API, SDKs & AI assistants

API reference

Dedicated Servers

API endpoint reference

Find each public endpoint's parameters, required permissions and responses.

OpenAPI 3.1.0

Version v1

BlazingFast Customer API

Automate account billing, VPS and dedicated servers, DNS and Website Protection, TCP Proxy, domains, SSH keys, firewall policies and storage. Use an official SDK for HMAC-signed requests, or a bearer-mode API key. Generic OpenAPI-generated clients do not implement BlazingFast HMAC signing automatically. Pagination is endpoint-specific: follow the documented page/limit, cursor/next_cursor or offset/next_offset model. limit is the canonical page-size parameter; page_size and pageSize are deprecated compatibility aliases only where documented. Begin by reading the resource, confirm changes, and inspect the result or returned task. Draft order creation does not charge the account. Atomic deployment is the documented exception: order + full final order amount paid from account balance + queued provisioning. Payment is not successful provisioning; accepted is not completed. Access depends on key scopes and account permissions.

Base URL: https://api.blazingfast.io

Download schema Endpoint examples Integration guide and SDK workflows Error codes API workflow Pagination

Category summary

Dedicated Servers

17 endpoints

Browse dedicated server options, create unpaid deployments, inspect progress and tasks, and manage power, reinstall, rescue or password reset. Reinstall erases disks. Credential reads require separate permissions and must not be logged.

Authentication

apiKey

SignedAuth

SignedAuth is represented by x-api-key for discovery only. Generic OpenAPI-generated clients do not automatically implement BlazingFast HMAC signing. Use BearerAuth with a bearer-mode credential or an official SDK, unless you implement the signing algorithm manually. Signed-key mode requires all five headers. SDKs send x-api-key, x-ts (Unix seconds), x-nonce, x-content-sha256 (Base64 SHA-256 of the exact body), and x-signature (Base64 HMAC-SHA256). Custom signing is explained in the API authentication guide. Every HTTP attempt needs a fresh timestamp and nonce; an action retry retains its original idempotency key and payload. Key expiry, IP restrictions, account permissions and scopes still apply.

http

bearer

api-key-secret

BearerAuth

Alternative mode for integrations that prefer Authorization: Bearer <prefix.secret>. Key status, expiry, scope checks, IP policy, and rate limits still apply.

Endpoints

POST

/v1/dedicated/deployments

Create dedicated deployment

Operation ID: dedicatedDeploy

Creates an unpaid order and invoice using catalog configurationCode, regionCode, numeric osProfileId, hostname, optional owned sshKeyId, billing and selectable add-ons. Use order-options to discover valid add-on keys and quantities, and preview the same complete configuration before ordering. Provisioning begins only after payment and any configured approval. Never invent configuration or OS IDs.

SignedAuth (dedicated.write)

BearerAuth (dedicated.write)

Parameters

Idempotency-Key HeaderstringRequired: Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

Required

application/json

application/json schema

{
  "type": "object",
  "properties": {
    "configuration_code": {
      "type": "string",
      "minLength": 1,
      "maxLength": 160
    },
    "region_code": {
      "type": "string",
      "pattern": "^[A-Z0-9-]{2,16}$"
    },
    "os_profile_id": {
      "type": "integer",
      "exclusiveMinimum": 0
    },
    "hostname": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "pattern": "^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"
    },
    "ssh_key_id": {
      "type": "string",
      "format": "uuid"
    },
    "addons": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "key": {
            "type": "string",
            "minLength": 1,
            "maxLength": 120,
            "pattern": "^[A-Za-z0-9_.:-]+$"
          },
          "qty": {
            "type": "integer",
            "minimum": 1,
            "maximum": 100
          }
        },
        "required": [
          "key",
          "qty"
        ],
        "additionalProperties": false
      },
      "maxItems": 50
    },
    "currency": {
      "type": "string",
      "enum": [
        "EUR",
        "USD"
      ],
      "default": "EUR"
    },
    "billing": {
      "type": "object",
      "properties": {
        "unit": {
          "type": "string",
          "enum": [
            "MONTH",
            "QUARTAL",
            "SEMIANNUAL",
            "YEAR"
          ],
          "default": "MONTH"
        },
        "count": {
          "type": "integer",
          "minimum": 1,
          "maximum": 120,
          "default": 1
        }
      },
      "additionalProperties": false,
      "default": {
        "unit": "MONTH",
        "count": 1
      }
    }
  },
  "required": [
    "configuration_code",
    "region_code",
    "os_profile_id",
    "hostname"
  ],
  "additionalProperties": false
}

Responses

201

application/json

Created order and invoice; not yet installed.

default

application/json

Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.

