On this page

Developer documentation

WebRock API v1.0.0

Manage domains, DNS, SSL, FTP, databases, cron jobs, mail and backups from your own scripts, CI pipelines or control panel. Same isolation as the dashboard: every token acts strictly within your own account.

https://www.webrock.online/api/v1 OpenAPI 3.1 spec Sign in to get a token

Quickstart

Book API access in the dashboard under Settings → API access (€22.61 per month incl. VAT, cancel monthly, requires an active hosting plan).
Create a token on the same page. It is shown once — store it like a password.
Send it as a bearer token:

curl -H "Authorization: Bearer wr_…" https://www.webrock.online/api/v1/account

# create a domain with a DNS zone
curl -X POST -H "Authorization: Bearer wr_…" -H "Content-Type: application/json" \
  -d '{"domain":"example.com","dns":true}' https://www.webrock.online/api/v1/domains

# issue a certificate, then poll the job
curl -X POST -H "Authorization: Bearer wr_…" https://www.webrock.online/api/v1/domains/example.com/ssl
curl -H "Authorization: Bearer wr_…" https://www.webrock.online/api/v1/jobs/ssl/example.com

Authentication

Every request except GET / and GET /openapi.json needs Authorization: Bearer wr_…. Tokens are 43 characters, prefixed wr_; we store only a hash.

Up to 10 active tokens per account, optional expiry, instant revocation in the dashboard. A revoked or expired token returns 401.

Subscription gate. Without an active API subscription every hosting endpoint returns 402 SUBSCRIPTION_REQUIRED. GET /account still works and tells you api_subscription.active, so scripts can fail early with a clear message. Tokens survive a lapse — after re-booking they simply work again.

Conventions

Envelope: Success: {"data": …, "request_id": "…"}. Error: {"error": {"code", "message", …}, "request_id"}. 204 has no body.
Request ID: Also sent as X-Request-Id. Quote it in support tickets — we can trace the exact request.
Bodies: JSON only (Content-Type: application/json). Invalid JSON returns 400 INVALID_JSON.
Rate limit: Per token, fixed 60-second window. Headers X-RateLimit-Limit, -Remaining, -Reset; on 429 honour Retry-After.
Async operations: SSL issuance, mail domain creation and backups return 202 with a job handle. Poll GET /jobs/{kind}/{key} until status is ok or error.
Generated secrets: Omit password when creating FTP, database or mail accounts and we generate one. It is returned once in that response and never again.
Timestamps: ISO 8601, UTC.
Stability: v1 is stable. Fields may be added without notice; nothing is removed or renamed within v1.

Error codes

Match on error.code, not on the message — messages may be reworded.

Code	HTTP	Meaning
UNAUTHORIZED	401	Missing or invalid bearer token.
TOKEN_EXPIRED	401	The token has passed its expiry date.
SUBSCRIPTION_REQUIRED	402	No active API subscription. Book it in the dashboard.
ACCOUNT_SUSPENDED	403	The account is suspended.
FORBIDDEN	403	The operation is not allowed (e.g. deleting the primary FTP account).
NOT_FOUND	404	Endpoint or resource does not exist / does not belong to you.
METHOD_NOT_ALLOWED	405	Wrong HTTP method; see the `Allow` header.
NO_HOSTING	409	The account has no active hosting product.
ALREADY_EXISTS	409	A resource with that name already exists.
RESOURCE_LOCKED	409	The resource is locked (e.g. suspended).
RESOURCE_IN_USE	409	The resource is still referenced elsewhere.
INVALID_JSON	400	Request body is not valid JSON.
VALIDATION_ERROR	422	One or more fields are invalid; see `fields`.
QUOTA_EXCEEDED	422	The plan limit for this resource type is reached.
FEATURE_DISABLED	422	The feature is not enabled for this account.
RATE_LIMITED	429	Too many requests; wait `retry_after` seconds.
BACKEND_ERROR	502	The hosting service reported an error. Retry later.
BACKEND_UNAVAILABLE	503	The hosting service is temporarily unreachable. Retry with backoff.
MAINTENANCE	503	Planned maintenance. Wait for `Retry-After` and try again.
INTERNAL_ERROR	500	Unexpected error. Quote the `request_id` to support.

