API endpoint reference
Find each public endpoint's parameters, required permissions and responses.
BlazingFast Customer API
Automate account billing, VPS and dedicated servers, DNS and Website Protection, TCP Proxy, domains, SSH keys, firewall policies and storage. Use an official SDK for HMAC-signed requests, or a bearer-mode API key. Generic OpenAPI-generated clients do not implement BlazingFast HMAC signing automatically. Pagination is endpoint-specific: follow the documented page/limit, cursor/next_cursor or offset/next_offset model. limit is the canonical page-size parameter; page_size and pageSize are deprecated compatibility aliases only where documented. Begin by reading the resource, confirm changes, and inspect the result or returned task. Draft order creation does not charge the account. Atomic deployment is the documented exception: order + full final order amount paid from account balance + queued provisioning. Payment is not successful provisioning; accepted is not completed. Access depends on key scopes and account permissions.
Integrations
Version and capability discovery, credentials, OAuth connections, account audit and integration metadata.
Authentication
SignedAuth
SignedAuth is represented by x-api-key for discovery only. Generic OpenAPI-generated clients do not automatically implement BlazingFast HMAC signing. Use BearerAuth with a bearer-mode credential or an official SDK, unless you implement the signing algorithm manually. Signed-key mode requires all five headers. SDKs send x-api-key, x-ts (Unix seconds), x-nonce, x-content-sha256 (Base64 SHA-256 of the exact body), and x-signature (Base64 HMAC-SHA256). Custom signing is explained in the API authentication guide. Every HTTP attempt needs a fresh timestamp and nonce; an action retry retains its original idempotency key and payload. Key expiry, IP restrictions, account permissions and scopes still apply.
BearerAuth
Alternative mode for integrations that prefer Authorization: Bearer <prefix.secret>. Key status, expiry, scope checks, IP policy, and rate limits still apply.
Endpoints
/v1/api-credentials
Create a restricted API credential
Operation ID: apiCredentialCreate
Requires a stable Idempotency-Key. Requested scopes and allowed CIDRs cannot exceed the issuer; expiry is capped by the issuer. The secret is returned only on issuance or same-key retry within 24 hours. Managed MCP/support keys cannot delegate.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 80
},
"scopes": {
"type": "array",
"items": {
"type": "string",
"enum": [
"audit.read",
"api_credentials.read",
"api_credentials.write",
"oauth.connections.read",
"oauth.connections.write",
"billing.balance.read",
"billing.invoices.read",
"billing.orders.read",
"billing.products.read",
"billing.services.read",
"billing.services.write",
"billing.transactions.read",
"billing.unpaid_total.read",
"billing.order.create",
"billing.invoice.pay",
"vps.read",
"vps.credentials.read",
"vps.write",
"dedicated.read",
"dedicated.credentials.read",
"dedicated.write",
"dns.read",
"dns.write",
"domains.read",
"domains.write",
"ssh.read",
"ssh.write",
"firewall.read",
"firewall.write",
"storage.read",
"storage.write",
"tcp_proxy.read",
"tcp_proxy.write",
"webhooks.read",
"webhooks.write"
]
},
"minItems": 1,
"maxItems": 35
},
"mode": {
"type": "string",
"enum": [
"signed",
"bearer"
],
"default": "signed"
},
"ttl_days": {
"type": "integer",
"minimum": 1,
"maximum": 365,
"default": 30
},
"allowed_cidrs": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"maxLength": 64
},
"maxItems": 50
}
},
"required": [
"name",
"scopes"
],
"additionalProperties": false
}Responses
Created credential and signing secret.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/api-credentials" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","scopes":["audit.read"]}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 201
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example integration",
"prefix": "ak_EXAMPLE",
"mode": "signed",
"enabled": true,
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"revoked_at": null,
"last_used_at": null,
"last_used_ip": null,
"scopes": [
"billing.services.read"
],
"allowed_cidrs": []
},
"secret": "sk_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEX"
}Illustrative values, not a live result.
/v1/webhooks/{id}
Delete a webhook endpoint
Operation ID: webhookDelete
Deletes the endpoint and its delivery history. An in-flight attempt may finish. Use a new retry key for an intentional replacement.
