API endpoint reference
Find each public endpoint's parameters, required permissions and responses.
BlazingFast Customer API
Automate account billing, VPS and dedicated servers, DNS and Website Protection, TCP Proxy, domains, SSH keys, firewall policies and storage. Use an official SDK for HMAC-signed requests, or a bearer-mode API key. Generic OpenAPI-generated clients do not implement BlazingFast HMAC signing automatically. Pagination is endpoint-specific: follow the documented page/limit, cursor/next_cursor or offset/next_offset model. limit is the canonical page-size parameter; page_size and pageSize are deprecated compatibility aliases only where documented. Begin by reading the resource, confirm changes, and inspect the result or returned task. Draft order creation does not charge the account. Atomic deployment is the documented exception: order + full final order amount paid from account balance + queued provisioning. Payment is not successful provisioning; accepted is not completed. Access depends on key scopes and account permissions.
Services
List services, inspect billing details, and manage supported renewals, upgrades, billing settings, autopay and termination.
Authentication
SignedAuth
SignedAuth is represented by x-api-key for discovery only. Generic OpenAPI-generated clients do not automatically implement BlazingFast HMAC signing. Use BearerAuth with a bearer-mode credential or an official SDK, unless you implement the signing algorithm manually. Signed-key mode requires all five headers. SDKs send x-api-key, x-ts (Unix seconds), x-nonce, x-content-sha256 (Base64 SHA-256 of the exact body), and x-signature (Base64 HMAC-SHA256). Custom signing is explained in the API authentication guide. Every HTTP attempt needs a fresh timestamp and nonce; an action retry retains its original idempotency key and payload. Key expiry, IP restrictions, account permissions and scopes still apply.
BearerAuth
Alternative mode for integrations that prefer Authorization: Bearer <prefix.secret>. Key status, expiry, scope checks, IP policy, and rate limits still apply.
Endpoints
/v1/services/{serviceId}/billing/change/checkout
Start billing-cycle change
Operation ID: serviceBillingChangeCheckout
Creates a prorated checkout when a customer changes the service billing cycle.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"unit": {
"type": "string",
"minLength": 1
},
"count": {
"type": "integer",
"minimum": 1
}
},
"required": [
"unit",
"count"
],
"additionalProperties": false
}Responses
Billing-cycle change checkout result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/billing/change/checkout" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"unit":"example","count":1}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"applied": true,
"payNow": "0.00",
"currency": "EUR"
}Illustrative values, not a live result.
/v1/services/{serviceId}/renewal/checkout
Start renewal checkout
Operation ID: serviceRenewalCheckout
Creates a renewal billing flow for the selected service and renewal period.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"unit": {
"type": "string",
"minLength": 1
},
"count": {
"type": "integer",
"minimum": 1
}
},
"required": [
"unit",
"count"
],
"additionalProperties": false
}Responses
Renewal checkout result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/renewal/checkout" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"unit":"example","count":1}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"orderId": null,
"invoiceId": "00000000-0000-4000-8000-000000000002",
"invoiceNumber": "INV-EXAMPLE-000001",
"total": "100.00",
"currency": "EUR",
"status": "unpaid"
}Illustrative values, not a live result.
/v1/services/{serviceId}/upgrade/checkout
Start upgrade checkout
Operation ID: serviceUpgradeCheckout
Creates or applies an upgrade flow for the selected service and variant.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"variant_id": {
"type": "string",
"format": "uuid"
}
},
"required": [
"variant_id"
],
"additionalProperties": false
}Responses
Upgrade checkout result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/upgrade/checkout" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"variant_id":"00000000-0000-4000-8000-000000000001"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"orderId": "00000000-0000-4000-8000-000000000001",
"invoiceId": "00000000-0000-4000-8000-000000000002",
"invoiceNumber": "INV-EXAMPLE-000001",
"total": "100.00",
"currency": "EUR",
"status": "unpaid"
}Illustrative values, not a live result.
