diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000000..f2d1cbebad
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,3 @@
+external-sources=true
+# Used for jdg-tap integration.
+source-path=source
diff --git a/debian/ngcp-panel.install b/debian/ngcp-panel.install
index 807c4b9ec1..817719ec2d 100644
--- a/debian/ngcp-panel.install
+++ b/debian/ngcp-panel.install
@@ -1,3 +1,4 @@
+etc/default/ngcp-api		etc/default/
 etc/logging.conf		etc/ngcp-panel/
 etc/ngcp_panel.conf		etc/ngcp-panel/
 lib/NGCP/Panel/I18N/*		usr/share/perl5/NGCP/Panel/I18N
diff --git a/etc/default/ngcp-api b/etc/default/ngcp-api
new file mode 100644
index 0000000000..28042fc9d2
--- /dev/null
+++ b/etc/default/ngcp-api
@@ -0,0 +1,10 @@
+# Example NGCP REST API configuration file.
+NGCP_API_IP=127.0.0.1
+NGCP_API_PORT=1442
+NGCP_API_IFACE=lo
+NGCP_API_SSLVERIFY=no
+NGCP_API_SSLVERIFY_LOOPBACK=no
+NGCP_API_READ_TIMEOUT=60
+AUTH_SYSTEM_LOGIN=system
+AUTH_SYSTEM_PASSWORD=00000000000000000000
+AUTH_SYSTEM_ROLES=admin
diff --git a/t/api-rest/testrunner b/t/api-rest/testrunner
index 135d9ee32c..c2bfbbed52 100755
--- a/t/api-rest/testrunner
+++ b/t/api-rest/testrunner
@@ -54,7 +54,8 @@ echo "Finished main setup, now running tests ..."
 
 export CATALYST_SERVER_SUB="https://${SERVER}:443"
 export CATALYST_SERVER="https://${SERVER}:1443"
-export NGCP_SESSION_ID="$(printf %03d $((RANDOM % 1000)))$(date +%s)"
+NGCP_SESSION_ID="$(printf %03d $((RANDOM % 1000)))$(date +%s)"
+export NGCP_SESSION_ID
 export NGCP_TYPE
 RC=0
 
diff --git a/tools/ngcp-api.inc b/tools/ngcp-api.inc
index 8c6a0e6747..52095d1d49 100644
--- a/tools/ngcp-api.inc
+++ b/tools/ngcp-api.inc
@@ -23,6 +23,7 @@ importcreds () {
   echo "${CREDS} present, checking perms"
   if stat "${CREDS}" | grep -q "Access: (${PERMS}" 1>/dev/null ; then
     echo "${CREDS} permissions ok"
+    # shellcheck source=./etc/default/ngcp-api
     . "${CREDS}"
   else
     echo "Error: ${CREDS} must have permissions ${PERMS}" >&2
diff --git a/tools_bin/ngcp-api-delete b/tools_bin/ngcp-api-delete
index 9a0bfaa5bd..2cc169a685 100755
--- a/tools_bin/ngcp-api-delete
+++ b/tools_bin/ngcp-api-delete
@@ -19,6 +19,7 @@ EOF
 
 if [ -z "${APIUSER}" ]; then
   if [ -f "${TOOLS}" ]; then
+    # shellcheck source=./tools/ngcp-api.inc
     source "${TOOLS}"
 
     importcreds "${USERCREDS}" 0600
@@ -34,6 +35,8 @@ if [ -z "${APIUSER}" ]; then
   fi
 fi
 
+CURL_OPTS=()
+
 while getopts "hv" OPTION
 do
   case ${OPTION} in
@@ -41,7 +44,7 @@ do
       usage
       ;;
     v)
-      VERBOSE="--verbose"
+      CURL_OPTS+=(--verbose)
       ;;
     ?)
       usage
@@ -56,7 +59,7 @@ if [ -z "${URL}" ] ; then
 fi
 validateurl "$URL"
 
-${CURL} -i ${VERBOSE} -X DELETE \
+${CURL} -i "${CURL_OPTS[@]}" -X DELETE \
   "${APIREALM[@]}" \
   -H 'Connection: close' \
   "${HEADERS}" --user "${APIUSER}" --insecure "${URL}"
diff --git a/tools_bin/ngcp-api-get b/tools_bin/ngcp-api-get
index 777a7baed6..d19557b128 100755
--- a/tools_bin/ngcp-api-get
+++ b/tools_bin/ngcp-api-get
@@ -19,6 +19,7 @@ EOF
 
 if [ -z "${APIUSER}" ]; then
   if [ -f "${TOOLS}" ]; then
+    # shellcheck source=./tools/ngcp-api.inc
     source "${TOOLS}"
 
     importcreds "${USERCREDS}" 0600
@@ -34,6 +35,8 @@ if [ -z "${APIUSER}" ]; then
   fi
 fi
 
+CURL_OPTS=()
+
 while getopts "hv" OPTION
 do
   case ${OPTION} in
@@ -41,7 +44,7 @@ do
       usage
       ;;
     v)
-      VERBOSE="--verbose"
+      CURL_OPTS+=(--verbose)
       ;;
     ?)
       usage
@@ -56,7 +59,7 @@ if [ -z "${URL}" ]; then
 fi
 validateurl "$URL"
 