Parameters
id- Owned endpoint UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Endpoint deleted.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/api-credentials/{id}
Update a restricted API credential
Operation ID: apiCredentialUpdate
Change name, scopes, expiry, enabled state or allowed CIDRs without exceeding the current issuer. Revoked or managed credentials cannot be reactivated.
Parameters
id- Owned credential UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 80
},
"scopes": {
"type": "array",
"items": {
"type": "string",
"enum": [
"audit.read",
"api_credentials.read",
"api_credentials.write",
"oauth.connections.read",
"oauth.connections.write",
"billing.balance.read",
"billing.invoices.read",
"billing.orders.read",
"billing.products.read",
"billing.services.read",
"billing.services.write",
"billing.transactions.read",
"billing.unpaid_total.read",
"billing.order.create",
"billing.invoice.pay",
"vps.read",
"vps.credentials.read",
"vps.write",
"dedicated.read",
"dedicated.credentials.read",
"dedicated.write",
"dns.read",
"dns.write",
"domains.read",
"domains.write",
"ssh.read",
"ssh.write",
"firewall.read",
"firewall.write",
"storage.read",
"storage.write",
"tcp_proxy.read",
"tcp_proxy.write",
"webhooks.read",
"webhooks.write"
]
},
"minItems": 1,
"maxItems": 35
},
"allowed_cidrs": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"maxLength": 64
},
"maxItems": 50
},
"enabled": {
"type": "boolean"
},
"expires_at": {
"type": "string",
"format": "date-time"
}
},
"additionalProperties": false
}Responses
Updated credential metadata.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/api-credentials/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","scopes":["audit.read"],"allowed_cidrs":["example"],"enabled":true,"expires_at":"example"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned credential UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example integration",
"prefix": "ak_EXAMPLE",
"mode": "signed",
"enabled": true,
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"revoked_at": null,
"last_used_at": null,
"last_used_ip": null,
"scopes": [
"billing.services.read"
],
"allowed_cidrs": []
}
}Illustrative values, not a live result.
/v1/api-credentials/{id}/rotate
Rotate an API credential
Operation ID: apiCredentialRotate
Requires Idempotency-Key. Replaces prefix and secret immediately; old authentication stops working. Use a different management key, or the dashboard, to rotate the key used by an integration. Self-rotation is rejected to avoid losing access after an interrupted response. Superseded receipts never reveal obsolete secrets.
Parameters
id- Owned ordinary credential UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {},
"additionalProperties": false
}Responses
Rotated credential and secret.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/api-credentials/${BF_PATH_ID}/rotate" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned ordinary credential UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example integration",
"prefix": "ak_EXAMPLE",
"mode": "signed",
"enabled": true,
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"revoked_at": null,
"last_used_at": null,
"last_used_ip": null,
"scopes": [
"billing.services.read"
],
"allowed_cidrs": []
},
"secret": "sk_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEX"
}Illustrative values, not a live result.
/v1/webhooks
Register a signed webhook
Operation ID: webhookCreate
HTTPS port 443, public IPv4 destinations only. Verified TLS, pinned DNS, no redirects. Events: invoice.paid, service.ready, service.suspended, service.terminated and operation.failed (Billing provisioning-job failures, not all power/reinstall failures). No historical backfill. Sensitive signing_secret is returned on creation or identical retry while the endpoint exists: never log it or send it to AI. At-least-once delivery: verify raw-body HMAC and timestamp, deduplicate event IDs, return 2xx promptly. Off by default until migration and worker deployment.
Parameters
Idempotency-Key- Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"maxLength": 2048
},
"events": {
"type": "array",
"items": {
"type": "string",
"enum": [
"invoice.paid",
"service.ready",
"service.suspended",
"service.terminated",
"operation.failed",
"operation.succeeded",
"operation.cancelled",
"invoice.created",
"invoice.overdue",
"service.provisioning",
"service.expiring",
"operation.started",
"backup.started",
"backup.completed",
"backup.failed",
"snapshot.created",
"snapshot.failed",
"dns.changed",
"service.power_changed",
"domain.verification_required",
"domain.renewal_pending",
"domain.renewed",
"domain.transfer_updated"
]
},
"minItems": 1,
"maxItems": 23
}
},
"required": [
"url",
"events"
],
"additionalProperties": false
}Responses
New endpoint and private signing secret.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/webhooks" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"url":"example","events":["invoice.paid"]}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 201
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"url": "https://example.com/hooks",
"events": [
"invoice.paid"
],
"enabled": true,
"createdAt": "2026-10-01T00:00:00.000Z"
},
"signing_secret": "whsec_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}Illustrative values, not a live result.
