API Reference

Your account: profile, role, per-user limits, and current wallet balance. GET is not rate-limited. PATCH updates allowedIps, maxServers, and monthlySpendLimit — API-token rotation and webhook URL/secret rotation stay console-only, since they require password re-authentication a Bearer token can't stand in for.

{
  "id": "usr_9f2...",
  "email": "[email protected]",
  "username": "you",
  "role": "user",
  "emailVerified": true,
  "allowedIps": null,
  "maxServers": 5,
  "monthlySpendLimit": 100.0,
  "balance": 12.34,
  "billingExempt": false,
  "webhookUrl": "https://your-app.com/webhooks/bashrack",
  "createdAt": "2026-05-30T08:12:00Z"
}

Platform health: overall state, per-component status (platform, datacenter locations, monitored services) and any unresolved incidents. Public — no authentication required. Checks run every minute; responses are cached ~30s. Human-readable version at bashrack.com/status.

{
  "overall": "operational",
  "checkedAt": "2026-07-02T13:06:47.856Z",
  "components": [
    { "component": "db",      "label": "Database",     "group": "platform",  "status": "operational", "latencyMs": 12 },
    { "component": "queue",   "label": "Job queue",    "group": "platform",  "status": "operational", "latencyMs": 8 },
    { "component": "loc:fra", "label": "🇩🇪 Frankfurt", "group": "locations", "status": "operational", "latencyMs": 254 }
  ],
  "activeIncidents": []
}

List all data-center locations with region codes.

[
  { "code": "fra", "city": "Frankfurt", "country": "Germany", "flag": "🇩🇪" },
  { "code": "ams", "city": "Amsterdam", "country": "Netherlands", "flag": "🇳🇱" },
  { "code": "nyc", "city": "New York", "country": "USA", "flag": "🇺🇸" },
  { "code": "lax", "city": "Los Angeles", "country": "USA", "flag": "🇺🇸" },
  { "code": "sgp", "city": "Singapore", "country": "Singapore", "flag": "🇸🇬" },
  { "code": "tyo", "city": "Tokyo", "country": "Japan", "flag": "🇯🇵" }
]

List available operating systems. All images support cloud-init.

[
  { "id": "ubuntu-24.04", "label": "Ubuntu 24.04 LTS", "family": "linux" },
  { "id": "ubuntu-22.04", "label": "Ubuntu 22.04 LTS", "family": "linux" },
  { "id": "debian-13",    "label": "Debian 13 (Trixie)", "family": "linux" },
  { "id": "debian-12",    "label": "Debian 12 (Bookworm)", "family": "linux" },
  { "id": "rocky-9",      "label": "Rocky Linux 9", "family": "linux" },
  { "id": "almalinux-9", "label": "AlmaLinux 9", "family": "linux" },
  { "id": "fedora-42",   "label": "Fedora 42", "family": "linux" },
  { "id": "alpine-3.20", "label": "Alpine Linux 3.20", "family": "linux" }
]

List VPS tier categories (shared, dedicated, performance) with pricing multipliers and default specs.

[
  {
    "id": "shared",
    "name": "Shared",
    "config": { "cores": 2, "ram": 4, "storageGb": 80, "bandwidth": 1 }
  },
  {
    "id": "dedicated",
    "name": "Dedicated",
    "config": { "cores": 8, "ram": 32, "storageGb": 320, "bandwidth": 10 }
  },
  {
    "id": "performance",
    "name": "Performance",
    "config": { "cores": 16, "ram": 64, "storageGb": 800, "bandwidth": 10, "unmetered": true }
  }
]

Create a new server order. Returns the order object with provisioning status.

