# API endpoint reference Source: https://docs.blazingfast.io/api/reference Find each public endpoint's parameters, required permissions and responses. This reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the [OpenAPI JSON](https://docs.blazingfast.io/api/public/openapi/userapi-v1) for client generation. Use the [integration guide](https://docs.blazingfast.io/api/integration-guide) for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself. ## Current purchase and operation workflows SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount. Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state. Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See [HTTP, SDK, CLI and MCP examples](https://docs.blazingfast.io/howto/api/machine-readable-purchase-and-operation-recovery). DNSSEC uses its separate endpoint and state contract. Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented. For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation. API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests. ## Customer API reference API origin: https://api.blazingfast.io OpenAPI: https://docs.blazingfast.io/api/public/openapi/userapi-v1 ### Pagination Pagination is endpoint-specific. Follow the pagination model documented for each endpoint; do not send page to a cursor- or offset-based endpoint. Page-based lists such as GET /v1/services use page and limit, with page, pageSize, total and pages in the response. Example: GET /v1/services?page=2&limit=50. Stop when page >= pages or items is empty. Cursor-based lists such as GET /v1/api-credentials use limit and cursor. Pass the returned next_cursor unchanged on the next request; null means finished. Offset-based lists such as GET /v1/products and GET /v1/dns/zones?view=summary use limit and offset. Use the returned next_offset; null means finished. DNS zone summary has its own default limit, while the default legacy view is not paginated. limit is the canonical page-size parameter. Deprecated page_size and pageSize request aliases are retained only on endpoints that explicitly document them; supplied size values must match. Defaults and maximum sizes are endpoint-specific. Page-based responses retain pageSize for compatibility. GET /v1/services applies ownership, status, type, search, external_id and label filters server-side before pagination and counts. Default states are active and suspended; historical services require an explicit status selection. group_by=type groups only the current page. GET /v1/services/grouped returns the complete inventory under its documented status/type filters, without pagination; its legacy compatibility default is active only; MCP/automation clients should pass status explicitly and prefer the paginated service endpoint with statuses=active,suspended. ### GET /v1/api-credentials List your API credentials Operation ID: apiCredentials Owner-only, secret-free inventory. Cursor pagination defaults to 50. Managed MCP credentials are read-only here. Scopes: api_credentials.read - query limit (optional): Maximum items, default 50. - query cursor (optional): Next UUID cursor. - query include_revoked (optional): Include revoked keys. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Credential inventory. Illustrative response: ```json { "ok": true, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example integration", "prefix": "ak_EXAMPLE", "mode": "signed", "enabled": true, "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "revoked_at": null, "last_used_at": null, "last_used_ip": null, "scopes": [ "billing.services.read" ], "allowed_cidrs": [] } ], "next_cursor": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/api-credentials Create a restricted API credential Operation ID: apiCredentialCreate Requires a stable Idempotency-Key. Requested scopes and allowed CIDRs cannot exceed the issuer; expiry is capped by the issuer. The secret is returned only on issuance or same-key retry within 24 hours. Managed MCP/support keys cannot delegate. Scopes: api_credentials.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 80 }, "scopes": { "type": "array", "items": { "type": "string", "enum": [ "audit.read", "api_credentials.read", "api_credentials.write", "oauth.connections.read", "oauth.connections.write", "billing.balance.read", "billing.invoices.read", "billing.orders.read", "billing.products.read", "billing.services.read", "billing.services.write", "billing.transactions.read", "billing.unpaid_total.read", "billing.order.create", "billing.invoice.pay", "vps.read", "vps.credentials.read", "vps.write", "dedicated.read", "dedicated.credentials.read", "dedicated.write", "dns.read", "dns.write", "domains.read", "domains.write", "ssh.read", "ssh.write", "firewall.read", "firewall.write", "storage.read", "storage.write", "tcp_proxy.read", "tcp_proxy.write", "webhooks.read", "webhooks.write" ] }, "minItems": 1, "maxItems": 35 }, "mode": { "type": "string", "enum": [ "signed", "bearer" ], "default": "signed" }, "ttl_days": { "type": "integer", "minimum": 1, "maximum": 365, "default": 30 }, "allowed_cidrs": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "maxItems": 50 } }, "required": [ "name", "scopes" ], "additionalProperties": false } ``` Response 201: Created credential and signing secret. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example integration", "prefix": "ak_EXAMPLE", "mode": "signed", "enabled": true, "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "revoked_at": null, "last_used_at": null, "last_used_ip": null, "scopes": [ "billing.services.read" ], "allowed_cidrs": [] }, "secret": "sk_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEX" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/api-credentials/{id} Read your credential metadata Operation ID: apiCredential Never returns signing secrets. Scopes: api_credentials.read - path id (required): Owned credential UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Credential metadata. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example integration", "prefix": "ak_EXAMPLE", "mode": "signed", "enabled": true, "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "revoked_at": null, "last_used_at": null, "last_used_ip": null, "scopes": [ "billing.services.read" ], "allowed_cidrs": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/api-credentials/{id} Update a restricted API credential Operation ID: apiCredentialUpdate Change name, scopes, expiry, enabled state or allowed CIDRs without exceeding the current issuer. Revoked or managed credentials cannot be reactivated. Scopes: api_credentials.write - path id (required): Owned credential UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 80 }, "scopes": { "type": "array", "items": { "type": "string", "enum": [ "audit.read", "api_credentials.read", "api_credentials.write", "oauth.connections.read", "oauth.connections.write", "billing.balance.read", "billing.invoices.read", "billing.orders.read", "billing.products.read", "billing.services.read", "billing.services.write", "billing.transactions.read", "billing.unpaid_total.read", "billing.order.create", "billing.invoice.pay", "vps.read", "vps.credentials.read", "vps.write", "dedicated.read", "dedicated.credentials.read", "dedicated.write", "dns.read", "dns.write", "domains.read", "domains.write", "ssh.read", "ssh.write", "firewall.read", "firewall.write", "storage.read", "storage.write", "tcp_proxy.read", "tcp_proxy.write", "webhooks.read", "webhooks.write" ] }, "minItems": 1, "maxItems": 35 }, "allowed_cidrs": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "maxItems": 50 }, "enabled": { "type": "boolean" }, "expires_at": { "type": "string", "format": "date-time" } }, "additionalProperties": false } ``` Response 200: Updated credential metadata. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example integration", "prefix": "ak_EXAMPLE", "mode": "signed", "enabled": true, "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "revoked_at": null, "last_used_at": null, "last_used_ip": null, "scopes": [ "billing.services.read" ], "allowed_cidrs": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/api-credentials/{id} Revoke an API credential Operation ID: apiCredentialRevoke Disables an owned ordinary credential; does not delete history. Managed MCP grants use connection revocation instead. Scopes: api_credentials.write - path id (required): Owned credential UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Credential revoked. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/api-credentials/{id}/rotate Rotate an API credential Operation ID: apiCredentialRotate Requires Idempotency-Key. Replaces prefix and secret immediately; old authentication stops working. Use a different management key, or the dashboard, to rotate the key used by an integration. Self-rotation is rejected to avoid losing access after an interrupted response. Superseded receipts never reveal obsolete secrets. Scopes: api_credentials.write - path id (required): Owned ordinary credential UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (optional) ```json { "type": "object", "properties": {}, "additionalProperties": false } ``` Response 200: Rotated credential and secret. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example integration", "prefix": "ak_EXAMPLE", "mode": "signed", "enabled": true, "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "revoked_at": null, "last_used_at": null, "last_used_ip": null, "scopes": [ "billing.services.read" ], "allowed_cidrs": [] }, "secret": "sk_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEX" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/oauth/connections List connected applications Operation ID: oauthConnections Owner-only hosted MCP OAuth connection inventory. Does not expose access tokens, refresh tokens or internal client credentials. Connection-management transport must be configured. Scopes: oauth.connections.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Connected applications. Illustrative response: ```json { "ok": true, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "application": "Example application", "scopes": [ "billing.services.read" ], "created_at": "2026-10-01T00:00:00.000Z", "expires_at": "2026-11-01T00:00:00.000Z", "policy": "read_only", "access_policy": "read_only", "enabled": true, "last_used_at": null, "revoked": false } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/oauth/connections/{id} Revoke a connected application Operation ID: oauthConnectionRevoke Revokes only this account’s grant using the existing fenced revocation flow. Repeating revocation is safe. Does not grant or expand permissions. Scopes: oauth.connections.write - path id (required): Connection UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Connection revoked. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/audit/actions List durable customer API action events Operation ID: auditActions Requested intent is saved before entering a write handler; accepted is not completion. Terminal operation results are recorded separately. Covers customer API and hosted MCP writes. Broader Billing dashboard/admin/committed state observations are available through audit/business. Updates are blocked; privileged retention deletes after the configured period. Scopes: audit.read - query limit (optional): Maximum items, default 50. - query cursor (optional): Next event cursor. - query resource_id (optional): Resource ID or zone name. - query phase (optional): Action phase. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Account-owned action history. Illustrative response: ```json { "ok": true, "items": [ { "id": "1", "request_id": "00000000-0000-4000-8000-000000000002", "actor": { "type": "api_key", "id": "00000000-0000-4000-8000-000000000001" }, "action": "POST /v1/vps/:serviceId/reboot", "resource_id": "00000000-0000-4000-8000-000000000001", "phase": "accepted", "operation_id": null, "created_at": "2026-10-01T00:00:00.000Z" } ], "next_cursor": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/audit/business List account-owned business audit events Operation ID: auditBusiness Durable Billing dashboard/admin request acceptance and committed service/invoice/order/lifecycle observations. A committed lifecycle log row is not proof of task completion. Database transitions without a verified human identity use system; identities are never inferred from metadata. Admin identity is withheld from customer responses. No payloads, credentials, provider errors or financial customer details are logged. This does not cover every action of other services or constitute a WORM export. Scopes: audit.read - query limit (optional): Maximum items, default 50 (1–100). - query cursor (optional): Exclusive cursor returned as next_cursor. - query actor_type (optional): Verified actor category. - query resource_type (optional): service, invoice, order or account. - query resource_id (optional): Owned resource UUID. - query request_id (optional): Correlation UUID. - query action (optional): Exact action. - query phase (optional): requested, accepted, rejected, unknown or committed. - query from (optional): Inclusive ISO timestamp. - query to (optional): Inclusive ISO timestamp. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Owner-filtered business observations, newest first. Illustrative response: ```json { "ok": true, "items": [ { "id": "1", "request_id": null, "actor": { "type": "system", "id": null }, "source": "database", "action": "service.changed", "resource_type": "service", "resource_id": "00000000-0000-4000-8000-000000000001", "phase": "committed", "changes": { "before": { "status": "active" }, "after": { "status": "suspended" } }, "created_at": "2026-10-01T00:00:00.000Z" } ], "next_cursor": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/{serviceId}/dnssec Read DNSSEC status Operation ID: domainDnssec Returns the locally saved DNSSEC state for your registered domain. Use action refresh to check current registration state. Zone signing and parent propagation are separate from enabled registration status. Scopes: domains.read - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Saved DNSSEC status. Illustrative response: ```json { "ok": true, "domain": "example.com", "tld": "com", "support": "supported", "nameservers": [ "dns1.blazingfast.io", "dns2.blazingfast.io" ], "keys": [], "status": "not_configured", "delegationStatus": "not_verified", "dnsProvider": "managed", "canEnable": true, "canDisable": false, "enabled": false, "checkedAt": "2026-10-01T00:00:00.000Z", "operation": "idle", "source": "local" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/{serviceId}/dnssec Update or check DNSSEC Operation ID: domainDnssecUpdate Enable managed signing or submit external public DNSKEY records, disable delegation without deleting signing keys, or refresh status. Enable/disable require acknowledgement and an Idempotency-Key. Refresh requires domains.read; changes require domains.write. HTTP 200 returns refresh state; HTTP 202 means enable/disable accepted, not completed: poll the same DNSSEC GET for operation and errorCode. operationId is a DNSSEC operation UUID, not a generic /v1/operations handle. queued/pending/running are ongoing; unconfirmed requires reconciliation; failed is not success. idle with the intended registrar status confirms registrar configuration only. delegationStatus=not_verified never proves parent-zone propagation. Do not repeat an unconfirmed change. Scopes: domains.read OR domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header Idempotency-Key (optional): Required for enable/disable: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse identical payloads; not required for refresh. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "anyOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "enable", "enum": [ "enable" ] }, "mode": { "type": "string", "const": "managed", "enum": [ "managed" ] }, "acknowledge": { "type": "boolean", "const": true, "enum": [ true ] } }, "required": [ "action", "mode", "acknowledge" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "enable", "enum": [ "enable" ] }, "mode": { "type": "string", "const": "external", "enum": [ "external" ] }, "acknowledge": { "type": "boolean", "const": true, "enum": [ true ] }, "keys": { "type": "array", "items": { "type": "object", "properties": { "flags": { "type": "number", "const": 257, "enum": [ 257 ] }, "protocol": { "type": "number", "const": 3, "enum": [ 3 ] }, "alg": { "type": "integer" }, "pub_key": { "type": "string", "minLength": 40, "maxLength": 4096, "pattern": "^[A-Za-z0-9+/]+={0,2}$" } }, "required": [ "flags", "protocol", "alg", "pub_key" ], "additionalProperties": false }, "minItems": 1, "maxItems": 4 } }, "required": [ "action", "mode", "acknowledge", "keys" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "disable", "enum": [ "disable" ] }, "acknowledge": { "type": "boolean", "const": true, "enum": [ true ] } }, "required": [ "action", "acknowledge" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "refresh", "enum": [ "refresh" ] } }, "required": [ "action" ], "additionalProperties": false } ] } ``` Response 200: Current DNSSEC state after refresh (domains.read). Response 202: Enable/disable accepted with domains.write; poll this domain’s DNSSEC GET, not the generic operation endpoint. Illustrative response: ```json { "ok": true, "domain": "example.com", "tld": "com", "support": "supported", "nameservers": [ "dns1.blazingfast.io", "dns2.blazingfast.io" ], "keys": [], "status": "not_configured", "delegationStatus": "not_verified", "dnsProvider": "managed", "canEnable": false, "canDisable": false, "enabled": false, "checkedAt": "2026-10-01T00:00:00.000Z", "operation": "queued", "operationId": "00000000-0000-4000-8000-000000000002", "requestedAction": "enable", "source": "local" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/history List DNS change history Operation ID: dnsHistory Owned-zone changes with DNS values and protection state. Stable cursor continuation; only this owner’s history is returned. Scopes: dns.read - path name (required): Zone or domain name. - query limit (optional): Maximum changes (default 10; 1–50). - query cursor (optional): nextCursor returned by the preceding response; scoped to this owner and zone. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS change history with nextCursor. Illustrative response: ```json { "ok": true, "items": [ { "id": "00000000-0000-4000-8000-000000000002", "action": "records.update", "status": "applied", "actorType": "userapi", "restoredFromId": null, "changes": [ { "name": "example.com.", "type": "A", "changetype": "REPLACE", "beforeTtl": 300, "afterTtl": 300, "beforeValues": [ "192.0.2.9" ], "afterValues": [ "192.0.2.10" ] } ], "protectionChanges": [], "beforeRecordCount": 3, "afterRecordCount": 3, "createdAt": "2026-10-01T00:00:00.000Z" } ], "nextCursor": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dns/zones/{name}/history/{changeId}/restore Restore DNS change Operation ID: dnsHistoryRestore Restores the state before the selected applied change, including protection and origin addresses. Requires acknowledgement, a stable retry key and current entitlements. A locked or ambiguous zone is not modified. Scopes: dns.write - path name (required): Zone or domain name. - path changeId (required): Owned DNS change UUID. - header Idempotency-Key (required): Stable retry key. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "acknowledge": { "type": "boolean", "const": true, "enum": [ true ] } }, "required": [ "acknowledge" ], "additionalProperties": false } ``` Response 200: Restored DNS/protection state or already-current result. Illustrative response: ```json { "ok": true, "appliedTo": "live_dns", "changeId": "00000000-0000-4000-8000-000000000001", "restoredFromId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/stats Read Website Protection statistics Operation ID: dnsStats Website Protection (WAF) traffic aggregates for your owned zone and subdomains, bounded to current ownership. This compatibility route does not report authoritative DNS query statistics. Requests, bytes, latency, cache-hit percentage, decisions, countries and automation categories. No individual visitor identities or raw logs. Missing collection is an error, not zero traffic. Scopes: dns.read - path name (required): Zone or domain name. - query range (optional): Window; defaults to 24h. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Owned-domain network aggregates. Requests are counts; bytes are bytes; latency is milliseconds. Illustrative response: ```json { "ok": true, "domain": "example.com", "range": "24h", "since": "2026-10-01T00:00:00.000Z", "until": "2026-11-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z", "lastEventAt": null, "coverage": "proxy_network", "coverageNote": "Proxy traffic only.", "summary": { "requests": 0, "bytes": 0, "averageResponseMs": 0, "cacheHitPercent": 0, "serverErrors": 0, "blocked": 0 }, "traffic": [], "countries": [], "automation": [], "statuses": [], "decisions": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/regions List regions Operation ID: regions Lists regions with VPS image choices or public orderable dedicated stock. Codes are lowercase; this does not reserve capacity. Scopes: billing.products.read - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Region list with next_offset. Illustrative response: ```json { "ok": true, "items": [ { "id": "nl", "name": "Netherlands" }, { "id": "pt", "name": "Portugal" } ], "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products List products Operation ID: products Flat public, active product variants with public, active parent products. type is the high-level normalized service family; product_code is the more specific purchasable product family. tcp-proxy maps to type=other, waf to type=dns, and license to type=other. Do not substitute product_code values into a type filter. id is the readable SKU; product_id and variant_id are order identifiers. Region and type eligibility are applied before pagination. CPU is vCPUs for VPS or sockets for dedicated; ram is MiB and disk is GiB. billing_cycles contains server-configured or converted period prices in the requested currency, exact decimal strings, unit/count and setup_fee. price prefers the monthly option. Account currency governs quotes and orders. configuration_url discovers required fields, defaults, compatible OS choices, connectivity and IP add-ons. Add-ons and tax are excluded from catalog prices: quote the complete cart before ordering. Domain pricing requires a live domain quote. available is not a reservation; capacity_verified=false for VPS. Dedicated available_stock is known compatible stock. A backend outage returns partial=true, unavailable_types and availability=unknown where possible; unknown stock is null, not zero. Image/stock snapshots are cached internally up to 15 seconds; checkout revalidates. Scopes: billing.products.read - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query product_code (optional): More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other. - query region (optional): Region code from GET /v1/regions, for example nl or pt. Case-insensitive. - query type (optional): High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code; applied before pagination. - query currency (optional): Configured pricing currency, default EUR. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Flat product list with next_offset. Illustrative response: ```json { "ok": true, "items": [ { "id": "8G", "product_id": "00000000-0000-4000-8000-000000000001", "variant_id": "00000000-0000-4000-8000-000000000002", "name": "Example VPS", "type": "vps", "product_code": "vps", "variant_code": "8G", "region": "nl", "regions": [ "nl" ], "cpu": 4, "cpu_unit": "vcpus", "ram": 8192, "ram_unit": "MiB", "disk": 100, "disk_unit": "GiB", "price": "12.00", "billing_cycle": "monthly", "billing_cycles": [ { "billing_cycle": "monthly", "unit": "MONTH", "count": 1, "period_months": 1, "price": "12.00", "setup_fee": "0", "currency": "EUR" }, { "billing_cycle": "quarterly", "unit": "QUARTAL", "count": 1, "period_months": 3, "price": "30.00", "setup_fee": "0", "currency": "EUR" } ], "currency": "EUR", "available": true, "capacity_verified": false, "configuration_code": null, "available_stock": null } ], "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region} List products in a region Operation ID: getProductsByRegion Flat public, active product variants with public, active parent products. type is the high-level normalized service family; product_code is the more specific purchasable product family. tcp-proxy maps to type=other, waf to type=dns, and license to type=other. Do not substitute product_code values into a type filter. id is the readable SKU; product_id and variant_id are order identifiers. Region and type eligibility are applied before pagination. CPU is vCPUs for VPS or sockets for dedicated; ram is MiB and disk is GiB. billing_cycles contains server-configured or converted period prices in the requested currency, exact decimal strings, unit/count and setup_fee. price prefers the monthly option. Account currency governs quotes and orders. configuration_url discovers required fields, defaults, compatible OS choices, connectivity and IP add-ons. Add-ons and tax are excluded from catalog prices: quote the complete cart before ordering. Domain pricing requires a live domain quote. available is not a reservation; capacity_verified=false for VPS. Dedicated available_stock is known compatible stock. A backend outage returns partial=true, unavailable_types and availability=unknown where possible; unknown stock is null, not zero. Image/stock snapshots are cached internally up to 15 seconds; checkout revalidates. Applies region restrictions on the server before pagination. A conflicting region query parameter is rejected. Scopes: billing.products.read - path region (required): Region code, for example nl or pt; all includes every eligible region. - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query product_code (optional): More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other. - query type (optional): High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code. - query currency (optional): Configured pricing currency, default EUR. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Region-filtered flat product list with next_offset. Illustrative response: ```json { "ok": true, "items": [ { "id": "8G", "product_id": "00000000-0000-4000-8000-000000000001", "variant_id": "00000000-0000-4000-8000-000000000002", "name": "Example VPS", "type": "vps", "product_code": "vps", "variant_code": "8G", "region": "nl", "regions": [ "nl" ], "cpu": 4, "cpu_unit": "vcpus", "ram": 8192, "ram_unit": "MiB", "disk": 100, "disk_unit": "GiB", "price": "12.00", "billing_cycle": "monthly", "billing_cycles": [ { "billing_cycle": "monthly", "unit": "MONTH", "count": 1, "period_months": 1, "price": "12.00", "setup_fee": "0", "currency": "EUR" }, { "billing_cycle": "quarterly", "unit": "QUARTAL", "count": 1, "period_months": 3, "price": "30.00", "setup_fee": "0", "currency": "EUR" } ], "currency": "EUR", "available": true, "capacity_verified": false, "configuration_code": null, "available_stock": null } ], "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region}/list List product codes by region Operation ID: productCodes Compact grouped public variant codes: products maps each family to an array of exact SKUs. Region eligibility is applied before pagination. limit counts variants across all families, not families; default 50. Follow next_offset until null and merge groups. Codes do not prove available stock; read the variant details and options. all includes all eligible regions; use a specific region for details and deployment. partial=true means collection is incomplete, not known zero stock. Existing flat catalog endpoints remain unchanged. Scopes: billing.products.read - path region (required): Region code or all. - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query currency (optional): Pricing currency; defaults to EUR. Quotes and orders use account currency. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Grouped family/SKU discovery with continuation. Illustrative response: ```json { "ok": true, "region": "nl", "products": { "vps": [ "8G" ] }, "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region}/list/{productCode} List variant codes for a family Operation ID: getProductsByRegionListByProductCode Same compact grouped response, restricted to the selected product family before pagination. An empty family array means no matching public plans on this page. Read detail availability separately; this does not reserve stock. Scopes: billing.products.read - path region (required): Eligible region, for example nl or pt. A single region is required. - path productCode (required): Product family. - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query currency (optional): Pricing currency; defaults to EUR. Quotes and orders use account currency. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Selected family and exact SKUs with continuation. Illustrative response: ```json { "ok": true, "region": "nl", "products": { "vps": [ "8G" ] }, "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region}/{productCode}/{variantCode} Read a product by public code Operation ID: getProduct Exact eligible region/family/SKU lookup. Returns safe hardware, public billing prices, availability, order UUIDs and links to prices/options/quote/deployment. Duplicate public SKUs in the family/region return catalog_variant_ambiguous (409); no plan is silently selected. Missing or hidden plans return 404. Provider outages may return unknown availability; they are never represented as known zero stock. This read is not a reservation. Scopes: billing.products.read - path region (required): Eligible region, for example nl or pt. A single region is required. - path productCode (required): Product family. - path variantCode (required): Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID. - query currency (optional): Pricing currency; defaults to EUR. Quotes and orders use account currency. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Exact public plan and discovery links. Illustrative response: ```json { "ok": true, "item": { "id": "8G", "product_id": "00000000-0000-4000-8000-000000000001", "variant_id": "00000000-0000-4000-8000-000000000002", "name": "Example VPS", "type": "vps", "product_code": "vps", "variant_code": "8G", "region": "nl", "regions": [ "nl" ], "cpu": 4, "cpu_unit": "vcpus", "ram": 8192, "ram_unit": "MiB", "disk": 100, "disk_unit": "GiB", "price": "12.00", "billing_cycle": "monthly", "billing_cycles": [ { "billing_cycle": "monthly", "unit": "MONTH", "count": 1, "period_months": 1, "price": "12.00", "setup_fee": "0", "currency": "EUR" }, { "billing_cycle": "quarterly", "unit": "QUARTAL", "count": 1, "period_months": 3, "price": "30.00", "setup_fee": "0", "currency": "EUR" } ], "currency": "EUR", "available": true, "capacity_verified": false, "configuration_code": null, "available_stock": null, "prices_url": "/v1/products/nl/vps/8G/prices", "options_url": "/v1/products/nl/vps/8G/options", "quote_url": "/v1/billing/orders/preview", "deploy_url": "/v1/deploy/nl/vps/8G" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region}/{productCode}/{variantCode}/prices Read billing prices by public code Operation ID: productPrices Base-plan prices only, as exact decimal strings with unit/count, setup_fee and currency. Optional billing_cycle filters configured periods; an unavailable period returns billing_cycle_not_available (400). An omitted period returns all public prices in the requested currency. Add-ons and tax require POST /v1/billing/orders/preview using the returned order UUIDs. Domain prices require a domain quote. price_scope=base_plan is not a final payable amount. Scopes: billing.products.read - path region (required): Eligible region, for example nl or pt. A single region is required. - path productCode (required): Product family. - path variantCode (required): Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID. - query currency (optional): Pricing currency; defaults to EUR. Quotes and orders use account currency. - query billing_cycle (optional): Optional billing period from the returned values. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Configured billing prices; never a fabricated price for a missing period. Illustrative response: ```json { "ok": true, "region": "nl", "product_code": "vps", "variant_code": "8G", "currency": "EUR", "prices": [ { "billing_cycle": "monthly", "unit": "MONTH", "count": 1, "period_months": 1, "price": "12.00", "setup_fee": "0", "currency": "EUR" }, { "billing_cycle": "quarterly", "unit": "QUARTAL", "count": 1, "period_months": 3, "price": "30.00", "setup_fee": "0", "currency": "EUR" } ], "price_scope": "base_plan", "pricing_mode": "configured", "quote_url": "/v1/billing/orders/preview" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/products/{region}/{productCode}/{variantCode}/options Read configuration options by public code Operation ID: productOptions Same authoritative configuration discovery as the UUID order-options endpoint, resolved by eligible region, family and exact SKU. Returns required inputs, defaults, compatible OS choices, owned SSH-key selection fields, connectivity options and IP/add-on limits. No private provider settings, inventory identities or credentials. Discovery does not reserve stock or pay. Scopes: billing.products.read - path region (required): Eligible region, for example nl or pt. A single region is required. - path productCode (required): Product family. - path variantCode (required): Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID. - query currency (optional): Pricing currency; defaults to EUR. Quotes and orders use account currency. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Validated public order options with exact order UUIDs. Illustrative response: ```json { "ok": true, "region": "nl", "product_code": "vps", "variant_code": "8G", "productId": "00000000-0000-4000-8000-000000000001", "variantId": "00000000-0000-4000-8000-000000000002", "supported": true, "capacityVerified": false, "requiredFields": [ { "field": "hostname", "label": "Hostname", "description": "Server hostname.", "format": "hostname" }, { "field": "location", "label": "Location", "description": "Location code." }, { "field": "os.code", "label": "Operating system", "description": "Operating system code." } ], "locations": [ { "code": "NL", "name": "Netherlands", "operatingSystems": [ { "code": "debian-13", "name": "Debian", "family": "debian", "version": "13", "arch": "amd64", "isDefault": true } ] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/my/services List my purchased services Operation ID: listMyServices Read-only alias of GET /v1/services with identical ownership, scope, filters and response contract. Defaults to active+suspended; terminated services require an explicit filter. Lifecycle status is separate from runtime power. Hostname and region are included when known; passwords are available only from separately scoped credential endpoints. Scopes: billing.services.read - query status (optional): Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate. - query type (optional): High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing. - query statuses (optional): Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state. - query types (optional): Comma-separated service types. Alias for type; do not supply both. - query search (optional): Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination. - query external_id (optional): Exact customer integration reference; applied before pagination. - query label (optional): Exact metadata label match: key=value. Applied before pagination. - query include_counts (optional): Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default. - query group_by (optional): Group the current page by type, retaining items and pagination. - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Filtered purchased service instances. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "status": "active", "displayName": "Example VPS", "hostname": "server.example.com", "type": "vps", "createdAt": "2026-10-01T00:00:00.000Z", "dueDate": "2026-11-01T00:00:00.000Z", "billingUnit": "MONTH", "billingCount": 1, "sku": "4G", "ipv4": "192.0.2.10", "ipv6": null, "meta": { "serviceType": "vps" } } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/images List VPS images Operation ID: vpsImages Returns VM-template OS codes and their region, family, version, architecture and default flag, without internal template references. Optional product_id and variant_id must be supplied together to restrict to a public VPS plan and its region. For full plan-specific configuration use the existing order-options endpoint. compatibility_verified=false means this is catalog discovery, not a physical capacity or placement guarantee. New VPS order configuration uses userConfig.os.code and uppercase userConfig.location. Scopes: billing.products.read - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query region (optional): Region code from GET /v1/regions, for example nl or pt. Case-insensitive. - query product_id (optional): Public product UUID; supply with variant_id. - query variant_id (optional): Public VPS variant UUID; supply with product_id. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: VPS OS images with next_offset. Illustrative response: ```json { "ok": true, "items": [ { "id": "debian-13", "name": "Debian", "family": "debian", "version": "13", "arch": "amd64", "is_default": true, "region": "nl" } ], "next_offset": null, "compatibility_verified": false } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/images List dedicated images Operation ID: dedicatedImages Returns compatible OS profile IDs for public dedicated configurations with available stock. Filter by region and configuration_code from the product catalog. An image ID can occur in several configurations; preserve its region/configuration context. Supply the numeric id as osProfileId when creating a dedicated deployment. Scopes: dedicated.read - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - query region (optional): Region code from GET /v1/regions, for example nl or pt. Case-insensitive. - query configuration_code (optional): Dedicated configuration code from GET /v1/products. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Compatible dedicated OS profiles with next_offset. Illustrative response: ```json { "ok": true, "items": [ { "id": 1, "name": "Debian 13", "region": "pt", "configuration_code": "EXAMPLE-PT", "ssh_keys_supported": true } ], "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/ssh-keys List my SSH keys Operation ID: getSshKeys Read-only alias of GET /v1/ssh/keys. Returns only keys owned by the authenticated account with names, fingerprints and public-key metadata; no private keys. Keeps the existing keys response contract (not a paginated catalog collection). Retrieve a selected public key through /v1/ssh/keys/{id}/public when required for provisioning. Scopes: ssh.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Owned SSH key metadata. Illustrative response: ```json { "ok": true, "keys": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/tcp-proxy/{serviceId} Read TCP Proxy configuration Operation ID: getTcpProxy Returns only customer configuration. Requires ownership or project service.view permission. tcpProxy is null for non-TCP services. Scopes: tcp_proxy.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: TCP Proxy configuration. Illustrative response: ```json { "tcpProxy": { "proxyIp": "192.0.2.20", "backendIp": "192.0.2.10", "ports": [ { "listen": 443, "backend": 443 } ], "includedPorts": 1, "additionalPorts": 0, "defaults": {}, "allowedSourceCidrs": [], "blockedSourceCidrs": [], "countryPolicy": { "mode": "disabled", "countries": [] }, "status": "active" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/tcp-proxy/{serviceId} Update TCP Proxy configuration Operation ID: tcpProxyUpdate Requires service.tcp-proxy.manage permission. Supply backendIp, ports, allowedSourceCidrs, blockedSourceCidrs or countryPolicy. Supplied arrays replace complete existing arrays; omitted fields remain unchanged. TCP country modes: disabled/allow/block. IPv4 only. Paid port entitlement is enforced. Send the same Idempotency-Key and body on retries; never retry an uncertain outcome with a new key. Scopes: tcp_proxy.