/v1/webhooks/{id}/deliveries/{deliveryId}/retry
Retry an exhausted delivery
Operation ID: webhookRetry
Only failed deliveries on your enabled endpoint can be retried. Pending/leased/successful events cannot be replayed; repeating this request returns delivery_not_retryable. Event ID is preserved.
Parameters
id- Owned endpoint UUID.
deliveryId- Failed delivery UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {},
"additionalProperties": false
}Responses
Delivery requeued.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}/deliveries/${BF_PATH_DELIVERY_ID}/retry" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_PATH_DELIVERY_ID — path parameter deliveryId (required). Failed delivery UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"delivery_id": "00000000-0000-4000-8000-000000000002",
"status": "pending"
}Illustrative values, not a live result.
/v1/webhooks/{id}/rotate-secret
Rotate webhook signing secret
Operation ID: webhookRotateSecret
Replaces the signing secret for an owned endpoint immediately. An already in-flight delivery may still use the old secret; accept both briefly at your receiver. Idempotency-Key is required. Identical retries return the same secret for 24 hours unless a subsequent rotation superseded it; superseded or expired keys never rotate again. Sensitive signing_secret: never log or send it to AI. Empty request body. Requires webhook_management capability.
Parameters
id- Owned endpoint UUID.
Idempotency-Key- Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {},
"additionalProperties": false
}Responses
New private signing secret.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}/rotate-secret" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"endpoint_id": "00000000-0000-4000-8000-000000000001",
"signing_secret": "whsec_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"rotated_at": "2026-10-01T00:00:00.000Z"
}Illustrative values, not a live result.
/v1/webhooks/{id}/test
Queue a signed webhook test
Operation ID: webhookTest
Queues a synthetic webhook.test event through the normal delivery worker. HTTP 202 means queued, not delivered. Read delivery history to check the result. Enabled owned endpoints only; one new test per endpoint per minute. Idempotency-Key is required; identical retries return the same delivery. Empty request body. Requires webhook_management capability.
Parameters
id- Owned endpoint UUID.
Idempotency-Key- Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {},
"additionalProperties": false
}Responses
Test event and delivery IDs.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}/test" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Stable action key: 8–128 letters, digits, dot, underscore, colon or hyphen. Reuse the same key and payload on retries; inspect task state after a timeout.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 202
json
{
"ok": true,
"endpoint_id": "00000000-0000-4000-8000-000000000001",
"delivery_id": "00000000-0000-4000-8000-000000000002",
"event_id": "00000000-0000-4000-8000-000000000002",
"status": "pending"
}Illustrative values, not a live result. Accepted for processing; check the returned task or operation before treating it as complete.
/v1/api-credentials/{id}
Revoke an API credential
Operation ID: apiCredentialRevoke
Disables an owned ordinary credential; does not delete history. Managed MCP grants use connection revocation instead.
Parameters
id- Owned credential UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Credential revoked.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/api-credentials/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned credential UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/oauth/connections/{id}
Revoke a connected application
Operation ID: oauthConnectionRevoke
Revokes only this account’s grant using the existing fenced revocation flow. Repeating revocation is safe. Does not grant or expand permissions.
