Recommended way to monitor Kea DHCP leases from Zabbix on pfSense Plus 26.03.1?

[pr0thy]

I enabled Netgate Nexus on pfSense Plus 26.03.1. Nexus HTTPS is reachable on 8443. Inspecting the frontend bundle only exposed /api/diag/console; I did not find DHCP, Kea, or lease API routes. Is there a documented read-only Nexus API endpoint for Kea DHCP lease status, or is Kea lease data currently only available through the local Kea control socket / GUI?

[stephenw10]

Available data is documented here: https://github.com/Netgate/pfsense-api

[pr0thy]

Thank you. I see that the documented API includes GET /services/dhcp/leases, which appears to provide the data I need.

My remaining question is authentication and least privilege. Can a pfSense Plus user or API role be restricted to read-only access to this endpoint, without permissions for the related lease-delete or DHCP-configuration endpoints?

Also, is this endpoint available directly on a single pfSense Plus appliance after enabling MIM, or does it require a separate Multi-instance Management Controller?

[stephenw10]

That sort of fine grained access isn't present yet. It's planned for a future update though.