{
  "category": "dedicated",
  "cores": 4,
  "ram": 16,
  "disk": 240,
  "storage": "nvme",
  "bw": "5g",
  "loc": "fra",
  "os": "ubuntu-24.04",
  "billing_cycle": "hourly",
  "cloud_init": {
    "ci_user": "deploy",
    "ssh_keys": "ssh-ed25519 AAAA...",
    "password": "mysecretpass"
  }
}

{
  "id": "ord_2vR9kP...",
  "server_id": "srv_4xKm9Q...",
  "status": "provisioning",
  "config": {
    "cores": 4,
    "ram": 16,
    "disk": 240,
    "storage": "nvme",
    "bw": "5g",
    "loc": "fra",
    "os": "ubuntu-24.04"
  },
  "price": {
    "hourly": 0.145833
  },
  "created_at": "2026-06-12T09:41:00Z"
}

List your active server orders. Supports ?status=active|terminated|provisioning.

[
  {
    "id": "ord_2vR9kP...",
    "status": "active",
    "ipv4": "185.203.114.12",
    "config": { "cores": 4, "ram": 16, "loc": "fra", "os": "ubuntu-24.04" },
    "price": { "hourly": 0.145833 },
    "created_at": "2026-06-12T09:41:00Z"
  }
]

Get a single order by ID. Includes live status and assigned IP addresses.

{
  "id": "ord_2vR9kP...",
  "status": "active",
  "ipv4": "185.203.114.12",
  "config": { "cores": 4, "ram": 16, "loc": "fra", "os": "ubuntu-24.04" },
  "price": { "hourly": 0.145833 },
  "created_at": "2026-06-12T09:41:00Z",
  "ready_at": "2026-06-12T09:52:00Z"
}

Terminate a server. Billing stops immediately. This action is irreversible.

{
  "id": "ord_2vR9kP...",
  "status": "terminated",
  "terminated_at": "2026-06-12T14:22:00Z"
}

Get live server details including status, IP address, and resource config. Use server_id from the order response as the ID.

{
  "id": "srv_...",
  "hostname": "srv-lt1-a3f9c2",
  "status": "running",
  "ipv4": "185.203.114.12",
  "os": "ubuntu-24.04",
  "location": "lt1",
  "config": {
    "cores": 4,
    "ram": 16,
    "disk": 240,
    "storage": "nvme",
    "bandwidth": 10
  },
  "cost": { "monthly": 120.00, "hourly": 0.166667 },
  "created_at": "2026-06-20T10:00:00Z",
  "terminated_at": null
}

Control a running or stopped server. Use server_id from the order response as the ID. Actions are applied asynchronously — poll GET /servers/{id} for the final status.

{
  "action": "reboot"
}

{
  "id": "srv_...",
  "status": "rebooting"
}

Reinstall the server's OS from a fresh image. Pass osId (see GET /os) to switch images, or omit it to reinstall the current one. All data on disk is destroyed. Async — poll GET /servers/{id} for status.

{
  "osId": "debian-12"
}

{
  "ok": true
}

Set the server's hostname.

{
  "hostname": "web-prod-01"
}

{
  "ok": true
}

Toggle the starred flag on a server (pins it in your dashboard). No request body.

{
  "starred": true
}

Mint a short-lived VNC ticket for the web console. The server must be running. Connect any RFB/noVNC client over the WebSocket proxy — the ws endpoint authenticates with your dashboard session cookie (browser), not the API token.

{
  "ws_path": "/api/v1/console/ws",
  "ticket": "PVE:VNC:6A2F...",
  "port": 5900,
  "node": "fra-r12-b07"
}

wss://bashrack.com/api/v1/console/ws?serverId=<id>&ticket=<urlencoded ticket>&port=5900&node=<node>
# pass the ticket again as the RFB password

Per-VM firewall via Proxmox's own firewall API. GET returns options, rules, and network interfaces. PATCH updates options. POST /servers/{id}/firewall/rules adds a rule; PATCH/DELETE /servers/{id}/firewall/rules/{pos} update or remove one by position. POST /servers/{id}/firewall/net/{iface} toggles the firewall on one NIC (e.g. net0).

