HF PanelDocsv1.0.0

API: accounts

List, create, suspend, change, delete and sign in to hosting accounts through the token API.

These endpoints manage hosting accounts. They are for administrator and reseller tokens only: an administrator's token works on every hosting account, a reseller's token only on that reseller's customers. An account the token may not manage answers 404 "No such account.", just like one that does not exist.

The examples use:

bash
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"

The account object is described in the API reference.

Note: a reseller's tokens follow that reseller's privileges. If the administrator has taken away a privilege under Reseller privileges (creating, deleting, suspending accounts, changing their package or logging in as a customer), the matching endpoint answers 403 "Your hosting provider has not given your reseller account this permission."

GET /v1/accounts

Every hosting account the token may manage, sorted by username. Who: staff.

bash
curl -s -H "$H" $A/accounts
json
{
    "ok": true,
    "data": [
        {
            "username": "sarahbakes",
            "email": "sarah@example.com",
            "status": "active",
            "package": "Starter",
            "disk_used_mb": 412,
            "disk_limit_mb": 5120,
            "domains": [
                "example.com",
                "shop.example.com"
            ],
            "two_factor": false,
            "server": "Main",
            "created_at": "2026-09-14 10:22:05",
            "last_login_at": "2026-10-24 08:01:33"
        }
    ]
}

POST /v1/accounts

Creates a hosting account. Who: staff, Read & change token. Answers 201.

Field Required What it does
username yes 3–16 lower-case letters and numbers, starting with a letter
email yes the customer's email address
package yes the package's id or name (any case)
password no 8–128 characters, without quotes ('), backslashes or control characters. Without it, a random 16-character password is made
domain no the account's first domain
welcome no true or 1 sends the welcome email to the customer
server no administrators only: the id of the server to put the account on. auto (the default) picks the server with the fewest accounts that takes new ones
bash
curl -s -H "$H" -H 'Content-Type: application/json' $A/accounts \
     -d '{"username":"sarahbakes","email":"sarah@example.com","package":"Starter","domain":"example.com","welcome":true}'
json
{
    "ok": true,
    "data": {
        "account": {
            "username": "sarahbakes",
            "email": "sarah@example.com",
            "status": "active",
            "package": "Starter",
            "disk_used_mb": 0,
            "disk_limit_mb": 5120,
            "domains": [
                "example.com"
            ],
            "two_factor": false,
            "server": "Main",
            "created_at": "2026-10-25 09:14:02",
            "last_login_at": null
        },
        "password": "q7Rk2mWv9xTb4LcN",
        "warning": null
    }
}
  • password is the account's password: the one you sent, or the random one. It is not shown again.
  • warning is null, or a message when the account was made but something else failed, for example "Account made, but the domain was not added: …".
Status error
422 Username: 3–16 lowercase letters/numbers, starting with a letter.
422 That username is taken.
422 Enter a valid email.
422 No such package: Gold
422 Password must be 8–128 characters.
422 That domain name is not valid. / That domain is already on this server.
422 You have reached your account limit. (a reseller at their account limit)
422 Unknown server.

A reseller's limits on disk space and other resources are checked too, as on the Accounts screen.

GET /v1/accounts/{username}

One account. Who: staff.

bash
curl -s -H "$H" $A/accounts/sarahbakes

The answer's data is one account object.

DELETE /v1/accounts/{username}

Deletes the account with all its websites, email and databases. Who: staff, Read & change token.

bash
curl -s -H "$H" -X DELETE $A/accounts/sarahbakes
json
{
    "ok": true,
    "data": {
        "deleted": "sarahbakes"
    }
}

Warning: this cannot be undone. When deleting an account needs a second administrator's approval, this endpoint answers 403 and you must delete the account in the panel, where the request is sent for approval.

POST /v1/accounts/{username}/suspend and unsuspend

POST /v1/accounts/{username}/suspend suspends the account: its websites, email and logins stop. POST /v1/accounts/{username}/unsuspend switches it back on. Nothing changes when the account already is in that state. Who: staff, Read & change token. No body.

bash
curl -s -H "$H" -X POST $A/accounts/sarahbakes/suspend
curl -s -H "$H" -X POST $A/accounts/sarahbakes/unsuspend

The answer's data is the account object after the change, with status suspended or active.