Account

GET `/` Health check

No authentication required.

Response 200 data: Health

Field	Type	Description
name	string
version	string
status	string

GET `/account` Account and subscription status

Works without an active API subscription — use it to check `api_subscription.active` before making other calls.

Response 200 data: Account

Field	Type	Description
id	integer
email	string
hosting_active	boolean
plan	string \| null	Hosting plan key or null.
term_ends_at	string \| null	Hosting term end (ISO 8601) or null.
suspended	boolean
api_subscription	object
token	object

GET `/account/usage` Storage and traffic usage

Response 200 data: Usage

Field	Type	Description
storage	object
traffic	object

Domains

GET `/domains` List web domains

Response 200 data: Domain[]

Field	Type	Description
domain	string
ssl	boolean
disk_mb	number
bandwidth_mb	number

POST `/domains` Create web domain

Optionally creates a DNS zone pointing at the server IP.

Request body DomainCreate

Field	Type	Description
domain (required)	string	Hostname, e.g. example.com.
dns	boolean	Also create a DNS zone. Default false.

Response 201 data: DomainCreated

Field	Type	Description
domain	string
ssl	boolean
dns	boolean	Whether the DNS zone was created.
warnings	array<string>	Non-fatal problems, e.g. DNS zone not created.

GET `/domains/{domain}` Get web domain

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 200 data: Domain

Field	Type	Description
domain	string
ssl	boolean
disk_mb	number
bandwidth_mb	number

DELETE `/domains/{domain}` Delete web domain

Removes the web domain including its files. Irreversible.

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 204

GET `/domains/{domain}/aliases` List aliases

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 200 data: Alias[]

Field	Type	Description
alias	string

POST `/domains/{domain}/aliases` Add alias

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Request body AliasCreate

Field	Type	Description
alias (required)	string

Response 201 data: AliasCreated

Field	Type	Description
domain	string
alias	string

DELETE `/domains/{domain}/aliases/{alias}` Remove alias

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.
alias	Alias hostname.

Response 204

GET `/domains/{domain}/redirect` Get redirect

Returns `null` when no redirect is set.

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 200 data: Redirect | null

Field	Type	Description
target	string
code	integer	301 or 302.

PUT `/domains/{domain}/redirect` Set redirect

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Request body RedirectSet

Field	Type	Description
target (required)	string	Hostname or URL.
code	integer	301 (default) or 302.

Response 200 data: Redirect

Field	Type	Description
target	string
code	integer	301 or 302.

DELETE `/domains/{domain}/redirect` Remove redirect

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 204

SSL

GET `/domains/{domain}/ssl` SSL status

Includes the last issuance job, if any.

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 200 data: SslStatus

Field	Type	Description
domain	string
ssl	boolean
letsencrypt	boolean
job	object \| null

POST `/domains/{domain}/ssl` Issue Let's Encrypt certificate

Asynchronous. Returns `202` with a job handle; poll `GET /jobs/ssl/{domain}`. Rate-limited to one attempt per domain every 5 minutes.

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 202 data: Job

Field	Type	Description
job	string	Handle `kind:key`.
status	none \| pending \| started \| ok \| error
message	string
updated_at	string \| null	ISO 8601 or null.

DELETE `/domains/{domain}/ssl` Remove certificate

Path parameters

Name	Description
domain	Web domain, e.g. `example.com`.

Response 204

DNS

GET `/dns/zones` List DNS zones

Response 200 data: DnsZone[]

Field	Type	Description
zone	string
records	integer
dnssec	boolean

GET `/dns/zones/{zone}/records` List records

Path parameters

Name	Description
zone	DNS zone, e.g. `example.com`.