Parameters
id- Connection UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Connection revoked.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/oauth/connections/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Connection UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/services/{serviceId}/metadata
Replace customer integration metadata
Operation ID: serviceMetadataUpdate
Replaces only this owned service’s external_id and labels; omitted fields are cleared. Does not change hardware, price, credentials or lifecycle. Up to 20 bounded labels. Do not store secrets in labels. Searches use external_id or label=key=value.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"external_id": {
"type": "string",
"minLength": 1,
"maxLength": 120
},
"labels": {
"type": "object",
"additionalProperties": {
"type": "string",
"maxLength": 120
}
}
},
"additionalProperties": false
}Responses
Saved customer reference and labels.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/metadata" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data "$BF_REQUEST_JSON"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
BF_REQUEST_JSON — the JSON payload described by this endpoint. Required fields are not defined in its schema yet; an empty object is not a validated payload.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"service_id": "00000000-0000-4000-8000-000000000001",
"external_id": "example-vps-1",
"labels": {
"environment": "test"
}
}Illustrative values, not a live result.
/v1/webhooks/{id}
Enable or pause webhook deliveries
Operation ID: webhookUpdate
Pauses new and queued deliveries; an in-flight attempt may finish. Re-enable resumes pending deliveries.
Parameters
id- Owned endpoint UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
},
"required": [
"enabled"
],
"additionalProperties": false
}Responses
Updated endpoint.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"enabled":true}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"url": "https://example.com/hooks",
"events": [
"invoice.paid"
],
"enabled": false,
"createdAt": "2026-10-01T00:00:00.000Z"
}
}Illustrative values, not a live result.
/v1/api-credentials
List your API credentials
Operation ID: apiCredentials
Owner-only, secret-free inventory. Cursor pagination defaults to 50. Managed MCP credentials are read-only here.
Parameters
limit- Maximum items, default 50.
cursor- Next UUID cursor.
include_revoked- Include revoked keys.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Credential inventory.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/api-credentials" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURSOR — query parameter cursor (optional). Next UUID cursor. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_INCLUDE_REVOKED — query parameter include_revoked (optional). Include revoked keys. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example integration",
"prefix": "ak_EXAMPLE",
"mode": "signed",
"enabled": true,
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"revoked_at": null,
"last_used_at": null,
"last_used_ip": null,
"scopes": [
"billing.services.read"
],
"allowed_cidrs": []
}
],
"next_cursor": null
}Illustrative values, not a live result.
/v1/api-credentials/{id}
Read your credential metadata
Operation ID: apiCredential
Never returns signing secrets.
Parameters
id- Owned credential UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Credential metadata.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/api-credentials/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned credential UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example integration",
"prefix": "ak_EXAMPLE",
"mode": "signed",
"enabled": true,
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"revoked_at": null,
"last_used_at": null,
"last_used_ip": null,
"scopes": [
"billing.services.read"
],
"allowed_cidrs": []
}
}Illustrative values, not a live result.
/v1/audit/actions
List durable customer API action events
Operation ID: auditActions
Requested intent is saved before entering a write handler; accepted is not completion. Terminal operation results are recorded separately. Covers customer API and hosted MCP writes. Broader Billing dashboard/admin/committed state observations are available through audit/business. Updates are blocked; privileged retention deletes after the configured period.
Parameters
limit- Maximum items, default 50.
cursor- Next event cursor.
resource_id- Resource ID or zone name.
phase- Action phase.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Account-owned action history.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/audit/actions" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURSOR — query parameter cursor (optional). Next event cursor. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_RESOURCE_ID — query parameter resource_id (optional). Resource ID or zone name. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PHASE — query parameter phase (optional). Action phase. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "1",
"request_id": "00000000-0000-4000-8000-000000000002",
"actor": {
"type": "api_key",
"id": "00000000-0000-4000-8000-000000000001"
},
"action": "POST /v1/vps/:serviceId/reboot",
"resource_id": "00000000-0000-4000-8000-000000000001",
"phase": "accepted",
"operation_id": null,
"created_at": "2026-10-01T00:00:00.000Z"
}
],
"next_cursor": null
}Illustrative values, not a live result.
/v1/audit/business
List account-owned business audit events
Operation ID: auditBusiness
Durable Billing dashboard/admin request acceptance and committed service/invoice/order/lifecycle observations. A committed lifecycle log row is not proof of task completion. Database transitions without a verified human identity use system; identities are never inferred from metadata. Admin identity is withheld from customer responses. No payloads, credentials, provider errors or financial customer details are logged. This does not cover every action of other services or constitute a WORM export.