Request example

bash

curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dedicated/deployments" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"configuration_code":"example","region_code":"example","os_profile_id":1,"hostname":"server.example.com"}'

Setup and request inputs

Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_REQUEST_KEY — header parameter Idempotency-Key (required). Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.

BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.

Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.

Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.

Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.

Example response · HTTP 201

json

{
  "ok": true,
  "orderId": "00000000-0000-4000-8000-000000000001",
  "invoiceId": "00000000-0000-4000-8000-000000000002",
  "invoiceNumber": "INV-EXAMPLE-000001",
  "total": "100.00",
  "currency": "EUR",
  "status": "unpaid",
  "deploymentStatusUrl": "/v1/dedicated/deployments/00000000-0000-4000-8000-000000000001",
  "message": "Invoice created. Provisioning begins after payment and any configured approval."
}

Illustrative values, not a live result.

POST

/v1/dedicated/{serviceId}/password-reset

Reset dedicated password

Operation ID: dedicatedPasswordReset

Interrupts connections while maintenance replaces the OS administrator password. Track the returned task; retrieve the result privately only after success.

SignedAuth (dedicated.write)

BearerAuth (dedicated.write)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key HeaderstringRequired: Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-bf-response-format HeaderstringOptional: Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

202

application/json

Queued password reset.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/password-reset" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

BF_HEADER_X_BF_RESPONSE_FORMAT — header parameter x-bf-response-format (optional). Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll.

Example response · HTTP 202

json

{
  "ok": true,
  "operation": {
    "id": "00000000-0000-4000-8000-000000000002",
    "state": "waiting_provider"
  },
  "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
  "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE"
}

Illustrative values, not a live result. Accepted for processing; check the returned task or operation before treating it as complete.

POST

/v1/dedicated/{serviceId}/power

Queue power action

Operation ID: dedicatedPower

Body action: start, stop, restart or exit_rescue. Exiting rescue boots the installed system from disk. Interrupting actions require explicit intent. Task acceptance is not completion; inspect the returned task.

SignedAuth (dedicated.write)

BearerAuth (dedicated.write)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key HeaderstringRequired: Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-bf-response-format HeaderstringOptional: Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

Required

application/json

application/json schema

{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "start",
        "stop",
        "restart",
        "exit_rescue"
      ]
    }
  },
  "required": [
    "action"
  ],
  "additionalProperties": false
}

Responses

202

application/json

Queued power operation.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/power" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"action":"start"}'

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.

Example response · HTTP 202

json

{
  "ok": true,
  "operation": {
    "id": "00000000-0000-4000-8000-000000000002",
    "kind": "power_on",
    "state": "queued"
  },
  "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
  "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE"
}

Illustrative values, not a live result. Accepted for processing; check the returned task or operation before treating it as complete.

POST

/v1/dedicated/{serviceId}/reinstall

Erase and reinstall the server

Operation ID: dedicatedReinstall

Irreversibly overwrites installed data. Read compatible profiles first; use an account-owned SSH key when supported. Inspect the returned task rather than submitting another installation.

SignedAuth (dedicated.write)

BearerAuth (dedicated.write)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key HeaderstringRequired: Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-bf-response-format HeaderstringOptional: Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

Required

application/json

application/json schema

{
  "type": "object",
  "properties": {
    "profile_id": {
      "type": "integer",
      "exclusiveMinimum": 0
    },
    "hostname": {
      "type": "string",
      "pattern": "^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"
    },
    "ssh_key_id": {
      "type": "string",
      "format": "uuid"
    },
    "confirmation": {
      "type": "string",
      "const": "ERASE",
      "enum": [
        "ERASE"
      ]
    }
  },
  "required": [
    "profile_id",
    "confirmation"
  ],
  "additionalProperties": false
}

Responses

202

application/json

Queued reinstall operation.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/reinstall" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"profile_id":1,"confirmation":"ERASE"}'

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.