{
  "options": { "enable": 1, "policy_in": "DROP", "policy_out": "ACCEPT" },
  "rules": [
    {
      "pos": 0,
      "type": "in",
      "action": "ACCEPT",
      "enable": 1,
      "dport": "22",
      "proto": "tcp",
      "comment": "SSH"
    }
  ],
  "netDevices": [{ "iface": "net0", "firewall": true }]
}

{
  "type": "in",
  "action": "ACCEPT",
  "dport": "80,443",
  "proto": "tcp",
  "comment": "web"
}

→ { "ok": true }

Change SSH keys, network config (static or DHCP), nameserver, and hostname after initial provisioning. Pure cloud-init config write — no guest agent, no command execution. Proxmox derives the cloud-init instance-id from a hash of this config, so changing it makes cloud-init treat the VM's next reboot as a first boot and re-apply it — reliably, across every distro. This only writes config; call POST /servers/{id}/action {"action":"reboot"} afterward to actually apply it.

{
  "sshKeys": "ssh-ed25519 AAAA...",
  "ipConfig": "ip=dhcp",
  "nameserver": null,
  "hostname": "my-server"
}

{
  "hostname": "web-prod-01",
  "ipConfig": { "mode": "static", "ip": "203.0.113.10", "cidr": 24, "gateway": "203.0.113.1" },
  "sshKeys": "ssh-ed25519 AAAA...",
  "nameserver": "1.1.1.1 8.8.8.8"
}

→ { "ok": true, "rebootRequired": true }

List and create disk snapshots. Create requires a positive wallet balance. Names: 1–40 chars, letters, digits, _ and -. Deleting: DELETE /servers/{id}/snapshots/{snapshotId}. Rolling back: POST /servers/{id}/snapshots/{snapshotId}/rollback (snapshot must be active; the server reboots).

[
  {
    "id": "snp_7Qw...",
    "name": "pre-upgrade",
    "description": "before ubuntu 26.04",
    "sizeGb": 12,
    "status": "active",
    "createdAt": "2026-07-01T10:20:00Z"
  }
]

{
  "name": "pre-upgrade",
  "description": "optional, max 255 chars"
}

→ {
  "id": "snp_7Qw..."
}

Current balance plus paginated wallet transactions. Query params: ?page=0 (default 0), ?limit=50 (1–200).

{
  "balance": 12.34,
  "transactions": [
    {
      "id": "txn_3Kd...",
      "type": "topup",
      "amount": 10.0,
      "balanceAfter": 22.34,
      "provider": "paypal",
      "status": "completed",
      "createdAt": "2026-07-10T12:00:00Z"
    },
    {
      "id": "txn_9Lw...",
      "type": "hourly_charge",
      "amount": -0.061,
      "balanceAfter": 12.34,
      "provider": null,
      "status": "completed",
      "createdAt": "2026-07-11T13:00:00Z"
    }
  ],
  "hasMore": false,
  "page": 0
}

Start a wallet top-up. Returns a checkout URL — redirect the user there to pay. Amount: 5–10,000 USD. Provider: paypal or nowpayments (crypto).

{
  "amount": 25,
  "provider": "paypal"
}

{
  "transactionId": "txn_3Kd...",
  "provider": "paypal",
  "approveUrl": "https://www.paypal.com/checkoutnow?token=..."
}

Automatic top-up when the balance drops below a threshold. GET returns the current config; POST updates it (threshold 0–10,000, amount 5–10,000). Only the NOWPayments provider is supported — crypto auto top-up emails an invoice rather than charging silently.

{
  "enabled": true,
  "threshold": 5,
  "amount": 20,
  "provider": "nowpayments"
}

{
  "enabled": true,
  "threshold": 5,
  "amount": 20,
  "provider": "nowpayments"
}

→ { "ok": true }

Which payment providers are enabled on this deployment. Not rate-limited.

{
  "paypal": true,
  "nowpayments": true
}

List your invoices, newest first. GET /invoices/{id} returns a single invoice (404 if not yours).

[
  {
    "id": "inv_5Rt...",
    "amount": 25.0,
    "description": "Wallet top-up",
    "status": "paid",
    "creditWallet": true,
    "dueDate": "2026-07-15",
    "sentAt": "2026-07-08T09:00:00Z",
    "paidAt": "2026-07-08T09:04:00Z",
    "createdAt": "2026-07-08T09:00:00Z",
    "invoiceNumber": "BRK-20260708-A1B2C3D4",
    "paymentProvider": "nowpayments",
    "paymentUrl": "https://nowpayments.io/payment/...",
    "paypalInvoiceNumber": null
  }
]

List and create support tickets. Create: subject 5–200 chars, body 10–10,000 chars, category billing | technical | general (default) | abuse. GET /tickets/{id} includes the full message thread, POST /tickets/{id}/reply appends a message (reopens pending/resolved tickets), POST /tickets/{id}/close closes it.

