Developer API

Installable OS templates for VPS orders and reinstalls. ?platform=linux (default) | windows | router — Cloud Router plans deploy MikroTik CHR only.

Atomic: debits your wallet at your effective price, issues a paid receipt, and provisions. Provisioning failure auto-refunds. Send an Idempotency-Key so a retried request can't order twice. Returns the server AND its initial root password (shown once).

{ "plan_slug": "vps-2", "label": "web-1", "hostname": "web-1", "os_family": "ubuntu", "os_template": "ubuntu-22.04" }

Same atomic debit/refund contract. Returns the account AND its SFTP/DB passwords (shown once). `php_version` defaults to 8.3.

{ "plan_slug": "hosting-starter", "domain": "example.com", "username": "examplecom" }

Server detail (no credentials, no internal provisioning data).

Live CPU / memory / network / disk usage.

Every IP on the server with its current PTR record. `zoneHosted: false` means the reverse zone is not on our DNS.

[
  {
    "ip": "46.31.78.56",
    "primary": true,
    "gateway": "46.31.78.1",
    "netmask": "255.255.255.0",
    "ptr": "mail.example.com",
    "zoneHosted": true
  }
]

Every IP across all your servers, grouped per server, with PTR records — the API form of the dashboard Reverse DNS page.

Plans this server can resize to — same family, same disk size (a plan change never alters disk). Returns the current plan and the switchable options, cheapest first.

{
  "current": { "id": "...", "name": "Cloud Router S", "vcpu": 1, "ramMb": 1024, "diskGb": 10, "monthlyPrice": 19.90 },
  "options": [ { "id": "...", "name": "Cloud Router M", "vcpu": 2, "ramMb": 2048, "diskGb": 10, "monthlyPrice": 29.90 } ]
}

Power the server start, stop, or reboot. `:action` ∈ {start,stop,reboot}.

Issue a short-lived URL to the browser VM console for this server.

Rotate the server root/admin password; the new password is returned once.

Add-ons available/attached for this server — SEO IP Pack, extra IPs, backups. Prices are in cents: `monthly_usd_cents` is the recurring charge, `prorated_usd_cents` what you pay today if you buy now.

Buy an add-on for the server. Debits your wallet **immediately**, prorated to the end of the server's current cycle; the add-on then renews with the server every month. Reseller tiers pay their discounted price. Auto-refunds if it cannot be attached.

{ "addonId": "seoip7pk" }

Cancel an add-on. **No refund** is issued for the remainder of the current cycle — the recurring price drops from the next renewal. For IP add-ons this is immediate and disruptive: the addresses are released upstream and stop routing to your server, so anything bound to them (sites, SSL, mail) breaks — unconfigure them in the guest OS first. Needed because only one add-on per type may be active, so moving between tiers (8 IPs to 16 IPs) is a remove then a purchase. Uses `vps:write`, not `orders:write` — it cancels a line item and spends nothing.

Switch to another plan in the same family with the same disk size — an in-place vCPU/RAM resize. The server reboots (~1 min) to apply; disk is never changed. Only the recurring price changes: no proration on an up-switch, no credit on a down-switch — the next renewal bills the new plan. Use GET /vps/:id/plan-options for valid targets.

{ "productId": "..." }

Change the display label.

{ "label": "web-prod-1" }

Point the IP's PTR record at a hostname (e.g. `mail.example.com`). Idempotent upsert.

{ "hostname": "mail.example.com" }

Remove the PTR record for the IP.

DESTRUCTIVE — wipe the disk and rebuild from an OS template. Honours an optional Idempotency-Key header.

{ "os": "ubuntu", "osTemplate": "ubuntu-22.04" }

DESTRUCTIVE — permanently terminate the server.

Monthly price for a pool shape, with a per-unit breakdown and the resolved figures (vCPU, GB, addresses) so you can show what is actually being bought. Nothing is charged. The purchase re-prices server-side, so a total worked out client-side is displayed but never trusted.

{ "productId": "...", "vcpu": 16, "ram2gb": 16, "disk100": 10, "ip16": 1 }

Every capacity pool on the account, with its quotas, status, monthly price and renewal date. `rates_cents` are the per-unit prices that pool was SOLD at — what a resize is charged at, which is not necessarily today's catalogue.