Parameters
limit- Maximum items, default 50 (1–100).
cursor- Exclusive cursor returned as next_cursor.
actor_type- Verified actor category.
resource_type- service, invoice, order or account.
resource_id- Owned resource UUID.
request_id- Correlation UUID.
action- Exact action.
phase- requested, accepted, rejected, unknown or committed.
from- Inclusive ISO timestamp.
to- Inclusive ISO timestamp.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Owner-filtered business observations, newest first.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/audit/business" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURSOR — query parameter cursor (optional). Exclusive cursor returned as next_cursor. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_ACTOR_TYPE — query parameter actor_type (optional). Verified actor category. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_RESOURCE_TYPE — query parameter resource_type (optional). service, invoice, order or account. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_RESOURCE_ID — query parameter resource_id (optional). Owned resource UUID. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_REQUEST_ID — query parameter request_id (optional). Correlation UUID. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_ACTION — query parameter action (optional). Exact action. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PHASE — query parameter phase (optional). requested, accepted, rejected, unknown or committed. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_FROM — query parameter from (optional). Inclusive ISO timestamp. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TO — query parameter to (optional). Inclusive ISO timestamp. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "1",
"request_id": null,
"actor": {
"type": "system",
"id": null
},
"source": "database",
"action": "service.changed",
"resource_type": "service",
"resource_id": "00000000-0000-4000-8000-000000000001",
"phase": "committed",
"changes": {
"before": {
"status": "active"
},
"after": {
"status": "suspended"
}
},
"created_at": "2026-10-01T00:00:00.000Z"
}
],
"next_cursor": null
}Illustrative values, not a live result.
/v1/audit/events
Read account audit history
Operation ID: auditEvents
Default view=requests preserves request history. view=activity merges durable API/MCP actions and Billing business events with actor/action/resource/status filters. Activity partial=true means a history source was unavailable; available_sources lists confirmed sources. Reuse opaque cursors with the same filters; ownership is always enforced. Acceptance is not provider completion. No passwords, tokens, private keys or webhook secrets. Activity source_ip follows the existing privacy masking policy.
Parameters
limit- Maximum items, default 50 (1–100).
view- History view.
cursor- Reuse next_cursor exactly with the same owner and filters.
method- HTTP method; request view only.
actor_type- Verified actor category.
actor_id- Exact verified actor UUID.
action- Semantic action, for example vps.reinstall.
resource_type- Resource category.
resource_id- Exact resource identity.
status- Action phase.
request_id- Exact request UUID.
from- Inclusive ISO 8601 timestamp.
to- Inclusive ISO 8601 timestamp.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Filtered history and next_cursor.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/audit/events" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_VIEW — query parameter view (optional). History view. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURSOR — query parameter cursor (optional). Reuse next_cursor exactly with the same owner and filters. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_METHOD — query parameter method (optional). HTTP method; request view only. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_ACTOR_TYPE — query parameter actor_type (optional). Verified actor category. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_ACTOR_ID — query parameter actor_id (optional). Exact verified actor UUID. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_ACTION — query parameter action (optional). Semantic action, for example vps.reinstall. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_RESOURCE_TYPE — query parameter resource_type (optional). Resource category. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_RESOURCE_ID — query parameter resource_id (optional). Exact resource identity. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_STATUS — query parameter status (optional). Action phase. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_REQUEST_ID — query parameter request_id (optional). Exact request UUID. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_FROM — query parameter from (optional). Inclusive ISO 8601 timestamp. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TO — query parameter to (optional). Inclusive ISO 8601 timestamp. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"next_cursor": null,
"items": []
}Illustrative values, not a live result.
/v1/capabilities
Discover capabilities and effective permissions
Operation ID: apiCapabilities
Distinguishes implemented support, environment enabled state and effective key permissions. enabled=null and availability=unconfirmed mean the backend could not confirm a gate, not that it is disabled. partial=true indicates incomplete discovery. Does not guarantee region inventory, provider health or order approval. Networking and generic metrics are reported not_implemented until supported.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Capability gates and key permissions.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/capabilities" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"contract_revision": "2026-10-07.1",
"dependency_revision": null,
"partial": true,
"features": {
"webhooks": {
"implemented": true,
"enabled": null,
"permitted": true,
"availability": "unconfirmed"
},
"private_networks": {
"implemented": false,
"enabled": false,
"permitted": false,
"availability": "not_implemented"
}
}
}Illustrative values, not a live result.
