Developer API

Everything the panel UI can do, your code can do. Two ways to authenticate:

1. API key (recommended for scripts): create a key in the panel, then send it as a Bearer token. Keys are shown once — only a SHA-256 hash is stored — and can be revoked any time.

curl -H "Authorization: Bearer sk_your_key_here" https://your-server:8443/api/domains

Create a key (with a logged-in session):

curl -b cookies.txt -X POST https://your-server:8443/api/keys \
  -H "Content-Type: application/json" \
  -d '{"name":"my deploy script"}'

2. Session cookie: POST /api/auth/login, then send the wp_session cookie. Failed logins are rate-limited (5 failures = 15-minute lockout).

Endpoints

Conventions

• All bodies are JSON. Errors look like {"error":"message"} with a matching HTTP status.
• Mutations that touch the live system report their sync result inline (for example dns_sync.ok on DNS writes) — the API never claims a change it did not make.
• API keys act with their owner's permissions and cannot manage other keys.