POST /v1/accounts/{username}/package

Moves the account to another package. PUT works too. Who: staff, Read & change token.

Field Required What it does
package yes the new package's id or name
bash
curl -s -H "$H" -H 'Content-Type: application/json' $A/accounts/sarahbakes/package \
     -d '{"package":"Business"}'

The answer's data is the account object with the new package and disk_limit_mb.

POST /v1/accounts/{username}/password

Sets the account's password for the Control Panel and SFTP. PUT works too. Who: staff, Read & change token.

Field Required What it does
password yes 8–128 characters, without quotes ('), backslashes or control characters
bash
curl -s -H "$H" -H 'Content-Type: application/json' $A/accounts/sarahbakes/password \
     -d '{"password":"Correct-Horse-42"}'
json
{
    "ok": true,
    "data": {
        "username": "sarahbakes",
        "password_changed": true
    }
}

POST /v1/accounts/{username}/login

Makes a one-time sign-in link to the customer's Control Panel, for a "Log in to control panel" button in your billing system. The link works once, for 2 minutes. Who: staff, Read & change token.

Field Required What it does
goto no the screen to open after signing in, for example wordpress or email (lower-case letters, numbers and dashes, up to 30)
bash
curl -s -H "$H" -H 'Content-Type: application/json' $A/accounts/sarahbakes/login \
     -d '{"goto":"wordpress"}'
json
{
    "ok": true,
    "data": {
        "url": "https://panel.yourdomain.com:8443/?r=sso&t=3f9c0e…",
        "expires_in": 120
    }
}

Send the customer's browser to url straight away. A suspended account answers 422 "This account is suspended."

GET /v1/accounts/{username}/usage

The account's usage this month, and its CPU, memory, disk and process use against its limits. Who: staff.

bash
curl -s -H "$H" "$A/accounts/sarahbakes/usage?period=7d"

period picks the series in resources: 24h (the default, a point every 5 minutes), 7d (hourly), 30d (every 4 hours) or 1y (daily).

json
{
    "ok": true,
    "data": {
        "username": "sarahbakes",
        "disk_used_mb": 412,
        "disk_limit_mb": 5120,
        "bandwidth_month_mb": 1830,
        "domains": 2,
        "mailboxes": 4,
        "databases": 1,
        "mongo_databases": 0,
        "resources": {
            "period": "7d",
            "supported": true,
            "enforced": true,
            "limits": { "cpu_percent": 150, "memory_mb": 1024, "processes": 60, "io_mbps": 50, "iops": 2000,
                        "php_workers": 8, "app_processes": 0, "disk_mb": 5120 },
            "now": { "time": 1793094000, "cpu_percent": 12.5, "memory_mb": 310, "processes": 9,
                     "io_read_mbps": 0.4, "io_write_mbps": 0.1, "iops": 35 },
            "limit_hits_24h": 0,
            "series": { "time": [1792490400, 1792494000], "cpu_percent": [8.1, 11.4], "memory_mb": [290, 305],
                        "processes": [7, 9], "io_read_mbps": [0.2, 0.3], "io_write_mbps": [0.1, 0.1],
                        "iops": [20, 31], "disk_mb": [410, 412] }
        }
    }
}
Field What it is
bandwidth_month_mb web traffic of all the account's domains since the 1st of this month, in MB
domains domains, subdomains and parked domains
mailboxes email accounts
databases MySQL databases
mongo_databases MongoDB databases
resources.supported false on a server with cgroup v1: nothing is measured or enforced there
resources.enforced whether limits are enforced (Server Admin › Packages › Enforce limits)
resources.limits the limits in force: the package's, or the account's own; CPU in % (100 = one core); 0 = no limit
resources.now the newest minute's figures, or null when there is none in the last 15 minutes
resources.limit_hits_24h how many times the account reached a limit in the last 24 hours
resources.series one value per point: CPU and disk speed are averages, memory the average in MB, processes the most