Add a MikroTik router
A read-only user on the router (RouterOS 6 or 7), the API service, then the device in WISPMap.
Updated 11 November 2026
WISPMap reads RouterOS 6 and 7 over the router's API, with a user that can only read. Nothing on the router is changed.
1. Add the read-only user
In a terminal on the router (Winbox's New Terminal, or SSH):
/user group add name=wispmon policy=read,api,test
/user add name=wispmon group=wispmon password="<a long random password>"
readlets it read the configuration and status;apilets it log in over the API;testlets it run the read-only tools WISPMap uses (such as reading a PoE port or a 60 GHz link withmonitor once).- Use the same user and password on every router: the collector uses one RouterOS login for all of them.
- The password only goes into the collector's
.env, never into WISPMap.
Not your admin user
Don't give the collector a user with write or full rights. WISPMap's security check flags it if its own user
can write, because nothing it does needs that.
2. Turn on the API
The API service is on by default on most routers. Check it, and allow it only from the collector (here 10.0.0.20):
/ip service print where name~"api"
/ip service set api disabled=no address=10.0.0.20/32
If a firewall filter rule on the router drops new connections to the router, allow TCP 8728 from the collector.
API over TLS
To encrypt the API traffic, use api-ssl (TCP 8729). It needs a certificate on the router. The router can make
its own: first a small certificate authority, then the certificate it signs (signing a certificate on its own fails
with CA not found on current RouterOS 7). Signing takes a few seconds:
/certificate add name=api-ca common-name=api-ca days-valid=3650 key-usage=key-cert-sign,crl-sign
/certificate sign api-ca
/certificate add name=api-ssl common-name=router days-valid=3650 key-usage=digital-signature,key-encipherment,tls-server
/certificate sign api-ssl ca=api-ca
/ip service set api-ssl certificate=api-ssl disabled=no address=10.0.0.20/32
/certificate print then shows api-ssl with the flags K and I (it has a key and was issued).
Then tick API over TLS on the device in WISPMap (the port becomes 8729). The collector doesn't check the
certificate, because RouterOS certificates are nearly always self-signed, but the traffic and the password are
encrypted. TLS needs collector 0.8.1 or newer. A router without a certificate shows tls_error.
3. Add it in WISPMap
In Admin → Devices, choose Add device:
- Name: what you call it, for example
TWR-NORTH-RTR. - Site: where it is.
- Kind: MikroTik RouterOS.
- Role: what it does in your network. The role sets how serious an outage is (device settings).
- Management IP / host: the address the collector reaches it on.
- Collector: the one that monitors it (set automatically if you have one).
Leave the port at 8728 (or 8729 with TLS) and the credential profile at default.
4. Check it
Within a minute the device's page shows API ok, its RouterOS version and board, and its interfaces. If the API column says something else:
| Says | Means |
|---|---|
timeout |
No answer on the API port: the service is off, its address list leaves out the collector, or a firewall drops it. |
refused |
The router answered but refused the connection: the service is off or on another port. |
auth_failed |
The wispmon user is missing on this router, or its password differs from the collector's. |
tls_error |
API over TLS, but the router has no certificate on api-ssl. |
More in network and firewall.
What WISPMap reads
Every 60 seconds: uptime, CPU, memory and version; interfaces with their traffic and errors; OSPF neighbours, costs and routes; BGP sessions and their routes; voltage, temperatures, power supplies and fans; PoE per port; wireless clients with their signal, SNR, CCQ and rates. Every 5 minutes: subscribers online (counts only) and the security settings for the security check. Every 15 minutes: neighbours, to suggest links. The full list is on How it works.