[
  {
    "id": "tkt_2Fd...",
    "subject": "Cannot SSH",
    "status": "open",
    "priority": "normal",
    "category": "technical",
    "messageCount": 3,
    "createdAt": "2026-07-12T08:00:00Z",
    "updatedAt": "2026-07-12T09:30:00Z"
  }
]

{
  "subject": "Cannot SSH",
  "body": "Connection refused since 08:00 UTC …",
  "category": "technical"
}

→ { "id": "tkt_2Fd..." }

List active dashboard sessions for your account (newest first). DELETE /sessions/{sid} revokes one — use the sid from this list. Note: API-token calls carry no session cookie, so current is always false here.

[
  {
    "sid": "sess_8Hm...",
    "current": false,
    "createdAt": "2026-07-14T19:22:00Z",
    "ip": "203.0.113.10",
    "ua": "Firefox 140 / Linux",
    "ttl": 604800
  }
]

List the organizations you belong to.

[
  {
    "id": "org_4Nq...",
    "name": "Acme Inc",
    "slug": "acme-inc",
    "role": "owner",
    "isOwner": true
  }
]

Organization detail with members. Pending invites are included only when your role is owner or admin.

{
  "id": "org_4Nq...",
  "name": "Acme Inc",
  "slug": "acme-inc",
  "ownerUserId": "usr_1Ab...",
  "role": "owner",
  "members": [
    {
      "userId": "usr_1Ab...",
      "username": "alice",
      "role": "owner",
      "isOwner": true,
      "joinedAt": "2026-06-01T10:00:00Z"
    }
  ],
  "invites": [
    {
      "id": "inv_9Zx...",
      "email": "[email protected]",
      "role": "member",
      "invitedBy": "usr_1Ab...",
      "expiresAt": "2026-07-08T10:00:00Z",
      "createdAt": "2026-07-01T10:00:00Z"
    }
  ]
}

Invite a member (owner/admin only, 7-day expiry, emailed to the invitee). DELETE /organizations/{id}/invites/{inviteId} revokes a pending invite. POST /organizations/invites/accept joins the caller using the emailed token.

{
  "email": "[email protected]",
  "role": "member"
}

→ { "id": "inv_9Zx..." }

{
  "token": "a1b2c3…"
}

→ { "organizationId": "org_4Nq..." }

Change a member's role (PATCH) or remove them (DELETE) — owner/admin only. POST /organizations/{id}/leave removes the caller. The organization's owner can't be role-changed, removed, or leave this way — ownership transfer is console-only.

{
  "role": "admin"
}

→ { "ok": true }

{ "ok": true }

List and create web hosting apps (Coolify-backed). appType is a discriminated union: dockerimage, nixpacks, static, or dockercompose. resourceTier (small/medium/large) selects a CPU/RAM tier; small is included, medium/large add a monthly surcharge. GET /hosting/{id} returns full details, PATCH /hosting/{id} changes the resource tier and/or domains, DELETE /hosting/{id} terminates (bills the final partial hour). POST /hosting/{id}/action starts/stops/restarts, POST /hosting/{id}/star toggles starred, GET /hosting/{id}/logs?lines=200 tails logs.

[
  {
    "id": "app_3Fk...",
    "coolifyUuid": "a1b2c3d4",
    "name": "my-app",
    "status": "running",
    "domains": ["https://my-app.example.com"],
    "costMonthly": 5.0,
    "starred": false,
    "createdAt": "2026-07-01T10:00:00Z",
    "managementUrl": "https://coolify.internal/project/.../application/a1b2c3d4"
  }
]

{
  "name": "my-app",
  "storageGb": 5,
  "appType": "nixpacks",
  "gitRepository": "https://github.com/me/my-app",
  "gitBranch": "main"
}

→ { "id": "app_3Fk..." }

List (values redacted) or set an app's environment variables. POST /hosting/{id}/env/{envUuid}/reveal returns the real value; DELETE /hosting/{id}/env/{envUuid} removes it. Keys must be a valid env var name (letters, digits, underscore).