/v1/services/{serviceId}/cancel
Request service cancellation
Operation ID: serviceCancel
Convenience alias for service termination. Use this when the customer intent is straightforward cancellation.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key- Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Cancellation result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/cancel" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_REQUEST_KEY — header parameter Idempotency-Key (optional). Recommended stable retry key. CLI 0.1.17 makes the flag optional: an omitted key is generated once, saved locally before dispatch and printed for explicit retries. Reuse the same key and exact payload. With durable_writes enabled, the API retains the dispatch identity after its encrypted response expires in 24 hours. An unknown outcome requires inspecting service/operation state; never generate a new key to retry it. Missing keys keep legacy behavior.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/services/{serviceId}/autopay
Toggle wallet autopay
Operation ID: serviceAutopay
Enables or disables autopay for a supported service so future renewal invoices can be handled automatically when policy allows it.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
},
"required": [
"enabled"
],
"additionalProperties": false
}Responses
Updated autopay state.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/autopay" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"enabled":true}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"serviceId": "00000000-0000-4000-8000-000000000001",
"autopayEnabled": true
}Illustrative values, not a live result.
/v1/services/{serviceId}/renewal
Renew and pay using the current billing cycle
Operation ID: serviceRenewal
Renews the existing plan and billing cycle from account balance in one call. Reuses an eligible unpaid renewal invoice or creates one; never pays a purchase, upgrade, changed-cycle or mixed-service invoice. Full payment only: insufficient credit or max_total violation rolls back new invoices and any debit. Idempotency-Key is required: reuse the same key and exact body after an interrupted response. The financial receipt is durable. Optional max_total caps the outstanding amount in invoice/account currency; it is not a supplied price. Domain renewals can return renewal_pending=true: paid_through remains the last confirmed date until provider processing completes. Manual suspensions are not cleared by this request.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
Idempotency-Key- Unique renewal attempt key, 8–128 letters, digits or . _ : -. Reuse it on retries; a new key authorizes another cycle.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"max_total": {
"type": "string",
"pattern": "^(0|[1-9]\\d{0,9})(\\.\\d{1,2})?$"
}
},
"additionalProperties": false
}Responses
Paid renewal receipt, or paid pending provider confirmation.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/renewal" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Unique renewal attempt key, 8–128 letters, digits or . _ : -. Reuse it on retries; a new key authorizes another cycle.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"service_id": "00000000-0000-4000-8000-000000000001",
"invoice_id": "00000000-0000-4000-8000-000000000002",
"invoice_number": "INV-EXAMPLE-001",
"status": "paid",
"invoice_status": "paid",
"paid_now": "10.00",
"currency": "EUR",
"billing": {
"unit": "MONTH",
"count": 1
},
"paid_through": "2026-11-01T00:00:00.000Z",
"renewal_pending": false
}Illustrative values, not a live result.
/v1/my/services
List my purchased services
Operation ID: listMyServices
Read-only alias of GET /v1/services with identical ownership, scope, filters and response contract. Defaults to active+suspended; terminated services require an explicit filter. Lifecycle status is separate from runtime power. Hostname and region are included when known; passwords are available only from separately scoped credential endpoints.
Parameters
status- Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate.
type- High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing.
statuses- Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state.
types- Comma-separated service types. Alias for type; do not supply both.
search- Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination.
external_id- Exact customer integration reference; applied before pagination.
label- Exact metadata label match: key=value. Applied before pagination.
include_counts- Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default.
group_by- Group the current page by type, retaining items and pagination.
page- Page number for pagination.
limit- Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match.
page_size- Deprecated compatibility alias for limit; values must match when supplied together.