/v1/oauth/connections
List connected applications
Operation ID: oauthConnections
Owner-only hosted MCP OAuth connection inventory. Does not expose access tokens, refresh tokens or internal client credentials. Connection-management transport must be configured.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Connected applications.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/oauth/connections" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "00000000-0000-4000-8000-000000000001",
"application": "Example application",
"scopes": [
"billing.services.read"
],
"created_at": "2026-10-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:00:00.000Z",
"policy": "read_only",
"access_policy": "read_only",
"enabled": true,
"last_used_at": null,
"revoked": false
}
]
}Illustrative values, not a live result.
/v1/operations
Recover an operation by idempotency key
Operation ID: recoverOperation
Lookup is confined to the authenticated account and permitted operation kinds. Keys are scoped to the original credential, HTTP method and exact path. Supply method/path together and optionally credential_id to disambiguate a key reused across endpoints or credentials (409 operation_lookup_ambiguous). Only new tracked deployment/VPS/dedicated writes with a retained identity are recoverable. 404 operation_not_found does not prove the write never executed. Identities remain after terminal receipt retention (90 days by default); 410 operation_expired means the original receipt is no longer available. Pending/unknown receipts are retained for reconciliation. Never generate a new key to repeat an uncertain write.
Parameters
idempotency_key- Original Idempotency-Key; 8–128 letters, digits, dot, underscore, colon or dash.
method- Original HTTP method; supply with path.
path- Exact original /v1/ path without query string; supply with method.
credential_id- Original credential UUID, when needed for disambiguation.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Original operation receipt; owner and read scopes are checked.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/operations" -H "Authorization: Bearer $BF_API_BEARER" --url-query "idempotency_key=$BF_QUERY_IDEMPOTENCY_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_IDEMPOTENCY_KEY — query parameter idempotency_key (required). Original Idempotency-Key; 8–128 letters, digits, dot, underscore, colon or dash. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_METHOD — query parameter method (optional). Original HTTP method; supply with path. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PATH — query parameter path (optional). Exact original /v1/ path without query string; supply with method. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CREDENTIAL_ID — query parameter credential_id (optional). Original credential UUID, when needed for disambiguation. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"operation": {
"id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
"kind": "vps",
"action": "reboot",
"status": "succeeded",
"done": true,
"progress": 100,
"stage": null,
"created_at": "2026-10-01T00:00:00.000Z",
"updated_at": "2026-10-01T00:00:00.000Z",
"service_ids": [
"00000000-0000-4000-8000-000000000001"
],
"error": null,
"result": {
"service_id": "00000000-0000-4000-8000-000000000001"
}
},
"links": {
"operation": "/v1/operations/op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
"service": "/v1/services/00000000-0000-4000-8000-000000000001"
}
}Illustrative values, not a live result.
/v1/operations/{operationId}
Read operation status
Operation ID: getOperation
Poll the opaque operation_id returned by supported wallet deployments and VPS/dedicated actions. Owner checks and the underlying read scope are enforced on every read. When durable_operations is enabled, new handles are stored independently of encryption keys and the first observed terminal outcome is immutable. Terminal receipts retain 90 days by default; pending/unknown receipts remain for reconciliation. Legacy encrypted handles remain readable but can be invalidated by encryption-key rotation. Deployment readiness respects historical activation; a service error alone is not proof of permanent provisioning failure. The canonical operation has status, done, progress, stage and optional typed result. Result is populated only on succeeded; failed/cancelled are terminal, unknown is nonterminal and is not success. Tracked writes accept x-bf-response-format: operation; the default response preserves legacy fields. DNSSEC and other untracked workflows retain their documented polling contracts. Client wait timeout never repeats/cancels a purchase.