{
  "key": "DATABASE_URL",
  "value": "postgres://...",
  "isBuildTime": false
}

{ "value": "postgres://..." }

List and create managed databases (Coolify-backed). Self-service dbType: postgresql, mysql, mariadb, redis, mongodb, keydb, dragonfly, clickhouse. resourceTier (small/medium/large) selects a CPU/RAM tier; small is included, medium/large add a monthly surcharge. GET /databases/{id} includes connection credentials. PATCH /databases/{id} changes the resource tier. DELETE /databases/{id} terminates. POST /databases/{id}/action starts/stops/restarts, POST /databases/{id}/star toggles starred, GET /databases/{id}/logs?lines=200 tails logs, POST /databases/{id}/public-access { "enabled": true } opens a random public port (49200–59999).

{
  "dbType": "postgresql",
  "name": "my-db",
  "storageGb": 5
}

→ { "id": "db_9Qw..." }

{
  "id": "db_9Qw...",
  "dbType": "postgresql",
  "status": "running",
  "isPublic": false,
  "credentials": {
    "user": "postgres",
    "password": "…",
    "database": "postgres",
    "host": "…",
    "port": 5432
  }
}

Public, unauthenticated: list published bare-metal dedicated server listings. Fully white-label — provider identity never appears here. Addon key/groupKey/requiresKey are opaque per-listing tokens; echo the exact key back, don't construct your own.

[
  {
    "id": "b3f1...-...-...-...",
    "displayName": "12 Core Server - AMD Ryzen 5900X",
    "locationLabel": "Miami, FL, USA",
    "specs": { "cpuModel": "AMD Ryzen 5900X @ 3.7GHz", "cpuCores": 12, "cpuThreads": 24, "ramGb": 64, "disks": [{ "type": "nvme", "capacityGb": 1000, "count": 2 }], "bandwidthGbps": 1 },
    "addons": [{ "key": "2ced763baa757a92174b", "label": "5TB Bandwidth @ 1 Gbps", "kind": "choice", "groupKey": "…", "providerPriceUsd": 0, "sellPriceUsd": 0 }],
    "monthlyPriceUsd": 147.15,
    "available": true
  }
]

List or place dedicated server orders. Ordering charges the first monthly cycle from your wallet immediately; fulfillment is manual (admin-driven against the wholesale provider) and can take up to 48 hours. GET /dedicated/orders/{id} returns one order — status moves queued → active → past_due → suspended, or cancelled. Recurring billing charges the same wallet once per cycle; a failed charge gets a 7-day grace period before suspension.

{
  "stockId": "b3f1...-...-...-...",
  "addonKeys": ["2ced763baa757a92174b"]
}

→ { "id": "5bde...-...", "status": "queued", "price": { "monthly": 147.15 } }

{
  "id": "5bde...-...",
  "status": "active",
  "ip": "203.0.113.10",
  "credentials": null,
  "nextChargeAt": "2026-10-03T20:53:07Z",
  "capabilities": { "restart": true, "rescue": true, "reinstall": true }
}

Once an order is active and fulfilled (check capabilities), POST .../action with { "action": "restart" | "rescue" | "reinstall" } to power-cycle, enter rescue mode, or reinstall the OS. reinstall needs dist (an entry from GET .../reinstall-options' distOptions/osOptions) or, when its flow is os_and_partitioning, both operatingSystemId and partitioningSchemeId — fetch those first from GET .../reinstall-options and GET .../partitioning-schemes?operatingSystemId={id}.

{ "action": "reinstall", "dist": "ubuntu-24.04" }

→ { "ok": true }

{ "flow": "os_only", "distOptions": ["ubuntu-24.04", "debian-12"] }