-${CURL} -i ${VERBOSE} -X GET \
+${CURL} -i "${CURL_OPTS[@]}" -X GET \
   "${APIREALM[@]}" \
   -H 'Connection: close' \
   --user "${APIUSER}" --insecure "${URL}"
diff --git a/tools_bin/ngcp-api-patch b/tools_bin/ngcp-api-patch
index bb3f688617..4c5c68b312 100755
--- a/tools_bin/ngcp-api-patch
+++ b/tools_bin/ngcp-api-patch
@@ -21,6 +21,7 @@ EOF
 
 if [ -z "${APIUSER}" ]; then
   if [ -f "${TOOLS}" ]; then
+    # shellcheck source=./tools/ngcp-api.inc
     source "${TOOLS}"
 
     importcreds "${USERCREDS}" 0600
@@ -35,6 +36,7 @@ if [ -z "${APIUSER}" ]; then
     exit 1
   fi
 fi
+CURL_OPTS=()
 INPUT=(-T -)
 CTYPE="application/json-patch+json"
 PREFER="representation"
@@ -47,7 +49,7 @@ do
       ;;
     f)
       INPUT=()
-      FILE_INPUT=(--data-binary @${OPTARG})
+      FILE_INPUT=(--data-binary "@${OPTARG}")
       if [ ! -f "${OPTARG}" ]; then
         echo "No '${OPTARG}' file found"
         usage
@@ -57,7 +59,7 @@ do
       PREFER="minimal"
       ;;
     v)
-      VERBOSE="--verbose"
+      CURL_OPTS+=(--verbose)
       ;;
     ?)
       usage
@@ -72,7 +74,7 @@ if [ -z "${URL}" ] ; then
 fi
 validateurl "$URL"
 
-${CURL} -i ${VERBOSE} -X PATCH \
+${CURL} -i "${CURL_OPTS[@]}" -X PATCH \
   "${APIREALM[@]}" \
   -H 'Connection: close' -H "Prefer: return=${PREFER}" \
   -H "Content-Type: ${CTYPE}" \
diff --git a/tools_bin/ngcp-api-post b/tools_bin/ngcp-api-post
index 449ebb01b6..5b90a002e0 100755
--- a/tools_bin/ngcp-api-post
+++ b/tools_bin/ngcp-api-post
@@ -20,6 +20,7 @@ EOF
 
 if [ -z "${APIUSER}" ]; then
   if [ -f "${TOOLS}" ]; then
+    # shellcheck source=./tools/ngcp-api.inc
     source "${TOOLS}"
 
     importcreds "${USERCREDS}" 0600
@@ -34,6 +35,7 @@ if [ -z "${APIUSER}" ]; then
     exit 1
   fi
 fi
+CURL_OPTS=()
 INPUT=(-T -)
 
 while getopts "f:hv" OPTION
@@ -44,14 +46,14 @@ do
       ;;
     f)
       INPUT=()
-      FILE_INPUT=(--data-binary @${OPTARG})
+      FILE_INPUT=(--data-binary "@${OPTARG}")
       if [ ! -f "${OPTARG}" ]; then
         echo "No '{$OPTARG}' file found"
         usage
       fi
       ;;
     v)
-      VERBOSE="--verbose"
+      CURL_OPTS+=(--verbose)
       ;;
     ?)
       usage
@@ -67,7 +69,7 @@ fi
 validateurl "$URL"
 CTYPE=${2:-application/json}
 
-${CURL} -i ${VERBOSE} -X POST \
+${CURL} -i "${CURL_OPTS[@]}" -X POST \
   "${APIREALM[@]}" \
   -H 'Connection: close' -H 'Prefer: return=representation' \
   -H "Content-Type: ${CTYPE}" \
diff --git a/tools_bin/ngcp-api-put b/tools_bin/ngcp-api-put
index d4120d2fe5..76fb23b95e 100755
--- a/tools_bin/ngcp-api-put
+++ b/tools_bin/ngcp-api-put
@@ -20,6 +20,7 @@ EOF
 
 if [ -z "${APIUSER}" ]; then
   if [ -f "${TOOLS}" ]; then
+    # shellcheck source=./tools/ngcp-api.inc
     source "${TOOLS}"
 
     importcreds "${USERCREDS}" 0600
@@ -34,6 +35,7 @@ if [ -z "${APIUSER}" ]; then
     exit 1
   fi
 fi
+CURL_OPTS=()
 INPUT=(-T -)
 
 while getopts "f:hv" OPTION
@@ -44,14 +46,14 @@ do
       ;;
     f)
       INPUT=()
-      FILE_INPUT=(--data-binary @${OPTARG})
+      FILE_INPUT=(--data-binary "@${OPTARG}")
       if [ ! -f "${OPTARG}" ]; then
         echo "No '${OPTARG}' file found"
         usage
       fi
       ;;
     v)
-      VERBOSE="--verbose"
+      CURL_OPTS+=(--verbose)
       ;;
     ?)
       usage
@@ -67,7 +69,7 @@ fi
 validateurl "$URL"
 CTYPE=${2:-application/json}
 
-${CURL} -i ${VERBOSE} -X PUT \
+${CURL} -i "${CURL_OPTS[@]}" -X PUT \
   "${APIREALM[@]}" \
   -H 'Connection: close' -H 'Prefer: return=representation' \
   -H "Content-Type: ${CTYPE}" \