API endpoint reference
Find each public endpoint's parameters, required permissions and responses.
BlazingFast Customer API
Automate account billing, VPS and dedicated servers, DNS and Website Protection, TCP Proxy, domains, SSH keys, firewall policies and storage. Use an official SDK for HMAC-signed requests, or a bearer-mode API key. Generic OpenAPI-generated clients do not implement BlazingFast HMAC signing automatically. Pagination is endpoint-specific: follow the documented page/limit, cursor/next_cursor or offset/next_offset model. limit is the canonical page-size parameter; page_size and pageSize are deprecated compatibility aliases only where documented. Begin by reading the resource, confirm changes, and inspect the result or returned task. Draft order creation does not charge the account. Atomic deployment is the documented exception: order + full final order amount paid from account balance + queued provisioning. Payment is not successful provisioning; accepted is not completed. Access depends on key scopes and account permissions.
Catalog
Simple read-only discovery of regions, flat products and eligible operating-system images. Requires an authenticated API key.
Authentication
SignedAuth
SignedAuth is represented by x-api-key for discovery only. Generic OpenAPI-generated clients do not automatically implement BlazingFast HMAC signing. Use BearerAuth with a bearer-mode credential or an official SDK, unless you implement the signing algorithm manually. Signed-key mode requires all five headers. SDKs send x-api-key, x-ts (Unix seconds), x-nonce, x-content-sha256 (Base64 SHA-256 of the exact body), and x-signature (Base64 HMAC-SHA256). Custom signing is explained in the API authentication guide. Every HTTP attempt needs a fresh timestamp and nonce; an action retry retains its original idempotency key and payload. Key expiry, IP restrictions, account permissions and scopes still apply.
BearerAuth
Alternative mode for integrations that prefer Authorization: Bearer <prefix.secret>. Key status, expiry, scope checks, IP policy, and rate limits still apply.
Endpoints
/v1/dedicated/images
List dedicated images
Operation ID: dedicatedImages
Returns compatible OS profile IDs for public dedicated configurations with available stock. Filter by region and configuration_code from the product catalog. An image ID can occur in several configurations; preserve its region/configuration context. Supply the numeric id as osProfileId when creating a dedicated deployment.
Parameters
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
region- Region code from GET /v1/regions, for example nl or pt. Case-insensitive.
configuration_code- Dedicated configuration code from GET /v1/products.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Compatible dedicated OS profiles with next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/images" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_REGION — query parameter region (optional). Region code from GET /v1/regions, for example nl or pt. Case-insensitive. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CONFIGURATION_CODE — query parameter configuration_code (optional). Dedicated configuration code from GET /v1/products. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": 1,
"name": "Debian 13",
"region": "pt",
"configuration_code": "EXAMPLE-PT",
"ssh_keys_supported": true
}
],
"next_offset": null
}Illustrative values, not a live result.
/v1/products
List products
Operation ID: products
Flat public, active product variants with public, active parent products. type is the high-level normalized service family; product_code is the more specific purchasable product family. tcp-proxy maps to type=other, waf to type=dns, and license to type=other. Do not substitute product_code values into a type filter. id is the readable SKU; product_id and variant_id are order identifiers. Region and type eligibility are applied before pagination. CPU is vCPUs for VPS or sockets for dedicated; ram is MiB and disk is GiB. billing_cycles contains server-configured or converted period prices in the requested currency, exact decimal strings, unit/count and setup_fee. price prefers the monthly option. Account currency governs quotes and orders. configuration_url discovers required fields, defaults, compatible OS choices, connectivity and IP add-ons. Add-ons and tax are excluded from catalog prices: quote the complete cart before ordering. Domain pricing requires a live domain quote. available is not a reservation; capacity_verified=false for VPS. Dedicated available_stock is known compatible stock. A backend outage returns partial=true, unavailable_types and availability=unknown where possible; unknown stock is null, not zero. Image/stock snapshots are cached internally up to 15 seconds; checkout revalidates.