Response 200 data: DnsRecord[]

Field	Type	Description
id	string
name	string	`@` for the apex.
type	string
value	string
priority	integer \| null
ttl	integer \| null

POST `/dns/zones/{zone}/records` Create record

Path parameters

Name	Description
zone	DNS zone, e.g. `example.com`.

Request body DnsRecordInput

Field	Type	Description
name (required)	string	`@`, `www`, `mail`, …
type (required)	A \| AAAA \| CNAME \| MX \| TXT \| NS \| SRV \| CAA \| PTR \| TLSA \| DNSKEY \| DS
value (required)	string
priority	integer	Required for MX and SRV.
ttl	integer	60 – 2592000 seconds.

Response 201 data: DnsRecord

Field	Type	Description
id	string
name	string	`@` for the apex.
type	string
value	string
priority	integer \| null
ttl	integer \| null

PATCH `/dns/zones/{zone}/records/{id}` Update record

Partial update — omitted fields keep their value.

Path parameters

Name	Description
zone	DNS zone, e.g. `example.com`.
id	Record id from the list.

Request body DnsRecordInput

Field	Type	Description
name (required)	string	`@`, `www`, `mail`, …
type (required)	A \| AAAA \| CNAME \| MX \| TXT \| NS \| SRV \| CAA \| PTR \| TLSA \| DNSKEY \| DS
value (required)	string
priority	integer	Required for MX and SRV.
ttl	integer	60 – 2592000 seconds.

Response 200 data: DnsRecord

Field	Type	Description
id	string
name	string	`@` for the apex.
type	string
value	string
priority	integer \| null
ttl	integer \| null

DELETE `/dns/zones/{zone}/records/{id}` Delete record

Path parameters

Name	Description
zone	DNS zone, e.g. `example.com`.
id	Record id from the list.

Response 204

FTP

GET `/ftp` List FTP accounts

Response 200 data: FtpAccount[]

Field	Type	Description
username	string
domain	string
path	string
primary	boolean

POST `/ftp` Create FTP account

The full login becomes `<panel-user>_<username>`. If `password` is omitted a random one is generated and returned **once**.

Request body FtpAccountCreate

Field	Type	Description
domain (required)	string
username (required)	string	Suffix only; lowercase, digits, underscore.
path	string	Relative to the domain root, e.g. public_html/app.
password	string	Min. 8 chars. Omit to generate.

Response 201 data: FtpAccountCreated

Field	Type	Description
username	string
domain	string
path	string
primary	boolean
password	string	Only when generated. Shown once.

PATCH `/ftp/{username}` Change FTP password

Omit `password` to generate one.

Path parameters

Name	Description
username	Full FTP login.

Request body PasswordInput

Field	Type	Description
password	string	Omit to generate a random one.

Response 200 data: PasswordChanged

Field	Type	Description
updated	boolean
password	string	Only when generated. Shown once.

DELETE `/ftp/{username}` Delete FTP account

The primary account cannot be deleted.

Path parameters

Name	Description
username	Full FTP login.

Response 204

Databases

GET `/databases` List databases

Response 200 data: Database[]

Field	Type	Description
name	string
user	string
type	string
host	string
charset	string
disk_mb	number
suspended	boolean

POST `/databases` Create database

Name and user are prefixed with `<panel-user>_`. Omit `password` to generate one (returned once).

Request body DatabaseCreate

Field	Type	Description
name (required)	string	Suffix; lowercase, digits, underscore, max. 32.
user	string	Defaults to name.
type	mysql \| pgsql	Default `mysql`.
password	string	Min. 8 chars. Omit to generate.

Response 201 data: DatabaseCreated

Field	Type	Description
name	string
user	string
type	string
password	string	Only when generated. Shown once.

PATCH `/databases/{name}` Change database password

Path parameters

Name	Description
name	Full database name.

Request body PasswordInput

Field	Type	Description
password	string	Omit to generate a random one.

Response 200 data: PasswordChanged

Field	Type	Description
updated	boolean
password	string	Only when generated. Shown once.

