HiPanel API

Overview

HiPanel has a REST API that returns JSON. The web interface runs on this same API, so anything you do in the panel can be done from a script, CI or an AI agent.

• Base URL: https://hipanel.cloud/api/v1
• OpenAPI spec: https://hipanel.cloud/api/v1/openapi.json
• Try it in Swagger UI: https://hipanel.cloud/api/v1/docs

Authentication

Create an API token under Settings → API tokens and choose the scopes you need. The token is shown only once; HiPanel only stores a hash. Send it in the Authorization header on every request.

curl https://hipanel.cloud/api/v1/servers \
  -H "Authorization: Bearer tc_live_xxxxxxxxxxxxxxxx" \
  -H "X-Team-Id: 7f3c2a10-…"   # optional

The X-Team-Id header picks a team when you belong to several; it defaults to the token's team. Revoke a token at any time and requests using it get a 401.

Token scopes

A write scope includes the matching read scope. A token's effective permissions are its scopes intersected with its creator's current role, checked on every request: a token can never do more than the person who created it.

Response format

Every response is a JSON envelope. Paginated lists also include meta.

{ "success": true, "message": "ok", "data": [ … ], "meta": { "page": 1, "per_page": 50, "total": 123 } }
​
{ "success": false, "message": "Domain shop.vn is already used on this server", "errors": { "domain": ["taken"] } }

Async tasks

Operations that run on a server (creating a site, issuing SSL, deploying, backing up…) return 202 with data.task. Poll GET /tasks/{id} until status is succeeded or failed. Failed tasks keep a log you can read, and can be retried.

• queued
• running
• succeeded
• failed

Rate limits

By default, 60 requests per minute per token, user or IP address. Going over returns 429 with a Retry-After header (seconds to wait).

Main resources

Paths are relative to the base URL. The complete list, with the schema of every field, is in the OpenAPI spec.

Examples

Create a WordPress site, wait for the task, then issue SSL:

# 1. Create a WordPress site: returns 202 with a task
curl -X POST https://hipanel.cloud/api/v1/servers/$SERVER_ID/sites \
  -H "Authorization: Bearer $HIPANEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "shop",
    "domain": "shop.vn",
    "aliases": ["www.shop.vn"],
    "site_type": "wordpress",
    "php_version": "8.3",
    "wordpress": { "title": "Shop", "admin_user": "admin", "admin_email": "you@shop.vn", "locale": "vi" }
  }'
​
# 2. Poll the task until it finishes
curl https://hipanel.cloud/api/v1/tasks/$TASK_ID -H "Authorization: Bearer $HIPANEL_TOKEN"
​
# 3. Issue a Let's Encrypt certificate
curl -X POST https://hipanel.cloud/api/v1/sites/$SITE_ID/ssl \
  -H "Authorization: Bearer $HIPANEL_TOKEN" \
  -H "Content-Type: application/json" -d '{"email": "you@shop.vn"}'

Deploy and roll back from CI:

# Deploy the configured branch, then roll back if needed
curl -X POST https://hipanel.cloud/api/v1/sites/$SITE_ID/deployments -H "Authorization: Bearer $HIPANEL_TOKEN"
curl -X POST https://hipanel.cloud/api/v1/sites/$SITE_ID/rollback -H "Authorization: Bearer $HIPANEL_TOKEN"