Parameters
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
product_code- More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other.
region- Region code from GET /v1/regions, for example nl or pt. Case-insensitive.
type- High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code; applied before pagination.
currency- Configured pricing currency: EUR or USD, default EUR.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Flat product list with next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PRODUCT_CODE — query parameter product_code (optional). More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_REGION — query parameter region (optional). Region code from GET /v1/regions, for example nl or pt. Case-insensitive. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPE — query parameter type (optional). High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code; applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURRENCY — query parameter currency (optional). Configured pricing currency: EUR or USD, default EUR. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "8G",
"product_id": "00000000-0000-4000-8000-000000000001",
"variant_id": "00000000-0000-4000-8000-000000000002",
"name": "Example VPS",
"type": "vps",
"product_code": "vps",
"variant_code": "8G",
"region": "nl",
"regions": [
"nl"
],
"cpu": 4,
"cpu_unit": "vcpus",
"ram": 8192,
"ram_unit": "MiB",
"disk": 100,
"disk_unit": "GiB",
"price": "12.00",
"billing_cycle": "monthly",
"billing_cycles": [
{
"billing_cycle": "monthly",
"unit": "MONTH",
"count": 1,
"period_months": 1,
"price": "12.00",
"setup_fee": "0",
"currency": "EUR"
},
{
"billing_cycle": "quarterly",
"unit": "QUARTAL",
"count": 1,
"period_months": 3,
"price": "30.00",
"setup_fee": "0",
"currency": "EUR"
}
],
"currency": "EUR",
"available": true,
"capacity_verified": false,
"configuration_code": null,
"available_stock": null
}
],
"next_offset": null
}Illustrative values, not a live result.
/v1/products/{region}
List products in a region
Operation ID: getProductsByRegion
Flat public, active product variants with public, active parent products. type is the high-level normalized service family; product_code is the more specific purchasable product family. tcp-proxy maps to type=other, waf to type=dns, and license to type=other. Do not substitute product_code values into a type filter. id is the readable SKU; product_id and variant_id are order identifiers. Region and type eligibility are applied before pagination. CPU is vCPUs for VPS or sockets for dedicated; ram is MiB and disk is GiB. billing_cycles contains server-configured or converted period prices in the requested currency, exact decimal strings, unit/count and setup_fee. price prefers the monthly option. Account currency governs quotes and orders. configuration_url discovers required fields, defaults, compatible OS choices, connectivity and IP add-ons. Add-ons and tax are excluded from catalog prices: quote the complete cart before ordering. Domain pricing requires a live domain quote. available is not a reservation; capacity_verified=false for VPS. Dedicated available_stock is known compatible stock. A backend outage returns partial=true, unavailable_types and availability=unknown where possible; unknown stock is null, not zero. Image/stock snapshots are cached internally up to 15 seconds; checkout revalidates. Applies region restrictions on the server before pagination. A conflicting region query parameter is rejected.
Parameters
region- Region code, for example nl or pt; all includes every eligible region.
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
product_code- More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other.
type- High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code.
currency- Configured pricing currency: EUR or USD, default EUR.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Region-filtered flat product list with next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Region code, for example nl or pt; all includes every eligible region.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PRODUCT_CODE — query parameter product_code (optional). More specific purchasable product family; distinct from type. tcp-proxy maps to other, waf to dns, license to other. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPE — query parameter type (optional). High-level normalized type filter; tcp-proxy/license use other and waf uses dns. Distinct from product_code. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURRENCY — query parameter currency (optional). Configured pricing currency: EUR or USD, default EUR. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "8G",
"product_id": "00000000-0000-4000-8000-000000000001",
"variant_id": "00000000-0000-4000-8000-000000000002",
"name": "Example VPS",
"type": "vps",
"product_code": "vps",
"variant_code": "8G",
"region": "nl",
"regions": [
"nl"
],
"cpu": 4,
"cpu_unit": "vcpus",
"ram": 8192,
"ram_unit": "MiB",
"disk": 100,
"disk_unit": "GiB",
"price": "12.00",
"billing_cycle": "monthly",
"billing_cycles": [
{
"billing_cycle": "monthly",
"unit": "MONTH",
"count": 1,
"period_months": 1,
"price": "12.00",
"setup_fee": "0",
"currency": "EUR"
},
{
"billing_cycle": "quarterly",
"unit": "QUARTAL",
"count": 1,
"period_months": 3,
"price": "30.00",
"setup_fee": "0",
"currency": "EUR"
}
],
"currency": "EUR",
"available": true,
"capacity_verified": false,
"configuration_code": null,
"available_stock": null
}
],
"next_offset": null
}Illustrative values, not a live result.