pageSize- Deprecated compatibility alias for limit; range 1–100, default 50.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Filtered purchased service instances.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/my/services" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_STATUS — query parameter status (optional). Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPE — query parameter type (optional). High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_STATUSES — query parameter statuses (optional). Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPES — query parameter types (optional). Comma-separated service types. Alias for type; do not supply both. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_SEARCH — query parameter search (optional). Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_EXTERNAL_ID — query parameter external_id (optional). Exact customer integration reference; applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_LABEL — query parameter label (optional). Exact metadata label match: key=value. Applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_INCLUDE_COUNTS — query parameter include_counts (optional). Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_GROUP_BY — query parameter group_by (optional). Group the current page by type, retaining items and pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PAGE — query parameter page (optional). Page number for pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"page": 1,
"pageSize": 50,
"total": 1,
"pages": 1,
"items": [
{
"id": "00000000-0000-4000-8000-000000000001",
"status": "active",
"displayName": "Example VPS",
"hostname": "server.example.com",
"type": "vps",
"createdAt": "2026-10-01T00:00:00.000Z",
"dueDate": "2026-11-01T00:00:00.000Z",
"billingUnit": "MONTH",
"billingCount": 1,
"sku": "4G",
"ipv4": "192.0.2.10",
"ipv6": null,
"meta": {
"serviceType": "vps"
}
}
]
}Illustrative values, not a live result.
/v1/services
Browse services
Operation ID: listServices
Returns customer service summaries with hostname and recorded region code. Region uses provider/migration metadata, falling back to original order location; use VPS status for the currently assigned region. Null means unavailable. Does not disclose internal node or cluster identifiers. Ownership, status, type, search, external_id and label filters are applied server-side before pagination and counts. The default is active plus suspended; historical states require an explicit status filter. group_by=type groups only the current page, not the complete inventory.
Parameters
status- Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate.
type- High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing.
statuses- Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state.
types- Comma-separated service types. Alias for type; do not supply both.
search- Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination.
external_id- Exact customer integration reference; applied before pagination.
label- Exact metadata label match: key=value. Applied before pagination.
include_counts- Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default.
group_by- Group the current page by type, retaining items and pagination.
page- Page number for pagination.
limit- Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match.
page_size- Deprecated compatibility alias for limit; values must match when supplied together.
pageSize- Deprecated compatibility alias for limit; range 1–100, default 50.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Paginated service list.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_STATUS — query parameter status (optional). Service lifecycle status; defaults to active and suspended when no status filter is supplied. Power state is separate. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPE — query parameter type (optional). High-level normalized service family: vps, dedicated, webhosting, storage, dns, domain or other (comma-separated). Distinct from catalog product_code: tcp-proxy and license map to other; waf maps to dns. Applied before pagination; use discovered product_code for purchasing. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_STATUSES — query parameter statuses (optional). Comma-separated lifecycle statuses, for example active,suspended. Use this or status, not both. Filtering and counts use service status, never runtime power state. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPES — query parameter types (optional). Comma-separated service types. Alias for type; do not supply both. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_SEARCH — query parameter search (optional). Search hostname, customer IPv4/IPv6, display name, product name, SKU or full service UUID; maximum 200 characters. Applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_EXTERNAL_ID — query parameter external_id (optional). Exact customer integration reference; applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_LABEL — query parameter label (optional). Exact metadata label match: key=value. Applied before pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_INCLUDE_COUNTS — query parameter include_counts (optional). Request counts only for selected statuses, with the same ownership, type and search filters. Omitted by default. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_GROUP_BY — query parameter group_by (optional). Group the current page by type, retaining items and pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_PAGE — query parameter page (optional). Page number for pagination. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum items to return (default 50; range 1–100). Canonical page-size parameter. Deprecated page_size and pageSize aliases remain accepted; supplied size values must match. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"page": 1,
"pageSize": 50,
"total": 1,
"pages": 1,
"items": [
{
"id": "00000000-0000-4000-8000-000000000001",
"status": "active",
"displayName": "Example VPS",
"hostname": "server.example.com",
"type": "vps",
"createdAt": "2026-10-01T00:00:00.000Z",
"dueDate": "2026-11-01T00:00:00.000Z",
"billingUnit": "MONTH",
"billingCount": 1,
"sku": "4G",
"ipv4": "192.0.2.10",
"ipv6": null,
"meta": {
"serviceType": "vps"
}
}
]
}Illustrative values, not a live result.