One pool plus live `usage` — the vCPU, RAM, disk, IPs and server count currently committed inside it — the `bounds` a resize may move between, and the servers we know are in it. Usage counts PROVISIONED resources, not live consumption: a powered-off server still holds its allocation, because you can switch it back on. ⚑ Read `policy.vcpuOvercommit` rather than assuming a ratio.

Buys a capacity pool and provisions it: the capacity is created with hard CPU and memory ceilings, the IPv4 block is reserved, and the pool gets its own private network segment (free) that its servers talk to each other on. Debits your balance immediately for the first month. Returns 400 if your balance will not cover it or the selection falls outside the product bounds. Honours an Idempotency-Key header. Reseller keys are charged their discounted RATES, which are then snapshotted — so the discount survives every renewal and resize.

{ "productId": "...", "label": "prod-cluster", "vcpu": 16, "ram2gb": 16, "disk100": 10, "ip16": 1 }

Prices a new shape without applying it: the new monthly, the difference, and `charge_now_usd_cents` — the prorated amount taken immediately for the days left in the cycle. Priced at the rates the pool was SOLD at, never at today's catalogue, so the figure matches what PATCH will charge.

{ "vcpu": 32, "ram2gb": 32, "disk100": 20, "ip16": 2 }

Changes the pool's shape. Takes the WHOLE shape in absolute units, not deltas — to add 8 vCPU to a 16-vCPU pool, send 24. **Growing is a purchase**: charged immediately, prorated, at the rates the pool was sold at. **Shrinking is not refunded** and lowers the price from the next renewal. Refuses to shrink below what the pool's servers already hold — delete servers first.

{ "vcpu": 32, "ram2gb": 32, "disk100": 20, "ip16": 2 }

Creates a server inside the pool. **It is free** — no charge now, no monthly price, no renewal; the pool carries the bill, and the build is checked against its quota instead of your balance. Which is why this is `vps:write` and not `orders:write`. `productId` is a plan **slug** from GET /v1/products (a UUID is accepted too). ⚑ `ipCount` chooses how many of the pool's own public addresses it takes (default 1), and they cost nothing — they came with the pool. **`ipCount: 0` is private-only: no public interface, no default route, and no internet at all** — reachable from the pool's other servers on its private network and through the web console. Linux only.

{ "productId": "vps-2", "label": "web-1", "os": "ubuntu", "osTemplate": "ubuntu-24.04", "ipCount": 1 }

Every IPv4 address the pool owns, with its PTR and which server holds it (`assigned_to: null` means free in the block). These came with the pool, so assigning one costs nothing — to get MORE, resize the pool's `ip16`. Add-ons are refused on a pool server for the same reason.

Assign, move or return addresses within the pool's own block, in ONE batch. `serverId` names a server INSIDE this pool; `null` returns the address to the block. Free. Addresses never leave the block. The set is validated whole and refused entire if any entry names a server that is not in this pool. ⚑ The guest OS is not reconfigured for you, and moving an address away stops it routing at once — anything bound to it breaks. Send every change together: each call reprograms the router once regardless of batch size.

{ "changes": [ { "ip": "203.0.113.10", "serverId": "uuid" }, { "ip": "203.0.113.11", "serverId": null } ] }

DESTRUCTIVE — every server in the pool is powered off (preserved, not destroyed), the whole IP block is returned and the private network is deleted. **No refund** for the remainder of the cycle.

Hosting account detail.

Suspend the account (site + databases stop serving). Reversible with unsuspend.

Lift a suspension and restore service.

DESTRUCTIVE — permanently removes the site, databases, and mail; the username becomes reusable.

Switch the account's PHP-FPM version. `php_version` ∈ {7.4, 8.1, 8.3}.

{ "php_version": "8.3" }

Retry the Let's Encrypt certificate issue for the account's domain now.

Tail the access or error log. Query: `kind` ∈ {access,error}, `lines`.

Retry the Let's Encrypt certificate issue now.

Switch the account's PHP-FPM version.