/v1/products/{region}/{productCode}/{variantCode}
Read a product by public code
Operation ID: getProduct
Exact eligible region/family/SKU lookup. Returns safe hardware, public billing prices, availability, order UUIDs and links to prices/options/quote/deployment. Duplicate public SKUs in the family/region return catalog_variant_ambiguous (409); no plan is silently selected. Missing or hidden plans return 404. Provider outages may return unknown availability; they are never represented as known zero stock. This read is not a reservation.
Parameters
region- Eligible region, for example nl or pt. A single region is required.
productCode- Product family.
variantCode- Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
currency- Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Exact public plan and discovery links.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}/${BF_PATH_PRODUCT_CODE}/${BF_PATH_VARIANT_CODE}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Eligible region, for example nl or pt. A single region is required.
BF_PATH_PRODUCT_CODE — path parameter productCode (required). Product family.
BF_PATH_VARIANT_CODE — path parameter variantCode (required). Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
BF_QUERY_CURRENCY — query parameter currency (optional). Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "8G",
"product_id": "00000000-0000-4000-8000-000000000001",
"variant_id": "00000000-0000-4000-8000-000000000002",
"name": "Example VPS",
"type": "vps",
"product_code": "vps",
"variant_code": "8G",
"region": "nl",
"regions": [
"nl"
],
"cpu": 4,
"cpu_unit": "vcpus",
"ram": 8192,
"ram_unit": "MiB",
"disk": 100,
"disk_unit": "GiB",
"price": "12.00",
"billing_cycle": "monthly",
"billing_cycles": [
{
"billing_cycle": "monthly",
"unit": "MONTH",
"count": 1,
"period_months": 1,
"price": "12.00",
"setup_fee": "0",
"currency": "EUR"
},
{
"billing_cycle": "quarterly",
"unit": "QUARTAL",
"count": 1,
"period_months": 3,
"price": "30.00",
"setup_fee": "0",
"currency": "EUR"
}
],
"currency": "EUR",
"available": true,
"capacity_verified": false,
"configuration_code": null,
"available_stock": null,
"prices_url": "/v1/products/nl/vps/8G/prices",
"options_url": "/v1/products/nl/vps/8G/options",
"quote_url": "/v1/billing/orders/preview",
"deploy_url": "/v1/deploy/nl/vps/8G"
}
}Illustrative values, not a live result.
/v1/products/{region}/{productCode}/{variantCode}/options
Read configuration options by public code
Operation ID: productOptions
Same authoritative configuration discovery as the UUID order-options endpoint, resolved by eligible region, family and exact SKU. Returns required inputs, defaults, compatible OS choices, owned SSH-key selection fields, connectivity options and IP/add-on limits. No private provider settings, inventory identities or credentials. Discovery does not reserve stock or pay.
Parameters
region- Eligible region, for example nl or pt. A single region is required.
productCode- Product family.
variantCode- Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
currency- Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Validated public order options with exact order UUIDs.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}/${BF_PATH_PRODUCT_CODE}/${BF_PATH_VARIANT_CODE}/options" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Eligible region, for example nl or pt. A single region is required.
BF_PATH_PRODUCT_CODE — path parameter productCode (required). Product family.
