API
The panel uses this same API, so nothing in the panel is panel-only.
Built, not open to the public yet
This feature is built and has been tested against simulated hosts and a test database. It has not yet been proven on real hardware, and nothing here can be ordered today.
The API reference lists every customer operation, with its permission, token scope, errors and an example. It is generated from the API's own description file on each release. It covers customer routes only. Staff routes are not published.
Tokens
- Create a token in the panel under Account, API. It looks like
vx_live_...and is shown once. We store only a hash. - A token works inside one organisation and only on what its scopes open:
org:read,servers:read,servers:power,servers:rebuild,servers:destroy,firewall:read,firewall:write,sshkeys:readandsshkeys:manage. - A token that can rebuild or destroy servers needs an IP allowlist or an expiry under 30 days.
- A token never works on staff routes and never manages tokens. Billing and account changes need a signed-in session.
- There are no token scopes yet for volumes, floating IPs, private networks, snapshots, backups, game servers, marketplace apps or organisation settings. Those are done in the panel, whose calls are listed in the reference too, but a token cannot make them.
A first request
curl -H "Authorization: Bearer $VEXELIA_TOKEN" \
"$VEXELIA_URL/api/v1/orgs/ORG_ID/servers"Safe retries
A request that changes something may carry an Idempotency-Key header, a new string of 1 to 100
printable characters for each logical request. Repeat it with the same key after a timeout and you get the stored
answer back; the action is not run again. Keys are kept for 24 hours.
Lists
Lists that a token can read use cursor pagination: send limit (1 to 200) and, for the next
page, cursor set to the previous answer's next_cursor.
Webhooks
You can send events from your organisation to your own URL under Account, Webhooks. See webhooks for the event types, retries and how to verify the signature.