Parameters
operationId- Opaque op_ token from the accepted response.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Unified status, safe progress and service IDs.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/operations/${BF_PATH_OPERATION_ID}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_OPERATION_ID — path parameter operationId (required). Opaque op_ token from the accepted response.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"operation": {
"id": "op_EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
"kind": "vps",
"action": "reboot",
"status": "succeeded",
"done": true,
"progress": 100,
"stage": null,
"created_at": "2026-10-01T00:00:00.000Z",
"updated_at": "2026-10-01T00:00:00.000Z",
"service_ids": [
"00000000-0000-4000-8000-000000000001"
],
"error": null
}
}Illustrative values, not a live result.
/v1/version
Read API contract revision
Operation ID: apiVersion
Authenticated discovery. release is a configured public release label or null, not an internal image or provider identifier. A contract revision is not proof of product availability.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
API version and contract revision.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/version" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"api_version": "1",
"contract_revision": "2026-10-07.1",
"release": null,
"deployment": null,
"released_at": null
}Illustrative values, not a live result.
/v1/webhooks
List webhook endpoints
Operation ID: listWebhooks
Owned endpoints without signing secrets. Maximum five per account; feature must be enabled for this environment.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Owned webhook endpoints.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/webhooks" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": []
}Illustrative values, not a live result.
/v1/webhooks/{id}/deliveries
Read webhook delivery history
Operation ID: webhookDeliveries
Owned delivery results, no response bodies or signing secrets. Delivered records retain 30 days, failed records 90 days. Paused pending events remain until deletion. Up to 12 attempts with exponential backoff capped at six hours.
Parameters
id- Owned endpoint UUID.
limit- Maximum items, default 50 (1–100).
offset- Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Delivery attempts and next_offset.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/webhooks/${BF_PATH_ID}/deliveries" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Owned endpoint UUID.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items, default 50 (1–100). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Start offset, default 0. Use next_offset from the response; null means finished. This contract has no page or pageSize fields. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [],
"next_offset": null
}Illustrative values, not a live result.
Errors and safe retries
Use HTTP status and error.code for decisions. The canonical envelope contains error.message, error.request_id and error.field_errors. Flat code, message, request_id, field_errors, details and status fields are legacy compatibility fields and may still appear; new integrations should read the nested error.
json
{
"ok": false,
"error": {
"code": "scope_denied",
"message": "Required scope is missing",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Error code reference
Server failures and interrupted connections
Generic API server failures intentionally omit internal error codes and provider details and use the same nested envelope with service_unavailable. An edge/network failure can also return non-JSON or no response at all.
json
{
"ok": false,
"error": {
"code": "service_unavailable",
"message": "The service is temporarily unavailable.",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Read-only GET requests can be retried with bounded backoff and jitter. SDKs perform limited retries for selected transient read failures; they do not automatically retry writes. A timeout or 5xx on a write does not prove it failed: check the resource, invoice or task before retrying. Where supported, reuse the same Idempotency-Key and identical request. Do not create a new operation key just because the response was lost.
For 429, honor the HTTP Retry-After header. SDK timeout, network_error and response_too_large codes describe client-side failures, not API error responses. For persistent errors, send support the request ID, HTTP status, method, endpoint and UTC time—never API secrets or passwords.
See error handling in PHP, Node.js, Python and GoThis reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the OpenAPI JSON for client generation.
Use the integration guide for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself.
Current purchase and operation workflows
SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount.
Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state.
Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See HTTP, SDK, CLI and MCP examples. DNSSEC uses its separate endpoint and state contract.
Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented.
For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation.
API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests.
On this page
Integrations
Create a restricted API credential
Delete a webhook endpoint
Update a restricted API credential
Rotate an API credential
Register a signed webhook
Retry an exhausted delivery
Rotate webhook signing secret
Queue a signed webhook test
Revoke an API credential
Revoke a connected application
Replace customer integration metadata
Enable or pause webhook deliveries
List your API credentials
Read your credential metadata
List durable customer API action events
List account-owned business audit events
Read account audit history
Discover capabilities and effective permissions
List connected applications
Recover an operation by idempotency key
Read operation status
Read API contract revision
List webhook endpoints
Read webhook delivery history