DELETE `/databases/{name}` Delete database

Irreversible.

Path parameters

Name	Description
name	Full database name.

Response 204

Cron

GET `/cron` List cron jobs

Response 200 data: CronJob[]

Field	Type	Description
id	string
minute	string
hour	string
day	string
month	string
weekday	string
command	string
suspended	boolean

POST `/cron` Create cron job

Request body CronJobCreate

Field	Type	Description
minute	string	Default `*`.
hour	string	Default `*`.
day	string	Default `*`.
month	string	Default `*`.
weekday	string	Default `*`.
command (required)	string	Single line, max. 1024 chars.

Response 201 data: CronJob

Field	Type	Description
id	string
minute	string
hour	string
day	string
month	string
weekday	string
command	string
suspended	boolean

DELETE `/cron/{id}` Delete cron job

Path parameters

Name	Description
id	Job id from the list.

Response 204

Mail

GET `/mail/domains` List mail domains

Response 200 data: MailDomain[]

Field	Type	Description
domain	string
accounts	integer
disk_mb	number
antispam	boolean
antivirus	boolean
reject_spam	boolean
dkim	boolean
ssl	boolean
catchall	string \| null
webmail	string
suspended	boolean
ssl_job	object \| null	Only on 202 after enabling SSL.

POST `/mail/domains` Create mail domain

Asynchronous (mail setup takes a while). Returns `202` with a job handle; poll `GET /jobs/mail_create/{domain}`.

Request body MailDomainCreate

Field	Type	Description
domain (required)	string
antispam	boolean	Default true.
antivirus	boolean	Default true.
dkim	boolean	Default true.
reject_spam	boolean	Default false.

Response 202 data: Job

Field	Type	Description
job	string	Handle `kind:key`.
status	none \| pending \| started \| ok \| error
message	string
updated_at	string \| null	ISO 8601 or null.

GET `/mail/domains/{domain}` Get mail domain

Path parameters

Name	Description
domain	Mail domain.

Response 200 data: MailDomain

Field	Type	Description
domain	string
accounts	integer
disk_mb	number
antispam	boolean
antivirus	boolean
reject_spam	boolean
dkim	boolean
ssl	boolean
catchall	string \| null
webmail	string
suspended	boolean
ssl_job	object \| null	Only on 202 after enabling SSL.

PATCH `/mail/domains/{domain}` Update mail domain

Toggle features, set or clear the catch-all, enable/disable SSL. Enabling SSL is asynchronous: the response is `202` with an `ssl_job` handle — poll `GET /jobs/mail_ssl/{domain}`.

Path parameters

Name	Description
domain	Mail domain.

Request body MailDomainUpdate

Field	Type	Description
antispam	boolean
antivirus	boolean
dkim	boolean
reject_spam	boolean
catchall	string	Email address, or empty string to remove.
ssl	boolean

Response 200 data: MailDomain

Field	Type	Description
domain	string
accounts	integer
disk_mb	number
antispam	boolean
antivirus	boolean
reject_spam	boolean
dkim	boolean
ssl	boolean
catchall	string \| null
webmail	string
suspended	boolean
ssl_job	object \| null	Only on 202 after enabling SSL.

DELETE `/mail/domains/{domain}` Delete mail domain

Deletes all mailboxes. Irreversible. Asynchronous: returns `202` with a job handle — poll `GET /jobs/mail_delete/{domain}`.

Path parameters

Name	Description
domain	Mail domain.

Response 202 data: Job

Field	Type	Description
job	string	Handle `kind:key`.
status	none \| pending \| started \| ok \| error
message	string
updated_at	string \| null	ISO 8601 or null.

GET `/mail/domains/{domain}/accounts` List mailboxes

Path parameters

Name	Description
domain	Mail domain.

Response 200 data: MailAccount[]

Field	Type	Description
account	string
domain	string
email	string
disk_mb	number
suspended	boolean

POST `/mail/domains/{domain}/accounts` Create mailbox

Omit `password` to generate one (returned once).

