API overview
Everything you can do in the client area, you can script — drive your servers or your invoices and tickets from your own code. Same backend, same permissions — the panel is just a client of this API.
Base URL
https://my.server.express/api/v1Every path in these docs is relative to that. So /cloud means https://my.server.express/api/v1/cloud.
HTTPS only. Requests are JSON in, JSON out — send Content-Type: application/json on anything with a body.
The response envelope
Every response has the same outer shape, success or failure. You never have to guess whether a 200 actually worked.
{
"success": true,
"data": { }
}{
"success": false,
"error": "action must be one of: start, stop, reboot"
}Check success first, read data second. Errors put a human-readable sentence in error — the message is meant to be shown to a person, not parsed by a machine.
Status codes
| Code | What it means |
|---|---|
200 | Fine. |
201 | Created — a token, a ticket. |
400 | Your request is malformed. Bad JSON, missing field, invalid enum value. |
401 | No credentials, bad credentials, or an expired/revoked token. |
403 | Authenticated, but your token lacks the scope this endpoint needs. |
404 | No such resource — or it isn’t yours. We don’t distinguish, deliberately. |
409 | Conflicting state. Reinstalling a machine that’s already reinstalling. |
422 | Valid request, impossible right now. A VM that isn’t provisioned yet. |
500 | Ours. Retry, and tell us if it persists. |
That 404 behaviour is worth internalising: asking about someone else’s service returns “not found”, not “forbidden”. Otherwise the API becomes a way to enumerate which service IDs exist.
What the API covers
Ten scopes, covering servers, invoices and tickets — read the authentication guide for the full list, and the endpoint reference for every route.
What it doesn’t cover
Being straight with you about the edges:
- Ordering. You can’t buy a server over the API yet. Provisioning happens through the client area.
- One-click apps. Installing and managing app stacks is panel-only for now.
- IP changes and rDNS. Read-only over the API; changes go through the panel.
- Admin operations. There’s a whole administrative API behind this one. It’s staff-only, session-authenticated, and not available to customer tokens.
If one of those blocks something you’re building, tell us — the scope list grows based on what people actually ask for.
Versioning
The /v1 prefix is a promise. We’ll add fields and endpoints inside v1, and we won’t remove fields or change what an existing one means. Anything that would break you gets a /v2.
Write clients that ignore unknown fields.
Rate limits
There’s no published request limit today. There is automatic IP banning on repeated failed authentication, so don’t retry a 401 in a loop — fix the credential instead. If you’re planning something high-volume, talk to us first rather than finding the edge by hitting it.
Last updated Invalid Date. Something wrong or missing? Tell us and we'll fix it.