Example response · HTTP 202

json

{
  "ok": true,
  "operation": {
    "id": "00000000-0000-4000-8000-000000000002",
    "state": "waiting_provider"
  },
  "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
  "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE"
}

Illustrative values, not a live result. Accepted for processing; check the returned task or operation before treating it as complete.

POST

/v1/dedicated/{serviceId}/rescue

Boot a rescue environment

Operation ID: dedicatedRescue

Interrupts applications and connections; does not itself reinstall the OS. Use a compatible rescue profile, then exit_rescue to return to installed-system boot.

SignedAuth (dedicated.write)

BearerAuth (dedicated.write)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key HeaderstringRequired: Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-bf-response-format HeaderstringOptional: Opt into the canonical Operation receipt for this tracked write. Requires canonical_operation_responses enabled. Omit for the legacy response. Retried requests may replay their initial response format; use its operation_id or operation.id to poll.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

Required

application/json

application/json schema

{
  "type": "object",
  "properties": {
    "profile_id": {
      "type": "integer",
      "exclusiveMinimum": 0
    },
    "confirmation": {
      "type": "string",
      "const": "RESCUE",
      "enum": [
        "RESCUE"
      ]
    }
  },
  "required": [
    "profile_id",
    "confirmation"
  ],
  "additionalProperties": false
}

Responses

202

application/json

Queued rescue operation.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/rescue" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"profile_id":1,"confirmation":"RESCUE"}'

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.

Example response · HTTP 202

json

{
  "ok": true,
  "operation": {
    "id": "00000000-0000-4000-8000-000000000002",
    "state": "waiting_provider"
  },
  "operation_id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
  "operation_url": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE"
}

Illustrative values, not a live result. Accepted for processing; check the returned task or operation before treating it as complete.

GET

/v1/dedicated/{serviceId}

Check dedicated server

Operation ID: dedicatedStatus

Returns the owned server lifecycle, hardware, operating system, IP, power state, and recent operations.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Dedicated server status.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "lifecycleStatus": "active",
  "service": {
    "state": "active",
    "configurationCode": "EXAMPLE",
    "regionCode": "PT",
    "hostname": "server.example.com",
    "osName": "Debian 13",
    "hardware": {
      "lineName": "Example dedicated server",
      "cpuSockets": 2,
      "ramGb": 256,
      "storageGb": 240,
      "linkGbps": 10,
      "physicalLinkGbps": 10,
      "cpuDescription": "Example CPU",
      "ramDescription": "DDR4 ECC",
      "storageDescription": "SSD"
    },
    "primaryIp": "192.0.2.10",
    "power": "online",
    "powerCheckedAt": "2026-10-01T00:00:00.000Z",
    "rescueMode": false,
    "canManage": true,
    "canConsole": true,
    "canReinstall": true,
    "canRescue": true
  },
  "operations": []
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/console

Open browser console

Operation ID: dedicatedConsole

Returns an authenticated portal console URL. No provider address or VNC password is exposed. Sign in to connect.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Console URL and requiresBrowserLogin.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/console" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "serviceId": "00000000-0000-4000-8000-000000000001",
  "consoleUrl": "https://my.blazingfast.io/manage/dedicated/00000000-0000-4000-8000-000000000001/console",
  "requiresBrowserLogin": true,
  "transport": "browser"
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/credentials

Reveal current credentials

Operation ID: dedicatedCredentials

Explicit no-store credential endpoint. Returns the owned server IP, username, and current generated password after activation.

SignedAuth (dedicated.credentials.read)

BearerAuth (dedicated.credentials.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Dedicated server access credentials.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/credentials" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "serviceId": "00000000-0000-4000-8000-000000000001",
  "ip": "192.0.2.10",
  "username": "root",
  "password": "<generated-password>",
  "credentialKind": "activate",
  "operationId": "00000000-0000-4000-8000-000000000002"
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/password-reset-credential

Reveal reset password

Operation ID: dedicatedPasswordResetCredential

Explicit no-store endpoint returning the generated password after successful reset. Sensitive output: do not log or send to an AI conversation.

