HF PanelDocsv1.0.0

Developers

Everything in HF Panel you can drive from your own code, with an overview of the API, webhooks, Dynamic DNS and the cluster.

HF Panel has one address for programs: https://api.yourdomain.com:2087/v1. Billing systems, your own scripts, the HF Server desktop app, payment providers, routers and the other servers of a cluster all talk to it. This section explains each way in, with working examples.

Note: the API's address is for programs only. If you open it in a web browser you get 403 Forbidden. Use curl or your own code.

What you can program

What Who uses it How it signs in Page
The token API billing systems, scripts, the desktop app an API token: Authorization: Bearer hf_… API overview, API reference
Billing integration your own billing or shop system an administrator's or reseller's API token Billing integration
WHMCS and Blesta modules WHMCS or Blesta, without writing code an administrator's or reseller's API token WHMCS module, Blesta module
Payment webhooks Stripe and PayPal a signature from the payment provider Webhooks
Notification webhooks your own service that receives alerts HF Panel signs each message for you Webhooks
Event hooks your own service, or programs on the server HF Panel signs each webhook for you; script hooks run as root Event hooks
Plugins your own features inside the panel: hooks and pages installed by the administrator Plugins
Dynamic DNS routers and scripts at home or in an office a Dynamic DNS name's own token Dynamic DNS
Servers and DNS cluster the main HF Panel and the servers joined to it a shared secret and signed requests Servers and cluster
HF Files and HF Studio scripts that manage files or databases of one hosting account the account's username and password, then an hff_ token HF Files and HF Studio API
Desktop app links the HF Server desktop app a device key: X-HF-Device Desktop app API
Licence server licensed servers (official edition only) a licence key Licence API

The token API at a glance

  • One base address: https://api.yourdomain.com:2087/v1. The old address https://panel.yourdomain.com:8443/api/v1 keeps working and gives the same answers.
  • Each request carries an API token that you make under Password & security. A token is either Read only or Read & change, and you can limit it to some IP addresses.
  • A token acts as the person who made it. An administrator's token sees every hosting account, a reseller's token sees only that reseller's customers, and a customer's token sees only their own account.
  • Every answer is JSON: {"ok": true, "data": …} or {"ok": false, "error": "…"}, with a matching HTTP status.
bash
curl -s https://api.yourdomain.com:2087/v1/me \
     -H "Authorization: Bearer hf_xxx"
json
{
    "ok": true,
    "data": {
        "username": "admin",
        "email": "admin@yourdomain.com",
        "role": "admin",
        "two_factor": true,
        "token": {
            "name": "Billing system",
            "access": "write"
        }
    }
}

Where to start

  1. Read the API overview: addresses, tokens, answers, status codes and limits.
  2. Make a token under Password & security › API tokens.
  3. Try GET /v1/me as shown above, then pick the endpoints you need from the API reference.