API Documentation

Getting Started

Already have an account? Login

Authentication

Every request carries a bearer token created on the API Tokens page. A token is minted for one account and, optionally, one or more specific services within it — it never has access beyond what its issuing user could see themselves.

All request and response bodies are JSON. All endpoints live under the /api/v1 prefix.

Abilities

A token is minted with one or more abilities, each a subset of the issuing user's own permissions on that account — a technical-only member can never mint a billing token, even for their own account.

Ability	Grants
view	List and view services, plans and migration requests
technical	Create services, register domains, suspend/unsuspend/reset the password/SSO into a service, manage service grants, manage webhooks, create migration requests
billing	List and view invoices, create Manage-track client accounts

A token can also be narrowed to specific services at creation time — if it is, every request is additionally checked against that list.

Rate Limits & Errors

60 requests per minute, per token. A request over the limit returns 429 Too Many Requests.

An authorization failure (missing ability, wrong account, unscoped service) returns 403 with a plain-text message field explaining which check failed. A validation failure returns 422 in Laravel's standard {"message": "...", "errors": {...}} shape.

Idempotency

Every service-creation request must carry an Idempotency-Key header — a client-generated unique value (a UUID works well). Retrying the same request with the same key returns the original response instead of creating a second service; a concurrent request with the same key while the first is still processing gets 409 Conflict. Missing the header at all returns 400.

Pagination

Every list endpoint below is paginated.

Pass ?page= to move through pages and ?per_page= to control page size (default 25 — 50 for Plans — max 100).

Every list response is wrapped in the same envelope:

Endpoints

Plans

Lists every orderable plan — the plan_id values POST /api/v1/services accepts. A Manage-track client account also sees manage_discount_percent and price_after_discount per plan — the price this token's account actually pays.

Services

Lists every service on the token's account (or, if scoped, just the scoped services).

Returns one service.

Orders a new service. Requires the Idempotency-Key header described above. An invoice is generated immediately; the service provisions once it's paid, the same as an order placed in the dashboard.

Field	Type	Notes
plan_id	integer	required — an active plan on an active product
currency	string	required — GEL, USD or EUR
domain	string	required for hosting plans, otherwise omitted

The response includes an invoice object — its total is what this order was actually billed, net of any Manage-track discount; the order's own price field is always the undiscounted list price.

Queues a suspend/unsuspend — the same retrying job the admin panel dispatches.

Changes the control panel password. For shared/WordPress hosting, pass a password field (min. 8 characters). For a Root VPS or Virtual Desktop, no body is needed — a password is generated and returned once in the response, since that's the only channel to learn it.

Returns a one-time cPanel single sign-on url.

Shares (or revokes access to) a single service with another RE:HOST user by email — { "email": "...", "permission": "view|manage", "expires_at": "..." }.

Invoices

Lists every invoice on the token's account.

Returns one invoice.

Webhook Subscriptions

Lists the account's webhook subscriptions.

Registers a webhook. The response includes the signing secret exactly once — store it immediately, the same one-time rule as the token itself.

Field	Type	Notes
url	string	required — must be a valid URL
events	array	required — one or more of the event names below

Removes a webhook subscription.

Domains

Checks one or many domains for availability.

Registers a domain — the same checkout the dashboard uses, so pricing and provisioning are identical. Requires domain, years, currency, nameserver_mode and registrant_contact. An invoice is generated immediately, the same way service creation does.

Accounts

Manage-track only: lists, or creates, a client account owned by this agency (requires the Growth partner tier or above). Requires name; company_name, company_number, vat_number and currency are optional.

Migration Requests

Queues a website migration request for a domain — requires domain; optionally binds it to an order_id and sets the source type/scope questions in the same call. Uploading migration credentials and final submission are dashboard-only.

Webhooks

Subscribed events are delivered as an HTTP POST to your registered URL as soon as they happen, so you can react instead of polling.

Event	Fires when
service.provisioned	A service finishes provisioning.
invoice.paid	An invoice is marked paid.
service.suspended	A service is suspended.
invoice.created	A new invoice is raised for a service (including a renewal).
service.expiring	A service enters its renewal notice window.
service.terminated	A service is terminated.
service.transfer_accepted	A service ownership transfer is accepted — fired to both the losing and gaining account.

Payload

Verifying the signature

Every delivery carries an X-RehostGe-Signature header — an HMAC-SHA256 of the exact raw request body, keyed with your webhook's own secret. Recompute it and compare before trusting the payload.

A delivery that doesn't receive a successful (2xx) response is retried up to 3 times with backoff, then given up on.

Versioning

Every endpoint lives under /api/v1. Backward-compatible changes — new fields, new optional parameters, new endpoints — ship without a version bump.

A breaking change would ship as a new /api/v2 prefix, with /v1 kept running for an announced deprecation window — never removed without notice.

Changelog

Date	What Changed
2026-09-20	Published a machine-readable OpenAPI 3.0 spec for this API — see the "Download OpenAPI spec" link above.
2026-09-20	Pagination added to every list endpoint (page/per_page query parameters). Docs page published publicly.
v1	Initial release: services, invoices, plans, webhooks, domains, accounts, migration-requests.