/v1/services/{serviceId}
Open service detail
Operation ID: getService
Returns the customer-facing detail view for one service.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Detailed service record.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"item": {
"id": "00000000-0000-4000-8000-000000000001",
"status": "active",
"displayName": "Example VPS",
"hostname": "server.example.com",
"type": "vps",
"createdAt": "2026-10-01T00:00:00.000Z",
"dueDate": "2026-11-01T00:00:00.000Z",
"billingUnit": "MONTH",
"billingCount": 1,
"sku": "4G",
"ipv4": "192.0.2.10",
"ipv6": null,
"meta": {
"serviceType": "vps"
}
}
}Illustrative values, not a live result.
/v1/services/{serviceId}/billing/change/options
Review billing-cycle options
Operation ID: serviceBillingChangeOptions
Returns the proration-aware billing-cycle change choices for a service before checkout.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Available billing-cycle change options.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/billing/change/options" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"currency": "EUR",
"current": {
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly",
"recurringUnitPrice": "100.00"
},
"proration": {
"fraction": 1,
"periodStart": "2026-10-01T00:00:00.000Z",
"periodEnd": "2026-11-01T00:00:00.000Z"
},
"options": [
{
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly",
"targetRecurringUnitPrice": "100.00",
"credit": "100.00",
"payNow": "0.00"
}
]
}Illustrative values, not a live result.
/v1/services/{serviceId}/billing/options
Review billing options
Operation ID: serviceBillingOptions
Returns the current billing-cycle choices exposed for the selected service.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Available billing options.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/billing/options" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"currency": "EUR",
"current": {
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly"
},
"options": [
{
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly",
"price": "100.00"
}
]
}Illustrative values, not a live result.
/v1/services/{serviceId}/dns/waf/record/config
Read Website Protection settings
Operation ID: getServiceDnsWafConfig
Read-only HTTPS/origin and custom-loader flags. Unknown settings are null; no raw provider configuration, private keys or scripts.
Parameters
serviceId- Your DNS zone name (example.com) or an owned service UUID. A name selects the owned zone directly; a UUID also requires domain in the query/body.
domain- Owned DNS zone; required only with a UUID selector. Must match a domain-name selector when supplied.
name- A record name, e.g. @ or www.; default @.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Safe settings.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/dns/waf/record/config" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Your DNS zone name (example.com) or an owned service UUID. A name selects the owned zone directly; a UUID also requires domain in the query/body.
BF_QUERY_DOMAIN — query parameter domain (optional). Owned DNS zone; required only with a UUID selector. Must match a domain-name selector when supplied. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_NAME — query parameter name (optional). A record name, e.g. @ or www.; default @. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"settings": {
"ssl_schema": null,
"force_ssl": null,
"ssl": null,
"custom_loader": null
}
}Illustrative values, not a live result.
/v1/services/{serviceId}/renewal/options
Review renewal options
Operation ID: serviceRenewalOptions
Returns valid renewal units or counts for the target service before you create a renewal checkout.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Available renewal options.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/renewal/options" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"currency": "EUR",
"current": {
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly",
"recurringUnitPrice": "100.00"
},
"options": [
{
"unit": "MONTH",
"count": 1,
"value": "MONTH:1",
"label": "Monthly",
"price": "100.00"
}
]
}Illustrative values, not a live result.
/v1/services/{serviceId}/upgrade/options
Review upgrade options
Operation ID: serviceUpgradeOptions
Returns supported upgrade choices for the selected service.