{ "php_version": "8.3" }

Read the crontab.

Replace the crontab.

{ "jobs": [ { "schedule": "0 3 * * *", "command": "php cron.php" } ] }

Password-protected directories (htpasswd).

Add or update a password-protected directory.

{ "path": "/admin", "basic_user": "u", "password": "…" }

Remove protection. Query: `path`.

ModSecurity WAF status for the account.

Whether temporary WAF-log access is active.

Request temporary access to WAF logs.

Whether browser-SSH terminal access is enabled.

Enable browser-SSH terminal access.

Start a browser-SSH session; returns a session URL/token.

Stop the browser-SSH session.

Git-deploy status for the account.

The SSH deploy key to add to your repo.

The push-to-deploy webhook URL/secret.

Enable push-to-deploy.

Disable push-to-deploy.

Clone/deploy a repo into the site.

{ "repo_url": "git@…", "branch": "main", "subdir": "" }

Pull the latest commit for the deployed repo.

Disconnect git deploy from the site.

List a directory. Query: `path` (default /public_html).

Read a text file's contents. Query: `path`.

Create or overwrite a text file.

{ "path": "/public_html/x.txt", "content": "…" }

Delete a file or directory. Query: `path`, `recursive`.

Stream a file as an attachment. Query: `path`.

Upload a file (multipart form field `file`). Query: `path`.

Create a directory.

{ "path": "/public_html/new" }

Rename or move a file/directory.

{ "from": "/a", "to": "/b" }

Site backups (restore points).

Create a new site backup.

Delete a backup.

Restore the site from a backup.

Stream a backup archive (gzip).

Visitor statistics. Query: `period` ∈ {24h,7d,30d}.

Extra MySQL databases on the account.

Create an extra MySQL database.

{ "suffix": "wp2" }

Delete an extra MySQL database.

Mailboxes under one mail domain.

Forwarding aliases under one mail domain.

Every mailbox across all your mail domains.

Create a mailbox on a mail domain.

{ "domain_id": 12, "local_part": "info", "password": "…", "quota_mb": 2048 }

Set a new password for a mailbox.

{ "password": "…" }

Permanently delete a mailbox and its mail.

Create a forwarding alias (source → destination).

{ "domain_id": 12, "source_local": "sales", "destination": "info@example.com" }

Remove a forwarding alias.

The registrant/WHOIS contact used for new registrations (returns SA defaults if none saved yet).

Create or update the registrant (WHOIS) contact.

{ "first_name": "Jane", "last_name": "Doe", "email": "…", "phone": "+90…", "address1": "…", "city": "…", "postal_code": "…", "country": "TR" }

Email the EPP transfer (auth) code to the registrant. Domain must be active with the transfer lock off.

Domain detail.

Update auto-renew, transfer lock, WHOIS privacy, or nameservers. Changes are pushed to the registry and rolled back if the push fails.

{ "auto_renew": true, "nameservers": ["ns1.example.com","ns2.example.com"] }

Single invoice with line items and payment transactions.

Settle an unpaid invoice from your wallet balance. Fails if the balance is insufficient (top up in the dashboard first). Returns the paid invoice.

Prepaid wallet balance (USD cents).

Recent wallet activity. Query: limit (max 200).

Ticket detail with the message thread.

Open a support ticket. Honours an optional Idempotency-Key header so a retried request doesn't open a duplicate.

{ "subject": "Mail deliverability", "message": "Our PTR record is set but…", "priority": "medium", "department": "technical" }

Post a customer reply. Re-opens a resolved/closed ticket.

{ "body": "Thanks — that fixed it." }

Close the ticket. Idempotent.

Subscribe an HTTPS URL to events. The signing secret is returned ONCE in this response.

{ "url": "https://example.com/hooks/444host", "events": ["vps.power.changed", "ticket.replied"] }

Subscription detail (secret masked).

Change url, events, description, or pause/resume via `is_active`.

{ "is_active": false }

Remove the subscription and stop deliveries.

Issue a new signing secret (returned ONCE). The old secret stops signing immediately.

Recent delivery attempts with status, duration, and errors. Query: limit (max 200).

Clone a past delivery into a fresh attempt.