← All Guides
Reference20 min read

API Reference

Complete REST API documentation for programmatic access to servers, deployments, databases, and monitoring.

1.Authentication

Authenticate API requests using JWT tokens or API keys.

  1. JWT: Obtain token via POST /api/auth/login with email/password
  2. Include token in header: Authorization: Bearer <token>
  3. Token expires in 24 hours — refresh via POST /api/auth/refresh
  4. API Keys: generate in Settings → API Keys for server-to-server auth
  5. API Key header: X-API-Key: <key>
  6. Rate limits: 100 req/min (JWT), 1000 req/min (API Key)

2.Server Management Endpoints

Manage servers programmatically.

  1. GET /api/servers — list all servers
  2. POST /api/servers — create new server
  3. GET /api/servers/:id — get server details
  4. PATCH /api/servers/:id — update server config
  5. DELETE /api/servers/:id — delete server
  6. POST /api/servers/:id/power — power actions (restart, shutdown, off)
  7. GET /api/servers/:id/metrics — real-time metrics

3.Deployment Endpoints

Manage application deployments.

  1. GET /api/apps — list applications
  2. POST /api/apps — create new application
  3. GET /api/apps/:id — get app details
  4. PATCH /api/apps/:id — update app config
  5. POST /api/apps/:id/deploy — trigger deployment
  6. GET /api/apps/:id/deployments — deployment history
  7. POST /api/apps/:id/rollback — rollback to previous version
  8. GET /api/apps/:id/logs — deployment/build logs

4.Webhook Subscriptions

Subscribe to real-time events via webhooks.

  1. POST /api/webhooks — create webhook subscription
  2. Events: deployment.started, deployment.completed, deployment.failed, server.created, server.deleted, alert.triggered, backup.completed
  3. Payload: JSON with event type, timestamp, and resource data
  4. Signature verification: X-Oxaploy-Signature header (HMAC-SHA256)
  5. Retry policy: exponential backoff (1m, 5m, 15m, 1h) up to 24h
  6. Test webhook in dashboard before going live