Parameters
serviceId- Customer-visible UUID of the service you want to inspect or change.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Available upgrade options.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/${BF_PATH_SERVICE_ID}/upgrade/options" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_SERVICE_ID — path parameter serviceId (required). Customer-visible UUID of the service you want to inspect or change.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"extraDiskGB": 0,
"keepExtraDisk": false,
"service": {
"category": "vps",
"isCpanel": false
},
"current": {
"variantId": "00000000-0000-4000-8000-000000000001",
"sku": "4G",
"dims": {
"cpu": 2,
"ram": 4,
"disk": 40
}
},
"currency": "EUR",
"billing": {
"unit": "MONTH",
"count": 1
},
"proration": {
"multiplier": 1,
"fraction": 1,
"periodStart": "2026-10-01T00:00:00.000Z",
"periodEnd": "2026-11-01T00:00:00.000Z"
},
"options": []
}Illustrative values, not a live result.
/v1/services/grouped
Browse services by type
Operation ID: listServicesGrouped
Returns the complete filtered customer-safe inventory grouped by type, without pagination. Intended for dashboard inventory. This is a legacy compatibility endpoint. Its default is active only, retained for backward compatibility; automation and MCP clients should pass status explicitly and prefer /v1/services?statuses=active,suspended&group_by=type for relevant lifecycle states. status=suspended or status=all explicitly includes other states. This differs from GET /v1/services?group_by=type, which groups only its current paginated result set. This endpoint supports status and type filters; use /v1/services for search and integration-metadata filters.
Parameters
status- Legacy default active; pass this explicitly. Filter by service status. Use all to disable status filtering.
type- Optional comma-separated list of service types to keep in the grouped response.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Grouped service list.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/services/grouped" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_STATUS — query parameter status (optional). Legacy default active; pass this explicitly. Filter by service status. Use all to disable status filtering. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_TYPE — query parameter type (optional). Optional comma-separated list of service types to keep in the grouped response. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"status": "active",
"type": null,
"services": {
"dns": [],
"vps": [],
"dedicated": [],
"webhosting": []
}
}Illustrative values, not a live result.
Errors and safe retries
Use HTTP status and error.code for decisions. The canonical envelope contains error.message, error.request_id and error.field_errors. Flat code, message, request_id, field_errors, details and status fields are legacy compatibility fields and may still appear; new integrations should read the nested error.
json
{
"ok": false,
"error": {
"code": "scope_denied",
"message": "Required scope is missing",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Error code reference
Server failures and interrupted connections
Generic API server failures intentionally omit internal error codes and provider details and use the same nested envelope with service_unavailable. An edge/network failure can also return non-JSON or no response at all.
json
{
"ok": false,
"error": {
"code": "service_unavailable",
"message": "The service is temporarily unavailable.",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Read-only GET requests can be retried with bounded backoff and jitter. SDKs perform limited retries for selected transient read failures; they do not automatically retry writes. A timeout or 5xx on a write does not prove it failed: check the resource, invoice or task before retrying. Where supported, reuse the same Idempotency-Key and identical request. Do not create a new operation key just because the response was lost.
For 429, honor the HTTP Retry-After header. SDK timeout, network_error and response_too_large codes describe client-side failures, not API error responses. For persistent errors, send support the request ID, HTTP status, method, endpoint and UTC time—never API secrets or passwords.
See error handling in PHP, Node.js, Python and GoThis reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the OpenAPI JSON for client generation.
Use the integration guide for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself.
Current purchase and operation workflows
SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount.
Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state.
Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See HTTP, SDK, CLI and MCP examples. DNSSEC uses its separate endpoint and state contract.
Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented.
For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation.
API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests.
On this page
Services
Start billing-cycle change
Start renewal checkout
Start upgrade checkout
Request service cancellation
Toggle wallet autopay
Renew and pay using the current billing cycle
List my purchased services
Browse services
Open service detail
Review billing-cycle options
Review billing options
Read Website Protection settings
Review renewal options
Review upgrade options
Browse services by type