through the API:

# Bulk update rate limits when a package changes
def update_package_rate(api, profile_name, new_rate):
    profiles = api.get_resource('/ppp/profile')
    existing = profiles.get(name=profile_name)
    if existing:
        profiles.set(id=existing[0]['id'], rate_limit=new_rate)
        print(f"Updated {profile_name} to {new_rate}")

# Disconnect a subscriber (force reconnect with new settings)
def disconnect_user(api, username):
    active = api.get_resource('/ppp/active')
    sessions = active.get(name=username)
    for session in sessions:
        active.remove(id=session['id'])
        print(f"Disconnected {username}")

# Read interface traffic counters
def get_traffic(api, interface_name):
    ifaces = api.get_resource('/interface')
    data = ifaces.get(name=interface_name)
    if data:
        rx_bytes = int(data[0].get('rx-byte', 0))
        tx_bytes = int(data[0].get('tx-byte', 0))
        print(f"{interface_name}: RX={rx_bytes/1048576:.1f}MB TX={tx_bytes/1048576:.1f}MB")

Securing API Access

The API is a powerful entry point — secure it properly:

• Use API-SSL (port 8729) — encrypts all communication between your server and the router
• Restrict source IPs— limit API access to your management server's IP only
• Dedicated API user — never use the admin account; create a user with minimal required permissions
• Firewall rules — block API ports from all addresses except your management subnet
• Rate limiting — add firewall rules to rate-limit API connection attempts

How ISPbills Uses the MikroTik API

ISPbills connects to all your MikroTik routers via the API to automate the complete subscriber lifecycle:

• Auto-provisioning — create subscriber, assign package → ISPbills pushes PPP secret and queue to the router
• Package changes — upgrade/downgrade a subscriber and the rate limit updates across all routers instantly
• Suspension/reconnection — overdue invoice → auto-disable; payment received → auto-enable
• Bulk sync — push configuration changes to 50+ routers in one click
• Live monitoring — read active PPPoE sessions, interface traffic, and device health via API in real time