Using the API: first calls and examples

Got a token (see "Create and manage your API tokens")? Here's how to use it. The API answers in JSON, at the address shown on My profile › API, something like https://your-client-area/api/portal/v1.

Authenticate

Every call carries the token in the Authorization header:

curl -H "Authorization: Bearer mmcp_…" "https://your-client-area/api/portal/v1/services"

With the read scope, this returns your services and their status.

A few examples

Your invoices (billing scope):

curl -H "Authorization: Bearer mmcp_…" "https://your-client-area/api/portal/v1/invoices"

Reboot a VM (VM power scope, plus the matching right for the token's creator):

curl -X POST -H "Authorization: Bearer mmcp_…" -H "Content-Type: application/json" \
  -d '{"action":"reboot"}' "https://your-client-area/api/portal/v1/services/vm:101/power"

The possible actions are start, shutdown, reboot, stop and reset. Services are named by the reference GET /services returns, such as vm:101.

Mark a deployment on a service (annotations scope), so it shows on its timeline and charts: POST /services/{ref}/annotations.

Reinstall a VPS with a startup script ("Your VPS: reinstall and rescue mode" scope): GET /services/{ref}/vps gives the systems of the offer, GET /startup-scripts your scripts, then:

curl -X POST -H "Authorization: Bearer mmcp_…" -H "Content-Type: application/json" \
  -d '{"template":9000,"confirm":"vps-101","startupScriptId":"…"}' \
  "https://your-client-area/api/portal/v1/services/vm:101/vps/reinstall"

confirm is the VPS's name: a reinstall erases its disk. Rescue mode is driven the same way, with POST then DELETE /services/{ref}/vps/rescue.

Put a server on a private network ("Private networks between your servers" scope): POST /private-networks creates the network, then POST /private-networks/{id}/members with {"ref":"vm:101"} attaches a server.

These calls only exist when the matching feature is open for your account; otherwise the API answers 404. A token made before they arrived doesn't gain them: each has its own scope, to tick on a new token.

The full list

The Endpoints tab on the API page lists every call with its method, path, required scope and what it does. Filter by scope or search for a word, then click the Copy the curl command icon: the command is ready, you just add your token and the reference you want. The OpenAPI link gives the full description, to import into Postman or a client generator.

Limits and errors

• At most 120 requests a minute per token. Beyond that the API answers 429: slow down.
• 401: token missing, revoked or expired, or its creator no longer has access to the client area.
• 403: the token lacks the scope for this call, or the IP address you're calling from isn't allowed by your company.
• 404: the resource doesn't exist, or doesn't belong to your company.

Good to know

• A token only opens the API: it can't be used to sign in to the client area.
• Prometheus-format metrics have their own token, on the same page, in the Prometheus metrics card.