SignedAuth (dedicated.credentials.read)

BearerAuth (dedicated.credentials.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
operationId QuerystringOptional: Optional password-reset operation UUID.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

New dedicated server password.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/password-reset-credential" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

BF_QUERY_OPERATION_ID — query parameter operationId (optional). Optional password-reset operation UUID. Supply the unencoded value; only required query parameters are included in the snippet.

Example response · HTTP 200

json

{
  "ok": true,
  "operationId": "00000000-0000-4000-8000-000000000002",
  "password": "<generated-password>"
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/power-stats

Read electrical power statistics

Operation ID: dedicatedStats

Electrical consumption in watts, not CPU utilization. Any estimated energy value is not a billing meter. Hardware may not expose measurements.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Power statistics or unavailable result.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/power-stats" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "available": false,
  "period": "24h",
  "points": [],
  "summary": {
    "currentWatts": null,
    "averageWatts": null,
    "peakWatts": null,
    "estimatedKwh": null
  }
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/reinstall-options

List compatible installation images

Operation ID: dedicatedReinstallOptions

Read compatible numeric profile IDs before requesting reinstall. Reading options does not start an installation.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Compatible OS profiles.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/reinstall-options" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "enabled": true,
  "currentProfileId": 1,
  "profiles": [
    {
      "id": 1,
      "name": "Debian 13",
      "allowSshKeys": true
    }
  ]
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/rescue-options

List compatible rescue images

Operation ID: dedicatedRescueOptions

Read compatible numeric rescue profile IDs before requesting maintenance boot.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Compatible rescue profiles.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/rescue-options" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "enabled": true,
  "profiles": [
    {
      "id": 2,
      "name": "Example rescue image"
    }
  ]
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/tasks

List dedicated tasks

Operation ID: dedicatedTasks

Returns customer-visible operations for the owned server. Read history before repeating an uncertain action.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Dedicated task history.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/tasks" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "tasks": [
    {
      "id": "00000000-0000-4000-8000-000000000002",
      "kind": "reinstall",
      "status": "in_progress",
      "stage": "installing",
      "errorCode": null,
      "createdAt": "2026-10-01T00:00:00.000Z",
      "updatedAt": "2026-10-01T00:00:00.000Z"
    }
  ]
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/tasks/{taskId}

Check dedicated task

Operation ID: dedicatedTask

Returns bounded customer-safe status for a power or maintenance task.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
taskId PathstringRequired: Dedicated operation UUID.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Dedicated task status.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/tasks/${BF_PATH_TASK_ID}" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

BF_PATH_TASK_ID — path parameter taskId (required). Dedicated operation UUID.

Example response · HTTP 200

json

{
  "ok": true,
  "task": {
    "id": "00000000-0000-4000-8000-000000000002",
    "kind": "reinstall",
    "status": "in_progress",
    "stage": "installing",
    "errorCode": null,
    "createdAt": "2026-10-01T00:00:00.000Z",
    "updatedAt": "2026-10-01T00:00:00.000Z"
  }
}

Illustrative values, not a live result.

GET

/v1/dedicated/{serviceId}/traffic

Read network traffic

Operation ID: getDedicatedByServiceIdTraffic

Returns available network samples. Rates are bits per second and traffic totals are bytes. Missing statistics are not zero traffic. Does not report guest resource usage.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

serviceId PathstringRequired: Customer-visible UUID of the service you want to inspect or change.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Network statistics or unavailable result.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/${BF_PATH_SERVICE_ID}/traffic" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.

Example response · HTTP 200

json

{
  "ok": true,
  "available": false,
  "period": "24h",
  "interfaces": []
}

Illustrative values, not a live result.

GET

/v1/dedicated/catalog

Browse dedicated inventory

Operation ID: dedicatedCatalog

Returns currently sellable configurations, regions, hardware, billing periods, and compatible operating-system profiles.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Available dedicated inventory.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/catalog" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

Example response · HTTP 200

json

{
  "ok": true,
  "items": []
}

Illustrative values, not a live result.

GET

/v1/dedicated/deployments/{orderId}

Check deployment

Operation ID: dedicatedDeployment

Returns payment, provisioning, service, IP, power, OS, and operation state for a dedicated order without exposing its password.

SignedAuth (dedicated.read)

BearerAuth (dedicated.read)

Parameters

orderId PathstringRequired: Dedicated deployment order UUID.
x-client-request-id HeaderstringOptional: Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256 HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature HeaderstringRequired for SignedAuth: Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.

