Endpoint reference

Every endpoint an API token can reach. Paths are relative to https://my.server.express/api/v1.

This page is generated from the routing code, so it lists what the server actually accepts rather than what we remembered to write down.

`services:read`

Method	Path
`GET`	`/cloud`
`GET`	`/cloud/:id`
`GET`	`/cloud/:id/:vmid`
`GET`	`/cloud/:id/network`
`GET`	`/cloud/:id/servers`
`GET`	`/dedicated`
`GET`	`/dedicated/:id`
`GET`	`/dedicated/:id/activity`
`GET`	`/dedicated/:id/metadata`
`GET`	`/dedicated/:id/network`
`GET`	`/dedicated/:id/overview`
`GET`	`/hosting`
`GET`	`/hosting/:id`
`POST`	`/hosting/:id/login-link`

`services:stats`

Method	Path
`GET`	`/cloud/:id/stats`

`services:power`

Method	Path
`POST`	`/cloud/:id/:vmid`
`POST`	`/dedicated/:id/power`

`services:rescue`

Method	Path
`GET`	`/cloud/:id/credentials`
`POST`	`/dedicated/:id/rescue`
`GET`	`/hosting/:id/credentials`

`services:reinstall`

Method	Path
`POST`	`/cloud/:id/reinstall`
`POST`	`/dedicated/:id/reinstall`

`services:cancel`

Method	Path
`POST`	`/cloud/:id/cancel`
`POST`	`/dedicated/:id/cancel`
`POST`	`/hosting/:id/cancel`

`invoices:read`

Method	Path
`GET`	`/client/invoices`
`GET`	`/client/invoices/:id`
`GET`	`/client/invoices/:id/pdf`

`invoices:pay`

Method	Path
`GET`	`/client/invoices/:id/pay`
`POST`	`/client/invoices/:id/pay`
`POST`	`/client/invoices/consolidate`

`tickets:read`

Method	Path
`GET`	`/client/tickets`
`GET`	`/client/tickets/:id`

`tickets:write`

Method	Path
`POST`	`/client/tickets`
`POST`	`/client/tickets/:id/messages`

`catalogue:read`

Method	Path
`GET`	`/reseller/catalogue`

`orders:place`

Method	Path
`POST`	`/reseller/orders/cloud`
`POST`	`/reseller/orders/dedicated`
`POST`	`/reseller/orders/hosting`

Everything else

The customer API has another 86 endpoints that tokens cannot reach. They need a browser session from the client area — ordering, one-click apps, IP and rDNS changes, account settings, passkeys, and the token endpoints themselves. A token can never mint another token or widen its own scopes.

There are a further 211 administrative endpoints. Those are staff-only, session-authenticated, and not reachable with a customer token at all.

If something you need is on the wrong side of that line, tell us — the list grows based on what people ask for.

Last updated Invalid Date. Something wrong or missing? Tell us and we'll fix it.