Developers

HF Panel has one address for programs: https://api.yourdomain.com/v1. Billing systems, your own scripts, the HF Local desktop app, payment providers, routers and the other servers of a cluster all talk to it. This section explains each way in, with working examples.

Note: the API's address is for programs only. If you open it in a web browser you get 403 Forbidden. Use curl or your own code.

What you can program

The token API at a glance

• One base address: https://api.yourdomain.com/v1.
• Each request carries an API token that you make under Password & security. A token is either Read only or Read & change, and you can limit it to some IP addresses.
• A token acts as the person who made it. An administrator's token sees every hosting account, a reseller's token sees only that reseller's customers, and a customer's token sees only their own account.
• Every answer is JSON: {"ok": true, "data": …} or {"ok": false, "error": "…"}, with a matching HTTP status.

curl -s https://api.yourdomain.com/v1/me \
     -H "Authorization: Bearer hf_xxx"

{
    "ok": true,
    "data": {
        "username": "admin",
        "email": "admin@yourdomain.com",
        "role": "admin",
        "two_factor": true,
        "token": {
            "name": "Billing system",
            "access": "write"
        }
    }
}

Where to start

1. Read the API overview: addresses, tokens, answers, status codes and limits.
2. Make a token under Password & security › API tokens.
3. Try GET /v1/me as shown above, then pick the endpoints you need from the API reference.

More pages

• Abuse desk and DNSSEC API: Read and add abuse complaints, set their status, add notes, and read or switch DNSSEC of a zone with the token API.
• "API: accounts": List, create, suspend, change, delete and sign in to hosting accounts through the token API.
• "API: apps and staging": List the App installer's apps and a hosting account's installed apps, and make, push, pull and delete staging copies through the token API.
• "API: cron jobs and FTP": List, add and delete a hosting account's cron jobs and FTP accounts through the token API.
• "API: MySQL and PostgreSQL": Create and drop MySQL and PostgreSQL databases, manage MySQL users and their privileges through the token API.
• "API: DNS": List a hosting account's DNS zones and add, change and delete their records through the token API.
• "API: domains, mail and databases": Read a hosting account's domains, email accounts and MySQL databases, and add, change and remove domains through the token API.
• "API: email": Mailboxes, passwords and quotas, forwarders, autoresponders, sending limits and email checks through the token API.
• "API: discount codes, announcements and help": Manage discount codes, send and list announcements, and search the help articles with the token API.
• API explorer: Every token API endpoint from the OpenAPI 3.1 description, grouped, with who may call it; and the description to download.
• "API: firewall rules, IP blocker, cron runs and capacity": Read and set a website's firewall rules, block addresses on every website of an account, read cron job runs or run a job now, and get the server's capacity forecast.
• "API: MongoDB": Create and delete MongoDB databases and users, grant roles and set remote access through the token API.
• "API: packages and resellers": Create, change and delete hosting packages, and create, suspend, limit and delete resellers through the token API.
• "API: search": Search accounts, domains, mailboxes, databases, invoices, tickets, resellers, IP addresses and screens with one request.
• "API: the server": Read the services and health checks, restart a service, check for updates and handle automatic server moves through the API.
• "API: site cloning and templates": Copy a website, save and delete site templates and make new websites from them through the token API.
• "API: SSH keys and own backup storage": Manage an account's SSH keys and SSH access, and its own S3 or SFTP backup storage, through the token API.
• "API: SSL and backups": Read each domain's certificate, issue, renew and remove certificates, run AutoSSL, and make, restore and share backups through the token API.
• "API: status and sync": Read the server's load, memory, disk and services, and the websites a token may sync with HF Local.
• "API: team members and reseller addresses": List, invite, change, suspend and remove an account's team members, and read a reseller's own addresses through the token API.
• "API: visitor statistics": Read a website's visitor statistics — totals, days, the last 48 hours and top lists — over a date range.
• WordPress vulnerability list: The JSON format of the WordPress vulnerability list, how the official edition imports it and how paid servers fetch it.

Related

• API overview
• API reference
• Billing integration