Request body

No request body

Responses

200

application/json

Dedicated deployment status.

default

application/json

Request example

bash

curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dedicated/deployments/${BF_PATH_ORDER_ID}" -H "Authorization: Bearer $BF_API_BEARER"

Setup and request inputs

Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.

BF_PATH_ORDER_ID — path parameter orderId (required). Dedicated deployment order UUID.

Example response · HTTP 200

json

{
  "ok": true,
  "deployment": {
    "orderId": "00000000-0000-4000-8000-000000000001",
    "orderStatus": "pending",
    "paymentStatus": "unpaid",
    "invoice": {
      "id": "00000000-0000-4000-8000-000000000001",
      "number": "INV-EXAMPLE-000001",
      "status": "unpaid",
      "total": "100.00",
      "paidTotal": "0.00",
      "currency": "EUR"
    },
    "serviceId": null,
    "serviceStatus": null,
    "ip": null,
    "power": null,
    "hostname": null,
    "osName": null,
    "operations": []
  }
}

Illustrative values, not a live result.

Errors and safe retries

Use HTTP status and error.code for decisions. The canonical envelope contains error.message, error.request_id and error.field_errors. Flat code, message, request_id, field_errors, details and status fields are legacy compatibility fields and may still appear; new integrations should read the nested error.

json

{
  "ok": false,
  "error": {
    "code": "scope_denied",
    "message": "Required scope is missing",
    "request_id": "00000000-0000-4000-8000-000000000001",
    "field_errors": []
  }
}

