Guide · For customers
Team and API
On the Team & API page you invite the people who work with you on your servers, create API keys for your scripts and see who did what. You, the account owner, can see it, and so can the team administrators.
Roles
| Role | What they can do |
|---|---|
| Administrator | everything you do: creates, resizes and deletes the package VPSs, invites technicians and read-only people, creates and deletes API keys, reads the log. They can't add, change or remove other administrators or administrator keys: only you manage those. |
| Technician | works on the VPSs: powers them on and off, opens the console, reinstalls, changes the root password, takes and restores snapshots and backups, changes firewall, disks, private networks and reverse DNS. They don't create or delete VPSs and don't see team, keys and log. |
| Read-only | sees VPSs, charts, backups and usage. They don't change anything, don't open the console and don't see application passwords. |
A new role applies right away, also for people who are already signed in.
Inviting a person
- Press Invite and write email, name and role.
- The person gets an email with the link. If the panel doesn't send emails, it shows you the link to send yourself.
- With the link they choose their password and sign in. After that they sign in from the sign-in page with their own email and password.
The link is valid for 7 days and only once. Each email can join one account only: working on several accounts needs different addresses. At most 20 invitations a day are sent, and one a minute to the same person.
If you are a reseller, the team also works on your customers' VPSs, with each person's role. New customers, VPSs, access to customers and API keys for WHMCS stay with you and the team administrators.
Next to each person there are three buttons:
- Send the invitation again (the paper plane): use it if the invitation expired or they lost their password. With the new link they choose a new password; the old one works until they use it.
- Edit (the pencil): name and role.
- Remove from team (the bin): they are signed out of every session right away and can no longer sign in.
- Remove two-step verification (the shield, only next to people who have it on, marked "2FA"): for someone who lost their phone and recovery codes. They are signed out of every session and next time sign in with the password alone, then turn it on again. Team administrators remove it from technicians and read-only people; only the owner removes it from administrators.
Everyone changes their own password and turns on their own two-step verification in My account: yours doesn't change, and your sessions stay open.
API keys
API keys are for your scripts and programs: for example to shut down a VPS at night, take a snapshot before an upgrade or read the status from a monitoring system.
- Press New key and give it a name and a role, the same roles as people. Choose the smallest role that is enough: read-only is enough to read the status.
- Copy the
kvm_…key: it is shown only once. - Send it in the
Authorization: Bearer kvm_…header of every request to the panel address followed by/api.
curl -H "Authorization: Bearer kvm_…" https://panel.example.com/api/vpsKeys can do what a person with the same role does: if the role isn't enough, the answer is 403. Keys can't manage the team or other keys and can't change passwords. At most 600 requests per minute per key and 20 keys per account.
If you delete a key, the scripts using it stop working right away. Keys stay even if the person who created them leaves the team.
Main calls
| Call | What it does |
|---|---|
GET /vps | your VPSs |
GET /vps/{id} | status and details of a VPS |
GET /vps/{id}/metrics?hours=24 | charts: CPU, RAM, disk and network |
POST /vps/{id}/power | {"action": "start"}, or stop, restart, kill |
POST /vps/{id}/reinstall | reinstall: image_id, confirm (the hostname), password, ssh_key_ids |
GET and POST /vps/{id}/snapshots | list and new snapshot (label) |
POST /vps/{id}/snapshots/{name}/restore, DELETE /vps/{id}/snapshots/{name} | restore and delete a snapshot |
GET and POST /vps/{id}/backups | list and new backup |
GET and PUT /vps/{id}/firewall | firewall: enabled and rules |
GET /images, GET /apps | systems and applications |
GET /account/ssh-keys | the saved SSH keys |
GET /self-service | your package: limits, usage, plans, cities |
POST /self-service/vps | create a VPS in the package: plan_id, image_id, city, hostname, ssh_key_ids, user_script |
POST /vps/{id}/plan | change the plan of a package VPS: plan_id |
DELETE /vps/{id}?confirm={hostname} | delete a package VPS |
GET /usage?month=YYYY-MM | hourly usage of the month |
GET, POST /load-balancers, GET, PUT, DELETE /load-balancers/{id} | load balancers (create and delete: administrator role) |
Only a key with the administrator role can create, resize and delete package VPSs. Answers are JSON; errors have an error field with the reason in Italian.
Activity log
At the bottom of the page there is the account log: sign-ins and operations done by you, by the team and by the API keys, with date and time. Keys show with their name, for example "API: Monitoring". Press Show older to go back in time.