Path parameters

Name	Description
domain	Mail domain.

Request body MailAccountCreate

Field	Type	Description
account (required)	string	Local part.
password	string	Min. 10 chars. Omit to generate.
quota_mb	integer	0 or omitted = unlimited.

Response 201 data: MailAccountCreated

Field	Type	Description
account	string
domain	string
email	string
quota_mb	integer \| null
password	string	Only when generated. Shown once.

GET `/mail/domains/{domain}/accounts/{account}` Get mailbox

Includes quota, aliases and forwards.

Path parameters

Name	Description
domain	Mail domain.
account	Local part, e.g. `info`.

Response 200 data: MailAccountDetail

Field	Type	Description
account	string
domain	string
email	string
disk_mb	number
suspended	boolean
quota_mb	integer \| null	null = unlimited.
aliases	array<string>
forwards	array<string>
forward_only	boolean

PATCH `/mail/domains/{domain}/accounts/{account}` Update mailbox

Change password, forward-only mode, add/remove forwards and aliases.

Path parameters

Name	Description
domain	Mail domain.
account	Local part, e.g. `info`.

Request body MailAccountUpdate

Field	Type	Description
password	string	Empty string generates one.
forward_only	boolean
add_forward	string	Email address.
remove_forward	string
add_alias	string	Local part.
remove_alias	string

Response 200 data: MailAccountDetail

Field	Type	Description
account	string
domain	string
email	string
disk_mb	number
suspended	boolean
quota_mb	integer \| null	null = unlimited.
aliases	array<string>
forwards	array<string>
forward_only	boolean

DELETE `/mail/domains/{domain}/accounts/{account}` Delete mailbox

Irreversible.

Path parameters

Name	Description
domain	Mail domain.
account	Local part, e.g. `info`.

Response 204

Backups

GET `/backups` List backups

Response 200 data: Backup[]

Field	Type	Description
name	string
type	string
size_mb	number
created_at	string \| null	ISO 8601.
contents	object

POST `/backups` Schedule backup

Asynchronous; the backup appears in the list once completed. One request per 10 minutes.

Response 202 data: Scheduled

Field	Type	Description
scheduled	boolean
message	string
name	string

DELETE `/backups/{name}` Delete backup

Path parameters

Name	Description
name	Backup file name from the list.

Response 204

POST `/backups/{name}/restore` Schedule restore

Restores the full backup in the background. Existing data is overwritten.

Path parameters

Name	Description
name	Backup file name.

Response 202 data: Scheduled

Field	Type	Description
scheduled	boolean
message	string
name	string

Jobs

GET `/jobs/{kind}/{key}` Job status

Poll asynchronous operations. `kind` is one of `ssl`, `mail_ssl`, `mail_create`, `mail_delete`, `dns_records_save`; `key` is the domain.

Path parameters

Name	Description
kind	Job kind.
key	Domain the job belongs to.

Response 200 data: Job

Field	Type	Description
job	string	Handle `kind:key`.
status	none \| pending \| started \| ok \| error
message	string
updated_at	string \| null	ISO 8601 or null.

Fields marked * are required. Questions? Open a ticket in the dashboard and include the request_id.