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "backend_ip": { "type": "string" }, "ports": { "type": "array", "items": { "anyOf": [ { "type": "integer", "minimum": 1, "maximum": 65535 }, { "type": "object", "properties": { "listen": { "type": "integer", "minimum": 1, "maximum": 65535 }, "backend": { "type": "integer", "minimum": 1, "maximum": 65535 }, "backend_ip": { "type": "string" }, "proxy_protocol_v2": { "type": "boolean" }, "max_connections_per_ip": { "type": "integer", "minimum": 1, "maximum": 1000000 }, "max_new_connections_per_second_per_ip": { "type": "integer", "minimum": 1, "maximum": 1000000 }, "connection_burst": { "type": "integer", "minimum": 0, "maximum": 1000000 }, "max_packets_per_second_per_ip": { "type": "integer", "minimum": 1, "maximum": 10000000 }, "packet_burst": { "type": "integer", "minimum": 0, "maximum": 10000000 } }, "required": [ "listen" ], "additionalProperties": false } ] }, "minItems": 1, "maxItems": 512 }, "allowed_source_cidrs": { "type": "array", "items": { "type": "string" }, "maxItems": 256 }, "blocked_source_cidrs": { "type": "array", "items": { "type": "string" }, "maxItems": 256 }, "country_policy": { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "disabled", "allow", "block" ] }, "countries": { "type": "array", "items": { "type": "string", "pattern": "^[A-Z]{2}$" }, "maxItems": 256 } }, "required": [ "mode", "countries" ], "additionalProperties": false } }, "additionalProperties": false } ``` Response 200: Updated configuration; does not purchase extra ports. Illustrative response: ```json { "ok": true, "tcpProxy": { "proxyIp": "192.0.2.20", "backendIp": "192.0.2.10", "ports": [ { "listen": 443, "backend": 443 } ], "includedPorts": 1, "additionalPorts": 0, "defaults": {}, "allowedSourceCidrs": [], "blockedSourceCidrs": [], "countryPolicy": { "mode": "disabled", "countries": [] }, "status": "active" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/tcp-proxy/{serviceId}/stats Read TCP Proxy analytics Operation ID: tcpProxyStats Window/bucket byte totals, observed connection events and blocked packet counts. Not instantaneous throughput or open sockets. Scopes: tcp_proxy.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - query range (optional): Time window (default 24h). - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Time-window summary and bucketed analytics. Illustrative response: ```json { "ok": true, "proxyIp": "192.0.2.20", "range": "24h", "since": "2026-10-01T00:00:00.000Z", "until": "2026-10-02T00:00:00.000Z", "updatedAt": "2026-10-02T00:00:00.000Z", "lastEventAt": null, "retentionDays": 7, "summary": { "connections": 0, "bytesIn": 0, "bytesOut": 0, "limited": 0, "errors": 0, "averageDurationMs": 0, "blockedPackets": 0 }, "traffic": [], "blockedTraffic": [], "ports": [], "statuses": [], "blockedPorts": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/dns/waf/record/config Read Website Protection settings Operation ID: getServiceDnsWafConfig Read-only HTTPS/origin and custom-loader flags. Unknown settings are null; no raw provider configuration, private keys or scripts. Scopes: dns.read - path serviceId (required): Your DNS zone name (example.com) or an owned service UUID. A name selects the owned zone directly; a UUID also requires domain in the query/body. - query domain (optional): Owned DNS zone; required only with a UUID selector. Must match a domain-name selector when supplied. - query name (optional): A record name, e.g. @ or www.; default @. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Safe settings. Illustrative response: ```json { "ok": true, "settings": { "ssl_schema": null, "force_ssl": null, "ssl": null, "custom_loader": null } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/records/config Read Website Protection record settings Operation ID: dnsRecordConfig Read-only safe HTTPS/origin and custom-loader flags for an active, owned, proxied A record. No service UUID or domain registration is needed. Unknown flags are null; no raw provider configuration, scripts or keys are exposed. Scopes: dns.read - path name (required): Zone or domain name. - query name (optional): Record name, e.g. @ or www.; default @. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Safe Website Protection settings. Illustrative response: ```json { "ok": true, "domain": "example.com", "name": "www", "settings": { "ssl_schema": "https", "force_ssl": "1", "ssl": "ecc", "custom_loader": "0" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/country-policy Read website country policy Operation ID: getDnsCountryPolicy For an owned, active, proxied A record. Scopes: dns.read - path name (required): Zone or domain name. - query record (optional): Record name; default @. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Saved policy. Illustrative response: ```json { "ok": true, "hostname": "example.com", "policy": { "mode": "off", "countries": [], "unknown": "allow", "whitelist_bypass": true } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/dns/zones/{name}/country-policy Replace website country policy Operation ID: dnsCountryPolicySet Body: record and policy containing mode (off/allow/deny), countries (ISO alpha-2), optional unknown (allow/deny) and whitelist_bypass. Replacement can block visitors. Send an Idempotency-Key. Check saved and synchronized independently. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "record": { "type": "string", "minLength": 1, "maxLength": 253 }, "policy": { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "off", "allow", "deny" ] }, "countries": { "type": "array", "items": { "type": "string" }, "maxItems": 249, "default": [] }, "unknown": { "type": "string", "enum": [ "allow", "deny" ] }, "whitelist_bypass": { "type": "boolean", "default": false } }, "required": [ "mode" ], "additionalProperties": false } }, "required": [ "record", "policy" ], "additionalProperties": false, "description": "Use valid ISO alpha-2 country codes. allow/deny requires at least one country; off disables the policy." } ``` Response 200: Saved and synchronized policy. Illustrative response: ```json { "ok": true, "hostname": "example.com", "policy": { "mode": "off", "countries": [], "unknown": "allow", "whitelist_bypass": true }, "saved": true, "synchronized": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/records/protection Read DNS record protection Operation ID: getDnsRecordProtection Read saved mitigation state for an owned, active, proxied A record, including external origins. No hosting service ID required. Null protection/stateUnknown must not be interpreted as disabled. Scopes: dns.read - path name (required): Zone or domain name. - query name (optional): A record name; default @. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Mitigation state, proxy state, origin IPs and synchronization status. No internal provider configuration. Illustrative response: ```json { "ok": true, "fqdn": "example.com", "type": "A", "proxied": true, "protection": true, "originValues": [ "192.0.2.10" ], "ttl": 300, "stateUnknown": false, "pending": false, "lastSyncedAt": "2026-10-01T00:00:00.000Z" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dns/zones/{name}/records/protection Change DNS record protection Operation ID: dnsRecordProtectionSet Toggle mitigation only; preserves proxy routing, origin addresses, DNS values and TTL. Enabling requires an active entitlement or eligible origin IPs. Send an Idempotency-Key. MCP requests require dashboard approval. A failed/unconfirmed response may have changed provider state; never assume it did not execute. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "enabled": { "type": "boolean" } }, "required": [ "name", "enabled" ], "additionalProperties": false } ``` Response 200: Confirmed mitigation state and audit change ID, or stateUnknown on an unconfirmed update. Illustrative response: ```json { "ok": true, "fqdn": "example.com", "type": "A", "proxied": true, "protection": true, "stateUnknown": false, "changeId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/balance Check wallet balance Operation ID: billingBalance Returns current account credit and currency so billing dashboards or automation can decide whether balance payment is available. Scopes: billing.balance.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Current balance details. Illustrative response: ```json { "ok": true, "exists": true, "currency": "EUR", "credit": "100", "vcredit": "0" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/invoices Browse invoices Operation ID: listInvoices Returns paginated customer invoices. Use this to build invoice history views, overdue checks, or reconciliation jobs. Scopes: billing.invoices.read - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated invoice list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "number": "INV-EXAMPLE-000001", "status": "unpaid", "total": "100.00", "paidTotal": "0.00", "currency": "EUR", "type": "purchase", "refundedTotal": "0.00", "createdAt": "2026-10-01T00:00:00.000Z", "dueDate": "2026-11-01T00:00:00.000Z", "payDate": null, "order": null } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/invoices/unpaid-total Check unpaid total Operation ID: billingUnpaidTotal Returns the current unpaid amount across customer invoices. This is useful for dashboard badges and automation that should pause when debt exists. Scopes: billing.unpaid_total.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Current unpaid invoice summary. Illustrative response: ```json { "ok": true, "data": { "unpaidTotal": 0, "currency": "EUR" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/orders Browse orders Operation ID: billingOrders Returns paginated customer orders and supports filtering by order or payment status for reporting and customer portals. Scopes: billing.orders.read - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - query status (optional): Optional order status filter. - query paymentStatus (optional): Optional payment status filter. - query external_id (optional): Exact customer reference on an owned order item; applied before pagination. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated order list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "status": "pending", "currency": "EUR", "total": "100.00", "paymentStatus": "unpaid", "paymentMethod": null, "createdAt": "2026-10-01T00:00:00.000Z", "invoice": { "id": "00000000-0000-4000-8000-000000000001", "number": "INV-EXAMPLE-000001", "status": "unpaid", "total": "100.00", "paidTotal": "0.00", "currency": "EUR" } } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/services Browse billable services Operation ID: billingServices Returns the billing-facing service list. Use this endpoint when the main goal is commercial visibility rather than grouped customer dashboards. Scopes: billing.services.read - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated billing service list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "status": "active", "displayName": "Example VPS", "hostname": "server.example.com", "type": "vps", "createdAt": "2026-10-01T00:00:00.000Z", "dueDate": "2026-11-01T00:00:00.000Z", "billingUnit": "MONTH", "billingCount": 1, "sku": "4G", "ipv4": "192.0.2.10", "ipv6": null, "meta": { "serviceType": "vps" } } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/products Browse product catalog Operation ID: billingProducts Returns product catalog entries that can be used for storefront search, quoting, and pre-checkout selection flows. Scopes: billing.products.read - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - query category (optional): Optional category filter. - query q (optional): Optional free-text search query. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated product list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example VPS", "category": "vps", "variants": [ { "id": "00000000-0000-4000-8000-000000000002", "productId": "00000000-0000-4000-8000-000000000001", "sku": "4G", "serviceType": "vps", "attributes": { "compute": { "CPU": 2, "RAM": 4 }, "storage": { "DISK_SPACE": 40 } }, "addons": [], "billingOptions": [ { "unit": "MONTH", "count": 1, "currency": "EUR", "price": "100.00", "setupFee": "0.00" } ] } ] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/products/{productId}/variants/{variantId}/order-options Discover product order options Operation ID: billingProductOrderOptions Read-only complete configuration discovery for a public, active product and variant. Returns required and optional fields, conditional requirements, priced add-ons, billing options and eligible OS/regions. VPS uses userConfig.location and userConfig.os.code. Managed dedicated uses userConfig.dedicated.configurationCode, regionCode, osProfileId and hostname; optional sshKeyId must belong to your account. Includes physical/default connectivity, purchasable bandwidth add-ons, IPv4 limits and reservation TTL. supported=false means dashboard-only. No capacity is reserved; compatible catalog stock is not a reservation. Domain pricingMode=domain_quote requires a domain-specific quote. No infrastructure secrets are returned. Scopes: billing.products.read - path productId (required): Product UUID from the catalog. - path variantId (required): Variant UUID belonging to this product. - query region (optional): Region code from GET /v1/regions, for example nl or pt. Case-insensitive. - query currency (optional): Pricing currency, default EUR. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Product-specific location and OS options. A catalog outage returns an error, never fallback options. Illustrative response: ```json { "ok": true, "productId": "00000000-0000-4000-8000-000000000001", "variantId": "00000000-0000-4000-8000-000000000002", "supported": true, "capacityVerified": false, "requiredFields": [ { "field": "hostname", "label": "Hostname", "description": "Server hostname.", "format": "hostname" }, { "field": "location", "label": "Location", "description": "Location code." }, { "field": "os.code", "label": "Operating system", "description": "Operating system code." } ], "locations": [ { "code": "NL", "name": "Netherlands", "operatingSystems": [ { "code": "debian-13", "name": "Debian", "family": "debian", "version": "13", "arch": "amd64", "isDefault": true } ] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/billing/transactions Browse transactions Operation ID: billingTransactions Returns paginated financial transaction records for account history and payment auditing. Scopes: billing.transactions.read - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated transaction list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "createdAt": "2026-10-01T00:00:00.000Z", "status": "completed", "type": "payment", "currency": "EUR", "amountIn": "100.00", "amountOut": "0.00", "fee": "0.00", "gateway": null, "invoiceId": "00000000-0000-4000-8000-000000000002", "meta": null } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/billing/orders/preview Preview order total Operation ID: billingOrderPreview Submit the same complete cart as order creation, including userConfig and public add-on key/qty selections. Uses checkout validation and pricing, equivalent billing periods, account currency and tax. Requires complete billing details. Returns reserved=false: no reservation, order, invoice or payment is created. A quote does not guarantee later stock or prices. The older single-item preview body is accepted and normalized to the same cart. Scopes: billing.products.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "anyOf": [ { "type": "object", "properties": { "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 200 }, "currency": { "type": "string", "enum": [ "USD", "EUR", "UAH", "GBP", "PLN", "BRL", "INR", "IDR", "CNY" ] }, "items": { "type": "array", "items": { "type": "object", "properties": { "product_id": { "type": "string", "format": "uuid" }, "variant_id": { "type": "string", "format": "uuid" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 }, "user_config": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "attributes": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "billing": { "type": "object", "properties": { "unit": { "type": "string", "enum": [ "ONCE", "HOUR", "DAY", "WEEK", "MONTH", "QUARTAL", "SEMIANNUAL", "YEAR" ] }, "count": { "type": "integer", "minimum": 1, "maximum": 120 } }, "required": [ "unit", "count" ], "additionalProperties": false }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 } }, "required": [ "product_id", "variant_id", "qty", "billing" ], "additionalProperties": false }, "minItems": 1, "maxItems": 50 } }, "required": [ "currency", "items" ], "additionalProperties": false }, { "type": "object", "properties": { "product_id": { "type": "string", "format": "uuid" }, "variant_id": { "type": "string", "format": "uuid" }, "currency": { "type": "string", "maxLength": 3, "minLength": 3 }, "unit": { "type": "string", "minLength": 1, "maxLength": 20 }, "count": { "type": "integer", "minimum": 1, "maximum": 120 }, "quantity": { "type": "integer", "minimum": 1, "maximum": 100, "default": 1 }, "user_config": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 } }, "required": [ "product_id", "variant_id", "currency", "unit", "count" ], "additionalProperties": false } ], "example": { "currency": "EUR", "items": [ { "product_id": "00000000-0000-4000-8000-000000000001", "variant_id": "00000000-0000-4000-8000-000000000002", "qty": 1, "billing": { "unit": "MONTH", "count": 1 }, "user_config": { "hostname": "example", "location": "NL", "os": { "code": "debian-13" } }, "addons": [] } ] }, "description": "Illustrative VPS cart. Replace IDs, required user_config fields, billing period and add-ons with the selected public plan’s order-options. The server validates ownership, eligibility and prices; caller-supplied hardware/price cannot change the plan. Quotes require complete billing details and use account currency." } ``` Response 200: Order preview with calculated totals. Illustrative response: ```json { "ok": true, "currency": "EUR", "subtotal": "100.00", "tax": "0.00", "total": "100.00", "reserved": false, "breakdown": { "base_price": "100.00", "addons": "0.00", "setup_fee": "0.00", "tax": "0.00", "total": "100.00" }, "items": [ { "productId": "00000000-0000-4000-8000-000000000001", "variantId": "00000000-0000-4000-8000-000000000002", "productName": "Example VPS", "sku": "4G", "quantity": 1, "billing": { "unit": "MONTH", "count": 1 }, "unitPrice": "100", "setupFee": "0", "subtotal": "100", "addons": [] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/deploy/{region}/{productCode}/{variantCode}/quote Quote a configured product by code Operation ID: productVariantQuote Accepts exactly the same simple or legacy body as deployment. Uses authoritative account currency, configuration, tax and add-on prices. Returns a price breakdown and reserved=false; creates no order, invoice, reservation or payment. No Idempotency-Key required. The quote object adds an opaque diagnostic id, guaranteed=false, currency, final total, breakdown, pricing_revision and recommended_max_total. Pass recommended_max_total as max_total to deployment. The revision fingerprints this priced cart; it is not a price lock, reservation or redeemable quote. A quote is optional and is not a stock or price guarantee. Scopes: billing.products.read - path region (required): Eligible region, for example nl or pt. A single region is required. - path productCode (required): Product family. - path variantCode (required): Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "anyOf": [ { "type": "object", "properties": { "billing": { "type": "object", "properties": { "unit": { "type": "string", "enum": [ "ONCE", "HOUR", "DAY", "WEEK", "MONTH", "QUARTAL", "SEMIANNUAL", "YEAR" ] }, "count": { "type": "integer", "minimum": 1, "maximum": 120 } }, "required": [ "unit", "count" ], "additionalProperties": false }, "userConfig": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 }, "maxTotal": { "type": "string", "pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$" } }, "required": [ "billing" ], "additionalProperties": false, "deprecated": true, "description": "Deprecated compatibility deployment shape. Prefer the canonical snake_case payload; no sunset date has been assigned." }, { "type": "object", "properties": { "billing_cycle": { "type": "string", "enum": [ "monthly", "quarterly", "semi_annually", "annually", "biennially", "triennially", "hourly", "daily", "weekly", "one_time" ], "default": "monthly" }, "hostname": { "type": "string", "maxLength": 253, "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$" }, "os": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 160 }, { "type": "integer", "exclusiveMinimum": 0 } ] }, "ssh_key_id": { "type": "string", "format": "uuid" }, "connectivity_gbps": { "type": "number", "exclusiveMinimum": 0, "maximum": 100 }, "additional_ips": { "type": "integer", "minimum": 0, "maximum": 100 }, "backend_ip": { "type": "string" }, "ports": { "type": "array", "items": { "type": "object", "properties": { "listen": { "type": "integer", "minimum": 1, "maximum": 65535 }, "backend": { "type": "integer", "minimum": 1, "maximum": 65535 } }, "required": [ "listen", "backend" ], "additionalProperties": false }, "minItems": 1, "maxItems": 100 }, "domain": { "type": "string", "minLength": 1, "maxLength": 253 }, "license_ip": { "type": "string" }, "parent_service_id": { "type": "string", "format": "uuid" }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 }, "max_total": { "type": "string", "pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$" }, "external_id": { "type": "string", "minLength": 1, "maxLength": 120 }, "labels": { "type": "object", "additionalProperties": { "type": "string", "maxLength": 120 } } }, "additionalProperties": false } ], "example": { "billing_cycle": "monthly", "hostname": "test", "os": "debian-13", "max_total": "25.00" }, "description": "Simple fields: billing_cycle, hostname, os, owned ssh_key_id, dedicated connectivity_gbps/additional_ips, TCP backend_ip/ports, external_id/labels, max_total. Use discovered choices; dedicated OS accepts its exact code or numeric ID. Path fixes region. Legacy billing/userConfig/addons/maxTotal remains accepted; never mix both shapes. Ceilings include tax/setup/add-ons in account currency." } ``` Response 200: Validated price, breakdown and selected line items. Illustrative response: ```json { "ok": true, "currency": "EUR", "subtotal": "12.00", "tax": "0.00", "total": "12.00", "reserved": false, "breakdown": { "base_price": "12.00", "addons": "0.00", "setup_fee": "0.00", "tax": "0.00", "total": "12.00" }, "items": [ { "productId": "00000000-0000-4000-8000-000000000001", "variantId": "00000000-0000-4000-8000-000000000002", "productName": "Example VPS", "sku": "2G", "quantity": 1, "billing": { "unit": "MONTH", "count": 1 }, "unitPrice": "12", "setupFee": "0", "subtotal": "12", "addons": [] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/operations Recover an operation by idempotency key Operation ID: recoverOperation Lookup is confined to the authenticated account and permitted operation kinds. Keys are scoped to the original credential, HTTP method and exact path. Supply method/path together and optionally credential_id to disambiguate a key reused across endpoints or credentials (409 operation_lookup_ambiguous). Only new tracked deployment/VPS/dedicated writes with a retained identity are recoverable. 404 operation_not_found does not prove the write never executed. Identities remain after terminal receipt retention (90 days by default); 410 operation_expired means the original receipt is no longer available. Pending/unknown receipts are retained for reconciliation. Never generate a new key to repeat an uncertain write. Scopes: billing.services.read OR vps.read OR dedicated.read - query idempotency_key (required): Original Idempotency-Key; 8–128 letters, digits, dot, underscore, colon or dash. - query method (optional): Original HTTP method; supply with path. - query path (optional): Exact original /v1/ path without query string; supply with method. - query credential_id (optional): Original credential UUID, when needed for disambiguation. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Original operation receipt; owner and read scopes are checked. Illustrative response: ```json { "ok": true, "operation": { "id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "kind": "vps", "action": "reboot", "status": "succeeded", "done": true, "progress": 100, "stage": null, "created_at": "2026-10-01T00:00:00.000Z", "updated_at": "2026-10-01T00:00:00.000Z", "service_ids": [ "00000000-0000-4000-8000-000000000001" ], "error": null, "result": { "service_id": "00000000-0000-4000-8000-000000000001" } }, "links": { "operation": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "service": "/v1/services/00000000-0000-4000-8000-000000000001" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/operations/{operationId} Read operation status Operation ID: getOperation Poll the opaque operation_id returned by supported wallet deployments and VPS/dedicated actions. Owner checks and the underlying read scope are enforced on every read. When durable_operations is enabled, new handles are stored independently of encryption keys and the first observed terminal outcome is immutable. Terminal receipts retain 90 days by default; pending/unknown receipts remain for reconciliation. Legacy encrypted handles remain readable but can be invalidated by encryption-key rotation. Deployment readiness respects historical activation; a service error alone is not proof of permanent provisioning failure. The canonical operation has status, done, progress, stage and optional typed result. Result is populated only on succeeded; failed/cancelled are terminal, unknown is nonterminal and is not success. Tracked writes accept x-bf-response-format: operation; the default response preserves legacy fields. DNSSEC and other untracked workflows retain their documented polling contracts. Client wait timeout never repeats/cancels a purchase. Scopes: billing.services.read OR vps.read OR dedicated.read - path operationId (required): Opaque op_ token from the accepted response. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Unified status, safe progress and service IDs. Illustrative response: ```json { "ok": true, "operation": { "id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "kind": "vps", "action": "reboot", "status": "succeeded", "done": true, "progress": 100, "stage": null, "created_at": "2026-10-01T00:00:00.000Z", "updated_at": "2026-10-01T00:00:00.000Z", "service_ids": [ "00000000-0000-4000-8000-000000000001" ], "error": null } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/services/{serviceId}/metadata Replace customer integration metadata Operation ID: serviceMetadataUpdate Replaces only this owned service’s external_id and labels; omitted fields are cleared. Does not change hardware, price, credentials or lifecycle. Up to 20 bounded labels. Do not store secrets in labels. Searches use external_id or label=key=value. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "external_id": { "type": "string", "minLength": 1, "maxLength": 120 }, "labels": { "type": "object", "additionalProperties": { "type": "string", "maxLength": 120 } } }, "additionalProperties": false } ``` Response 200: Saved customer reference and labels. Illustrative response: ```json { "ok": true, "service_id": "00000000-0000-4000-8000-000000000001", "external_id": "example-vps-1", "labels": { "environment": "test" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/webhooks List webhook endpoints Operation ID: listWebhooks Owned endpoints without signing secrets. Maximum five per account; feature must be enabled for this environment. Scopes: webhooks.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Owned webhook endpoints. Illustrative response: ```json { "ok": true, "items": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/webhooks Register a signed webhook Operation ID: webhookCreate HTTPS port 443, public IPv4 destinations only. Verified TLS, pinned DNS, no redirects. Events: invoice.paid, service.ready, service.suspended, service.terminated and operation.failed (Billing provisioning-job failures, not all power/reinstall failures). No historical backfill. Sensitive signing_secret is returned on creation or identical retry while the endpoint exists: never log it or send it to AI. At-least-once delivery: verify raw-body HMAC and timestamp, deduplicate event IDs, return 2xx promptly. Off by default until migration and worker deployment. Scopes: webhooks.write - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "url": { "type": "string", "format": "uri", "maxLength": 2048 }, "events": { "type": "array", "items": { "type": "string", "enum": [ "invoice.paid", "service.ready", "service.suspended", "service.terminated", "operation.failed", "operation.succeeded", "operation.cancelled", "invoice.created", "invoice.overdue", "service.provisioning", "service.expiring", "operation.started", "backup.started", "backup.completed", "backup.failed", "snapshot.created", "snapshot.failed", "dns.changed", "service.power_changed", "domain.verification_required", "domain.renewal_pending", "domain.renewed", "domain.transfer_updated" ] }, "minItems": 1, "maxItems": 23 } }, "required": [ "url", "events" ], "additionalProperties": false } ``` Response 201: New endpoint and private signing secret. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "url": "https://example.com/hooks", "events": [ "invoice.paid" ], "enabled": true, "createdAt": "2026-10-01T00:00:00.000Z" }, "signing_secret": "whsec_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/version Read API contract revision Operation ID: apiVersion Authenticated discovery. release is a configured public release label or null, not an internal image or provider identifier. A contract revision is not proof of product availability. Scopes: - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: API version and contract revision. Illustrative response: ```json { "ok": true, "api_version": "1", "contract_revision": "2026-10-07.1", "release": null, "deployment": null, "released_at": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/capabilities Discover capabilities and effective permissions Operation ID: apiCapabilities Distinguishes implemented support, environment enabled state and effective key permissions. enabled=null and availability=unconfirmed mean the backend could not confirm a gate, not that it is disabled. partial=true indicates incomplete discovery. Does not guarantee region inventory, provider health or order approval. Networking and generic metrics are reported not_implemented until supported. Scopes: - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Capability gates and key permissions. Illustrative response: ```json { "ok": true, "contract_revision": "2026-10-07.1", "dependency_revision": null, "partial": true, "features": { "webhooks": { "implemented": true, "enabled": null, "permitted": true, "availability": "unconfirmed" }, "private_networks": { "implemented": false, "enabled": false, "permitted": false, "availability": "not_implemented" } } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/audit/events Read account audit history Operation ID: auditEvents Default view=requests preserves request history. view=activity merges durable API/MCP actions and Billing business events with actor/action/resource/status filters. Activity partial=true means a history source was unavailable; available_sources lists confirmed sources. Reuse opaque cursors with the same filters; ownership is always enforced. Acceptance is not provider completion. No passwords, tokens, private keys or webhook secrets. Activity source_ip follows the existing privacy masking policy. Scopes: audit.read - query limit (optional): Maximum items, default 50 (1–100). - query view (optional): History view. - query cursor (optional): Reuse next_cursor exactly with the same owner and filters. - query method (optional): HTTP method; request view only. - query actor_type (optional): Verified actor category. - query actor_id (optional): Exact verified actor UUID. - query action (optional): Semantic action, for example vps.reinstall. - query resource_type (optional): Resource category. - query resource_id (optional): Exact resource identity. - query status (optional): Action phase. - query request_id (optional): Exact request UUID. - query from (optional): Inclusive ISO 8601 timestamp. - query to (optional): Inclusive ISO 8601 timestamp. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Filtered history and next_cursor. Illustrative response: ```json { "ok": true, "next_cursor": null, "items": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/webhooks/{id}/test Queue a signed webhook test Operation ID: webhookTest Queues a synthetic webhook.test event through the normal delivery worker. HTTP 202 means queued, not delivered. Read delivery history to check the result. Enabled owned endpoints only; one new test per endpoint per minute. Idempotency-Key is required; identical retries return the same delivery. Empty request body. Requires webhook_management capability. Scopes: webhooks.write - path id (required): Owned endpoint UUID. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (optional) ```json { "type": "object", "properties": {}, "additionalProperties": false } ``` Response 202: Test event and delivery IDs. Illustrative response: ```json { "ok": true, "endpoint_id": "00000000-0000-4000-8000-000000000001", "delivery_id": "00000000-0000-4000-8000-000000000002", "event_id": "00000000-0000-4000-8000-000000000002", "status": "pending" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/webhooks/{id}/rotate-secret Rotate webhook signing secret Operation ID: webhookRotateSecret Replaces the signing secret for an owned endpoint immediately. An already in-flight delivery may still use the old secret; accept both briefly at your receiver. Idempotency-Key is required. Identical retries return the same secret for 24 hours unless a subsequent rotation superseded it; superseded or expired keys never rotate again. Sensitive signing_secret: never log or send it to AI. Empty request body. Requires webhook_management capability. Scopes: webhooks.write - path id (required): Owned endpoint UUID. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (optional) ```json { "type": "object", "properties": {}, "additionalProperties": false } ``` Response 200: New private signing secret. Illustrative response: ```json { "ok": true, "endpoint_id": "00000000-0000-4000-8000-000000000001", "signing_secret": "whsec_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "rotated_at": "2026-10-01T00:00:00.000Z" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/webhooks/{id} Enable or pause webhook deliveries Operation ID: webhookUpdate Pauses new and queued deliveries; an in-flight attempt may finish. Re-enable resumes pending deliveries. Scopes: webhooks.write - path id (required): Owned endpoint UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ], "additionalProperties": false } ``` Response 200: Updated endpoint. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "url": "https://example.com/hooks", "events": [ "invoice.paid" ], "enabled": false, "createdAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/webhooks/{id} Delete a webhook endpoint Operation ID: webhookDelete Deletes the endpoint and its delivery history. An in-flight attempt may finish. Use a new retry key for an intentional replacement. Scopes: webhooks.write - path id (required): Owned endpoint UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Endpoint deleted. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/webhooks/{id}/deliveries Read webhook delivery history Operation ID: webhookDeliveries Owned delivery results, no response bodies or signing secrets. Delivered records retain 30 days, failed records 90 days. Paused pending events remain until deletion. Up to 12 attempts with exponential backoff capped at six hours. Scopes: webhooks.read - path id (required): Owned endpoint UUID. - query limit (optional): Maximum items, default 50 (1–100). - query offset (optional): Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Delivery attempts and next_offset. Illustrative response: ```json { "ok": true, "items": [], "next_offset": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/webhooks/{id}/deliveries/{deliveryId}/retry Retry an exhausted delivery Operation ID: webhookRetry Only failed deliveries on your enabled endpoint can be retried. Pending/leased/successful events cannot be replayed; repeating this request returns delivery_not_retryable. Event ID is preserved. Scopes: webhooks.write - path id (required): Owned endpoint UUID. - path deliveryId (required): Failed delivery UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (optional) ```json { "type": "object", "properties": {}, "additionalProperties": false } ``` Response 200: Delivery requeued. Illustrative response: ```json { "ok": true, "delivery_id": "00000000-0000-4000-8000-000000000002", "status": "pending" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/deploy/{region}/{productCode}/{variantCode} Deploy product variant from wallet Operation ID: productVariantDeploy One call validates a public VPS, managed dedicated, TCP proxy, Website Protection or software-license variant, creates its order/invoice, charges the full final order amount to the account balance and queues normal provisioning. Insufficient funds returns HTTP 402 insufficient_credit with no committed order/payment. Uses account billing currency and authoritative prices including tax, setup and add-ons. max_total is an optional decimal-string spending ceiling in that currency. Requires both scopes. Idempotency-Key is required; reuse identical arguments after interruption. Never charges a card or tops up the wallet. Acceptance is not a ready server: inspect returned serviceIds. Dedicated admin approvals, inventory and license rollout gates still apply. Domains/free products are not supported by this convenience endpoint; legacy unpaid checkout/payment remain unchanged. Scopes: billing.order.create + billing.invoice.pay - path region (required): Region code, for example nl or pt. - path productCode (required): Catalog product_code: vps, dedicated, tcp-proxy, waf or license. - path variantCode (required): Exact public catalog variant_code/SKU, for example 2G or PTV4-1. - header Idempotency-Key (required): Stable retry key, 8–128 characters. Never replace it after an uncertain response. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "anyOf": [ { "type": "object", "properties": { "billing": { "type": "object", "properties": { "unit": { "type": "string", "enum": [ "ONCE", "HOUR", "DAY", "WEEK", "MONTH", "QUARTAL", "SEMIANNUAL", "YEAR" ] }, "count": { "type": "integer", "minimum": 1, "maximum": 120 } }, "required": [ "unit", "count" ], "additionalProperties": false }, "userConfig": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 }, "maxTotal": { "type": "string", "pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$" } }, "required": [ "billing" ], "additionalProperties": false, "deprecated": true, "description": "Deprecated compatibility deployment shape. Prefer the canonical snake_case payload; no sunset date has been assigned." }, { "type": "object", "properties": { "billing_cycle": { "type": "string", "enum": [ "monthly", "quarterly", "semi_annually", "annually", "biennially", "triennially", "hourly", "daily", "weekly", "one_time" ], "default": "monthly" }, "hostname": { "type": "string", "maxLength": 253, "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$" }, "os": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 160 }, { "type": "integer", "exclusiveMinimum": 0 } ] }, "ssh_key_id": { "type": "string", "format": "uuid" }, "connectivity_gbps": { "type": "number", "exclusiveMinimum": 0, "maximum": 100 }, "additional_ips": { "type": "integer", "minimum": 0, "maximum": 100 }, "backend_ip": { "type": "string" }, "ports": { "type": "array", "items": { "type": "object", "properties": { "listen": { "type": "integer", "minimum": 1, "maximum": 65535 }, "backend": { "type": "integer", "minimum": 1, "maximum": 65535 } }, "required": [ "listen", "backend" ], "additionalProperties": false }, "minItems": 1, "maxItems": 100 }, "domain": { "type": "string", "minLength": 1, "maxLength": 253 }, "license_ip": { "type": "string" }, "parent_service_id": { "type": "string", "format": "uuid" }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 }, "max_total": { "type": "string", "pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$" }, "external_id": { "type": "string", "minLength": 1, "maxLength": 120 }, "labels": { "type": "object", "additionalProperties": { "type": "string", "maxLength": 120 } } }, "additionalProperties": false } ], "example": { "billing_cycle": "monthly", "hostname": "test", "os": "debian-13", "max_total": "25.00" }, "description": "Simple fields: billing_cycle, hostname, os, owned ssh_key_id, dedicated connectivity_gbps/additional_ips, TCP backend_ip/ports, external_id/labels, max_total. Use discovered choices; dedicated OS accepts its exact code or numeric ID. Path fixes region. Legacy billing/userConfig/addons/maxTotal remains accepted; never mix both shapes. Ceilings include tax/setup/add-ons in account currency." } ``` Response 200: Fully paid order with asynchronous provisioning queued. Illustrative response: ```json { "ok": true, "orderId": "00000000-0000-4000-8000-000000000001", "invoiceId": "00000000-0000-4000-8000-000000000002", "invoiceNumber": "INV-EXAMPLE-000001", "total": "100.00", "currency": "EUR", "status": "paid", "paidNow": "100.00", "fullyPaid": true, "serviceIds": [ "00000000-0000-4000-8000-000000000003" ], "provisioning": "queued", "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/billing/orders/draft Start draft order Operation ID: billingOrderDraft Creates a draft order from one or more items so you can continue into invoice creation and payment. Scopes: billing.order.create - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 200 }, "currency": { "type": "string", "enum": [ "USD", "EUR", "UAH", "GBP", "PLN", "BRL", "INR", "IDR", "CNY" ] }, "items": { "type": "array", "items": { "type": "object", "properties": { "product_id": { "type": "string", "format": "uuid" }, "variant_id": { "type": "string", "format": "uuid" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 }, "user_config": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "attributes": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "description": "JSON value; product-specific fields are discovered through order-options." } }, { "type": "object", "additionalProperties": { "description": "JSON value; product-specific fields are discovered through order-options." } } ] }, "billing": { "type": "object", "properties": { "unit": { "type": "string", "enum": [ "ONCE", "HOUR", "DAY", "WEEK", "MONTH", "QUARTAL", "SEMIANNUAL", "YEAR" ] }, "count": { "type": "integer", "minimum": 1, "maximum": 120 } }, "required": [ "unit", "count" ], "additionalProperties": false }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 } }, "required": [ "product_id", "variant_id", "qty", "billing" ], "additionalProperties": false }, "minItems": 1, "maxItems": 50 } }, "required": [ "currency", "items" ], "additionalProperties": false, "example": { "currency": "EUR", "items": [ { "product_id": "00000000-0000-4000-8000-000000000001", "variant_id": "00000000-0000-4000-8000-000000000002", "qty": 1, "billing": { "unit": "MONTH", "count": 1 }, "user_config": { "hostname": "example", "location": "NL", "os": { "code": "debian-13" } }, "addons": [] } ] }, "description": "Illustrative VPS cart. Replace IDs, required user_config fields, billing period and add-ons with the selected public plan’s order-options. The server validates ownership, eligibility and prices; caller-supplied hardware/price cannot change the plan. Quotes require complete billing details and use account currency." } ``` Response 200: Created draft order and related billing payload. Illustrative response: ```json { "ok": true, "orderId": "00000000-0000-4000-8000-000000000001", "invoiceId": "00000000-0000-4000-8000-000000000002", "invoiceNumber": "INV-EXAMPLE-000001", "total": "100.00", "currency": "EUR", "status": "unpaid" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/billing/invoices/{id}/pay Pay invoice from wallet Operation ID: payInvoice Attempts to settle the target invoice using account balance. This is the customer API path for balance-driven payment automation. Scopes: billing.invoice.pay - path id (required): Invoice UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Invoice payment result. Illustrative response: ```json { "ok": true, "paidNow": "100", "partial": false, "fullyPaid": true, "invoiceId": "00000000-0000-4000-8000-000000000001", "orderId": null, "status": "paid", "meta": { "createdServices": 0, "renewedServices": 1, "createdServiceIds": [], "provisioning": null } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services Browse services Operation ID: listServices Returns customer service summaries with hostname and recorded region code. Region uses provider/migration metadata, falling back to original order location; use VPS status for the currently assigned region. Null means unavailable. Does not disclose internal node or cluster identifiers. Ownership, status, type, search, external_id and label filters are applied server-side before pagination and counts. The default is active plus suspended; historical states require an explicit status filter. group_by=type groups only the current page, not the complete inventory. Scopes: billing.services.read - query status (optional): Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate. - query type (optional): High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing. - query statuses (optional): Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state. - query types (optional): Comma-separated service types. Alias for type; do not supply both. - query search (optional): Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination. - query external_id (optional): Exact customer integration reference; applied before pagination. - query label (optional): Exact metadata label match: key=value. Applied before pagination. - query include_counts (optional): Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default. - query group_by (optional): Group the current page by type, retaining items and pagination. - query page (optional): Page number for pagination. - query limit (optional): Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. - query page_size (optional, deprecated): Deprecated compatibility alias for limit; values must match when supplied together. - query pageSize (optional, deprecated): Deprecated compatibility alias for limit; range 1–100, default 50. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Paginated service list. Illustrative response: ```json { "ok": true, "page": 1, "pageSize": 50, "total": 1, "pages": 1, "items": [ { "id": "00000000-0000-4000-8000-000000000001", "status": "active", "displayName": "Example VPS", "hostname": "server.example.com", "type": "vps", "createdAt": "2026-10-01T00:00:00.000Z", "dueDate": "2026-11-01T00:00:00.000Z", "billingUnit": "MONTH", "billingCount": 1, "sku": "4G", "ipv4": "192.0.2.10", "ipv6": null, "meta": { "serviceType": "vps" } } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/grouped Browse services by type Operation ID: listServicesGrouped Returns the complete filtered customer-safe inventory grouped by type, without pagination. Intended for dashboard inventory. This is a legacy compatibility endpoint. Its default is active only, retained for backward compatibility; automation and MCP clients should pass status explicitly and prefer /v1/services?statuses=active,suspended&group_by=type for relevant lifecycle states. status=suspended or status=all explicitly includes other states. This differs from GET /v1/services?group_by=type, which groups only its current paginated result set. This endpoint supports status and type filters; use /v1/services for search and integration-metadata filters. Scopes: billing.services.read - query status (optional): Legacy default active; pass this explicitly. Filter by service status. Use all to disable status filtering. - query type (optional): Optional comma-separated list of service types to keep in the grouped response. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Grouped service list. Illustrative response: ```json { "ok": true, "status": "active", "type": null, "services": { "dns": [], "vps": [], "dedicated": [], "webhosting": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId} Open service detail Operation ID: getService Returns the customer-facing detail view for one service. Scopes: billing.services.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Detailed service record. Illustrative response: ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000001", "status": "active", "displayName": "Example VPS", "hostname": "server.example.com", "type": "vps", "createdAt": "2026-10-01T00:00:00.000Z", "dueDate": "2026-11-01T00:00:00.000Z", "billingUnit": "MONTH", "billingCount": 1, "sku": "4G", "ipv4": "192.0.2.10", "ipv6": null, "meta": { "serviceType": "vps" } } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/services/{serviceId}/autopay Toggle wallet autopay Operation ID: serviceAutopay Enables or disables autopay for a supported service so future renewal invoices can be handled automatically when policy allows it. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ], "additionalProperties": false } ``` Response 200: Updated autopay state. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "autopayEnabled": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/renewal/options Review renewal options Operation ID: serviceRenewalOptions Returns valid renewal units or counts for the target service before you create a renewal checkout. Scopes: billing.services.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available renewal options. Illustrative response: ```json { "ok": true, "currency": "EUR", "current": { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly", "recurringUnitPrice": "100.00" }, "options": [ { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly", "price": "100.00" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/renewal Renew and pay using the current billing cycle Operation ID: serviceRenewal Renews the existing plan and billing cycle from account balance in one call. Reuses an eligible unpaid renewal invoice or creates one; never pays a purchase, upgrade, changed-cycle or mixed-service invoice. Full payment only: insufficient credit or max_total violation rolls back new invoices and any debit. Idempotency-Key is required: reuse the same key and exact body after an interrupted response. The financial receipt is durable. Optional max_total caps the outstanding amount in invoice/account currency; it is not a supplied price. Domain renewals can return renewal_pending=true: paid_through remains the last confirmed date until provider processing completes. Manual suspensions are not cleared by this request. Scopes: billing.services.write + billing.invoice.pay - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (required): Unique renewal attempt key, 8–128 letters, digits or . _ : -. Reuse it on retries; a new key authorizes another cycle. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (optional) ```json { "type": "object", "properties": { "max_total": { "type": "string", "pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$" } }, "additionalProperties": false } ``` Response 200: Paid renewal receipt, or paid pending provider confirmation. Illustrative response: ```json { "ok": true, "service_id": "00000000-0000-4000-8000-000000000001", "invoice_id": "00000000-0000-4000-8000-000000000002", "invoice_number": "INV-EXAMPLE-001", "status": "paid", "invoice_status": "paid", "paid_now": "10.00", "currency": "EUR", "billing": { "unit": "MONTH", "count": 1 }, "paid_through": "2026-11-01T00:00:00.000Z", "renewal_pending": false } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/renewal/checkout Start renewal checkout Operation ID: serviceRenewalCheckout Creates a renewal billing flow for the selected service and renewal period. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "unit": { "type": "string", "minLength": 1 }, "count": { "type": "integer", "minimum": 1 } }, "required": [ "unit", "count" ], "additionalProperties": false } ``` Response 200: Renewal checkout result. Illustrative response: ```json { "ok": true, "orderId": null, "invoiceId": "00000000-0000-4000-8000-000000000002", "invoiceNumber": "INV-EXAMPLE-000001", "total": "100.00", "currency": "EUR", "status": "unpaid" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/upgrade/options Review upgrade options Operation ID: serviceUpgradeOptions Returns supported upgrade choices for the selected service. Scopes: billing.services.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available upgrade options. Illustrative response: ```json { "ok": true, "extraDiskGB": 0, "keepExtraDisk": false, "service": { "category": "vps", "isCpanel": false }, "current": { "variantId": "00000000-0000-4000-8000-000000000001", "sku": "4G", "dims": { "cpu": 2, "ram": 4, "disk": 40 } }, "currency": "EUR", "billing": { "unit": "MONTH", "count": 1 }, "proration": { "multiplier": 1, "fraction": 1, "periodStart": "2026-10-01T00:00:00.000Z", "periodEnd": "2026-11-01T00:00:00.000Z" }, "options": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/upgrade/checkout Start upgrade checkout Operation ID: serviceUpgradeCheckout Creates or applies an upgrade flow for the selected service and variant. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "variant_id": { "type": "string", "format": "uuid" } }, "required": [ "variant_id" ], "additionalProperties": false } ``` Response 200: Upgrade checkout result. Illustrative response: ```json { "ok": true, "orderId": "00000000-0000-4000-8000-000000000001", "invoiceId": "00000000-0000-4000-8000-000000000002", "invoiceNumber": "INV-EXAMPLE-000001", "total": "100.00", "currency": "EUR", "status": "unpaid" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/billing/options Review billing options Operation ID: serviceBillingOptions Returns the current billing-cycle choices exposed for the selected service. Scopes: billing.services.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available billing options. Illustrative response: ```json { "ok": true, "currency": "EUR", "current": { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly" }, "options": [ { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly", "price": "100.00" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/billing/change/options Review billing-cycle options Operation ID: serviceBillingChangeOptions Returns the proration-aware billing-cycle change choices for a service before checkout. Scopes: billing.services.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available billing-cycle change options. Illustrative response: ```json { "ok": true, "currency": "EUR", "current": { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly", "recurringUnitPrice": "100.00" }, "proration": { "fraction": 1, "periodStart": "2026-10-01T00:00:00.000Z", "periodEnd": "2026-11-01T00:00:00.000Z" }, "options": [ { "unit": "MONTH", "count": 1, "value": "MONTH:1", "label": "Monthly", "targetRecurringUnitPrice": "100.00", "credit": "100.00", "payNow": "0.00" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/billing/change/checkout Start billing-cycle change Operation ID: serviceBillingChangeCheckout Creates a prorated checkout when a customer changes the service billing cycle. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "unit": { "type": "string", "minLength": 1 }, "count": { "type": "integer", "minimum": 1 } }, "required": [ "unit", "count" ], "additionalProperties": false } ``` Response 200: Billing-cycle change checkout result. Illustrative response: ```json { "ok": true, "applied": true, "payNow": "0.00", "currency": "EUR" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/cancel Request service cancellation Operation ID: serviceCancel Convenience alias for service termination. Use this when the customer intent is straightforward cancellation. Scopes: billing.services.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Cancellation result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/dns/waf Check DNS/WAF eligibility Operation ID: serviceDnsWafStatus Returns the protection mode and service eligibility for DNS proxy and WAF-related actions on the selected service. Scopes: dns.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS/WAF eligibility details. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "serviceStatus": "active", "backendIpv4": "192.0.2.10", "dnsWaf": { "serviceId": null, "active": false }, "free": { "eligible": true }, "eligible": true, "mode": "free" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/services/{serviceId}/dns/waf/record Inspect protected record Operation ID: getServiceDnsWafRecord Returns the current proxy, protection, and origin values for one service-scoped DNS record. Scopes: dns.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - query domain (required): Zone or apex domain for the protected record. - query name (required): Record name such as @ or www. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Protected record status. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "serviceStatus": "active", "backendIpv4": "192.0.2.10", "domain": "example.com", "record": { "name": "example.com.", "type": "A", "ttl": 300, "values": [ "192.0.2.10" ], "proxied": false, "originValues": null, "protection": false } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy Toggle proxy mode Operation ID: serviceDnsWafRecordProxy Enables or disables proxy mode for a service-scoped record. This is the main action for moving a record behind the managed proxy layer. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "enabled": { "type": "boolean" }, "ttl": { "type": "integer", "minimum": 1, "maximum": 86400 } }, "required": [ "domain", "name", "enabled" ], "additionalProperties": false } ``` Response 200: Updated proxy state. Illustrative response: ```json { "ok": true, "appliedTo": "powerdns", "proxied": true, "providerBackends": [ "192.0.2.10" ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/protection Toggle protection mode Operation ID: serviceDnsWafRecordProtection Enables or disables the protection layer for a proxied record. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "enabled": { "type": "boolean" } }, "required": [ "domain", "name", "enabled" ], "additionalProperties": false } ``` Response 200: Updated protection state. Illustrative response: ```json { "ok": true, "fqdn": "example.com", "protection": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/origin-sync Run origin sync Operation ID: serviceDnsWafRecordOriginSync Refreshes the protected record origin target so the proxy backend follows the current service IP. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 } }, "required": [ "domain", "name" ], "additionalProperties": false } ``` Response 200: Origin sync result. Illustrative response: ```json { "ok": true, "fqdn": "example.com", "backendIpv4": "192.0.2.10" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/show View proxy settings Operation ID: serviceDnsWafProxyConfigShow Returns the proxy configuration for an owned proxied record. Accepts an owned DNS zone name or service UUID. With a zone-name selector, domain is optional and must match when supplied; name defaults to @. Prefer the read-only GET /v1/dns/zones/{name}/records/config. This legacy POST can ensure proxy registration. Scopes: dns.read - path serviceId (required): Your DNS zone name (example.com) or an owned service UUID. A name selects the owned zone directly; a UUID also requires domain in the query/body. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1, "maxLength": 1024 }, "name": { "type": "string", "minLength": 1, "maxLength": 253, "default": "@" } }, "additionalProperties": false } ``` Response 200: Current proxy configuration. Illustrative response: ```json { "ok": true, "data": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/update-setting Change proxy setting Operation ID: serviceDnsWafProxyConfigUpdateSetting Changes one supported proxy setting such as force SSL, SSL mode, or custom loader behavior. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "option": { "type": "string", "enum": [ "ssl_schema", "force_ssl", "ssl", "custom_loader" ] }, "value": { "type": "string", "minLength": 1 } }, "required": [ "domain", "name", "option", "value" ], "additionalProperties": false } ``` Response 200: Updated proxy setting result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/get-ssl View SSL settings Operation ID: serviceDnsWafProxyConfigGetSsl Returns certificate metadata and configuration readiness for the selected protected record. ready confirms a matching, currently valid certificate in the provider configuration; it does not confirm public DNS propagation or browser trust. Provider lookup failures return a safe error. Scopes: dns.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 } }, "required": [ "domain", "name" ], "additionalProperties": false } ``` Response 200: SSL configuration details. Illustrative response: ```json { "ok": true, "data": { "hasCert": true, "ready": true, "status": "ready", "mode": "c", "readiness_scope": "certificate_configuration", "cert": { "subject": "CN=example.com", "issuer": "CN=Example CA", "validFrom": "2026-10-01T00:00:00.000Z", "validTo": "2027-10-06T00:00:00.000Z", "fingerprint256": "AA:BB:CC" } } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/upload-ssl Upload custom SSL certificate Operation ID: serviceDnsWafProxyConfigUploadSsl Validates the hostname, validity dates, certificate chain syntax and matching private key before uploading. Domains may be configured before DNS points to the proxy. Returns certificate configuration readiness and expected_fingerprint256 after readback. pending or unknown means the accepted upload is not yet confirmed; check get-ssl before retrying. Private key material is never returned. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "mode": { "type": "string", "enum": [ "c", "w" ] }, "cert": { "type": "string", "minLength": 1 }, "pkey": { "type": "string", "minLength": 1 }, "bundle": { "type": "string", "default": "" } }, "required": [ "domain", "name", "mode", "cert", "pkey" ], "additionalProperties": false } ``` Response 200: SSL upload result. Illustrative response: ```json { "ok": true, "data": { "hasCert": false, "ready": false, "status": "pending", "mode": "c", "readiness_scope": "certificate_configuration" }, "expected_fingerprint256": "AA:BB:CC" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/get-loader View custom loader Operation ID: serviceDnsWafProxyConfigGetLoader Returns the currently configured custom loader or response page for a protected record. Scopes: dns.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 } }, "required": [ "domain", "name" ], "additionalProperties": false } ``` Response 200: Current loader configuration. Illustrative response: ```json { "ok": true, "data": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/services/{serviceId}/dns/waf/record/proxy-config/upload-loader Upload custom loader Operation ID: serviceDnsWafProxyConfigUploadLoader Uploads custom HTML used by the proxy layer for the selected record. Scopes: dns.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domain": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "html": { "type": "string", "minLength": 1 } }, "required": [ "domain", "name", "html" ], "additionalProperties": false } ``` Response 200: Loader upload result. Illustrative response: ```json { "ok": true, "data": null, "html": "Loading" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/catalog Browse dedicated inventory Operation ID: dedicatedCatalog Returns currently sellable configurations, regions, hardware, billing periods, and compatible operating-system profiles. Scopes: dedicated.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available dedicated inventory. Illustrative response: ```json { "ok": true, "items": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dedicated/deployments Create dedicated deployment Operation ID: dedicatedDeploy Creates an unpaid order and invoice using catalog configurationCode, regionCode, numeric osProfileId, hostname, optional owned sshKeyId, billing and selectable add-ons. Use order-options to discover valid add-on keys and quantities, and preview the same complete configuration before ordering. Provisioning begins only after payment and any configured approval. Never invent configuration or OS IDs. Scopes: dedicated.write - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "configuration_code": { "type": "string", "minLength": 1, "maxLength": 160 }, "region_code": { "type": "string", "pattern": "^[A-Z0-9-]{2,16}$" }, "os_profile_id": { "type": "integer", "exclusiveMinimum": 0 }, "hostname": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$" }, "ssh_key_id": { "type": "string", "format": "uuid" }, "addons": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9_.:-]+$" }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "key", "qty" ], "additionalProperties": false }, "maxItems": 50 }, "currency": { "type": "string", "enum": [ "USD", "EUR", "UAH", "GBP", "PLN", "BRL", "INR", "IDR", "CNY" ], "default": "EUR" }, "billing": { "type": "object", "properties": { "unit": { "type": "string", "enum": [ "MONTH", "QUARTAL", "SEMIANNUAL", "YEAR" ], "default": "MONTH" }, "count": { "type": "integer", "minimum": 1, "maximum": 120, "default": 1 } }, "additionalProperties": false, "default": { "unit": "MONTH", "count": 1 } } }, "required": [ "configuration_code", "region_code", "os_profile_id", "hostname" ], "additionalProperties": false } ``` Response 201: Created order and invoice; not yet installed. Illustrative response: ```json { "ok": true, "orderId": "00000000-0000-4000-8000-000000000001", "invoiceId": "00000000-0000-4000-8000-000000000002", "invoiceNumber": "INV-EXAMPLE-000001", "total": "100.00", "currency": "EUR", "status": "unpaid", "deploymentStatusUrl": "/v1/dedicated/deployments/00000000-0000-4000-8000-000000000001", "message": "Invoice created. Provisioning begins after payment and any configured approval." } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/deployments/{orderId} Check deployment Operation ID: dedicatedDeployment Returns payment, provisioning, service, IP, power, OS, and operation state for a dedicated order without exposing its password. Scopes: dedicated.read - path orderId (required): Dedicated deployment order UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Dedicated deployment status. Illustrative response: ```json { "ok": true, "deployment": { "orderId": "00000000-0000-4000-8000-000000000001", "orderStatus": "pending", "paymentStatus": "unpaid", "invoice": { "id": "00000000-0000-4000-8000-000000000001", "number": "INV-EXAMPLE-000001", "status": "unpaid", "total": "100.00", "paidTotal": "0.00", "currency": "EUR" }, "serviceId": null, "serviceStatus": null, "ip": null, "power": null, "hostname": null, "osName": null, "operations": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId} Check dedicated server Operation ID: dedicatedStatus Returns the owned server lifecycle, hardware, operating system, IP, power state, and recent operations. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Dedicated server status. Illustrative response: ```json { "ok": true, "lifecycleStatus": "active", "service": { "state": "active", "configurationCode": "EXAMPLE", "regionCode": "PT", "hostname": "server.example.com", "osName": "Debian 13", "hardware": { "lineName": "Example dedicated server", "cpuSockets": 2, "ramGb": 256, "storageGb": 240, "linkGbps": 10, "physicalLinkGbps": 10, "cpuDescription": "Example CPU", "ramDescription": "DDR4 ECC", "storageDescription": "SSD" }, "primaryIp": "192.0.2.10", "power": "online", "powerCheckedAt": "2026-10-01T00:00:00.000Z", "rescueMode": false, "canManage": true, "canConsole": true, "canReinstall": true, "canRescue": true }, "operations": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/credentials Reveal current credentials Operation ID: dedicatedCredentials Explicit no-store credential endpoint. Returns the owned server IP, username, and current generated password after activation. Scopes: dedicated.credentials.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Dedicated server access credentials. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "ip": "192.0.2.10", "username": "root", "password": "", "credentialKind": "activate", "operationId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dedicated/{serviceId}/power Queue power action Operation ID: dedicatedPower Body action: start, stop, restart or exit_rescue. Exiting rescue boots the installed system from disk. Interrupting actions require explicit intent. Task acceptance is not completion; inspect the returned task. Scopes: dedicated.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "action": { "type": "string", "enum": [ "start", "stop", "restart", "exit_rescue" ] } }, "required": [ "action" ], "additionalProperties": false } ``` Response 202: Queued power operation. Illustrative response: ```json { "ok": true, "operation": { "id": "00000000-0000-4000-8000-000000000002", "kind": "power_on", "state": "queued" }, "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/tasks List dedicated tasks Operation ID: dedicatedTasks Returns customer-visible operations for the owned server. Read history before repeating an uncertain action. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Dedicated task history. Illustrative response: ```json { "ok": true, "tasks": [ { "id": "00000000-0000-4000-8000-000000000002", "kind": "reinstall", "status": "in_progress", "stage": "installing", "errorCode": null, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/traffic Read network traffic Operation ID: getDedicatedByServiceIdTraffic Returns available network samples. Rates are bits per second and traffic totals are bytes. Missing statistics are not zero traffic. Does not report guest resource usage. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Network statistics or unavailable result. Illustrative response: ```json { "ok": true, "available": false, "period": "24h", "interfaces": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/power-stats Read electrical power statistics Operation ID: dedicatedStats Electrical consumption in watts, not CPU utilization. Any estimated energy value is not a billing meter. Hardware may not expose measurements. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Power statistics or unavailable result. Illustrative response: ```json { "ok": true, "available": false, "period": "24h", "points": [], "summary": { "currentWatts": null, "averageWatts": null, "peakWatts": null, "estimatedKwh": null } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/reinstall-options List compatible installation images Operation ID: dedicatedReinstallOptions Read compatible numeric profile IDs before requesting reinstall. Reading options does not start an installation. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Compatible OS profiles. Illustrative response: ```json { "ok": true, "enabled": true, "currentProfileId": 1, "profiles": [ { "id": 1, "name": "Debian 13", "allowSshKeys": true } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/rescue-options List compatible rescue images Operation ID: dedicatedRescueOptions Read compatible numeric rescue profile IDs before requesting maintenance boot. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Compatible rescue profiles. Illustrative response: ```json { "ok": true, "enabled": true, "profiles": [ { "id": 2, "name": "Example rescue image" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dedicated/{serviceId}/reinstall Erase and reinstall the server Operation ID: dedicatedReinstall Irreversibly overwrites installed data. Read compatible profiles first; use an account-owned SSH key when supported. Inspect the returned task rather than submitting another installation. Scopes: dedicated.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "profile_id": { "type": "integer", "exclusiveMinimum": 0 }, "hostname": { "type": "string", "pattern": "^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$" }, "ssh_key_id": { "type": "string", "format": "uuid" }, "confirmation": { "type": "string", "const": "ERASE", "enum": [ "ERASE" ] } }, "required": [ "profile_id", "confirmation" ], "additionalProperties": false } ``` Response 202: Queued reinstall operation. Illustrative response: ```json { "ok": true, "operation": { "id": "00000000-0000-4000-8000-000000000002", "state": "waiting_provider" }, "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dedicated/{serviceId}/rescue Boot a rescue environment Operation ID: dedicatedRescue Interrupts applications and connections; does not itself reinstall the OS. Use a compatible rescue profile, then exit_rescue to return to installed-system boot. Scopes: dedicated.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "profile_id": { "type": "integer", "exclusiveMinimum": 0 }, "confirmation": { "type": "string", "const": "RESCUE", "enum": [ "RESCUE" ] } }, "required": [ "profile_id", "confirmation" ], "additionalProperties": false } ``` Response 202: Queued rescue operation. Illustrative response: ```json { "ok": true, "operation": { "id": "00000000-0000-4000-8000-000000000002", "state": "waiting_provider" }, "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/tasks/{taskId} Check dedicated task Operation ID: dedicatedTask Returns bounded customer-safe status for a power or maintenance task. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - path taskId (required): Dedicated operation UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Dedicated task status. Illustrative response: ```json { "ok": true, "task": { "id": "00000000-0000-4000-8000-000000000002", "kind": "reinstall", "status": "in_progress", "stage": "installing", "errorCode": null, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dedicated/{serviceId}/password-reset Reset dedicated password Operation ID: dedicatedPasswordReset Interrupts connections while maintenance replaces the OS administrator password. Track the returned task; retrieve the result privately only after success. Scopes: dedicated.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (required): Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 202: Queued password reset. Illustrative response: ```json { "ok": true, "operation": { "id": "00000000-0000-4000-8000-000000000002", "state": "waiting_provider" }, "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/password-reset-credential Reveal reset password Operation ID: dedicatedPasswordResetCredential Explicit no-store endpoint returning the generated password after successful reset. Sensitive output: do not log or send to an AI conversation. Scopes: dedicated.credentials.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - query operationId (optional): Optional password-reset operation UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: New dedicated server password. Illustrative response: ```json { "ok": true, "operationId": "00000000-0000-4000-8000-000000000002", "password": "" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/status Check VPS status Operation ID: vpsStatus Returns hostname, assigned region code (for example NL or PT), customer IPv4/IPv6, power state and selected runtime metrics. Region describes the hosting country, not a specific datacenter building; null means unavailable. Does not disclose internal node or cluster identifiers. Ownership, status, type, search, external_id and label filters are applied server-side before pagination and counts. The default is active plus suspended; historical states require an explicit status filter. group_by=type groups only the current page, not the complete inventory. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: VPS runtime status, hostname and assigned region. Illustrative response: ```json { "ok": true, "vm": { "status": "running", "power": "on", "hostname": "server.example.com", "os": { "name": "Debian", "version": "13", "family": "debian", "source": "provisioning_metadata", "guestVerified": false }, "ipv4": "192.0.2.10", "ipv6": null, "uptime": 3600, "cpus": 2, "cpu": 0.05, "mem": 536870912, "maxmem": 4294967296, "disk": 0, "maxdisk": 42949672960, "netin": 0, "netout": 0, "diskread": 0, "diskwrite": 0 } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/credentials Reveal recorded VPS credentials Operation ID: vpsCredentials Explicit, audited, no-store password retrieval. The platform-recorded root password may differ if changed inside the guest. Never log output or send it to a hosted AI conversation. Scopes: vps.credentials.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Recorded rootPassword, hostname, IPv4 and IPv6. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "hostname": "server.example.com", "ipv4": "192.0.2.10", "ipv6": null, "rootPassword": "", "credentialSource": "platform_record", "guestVerified": false } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/console Open browser console Operation ID: vpsConsole Returns an authenticated portal console URL, not a raw VNC connection or provider ticket. Browser login and service access are checked before connecting. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Console URL and requiresBrowserLogin. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "consoleUrl": "https://my.blazingfast.io/manage/vps/00000000-0000-4000-8000-000000000001/vnc", "requiresBrowserLogin": true, "transport": "browser" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dedicated/{serviceId}/console Open browser console Operation ID: dedicatedConsole Returns an authenticated portal console URL. No provider address or VNC password is exposed. Sign in to connect. Scopes: dedicated.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Console URL and requiresBrowserLogin. Illustrative response: ```json { "ok": true, "serviceId": "00000000-0000-4000-8000-000000000001", "consoleUrl": "https://my.blazingfast.io/manage/dedicated/00000000-0000-4000-8000-000000000001/console", "requiresBrowserLogin": true, "transport": "browser" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/reboot Reboot server Operation ID: rebootVps Triggers a reboot action for the selected VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Reboot action result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002", "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/start Start server Operation ID: vpsStart Starts a stopped VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Start action result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002", "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/stop Stop server Operation ID: vpsStop Stops a running VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Stop action result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002", "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE", "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/password/reset Reset root password Operation ID: vpsPasswordReset Generates and applies a new root password, then returns it once to the caller. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Generated password and reset result. Illustrative response: ```json { "ok": true, "newPassword": "", "credentialSynced": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/actions/{actionId} Check action status Operation ID: vpsActionStatus Polls the current state of a long-running VPS action such as power, backup, or reinstall work. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - path actionId (required): Action UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Action status details. Illustrative response: ```json { "ok": true, "action": { "id": "00000000-0000-4000-8000-000000000002", "type": "start", "phase": "completed", "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/reinstall/os Browse reinstall images Operation ID: vpsReinstallOs Returns operating system choices available for VPS reinstall. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Available reinstall operating systems. Illustrative response: ```json { "ok": true, "osTemplates": [ { "code": "debian-13", "name": "Debian", "version": "13", "arch": "amd64" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/reinstall Start reinstall Operation ID: vpsReinstall Queues a durable reinstall and returns HTTP 202 with an action ID and operation URL. Poll the operation URL until completion, then read VPS credentials separately with vps.credentials.read. Acceptance does not mean the guest is ready. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header Idempotency-Key (optional): Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "os_code": { "type": "string", "minLength": 1 }, "hostname": { "type": "string", "minLength": 1, "maxLength": 255 }, "ssh_key_id": { "anyOf": [ { "type": "string", "format": "uuid" }, { "type": "null" } ] }, "ssh_public_key": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ] }, "firewall_policy_id": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 128 }, { "type": "string", "const": "__DEFAULT__", "enum": [ "__DEFAULT__" ] }, { "type": "null" } ] }, "os_name": { "type": "string", "minLength": 1 }, "os_version": { "type": "string", "minLength": 1 }, "os_arch": { "type": "string", "minLength": 1 } }, "required": [ "os_code" ], "additionalProperties": false } ``` Response 202: Queued reinstall receipt. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002", "queued": true, "status": "queued", "operation_id": "op_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "operation_url": "/v1/operations/op_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/vps/{serviceId}/sshkey Update VPS SSH key Operation ID: vpsSshkeySet Applies a public SSH key or a saved SSH key reference to the target VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "ssh_key_id": { "type": "string", "format": "uuid" }, "public_key": { "type": "string", "minLength": 1, "maxLength": 8192 } }, "additionalProperties": false } ``` Response 200: SSH key assignment result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/snapshots Browse snapshots Operation ID: listVpsSnapshots Returns existing snapshots for the target VPS. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Snapshot list. Illustrative response: ```json { "ok": true, "snapshots": [ { "name": "before-upgrade", "description": "Before upgrade", "running": 0 } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/snapshots Take snapshot Operation ID: vpsSnapshotCreate Creates a new snapshot for the target VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 120 }, "description": { "type": "string", "minLength": 1, "maxLength": 200 }, "include_ram": { "type": "boolean" } }, "additionalProperties": false } ``` Response 200: Snapshot creation result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002", "snapname": "before-upgrade" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/snapshots/progress Check snapshot progress Operation ID: vpsSnapshotsProgress Returns the current progress state for an in-flight snapshot operation. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Snapshot progress. Illustrative response: ```json { "ok": true, "inProgress": false, "actionId": null, "lastRequestedAt": null, "lastResult": null, "action": null, "target": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/snapshots/{name}/rollback Restore snapshot Operation ID: vpsSnapshotRollback Restores the VPS from the named snapshot. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - path name (required): Snapshot name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Snapshot rollback result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/vps/{serviceId}/snapshots/{name} Remove snapshot Operation ID: vpsSnapshotDelete Deletes the named VPS snapshot. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - path name (required): Snapshot name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Snapshot deletion result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/backup Check backup status Operation ID: getVpsBackup Returns current backup information for the VPS. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Current backup state. Illustrative response: ```json { "ok": true, "storageId": "example-backup-storage", "usedBytes": 0, "backupCount": 0, "poolUsedBytes": 0, "poolBackupCount": 0, "quota": { "freeGiB": 10, "purchasedGiB": 0, "limitBytes": 10737418240, "freeBytes": 10737418240 }, "files": [], "backup": null, "os": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/vps/{serviceId}/backup Delete backup files Operation ID: vpsBackupDelete Deletes the current backup record or configured backup object for the VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup deletion result. Illustrative response: ```json { "ok": true, "deleted": 1 } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/backup/schedule View backup schedule Operation ID: getVpsBackupSchedule Returns current backup schedule settings for the VPS. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup schedule settings. Illustrative response: ```json { "ok": true, "schedule": { "enabled": false } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/vps/{serviceId}/backup/schedule Change backup schedule Operation ID: vpsBackupSchedulePut Creates or updates the backup schedule for the VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "enabled": { "type": "boolean" }, "cadence": { "type": "string", "enum": [ "daily", "weekly" ] }, "at_hour": { "type": "integer", "minimum": 0, "maximum": 23 }, "at_minute": { "type": "integer", "minimum": 0, "maximum": 59 }, "day_of_week": { "type": "integer", "minimum": 0, "maximum": 6 } }, "additionalProperties": false } ``` Response 200: Updated backup schedule. Illustrative response: ```json { "ok": true, "schedule": { "enabled": false } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/backup/run Start backup Operation ID: vpsBackupRun Starts an on-demand backup for the selected VPS. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup run result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/backup/progress Check backup progress Operation ID: vpsBackupProgress Returns current progress for an active backup job. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup progress. Illustrative response: ```json { "ok": true, "inProgress": false, "actionId": null, "lastRequestedAt": null, "lastResult": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/backup/cancel Cancel backup run Operation ID: vpsBackupCancel Requests cancellation of an active backup job. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup cancellation result. Illustrative response: ```json { "ok": true, "cancelled": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/backup/restore Start backup restore Operation ID: vpsBackupRestore Starts a restore from the current or selected VPS backup artifact. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-bf-response-format (optional): Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "auto_start": { "type": "boolean" }, "file": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 255 }, { "type": "null" } ] } }, "additionalProperties": false } ``` Response 200: Backup restore result. Illustrative response: ```json { "ok": true, "actionId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/backup/restore/progress Check restore progress Operation ID: vpsBackupRestoreProgress Returns progress for an active backup restore. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Backup restore progress. Illustrative response: ```json { "ok": true, "inProgress": false, "actionId": null, "lastRequestedAt": null, "lastResult": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/templates Browse DNS templates Operation ID: listDnsTemplates Returns reusable DNS templates that can be applied during zone creation. Scopes: dns.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS template list. Illustrative response: ```json { "ok": true, "templates": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example template", "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z", "system": false, "visibility": "private", "isHidden": false } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dns/templates Save DNS template Operation ID: dnsTemplateCreate Creates a reusable DNS template from a zone-file fragment. Scopes: dns.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 }, "zone_file": { "type": "string", "minLength": 1, "maxLength": 500000 } }, "required": [ "name", "zone_file" ], "additionalProperties": false } ``` Response 200: Created DNS template. Illustrative response: ```json { "ok": true, "template": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example template", "zoneFile": "@ 300 IN A 192.0.2.10", "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z", "system": false, "visibility": "private" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/templates/{id} Open DNS template Operation ID: getDnsTemplate Returns an owned or public system template by name or UUID. Name matching is case-insensitive and checks your templates first; public system defaults are a fallback. Other accounts are excluded. Only duplicate names within the selected scope return template_identifier_ambiguous. Edit/delete routes still require UUIDs. Scopes: dns.read - path id (required): Your template name (cpanel2 or My template) or UUID; URL-encode spaces and Unicode. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS template detail. Illustrative response: ```json { "ok": true, "template": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example template", "zoneFile": "@ 300 IN A 192.0.2.10", "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z", "system": false, "visibility": "private" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/dns/templates/{id} Edit DNS template Operation ID: dnsTemplateUpdate Updates the name or zone-file content of an existing template. Scopes: dns.write - path id (required): DNS template UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 }, "zone_file": { "type": "string", "minLength": 1, "maxLength": 500000 } }, "additionalProperties": false } ``` Response 200: Updated DNS template. Illustrative response: ```json { "ok": true, "template": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example template", "zoneFile": "@ 300 IN A 192.0.2.10", "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z", "system": false, "visibility": "private" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/dns/templates/{id} Remove DNS template Operation ID: dnsTemplateDelete Deletes a DNS template. Scopes: dns.write - path id (required): DNS template UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS template deletion result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones Browse DNS zones Operation ID: listDnsZones Returns owned customer DNS zones. Use view=summary for a lightweight, read-only inventory with name search before pagination; it returns total, limit, offset and zones. The default legacy view remains unchanged. Summary results sort by zone name and do not contact nameservers or change billing links. Scopes: dns.read - query q (optional): Optional zone name search filter. - query sort (optional): Optional legacy-view sort key; summary always sorts by name. - query view (optional): Use summary for lightweight paginated zone cards. - query limit (optional): Summary only: maximum zones returned. - query offset (optional): Summary only: number of matching zones to skip. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS zone list. Summary adds total, limit and offset; zones contain name, status and createdAt only. Illustrative response: ```json { "ok": true, "zones": [ { "name": "example.com", "status": "active", "createdAt": "2026-10-01T00:00:00.000Z" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dns/zones Create or preview DNS zone Operation ID: createDnsZone Body: name; at most one of templateId UUID, zoneFile text (100000 characters max), or records array ({name,type,ttl,values}, max 200 sets, 50 values/set, TTL 1–86400 seconds). Omit all sources for an empty zone. dryRun:true validates and returns records/notes without creating or reserving a zone; requires an existing active DNS service. Use separate Idempotency-Keys for preview and creation. Platform apex NS replaces imported NS and SOA is managed automatically. Zone files support IN records, relative names, $ORIGIN, $TTL and multiline records; external includes/generation and foreign owners are rejected. Resolve template names via GET /v1/dns/templates and inspect their details; templates must be owned or public. Existing zones are never overwritten. A records may be proxied by the existing protection policy. Does not register domains or change registrar delegation. Scopes: dns.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "template_id": { "type": "string", "format": "uuid" }, "zone_file": { "type": "string", "minLength": 1, "maxLength": 100000 }, "records": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "type": { "type": "string", "enum": [ "A", "AAAA", "CNAME", "MX", "TXT", "NS", "SOA", "PTR", "SRV", "CAA", "SSHFP", "TLSA", "NAPTR", "LOC", "DS", "DNSKEY" ] }, "ttl": { "type": "integer", "minimum": 1, "maximum": 86400 }, "values": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 }, "minItems": 1, "maxItems": 50 } }, "required": [ "name", "type", "values" ], "additionalProperties": false }, "maxItems": 200 }, "dry_run": { "type": "boolean" } }, "required": [ "name" ], "additionalProperties": false, "description": "At most one of templateId, zoneFile or records. Omit all three for an empty zone. Names and record ownership are validated by the backend." } ``` Response 200: Created zone, or normalized records and notes for dryRun. Illustrative response: ```json { "ok": true, "zoneId": "00000000-0000-4000-8000-000000000001", "zone": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name} Open DNS zone Operation ID: getDnsZone Returns one DNS zone and its customer-facing detail view. Scopes: dns.read - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS zone detail. Illustrative response: ```json { "ok": true, "domain": { "name": "example.com", "zoneId": "00000000-0000-4000-8000-000000000001", "status": "active", "adminLock": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/dns/zones/{name} Remove DNS zone Operation ID: dnsZoneDelete Deletes a DNS zone. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: DNS zone deletion result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/records/simple Browse simple records Operation ID: listDnsRecordsSimple Returns simplified DNS records for a zone. Scopes: dns.read - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Simple DNS records. Illustrative response: ```json { "ok": true, "service": { "id": "00000000-0000-4000-8000-000000000001", "status": "active", "suspendedReason": null }, "records": [ { "name": "@", "type": "A", "ttl": 300, "values": [ "192.0.2.10" ], "proxied": false, "originValues": null, "protection": false, "wafEligible": false, "protectionMode": "none" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/dns/zones/{name}/records/simple Save simple record Operation ID: dnsRecordsSimpleSet Creates or replaces a simplified DNS record set. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "append", "replace" ] }, "record": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "type": { "type": "string", "minLength": 1, "maxLength": 16 }, "ttl": { "type": "integer", "minimum": 1, "maximum": 86400 }, "values": { "type": "array", "items": { "type": "string" }, "minItems": 1, "maxItems": 50 }, "protect": { "type": "boolean" } }, "required": [ "name", "type", "values" ], "additionalProperties": false } }, "required": [ "record" ], "additionalProperties": false } ``` Response 200: Simple record upsert result. Illustrative response: ```json { "ok": true, "appliedTo": "powerdns", "changeId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/dns/zones/{name}/records/simple Remove simple record Operation ID: dnsRecordsSimpleDelete Deletes a simplified DNS record set from the zone. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "type": { "type": "string", "minLength": 1, "maxLength": 16 } }, "required": [ "name", "type" ], "additionalProperties": false } ``` Response 200: Simple record deletion result. Illustrative response: ```json { "ok": true, "appliedTo": "powerdns", "changeId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/dns/zones/{name}/records Browse raw rrsets Operation ID: getDnsRrsets Returns advanced rrset data for customers that need lower-level DNS editing. Scopes: dns.read - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Raw rrset list. Illustrative response: ```json { "ok": true, "source": "powerdns", "rrsets": [ { "name": "example.com.", "type": "A", "ttl": 300, "records": [ { "content": "192.0.2.10", "disabled": false } ] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/dns/zones/{name}/records Apply rrset changes Operation ID: dnsRrsetsPatch Applies advanced rrset changes using REPLACE or DELETE style operations. Scopes: dns.write - path name (required): Zone or domain name. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "rrsets": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 253 }, "type": { "type": "string", "minLength": 1, "maxLength": 16 }, "ttl": { "type": "integer", "minimum": 0, "maximum": 2147483647 }, "changetype": { "type": "string", "enum": [ "REPLACE", "DELETE" ] }, "records": { "type": "array", "items": { "type": "object", "properties": { "content": { "type": "string" }, "disabled": { "type": "boolean" } }, "required": [ "content" ], "additionalProperties": false } } }, "required": [ "name", "type" ], "additionalProperties": false } } }, "required": [ "rrsets" ], "additionalProperties": false } ``` Response 200: Raw rrset patch result. Illustrative response: ```json { "ok": true, "appliedTo": "powerdns", "changeId": "00000000-0000-4000-8000-000000000002" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/tlds Browse supported TLDs Operation ID: domainTlds Returns customer-searchable TLD data for domain purchase and transfer flows. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Supported TLD list. Illustrative response: ```json { "ok": true, "tlds": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/check Check availability Operation ID: domainCheck Checks one or more domains for availability. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string", "minLength": 3 }, "minItems": 1, "maxItems": 50 } }, "required": [ "domains" ], "additionalProperties": false } ``` Response 200: Availability results. Illustrative response: ```json { "ok": true, "results": [ { "domain": "example.com", "available": false, "premium": false, "price": null, "renewalPrice": null, "renewalCurrency": null, "currency": null, "transferPrice": null, "transferCurrency": null, "is_private_whois_allowed": false } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/search Search domains Operation ID: domainSearch Searches available domains by keyword with paging support. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "keyword": { "type": "string", "minLength": 1, "maxLength": 63 }, "page": { "type": "integer", "minimum": 0, "default": 0 }, "page_size": { "type": "integer", "minimum": 5, "maximum": 50, "default": 20 } }, "required": [ "keyword" ], "additionalProperties": false } ``` Response 200: Domain search results. Illustrative response: ```json { "ok": true, "results": [], "hasMore": false, "page": 0, "total": 0 } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/suggest Suggest domains Operation ID: domainSuggest Returns suggestion-style domain options derived from a keyword. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "keyword": { "type": "string", "minLength": 1, "maxLength": 253 }, "limit": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": [ "keyword" ], "additionalProperties": false } ``` Response 200: Domain suggestions. Illustrative response: ```json { "ok": true, "suggestions": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains Browse domains Operation ID: listDomains Returns domain services already attached to the customer account. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Customer domain service list. Illustrative response: ```json { "ok": true, "domains": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/{serviceId} Open domain detail Operation ID: getDomain Returns the current detail view for one domain service. Scopes: domains.read - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Domain service detail. Illustrative response: ```json { "ok": true, "service_id": "00000000-0000-4000-8000-000000000001", "domain_name": "example.com", "service": { "id": "00000000-0000-4000-8000-000000000001", "status": "active" }, "domain": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/{serviceId}/status Check domain status Operation ID: domainStatus Returns current domain lifecycle or verification status for one domain service. Scopes: domains.read - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Domain status details. Illustrative response: ```json { "ok": true, "status": null } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/domains/{serviceId}/nameservers Update nameservers Operation ID: domainNameserversUpdate Replaces nameserver configuration for a domain service. Scopes: domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "nameservers": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "ip": { "type": "string" } }, "required": [ "name" ], "additionalProperties": false }, "minItems": 2, "maxItems": 13 } }, "required": [ "nameservers" ], "additionalProperties": false } ``` Response 200: Nameserver update result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/domains/{serviceId}/lock Change transfer lock Operation ID: domainLock Enables or disables the domain lock state. Scopes: domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "locked": { "type": "boolean" } }, "required": [ "locked" ], "additionalProperties": false } ``` Response 200: Updated domain lock state. Illustrative response: ```json { "ok": true, "locked": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/domains/{serviceId}/whois-privacy Change WHOIS privacy Operation ID: domainWhoisPrivacy Enables or disables WHOIS privacy when the domain and registrar flow allow it. Scopes: domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ], "additionalProperties": false } ``` Response 200: Updated WHOIS privacy state. Illustrative response: ```json { "ok": true, "enabled": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/{serviceId}/auth-code View transfer code Operation ID: domainAuthCode Returns the current transfer authorization code when available. Scopes: domains.read - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Transfer auth code. Illustrative response: ```json { "ok": true, "auth_code": "" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/{serviceId}/transfer-status Check transfer status Operation ID: domainTransferStatus Returns the current transfer state for a domain service. Scopes: domains.read - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Transfer status details. Illustrative response: ```json { "ok": true, "transferStatus": "unknown", "isActive": false } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/{serviceId}/resend-verification Resend verification Operation ID: domainResendVerification Resends a verification step for a domain when the registrar flow requires it. Scopes: domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Verification resend result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/domains/{serviceId}/contacts Assign contacts Operation ID: domainAssignContacts Assigns registrant, admin, tech, or billing contacts to a domain service. Scopes: domains.write - path serviceId (required): Your registered domain name (example.com) or service UUID. Names are case-insensitive and normalized to IDNA ASCII; one trailing dot is accepted. Exact matches are restricted to your non-terminated domain services. Multiple matches return domain_identifier_ambiguous; use the UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "contact_ids": { "type": "object", "properties": { "registrant": { "type": "string", "format": "uuid" }, "admin": { "type": "string", "format": "uuid" }, "tech": { "type": "string", "format": "uuid" }, "billing": { "type": "string", "format": "uuid" } }, "additionalProperties": false } }, "required": [ "contact_ids" ], "additionalProperties": false } ``` Response 200: Updated domain contacts. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/domains/contacts Browse domain contacts Operation ID: listDomainContacts Returns saved domain contact records available for assignment. Scopes: domains.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Domain contact list. Illustrative response: ```json { "ok": true, "contacts": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/domains/contacts Save domain contact Operation ID: domainContactCreate Creates a reusable domain contact record. Scopes: domains.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "first_name": { "type": "string", "minLength": 1 }, "last_name": { "type": "string", "minLength": 1 }, "company_name": { "type": "string" }, "email": { "type": "string", "format": "email" }, "phone": { "type": "string", "minLength": 1 }, "address": { "type": "object", "properties": { "street": { "type": "string", "minLength": 1 }, "number": { "type": "string", "minLength": 1 }, "city": { "type": "string", "minLength": 1 }, "zipcode": { "type": "string", "minLength": 1 }, "state": { "type": "string" }, "country": { "type": "string", "maxLength": 2, "minLength": 2 } }, "required": [ "street", "number", "city", "zipcode", "country" ], "additionalProperties": false }, "tag": { "type": "string" }, "vat": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\-. ]*$" }, "passport_number": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\- ]*$" }, "tax_id": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\-. ]*$" }, "additional_data": { "type": "object", "additionalProperties": {} } }, "required": [ "first_name", "last_name", "email", "phone", "address" ], "additionalProperties": false } ``` Response 200: Created domain contact. Illustrative response: ```json { "ok": true, "contact": { "id": "00000000-0000-4000-8000-000000000001", "firstName": "Example", "lastName": "Customer", "country": "NL" }, "handle": "EXAMPLE-HANDLE" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/domains/contacts/{contactId} Edit domain contact Operation ID: domainContactUpdate Replaces a saved domain contact record. Scopes: domains.write - path contactId (required): Domain contact UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "first_name": { "type": "string", "minLength": 1 }, "last_name": { "type": "string", "minLength": 1 }, "company_name": { "type": "string" }, "email": { "type": "string", "format": "email" }, "phone": { "type": "string", "minLength": 1 }, "address": { "type": "object", "properties": { "street": { "type": "string", "minLength": 1 }, "number": { "type": "string", "minLength": 1 }, "city": { "type": "string", "minLength": 1 }, "zipcode": { "type": "string", "minLength": 1 }, "state": { "type": "string" }, "country": { "type": "string", "maxLength": 2, "minLength": 2 } }, "required": [ "street", "number", "city", "zipcode", "country" ], "additionalProperties": false }, "tag": { "type": "string" }, "vat": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\-. ]*$" }, "passport_number": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\- ]*$" }, "tax_id": { "type": "string", "maxLength": 30, "pattern": "^[A-Za-z0-9\\-. ]*$" }, "additional_data": { "type": "object", "additionalProperties": {} } }, "required": [ "first_name", "last_name", "email", "phone", "address" ], "additionalProperties": false } ``` Response 200: Updated domain contact. Illustrative response: ```json { "ok": true, "contact": { "id": "00000000-0000-4000-8000-000000000001", "firstName": "Example", "lastName": "Customer", "country": "NL" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/domains/contacts/{contactId} Remove domain contact Operation ID: domainContactDelete Deletes a saved domain contact record. Scopes: domains.write - path contactId (required): Domain contact UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Domain contact deletion result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/ssh/keys Browse SSH keys Operation ID: listSshKeys Returns saved SSH keys for the customer account. Scopes: ssh.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: SSH key list. Illustrative response: ```json { "ok": true, "keys": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/ssh/keys Save SSH key Operation ID: sshKeyImport Stores a new public SSH key for later provisioning or VPS assignment. Scopes: ssh.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 }, "public_key": { "type": "string", "minLength": 1, "maxLength": 8192 } }, "required": [ "name", "public_key" ], "additionalProperties": false } ``` Response 201: Created SSH key. Illustrative response: ```json { "ok": true, "key": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/ssh/keys/generate Generate SSH keypair Operation ID: sshKeyGenerate Generates a new SSH keypair and returns the private key once. Scopes: ssh.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 }, "algorithm": { "type": "string", "minLength": 1 }, "format": { "type": "string", "minLength": 1 }, "passphrase": { "type": "string", "minLength": 8, "maxLength": 200 } }, "required": [ "name", "passphrase" ], "additionalProperties": false } ``` Response 201: Generated SSH keypair. Illustrative response: ```json { "ok": true, "key": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": true, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" }, "privateKey": "" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/ssh/keys/{id}/public View public key Operation ID: sshKeyPublic Returns the public portion of one saved SSH key. Scopes: ssh.read - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Public SSH key material. Illustrative response: ```json { "ok": true, "id": "00000000-0000-4000-8000-000000000001", "publicKey": "" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/ssh/keys/{id}/private Export private key Operation ID: sshKeyPrivateExport Exports the private portion of a generated SSH key when the correct passphrase is supplied. Scopes: ssh.write - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "passphrase": { "type": "string", "minLength": 1, "maxLength": 200 } }, "required": [ "passphrase" ], "additionalProperties": false } ``` Response 200: Private SSH key export result. Illustrative response: ```json { "ok": true, "privateKey": "" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/ssh/keys/{id} Edit SSH key Operation ID: sshKeyUpdate Replaces the name and public key material of an existing SSH key record. Scopes: ssh.write - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 }, "public_key": { "type": "string", "minLength": 1, "maxLength": 8192 } }, "required": [ "name", "public_key" ], "additionalProperties": false } ``` Response 200: Updated SSH key. Illustrative response: ```json { "ok": true, "key": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/ssh/keys/{id} Rename SSH key Operation ID: sshKeyRename Changes only the display name of an SSH key. Scopes: ssh.write - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 } }, "required": [ "name" ], "additionalProperties": false } ``` Response 200: Renamed SSH key. Illustrative response: ```json { "ok": true, "key": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example key", "algorithm": "ed25519", "fingerprint": "SHA256:example-fingerprint", "isPrimary": false, "hasPrivateKey": false, "createdAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/ssh/keys/{id} Remove SSH key Operation ID: sshKeyDelete Deletes an SSH key from the customer account. Scopes: ssh.write - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: SSH key deletion result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PUT /v1/ssh/keys/{id}/primary Set primary SSH key Operation ID: sshKeySetPrimary Marks one SSH key as the primary default choice for relevant workflows. Scopes: ssh.write - path id (required): SSH key UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Updated primary SSH key. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/firewall/policies Browse firewall policies Operation ID: listFirewallPolicies Returns reusable firewall policies available to the customer. Scopes: firewall.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Firewall policy list. Illustrative response: ```json { "ok": true, "policies": [ { "id": "00000000-0000-4000-8000-000000000001", "name": "Example policy", "description": null, "isPrimary": false, "policyIn": "DROP", "policyOut": "ACCEPT", "rules": [] } ] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/firewall/policies Save firewall policy Operation ID: firewallPolicyCreate Creates a reusable firewall policy with default actions and optional rules. Scopes: firewall.write - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "description": { "type": "string", "maxLength": 500 }, "policy_in": { "type": "string", "enum": [ "DROP", "ACCEPT" ] }, "policy_out": { "type": "string", "enum": [ "DROP", "ACCEPT" ] }, "rules": { "type": "array", "items": { "type": "object", "properties": { "direction": { "type": "string", "enum": [ "IN", "OUT" ] }, "type": { "type": "string", "enum": [ "in", "out" ] }, "action": { "type": "string", "enum": [ "ACCEPT", "DROP", "REJECT" ] }, "proto": { "type": "string", "enum": [ "tcp", "udp", "icmp", "TCP", "UDP", "ICMP", "any", "all", "ANY", "ALL" ] }, "dport": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "sport": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "source": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "destination": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "dest": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "comment": { "type": "string", "maxLength": 200 }, "enabled": { "anyOf": [ { "type": "boolean" }, { "type": "string" }, { "type": "number" } ] }, "enable": { "anyOf": [ { "type": "boolean" }, { "type": "string" }, { "type": "number" } ] }, "iface": { "type": "string", "maxLength": 64 }, "log": { "type": "string", "maxLength": 64 } }, "required": [ "action" ], "additionalProperties": false } }, "is_primary": { "type": "boolean" } }, "required": [ "name" ], "additionalProperties": false } ``` Response 200: Created firewall policy. Illustrative response: ```json { "ok": true, "policy": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example policy", "description": null, "isPrimary": false, "policyIn": "DROP", "policyOut": "ACCEPT", "rules": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### PATCH /v1/firewall/policies/{policyId} Edit firewall policy Operation ID: firewallPolicyUpdate Updates policy metadata or replaces rules when a new rule list is provided. Scopes: firewall.write - path policyId (required): Firewall policy UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "description": { "type": "string", "maxLength": 500 }, "policy_in": { "type": "string", "enum": [ "DROP", "ACCEPT" ] }, "policy_out": { "type": "string", "enum": [ "DROP", "ACCEPT" ] }, "rules": { "type": "array", "items": { "type": "object", "properties": { "direction": { "type": "string", "enum": [ "IN", "OUT" ] }, "type": { "type": "string", "enum": [ "in", "out" ] }, "action": { "type": "string", "enum": [ "ACCEPT", "DROP", "REJECT" ] }, "proto": { "type": "string", "enum": [ "tcp", "udp", "icmp", "TCP", "UDP", "ICMP", "any", "all", "ANY", "ALL" ] }, "dport": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "sport": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "source": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "destination": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "dest": { "anyOf": [ { "type": "string" }, { "type": "number" } ] }, "comment": { "type": "string", "maxLength": 200 }, "enabled": { "anyOf": [ { "type": "boolean" }, { "type": "string" }, { "type": "number" } ] }, "enable": { "anyOf": [ { "type": "boolean" }, { "type": "string" }, { "type": "number" } ] }, "iface": { "type": "string", "maxLength": 64 }, "log": { "type": "string", "maxLength": 64 } }, "required": [ "action" ], "additionalProperties": false } } }, "additionalProperties": false } ``` Response 200: Updated firewall policy. Illustrative response: ```json { "ok": true, "policy": { "id": "00000000-0000-4000-8000-000000000001", "name": "Example policy", "description": null, "isPrimary": false, "policyIn": "DROP", "policyOut": "ACCEPT", "rules": [] } } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### DELETE /v1/firewall/policies/{policyId} Remove firewall policy Operation ID: firewallPolicyDelete Deletes a reusable firewall policy. Scopes: firewall.write - path policyId (required): Firewall policy UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Firewall policy deletion result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/firewall/policies/{policyId}/primary Set primary firewall policy Operation ID: firewallPolicySetPrimary Marks a firewall policy as the primary default policy. Scopes: firewall.write - path policyId (required): Firewall policy UUID. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Primary policy update result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/vps/{serviceId}/firewall/policy View VPS firewall policy Operation ID: getVpsFirewallPolicy Returns the effective firewall policy selection for a VPS. Scopes: vps.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Effective firewall policy. Illustrative response: ```json { "ok": true, "requestedPolicyId": null, "primaryPolicyId": "00000000-0000-4000-8000-000000000001", "effectivePolicyId": "00000000-0000-4000-8000-000000000001", "effectiveMode": "primary" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/vps/{serviceId}/firewall/policy/apply Apply policy to VPS Operation ID: vpsFirewallPolicyApply Applies a selected firewall policy to a VPS service. Scopes: vps.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "policy_id": { "type": "string", "minLength": 1, "maxLength": 128 } }, "required": [ "policy_id" ], "additionalProperties": false } ``` Response 200: Firewall policy apply result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/storage/volumes Browse storage volumes Operation ID: listStorageVolumes Returns customer-visible storage volumes. Scopes: storage.read - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Storage volume list. Illustrative response: ```json { "ok": true, "items": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### GET /v1/storage/volumes/{serviceId}/attach-options View attach options Operation ID: storageVolumeAttachOptions Returns eligible target services or VMs that can accept the selected volume. Scopes: storage.read - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Volume attach options. Illustrative response: ```json { "ok": true, "items": [] } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/storage/volumes/{serviceId}/attach Attach volume Operation ID: storageVolumeAttach Attaches the selected volume to a target service. Scopes: storage.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "target_service_id": { "type": "string", "format": "uuid" } }, "required": [ "target_service_id" ], "additionalProperties": false } ``` Response 200: Volume attach result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/storage/volumes/{serviceId}/detach Detach volume Operation ID: storageVolumeDetach Detaches the selected volume from its current target. Scopes: storage.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. Response 200: Volume detach result. Illustrative response: ```json { "ok": true } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ``` ### POST /v1/storage/volumes/{serviceId}/rename Rename volume Operation ID: storageVolumeRename Changes the customer-visible volume name. Scopes: storage.write - path serviceId (required): Customer-visible UUID of the service you want to inspect or change. - header x-client-request-id (optional): Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key. - header x-ts (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-nonce (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-content-sha256 (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. - header x-signature (optional): Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually. JSON body (required) ```json { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64 } }, "required": [ "name" ], "additionalProperties": false } ``` Response 200: Volume rename result. Illustrative response: ```json { "ok": true, "billingServiceId": "00000000-0000-4000-8000-000000000001", "name": "Example volume" } ``` Response default: Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown. Illustrative response: ```json { "ok": false, "error": { "code": "scope_denied", "message": "Required scope is missing", "request_id": "00000000-0000-4000-8000-000000000001", "field_errors": [] } } ```