API: server updates, firewall, staff and billing
Operating system updates, the firewall, the activity log, staff logins, invoices, payments, products and orders through the token API.
Most of these are for administrators. Billing lists follow the scope of /v1/invoices: an administrator sees all, a reseller its customers', a customer its own.
Restarting the server is not offered over the API. Making a staff login with full access or removing one needs another administrator's approval when that is switched on; the API refuses (403) and the action is done in the panel.
A=https://api.yourdomain.com/v1
H="Authorization: Bearer hf_xxx"
Server updates
| Method | Path | Who | What it does |
|---|---|---|---|
| GET | /v1/server/updates |
admin | Operating system updates: how many, when checked, the update log |
| POST | /v1/server/updates/apply |
admin, write | Install the updates in the background (follow the log with GET /server/updates) |
| POST | /v1/server/updates/check |
admin, write | Check for updates now |
Firewall
/firewall-rules lists and changes the server's rules, /firewall-bans the addresses fail2ban banned, /ip-blocks the addresses blocked from the whole server. The rule's id is its number; numbers move up after a delete.
| Method | Path | Who | What it does |
|---|---|---|---|
| GET | /v1/firewall-bans |
admin | The addresses fail2ban has banned |
| DELETE | /v1/firewall-bans/{ip} |
admin, write | Lift a ban |
| GET | /v1/firewall-rules |
admin | The firewall's rules |
| POST | /v1/firewall-rules |
admin, write | Open a port (action allow) or block an address or range (action block) |
| GET | /v1/firewall-rules/{id} |
admin | One rule |
| DELETE | /v1/firewall-rules/{id} |
admin, write | Remove a rule (the rule numbers move up after it) |
| GET | /v1/ip-blocks |
admin | The addresses blocked from the whole server |
| POST | /v1/ip-blocks |
admin, write | Block an address or range from the whole server |
| DELETE | /v1/ip-blocks/{ip} |
admin, write | Unblock an address or range (write / in a range as %2F) |
POST /v1/firewall-rules
| Field | Type | Required | Meaning |
|---|---|---|---|
action |
one of allow, block | yes | allow or block |
port |
string | allow: 3306 or a range 6000:6100 | |
proto |
one of tcp, udp, any | allow: tcp (default), udp or any | |
ip |
string | block: an address or range like 203.0.113.0/24 |
POST /v1/ip-blocks
| Field | Type | Required | Meaning |
|---|---|---|---|
ip |
string | yes | an address or range like 203.0.113.0/24 |
Activity log
| Method | Path | Who | What it does |
|---|---|---|---|
| GET | /v1/activity-log |
admin | The newest 500 lines of the activity log; q searches the account, action, detail and address |
Staff logins
| Method | Path | Who | What it does |
|---|---|---|---|
| GET | /v1/staff |
admin | The administrator logins |
| POST | /v1/staff |
admin, write | Add an administrator login; it gets an email to choose its password. Full access needs a second administrator's approval when that is switched on (refused here) |
| GET | /v1/staff/{username} |
admin | One administrator login |
| PATCH | /v1/staff/{username} |
admin, write | Change a login's access |
| DELETE | /v1/staff/{username} |
admin, write | Remove an administrator login (at least one full one stays) |
| POST | /v1/staff/{username}/resend |
admin, write | Email the login a new link to choose its password |
POST /v1/staff
| Field | Type | Required | Meaning |
|---|---|---|---|
username |
string | yes | 3–32 lowercase letters, numbers, . _ -, starting with a letter |
email |
string | yes | their email address |
access |
one of read-only, full | read-only (default) or full |
PATCH /v1/staff/{username}
| Field | Type | Required | Meaning |
|---|---|---|---|
access |
one of read-only, full | yes | read-only or full |
Invoices
The read endpoints GET /v1/invoices and GET /v1/invoices/{id} are on the billing pages.
| Method | Path | Who | What it does |
|---|---|---|---|
| POST | /v1/invoices |
admin, write | Make an invoice for an account |
| POST | /v1/invoices/{id}/mark-paid |
admin, write | Mark an unpaid invoice made by hand paid; a receipt is emailed |
| POST | /v1/invoices/{id}/send |
admin, write | Email the invoice again |
| POST | /v1/invoices/{id}/void |
admin, write | Void an invoice (its number stays used) |
POST /v1/invoices
| Field | Type | Required | Meaning |
|---|---|---|---|
account |
string | yes | the customer's username |
lines |
array | yes | objects with description, quantity (default 1) and unit_price |
due_days |
integer | days until it is due (0–90) | |
notes |
string | printed on the invoice | |
paid |
boolean | make it already paid | |
send |
boolean | email it | |
coupon |
string | a discount code |
Payments, products and orders
Payments are the paid invoices. Products are the packages as sold (change them at /v1/packages). Orders are domain orders.
| Method | Path | Who | What it does |
|---|---|---|---|
| GET | /v1/orders |
any token | Domain orders, newest first (staff: those of the accounts they see; customers: their own) |
| GET | /v1/orders/{id} |
any token | One order |
| GET | /v1/payments |
any token | Payments received, newest first: the paid invoices the token may see |
| GET | /v1/payments/{id} |
any token | One payment (by its invoice's id) |
| GET | /v1/products |
staff | The packages as they are sold, cheapest first (change them with /packages) |
| GET | /v1/products/{id} |
staff | One product |
GET /v1/orders
Query: status (only this status)
GET /v1/payments
Query: account (only this account (staff)); from (first day, YYYY-MM-DD); to (last day, YYYY-MM-DD)