BF_PATH_VARIANT_CODE — path parameter variantCode (required). Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
BF_QUERY_CURRENCY — query parameter currency (optional). Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"region": "nl",
"product_code": "vps",
"variant_code": "8G",
"productId": "00000000-0000-4000-8000-000000000001",
"variantId": "00000000-0000-4000-8000-000000000002",
"supported": true,
"capacityVerified": false,
"requiredFields": [
{
"field": "hostname",
"label": "Hostname",
"description": "Server hostname.",
"format": "hostname"
},
{
"field": "location",
"label": "Location",
"description": "Location code."
},
{
"field": "os.code",
"label": "Operating system",
"description": "Operating system code."
}
],
"locations": [
{
"code": "NL",
"name": "Netherlands",
"operatingSystems": [
{
"code": "debian-13",
"name": "Debian",
"family": "debian",
"version": "13",
"arch": "amd64",
"isDefault": true
}
]
}
]
}Illustrative values, not a live result.
/v1/products/{region}/{productCode}/{variantCode}/prices
Read billing prices by public code
Operation ID: productPrices
Base-plan prices only, as exact decimal strings with unit/count, setup_fee and currency. Optional billing_cycle filters configured periods; an unavailable period returns billing_cycle_not_available (400). An omitted period returns all public prices in the requested currency. Add-ons and tax require POST /v1/billing/orders/preview using the returned order UUIDs. Domain prices require a domain quote. price_scope=base_plan is not a final payable amount.
Parameters
region- Eligible region, for example nl or pt. A single region is required.
productCode- Product family.
variantCode- Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
currency- Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency.
billing_cycle- Optional billing period from the returned values.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Configured billing prices; never a fabricated price for a missing period.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}/${BF_PATH_PRODUCT_CODE}/${BF_PATH_VARIANT_CODE}/prices" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Eligible region, for example nl or pt. A single region is required.
BF_PATH_PRODUCT_CODE — path parameter productCode (required). Product family.
BF_PATH_VARIANT_CODE — path parameter variantCode (required). Exact case-sensitive public SKU, for example 2G or PTV4-1. Never an internal inventory ID.
BF_QUERY_CURRENCY — query parameter currency (optional). Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_BILLING_CYCLE — query parameter billing_cycle (optional). Optional billing period from the returned values. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"region": "nl",
"product_code": "vps",
"variant_code": "8G",
"currency": "EUR",
"prices": [
{
"billing_cycle": "monthly",
"unit": "MONTH",
"count": 1,
"period_months": 1,
"price": "12.00",
"setup_fee": "0",
"currency": "EUR"
},
{
"billing_cycle": "quarterly",
"unit": "QUARTAL",
"count": 1,
"period_months": 3,
"price": "30.00",
"setup_fee": "0",
"currency": "EUR"
}
],
"price_scope": "base_plan",
"pricing_mode": "configured",
"quote_url": "/v1/billing/orders/preview"
}Illustrative values, not a live result.
/v1/products/{region}/list
List product codes by region
Operation ID: productCodes
Compact grouped public variant codes: products maps each family to an array of exact SKUs. Region eligibility is applied before pagination. limit counts variants across all families, not families; default 50. Follow next_offset until null and merge groups. Codes do not prove available stock; read the variant details and options. all includes all eligible regions; use a specific region for details and deployment. partial=true means collection is incomplete, not known zero stock. Existing flat catalog endpoints remain unchanged.
Parameters
region- Region code or all.
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
currency- Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Grouped family/SKU discovery with continuation.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}/list" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Region code or all.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURRENCY — query parameter currency (optional). Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"region": "nl",
"products": {
"vps": [
"8G"
]
},
"next_offset": null
}Illustrative values, not a live result.
/v1/products/{region}/list/{productCode}
List variant codes for a family
Operation ID: getProductsByRegionListByProductCode
Same compact grouped response, restricted to the selected product family before pagination. An empty family array means no matching public plans on this page. Read detail availability separately; this does not reserve stock.