Quickstart

Authentication

Conventions

Error codes

Account

GET / Health check

GET /account Account and subscription status

GET /account/usage Storage and traffic usage

Domains

GET /domains List web domains

POST /domains Create web domain

GET /domains/{domain} Get web domain

DELETE /domains/{domain} Delete web domain

GET /domains/{domain}/aliases List aliases

POST /domains/{domain}/aliases Add alias

DELETE /domains/{domain}/aliases/{alias} Remove alias

GET /domains/{domain}/redirect Get redirect

PUT /domains/{domain}/redirect Set redirect

DELETE /domains/{domain}/redirect Remove redirect

SSL

GET /domains/{domain}/ssl SSL status

POST /domains/{domain}/ssl Issue Let's Encrypt certificate

DELETE /domains/{domain}/ssl Remove certificate

DNS

GET /dns/zones List DNS zones

GET /dns/zones/{zone}/records List records

POST /dns/zones/{zone}/records Create record

PATCH /dns/zones/{zone}/records/{id} Update record

DELETE /dns/zones/{zone}/records/{id} Delete record

FTP

GET /ftp List FTP accounts

POST /ftp Create FTP account

PATCH /ftp/{username} Change FTP password

DELETE /ftp/{username} Delete FTP account

Databases

GET /databases List databases

POST /databases Create database

PATCH /databases/{name} Change database password

DELETE /databases/{name} Delete database

Cron

GET /cron List cron jobs

POST /cron Create cron job

DELETE /cron/{id} Delete cron job

Mail

GET /mail/domains List mail domains

POST /mail/domains Create mail domain

GET /mail/domains/{domain} Get mail domain

PATCH /mail/domains/{domain} Update mail domain

DELETE /mail/domains/{domain} Delete mail domain

GET /mail/domains/{domain}/accounts List mailboxes

POST /mail/domains/{domain}/accounts Create mailbox

GET /mail/domains/{domain}/accounts/{account} Get mailbox

PATCH /mail/domains/{domain}/accounts/{account} Update mailbox

DELETE /mail/domains/{domain}/accounts/{account} Delete mailbox

Backups

GET /backups List backups

POST /backups Schedule backup

DELETE /backups/{name} Delete backup

POST /backups/{name}/restore Schedule restore

Jobs

GET /jobs/{kind}/{key} Job status

GET `/` Health check

GET `/account` Account and subscription status

GET `/account/usage` Storage and traffic usage

GET `/domains` List web domains

POST `/domains` Create web domain

GET `/domains/{domain}` Get web domain

DELETE `/domains/{domain}` Delete web domain

GET `/domains/{domain}/aliases` List aliases

POST `/domains/{domain}/aliases` Add alias

DELETE `/domains/{domain}/aliases/{alias}` Remove alias

GET `/domains/{domain}/redirect` Get redirect

PUT `/domains/{domain}/redirect` Set redirect

DELETE `/domains/{domain}/redirect` Remove redirect

GET `/domains/{domain}/ssl` SSL status

POST `/domains/{domain}/ssl` Issue Let's Encrypt certificate

DELETE `/domains/{domain}/ssl` Remove certificate

GET `/dns/zones` List DNS zones

GET `/dns/zones/{zone}/records` List records

POST `/dns/zones/{zone}/records` Create record

PATCH `/dns/zones/{zone}/records/{id}` Update record

DELETE `/dns/zones/{zone}/records/{id}` Delete record

GET `/ftp` List FTP accounts

POST `/ftp` Create FTP account

PATCH `/ftp/{username}` Change FTP password

DELETE `/ftp/{username}` Delete FTP account

GET `/databases` List databases

POST `/databases` Create database

PATCH `/databases/{name}` Change database password

DELETE `/databases/{name}` Delete database

GET `/cron` List cron jobs

POST `/cron` Create cron job

DELETE `/cron/{id}` Delete cron job

GET `/mail/domains` List mail domains

POST `/mail/domains` Create mail domain

GET `/mail/domains/{domain}` Get mail domain

PATCH `/mail/domains/{domain}` Update mail domain

DELETE `/mail/domains/{domain}` Delete mail domain

GET `/mail/domains/{domain}/accounts` List mailboxes

POST `/mail/domains/{domain}/accounts` Create mailbox

GET `/mail/domains/{domain}/accounts/{account}` Get mailbox

PATCH `/mail/domains/{domain}/accounts/{account}` Update mailbox

DELETE `/mail/domains/{domain}/accounts/{account}` Delete mailbox

GET `/backups` List backups

POST `/backups` Schedule backup

DELETE `/backups/{name}` Delete backup

POST `/backups/{name}/restore` Schedule restore

GET `/jobs/{kind}/{key}` Job status