Error code reference

HTTP	Code	Meaning	What to do
409	`service_not_renewable`	The service lifecycle or billing mode does not allow fixed-cycle renewal.	Only active/suspended recurring services support renew-and-pay. One-time and wallet-metered services use their own billing flow.
409	`renewal_invoice_requires_review`	The open invoice is not a same-cycle, single-service renewal.	Review the invoice separately. Do not automatically pay an upgrade, purchase, changed-cycle or mixed-service invoice as renewal.
409	`renewal_price_limit_exceeded`	The outstanding renewal amount exceeds max_total.	No debit or new invoice was committed. Review the amount before raising the ceiling.
409	`service_changed_retry`	The service changed while its renewal was being prepared.	Reload service/invoice details and retry the same renewal key and body. Do not replace the key after an ambiguous outcome.
400	`unsupported_region`	This discovery region is not supported.	Select a region returned by /v1/regions. Use the same region for product, configuration and image discovery.
400	`billing_cycle_not_available`	The requested plan has no public price for this billing period and currency.	Read /prices without a billing_cycle filter and select one of the returned unit/count options.
409	`catalog_variant_ambiguous`	More than one eligible public plan has the same family and SKU.	Use the existing UUID-based catalog workflow or ask support to correct the duplicate SKU. Do not guess which plan to deploy.
503	`catalog_unavailable`	The catalog could not be read safely.	Retry with backoff. Never infer stock from an outage; a partial catalog marks unavailable service types explicitly.
503	`order_options_unavailable`	Configuration choices or an owned SSH key could not be checked.	Retry configuration discovery; do not create an order with guessed configuration.
503	`dedicated_catalog_unavailable`	Dedicated stock could not be checked.	Wait and refresh dedicated discovery. VPS discovery remains usable independently.
400	`order_config_invalid`	The selected product’s required configuration is missing or invalid.	Read its order-options and correct the fields reported in the response.
400	`price_not_found`	The selected currency or billing period is unavailable.	Use a current billing option and quote the same complete cart you intend to order.
400	`validation_error`	A field or request body is invalid.	Correct the fields identified in details. Do not retry an unchanged invalid request.
400	`idempotency_key_required`	This action needs a valid Idempotency-Key header.	Use 8–128 letters, digits, dots, underscores, colons or hyphens. Save the key for this intended operation.
400	`invalid_idempotency_key`	The supplied request key has an invalid format.	Correct its format before sending the request.
401 / 403	`unauthorized`	Credentials are missing, invalid, expired or revoked, or the authentication mode is wrong.	Check the key, mode and environment in Settings → API. Do not retry with unchanged credentials.
401	`invalid_signature`	The signature, body hash, timestamp or nonce could not be verified.	Use the SDK, synchronize the clock and sign each attempt with a fresh nonce. Keep the same operation request key when retrying a write.
403	`scope_denied`	The key lacks the permission required by this endpoint.	Grant only the required scope in Settings → API. A different service ID will not bypass ownership checks.
403	`ip_blocked`	The source IP is blocked or outside the key’s allowlist.	Check your actual outbound IP and the API key allowlist. Do not try to bypass restrictions with forwarded headers.
403	`service_disabled`	API access is disabled for the account.	Review the account’s API access settings or contact support.
404	`not_found`	The resource is unavailable to this account or does not exist.	Use an owned name or ID from your own discovery/list response and check the environment.
400	`invalid_domain_identifier`	The selector is not a valid domain name or service UUID.	Use a domain name, not a URL, IP, wildcard or hostname with a port.
409	`domain_identifier_ambiguous`	More than one eligible domain service matches that name in your account.	Select the intended service UUID from your own domain list.
409	`template_identifier_ambiguous`	Multiple DNS templates in your account (or the system fallback scope) match that name.	Use the exact UUID returned by the DNS template list. Other customers are never included.
400	`domain_identifier_mismatch`	The path domain differs from the domain in the query/body.	Use one consistent owned domain, or omit the redundant domain field for name-based Website Protection reads.
409	`idempotency_conflict`	A request key was reused for a different request.	Do not change the body or target of an existing operation. Use a new key only for a genuinely new intended operation.
409	`idempotency_in_progress`	The matching request is still processing.	Wait as directed by Retry-After, check resource/task status, and keep the same key and exact request.
429	`rate_limited`	The key has reached its request limit.	Honor Retry-After; back off with jitter and reduce polling. Do not parallelize retries.
409	`dedicated_configuration_unavailable`	The selected dedicated configuration, region or OS option is unavailable.	Refresh the dedicated catalog and choose a currently available option before preparing another order.
409	`dedicated_os_ssh_keys_not_supported`	The selected OS profile does not support SSH key installation.	Choose a compatible OS or omit the SSH key; never submit a private key.
404	`ssh_key_not_found`	The public SSH key is not available to this account.	List your SSH keys and use one of the returned IDs.
409	`ssh_key_not_available`	The selected SSH key has no usable public key.	Check or replace the public key before deployment/reinstallation.
502	`protection_update_unconfirmed`	A Website Protection write may have persisted, but its result is uncertain.	Check the protection state and change history before making another change. Preserve the request ID and changeId, if returned.
502	`country_policy_sync_incomplete`	The country policy was saved but is not enforced everywhere yet.	Read the saved rule and retry the same update. Do not treat saved=true as proof of full enforcement.
502	`proxy_policy_unavailable`	The country policy could not be confirmed.	Read the saved rule before retrying. State may be unknown.
502	`proxy_policy_response_invalid`	The country policy response could not be validated.	Read the saved rule before retrying and provide the request ID to support if it persists.

Server failures and interrupted connections

Generic API server failures intentionally omit internal error codes and provider details and use the same nested envelope with service_unavailable. An edge/network failure can also return non-JSON or no response at all.

json

{
  "ok": false,
  "error": {
    "code": "service_unavailable",
    "message": "The service is temporarily unavailable.",
    "request_id": "00000000-0000-4000-8000-000000000001",
    "field_errors": []
  }
}

Read-only GET requests can be retried with bounded backoff and jitter. SDKs perform limited retries for selected transient read failures; they do not automatically retry writes. A timeout or 5xx on a write does not prove it failed: check the resource, invoice or task before retrying. Where supported, reuse the same Idempotency-Key and identical request. Do not create a new operation key just because the response was lost.

For 429, honor the HTTP Retry-After header. SDK timeout, network_error and response_too_large codes describe client-side failures, not API error responses. For persistent errors, send support the request ID, HTTP status, method, endpoint and UTC time—never API secrets or passwords.

See error handling in PHP, Node.js, Python and Go

This reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the OpenAPI JSON for client generation.

Use the integration guide for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself.

Current purchase and operation workflows

SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount.

Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state.

Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See HTTP, SDK, CLI and MCP examples. DNSSEC uses its separate endpoint and state contract.

Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented.

For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation.

API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests.