# api
API Reference
Provision and manage servers, hosting, databases and billing from your terminal, CI, or any HTTP client. Everything in the console is scriptable.
Looking for setup or account help? Open Help & guides.
Topics
- OverviewAuthenticationBearer tokens, base URL, rate limits, idempotency and IP allowlists.
- OverviewMCPRead-only Model Context Protocol endpoint for discovery and cost estimates.
- Account & catalogAccount & catalogYour account and API settings, plus locations, OS images and tiers.
- OrdersOrdersCreate, list, inspect and cancel VPS orders.
- ServersServersServer list, power actions, reinstall, console, firewall and cloud-init.
- BillingBillingWallet balance and transactions, top-ups, auto top-up and invoices.
- Support & accessSupport & accessSupport tickets and your account's browser sessions.
- OrganizationsOrganizationsTeam organizations, invites and members.
- HostingHosting & databasesWeb hosting apps, environment variables and managed databases.
- Dedicated serversDedicated serversThe public dedicated catalog, orders and post-fulfillment actions.
- Events & errorsWebhooks & errorsSigned webhook events and the error codes every endpoint can return.
Authentication
All requests require a Bearer token in the Authorization header (a few endpoints, like the dedicated server catalog, are public and noted as such below). Generate tokens from your dashboard under Profile → Developer → API token.
bash
curl https://bashrack.com/api/v1/orders \
-H "Authorization: Bearer $BASHRACK_API_TOKEN" \
-H "Content-Type: application/json"Base URL:
Rate limit: 60 requests / minute per token. Burst: 10.
Idempotency:
IP allowlist: if you restrict your token to specific IPs, requests from other IPs get
https://bashrack.com/api/v1Rate limit: 60 requests / minute per token. Burst: 10.
Idempotency:
POST /orders accepts an X-Idempotency-Key header — safe retries replay the first response for 24h.IP allowlist: if you restrict your token to specific IPs, requests from other IPs get
403 ip_not_allowed.