Parameters
region- Eligible region, for example nl or pt. A single region is required.
productCode- Product family.
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
currency- Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Selected family and exact SKUs with continuation.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/products/${BF_PATH_REGION}/list/${BF_PATH_PRODUCT_CODE}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_REGION — path parameter region (required). Eligible region, for example nl or pt. A single region is required.
BF_PATH_PRODUCT_CODE — path parameter productCode (required). Product family.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURRENCY — query parameter currency (optional). Pricing currency: EUR or USD; defaults to EUR. Quotes and orders use account currency. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"region": "nl",
"products": {
"vps": [
"8G"
]
},
"next_offset": null
}Illustrative values, not a live result.
/v1/regions
List regions
Operation ID: regions
Lists regions with VPS image choices or public orderable dedicated stock. Codes are lowercase; this does not reserve capacity.
Parameters
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Region list with next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/regions" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "nl",
"name": "Netherlands"
},
{
"id": "pt",
"name": "Portugal"
}
],
"next_offset": null
}Illustrative values, not a live result.
/v1/vps/images
List VPS images
Operation ID: vpsImages
Returns VM-template OS codes and their region, family, version, architecture and default flag, without internal template references. Optional product_id and variant_id must be supplied together to restrict to a public VPS plan and its region. For full plan-specific configuration use the existing order-options endpoint. compatibility_verified=false means this is catalog discovery, not a physical capacity or placement guarantee. New VPS order configuration uses userConfig.os.code and uppercase userConfig.location.
Parameters
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
region- Region code from GET /v1/regions, for example nl or pt. Case-insensitive.
product_id- Public product UUID; supply with variant_id.
variant_id- Public VPS variant UUID; supply with product_id.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
VPS OS images with next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/vps/images" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_REGION — query parameter region (optional). Region code from GET /v1/regions, for example nl or pt. Case-insensitive. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PRODUCT_ID — query parameter product_id (optional). Public product UUID; supply with variant_id. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_VARIANT_ID — query parameter variant_id (optional). Public VPS variant UUID; supply with product_id. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "debian-13",
"name": "Debian",
"family": "debian",
"version": "13",
"arch": "amd64",
"is_default": true,
"region": "nl"
}
],
"next_offset": null,
"compatibility_verified": false
}Illustrative values, not a live result.
Errors and safe retries
Use HTTP status and error.code for decisions. The canonical envelope contains error.message, error.request_id and error.field_errors. Flat code, message, request_id, field_errors, details and status fields are legacy compatibility fields and may still appear; new integrations should read the nested error.
json
{
"ok": false,
"error": {
"code": "scope_denied",
"message": "Required scope is missing",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Error code reference
Server failures and interrupted connections
Generic API server failures intentionally omit internal error codes and provider details and use the same nested envelope with service_unavailable. An edge/network failure can also return non-JSON or no response at all.
json
{
"ok": false,
"error": {
"code": "service_unavailable",
"message": "The service is temporarily unavailable.",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Read-only GET requests can be retried with bounded backoff and jitter. SDKs perform limited retries for selected transient read failures; they do not automatically retry writes. A timeout or 5xx on a write does not prove it failed: check the resource, invoice or task before retrying. Where supported, reuse the same Idempotency-Key and identical request. Do not create a new operation key just because the response was lost.
For 429, honor the HTTP Retry-After header. SDK timeout, network_error and response_too_large codes describe client-side failures, not API error responses. For persistent errors, send support the request ID, HTTP status, method, endpoint and UTC time—never API secrets or passwords.
See error handling in PHP, Node.js, Python and GoThis reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the OpenAPI JSON for client generation.
Use the integration guide for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself.
Current purchase and operation workflows
SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount.
Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state.
Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See HTTP, SDK, CLI and MCP examples. DNSSEC uses its separate endpoint and state contract.
Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented.
For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation.
API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests.
On this page