HF PanelDocsv1.0.0

API: apps and staging

List the App installer's apps and a hosting account's installed apps, and make, push, pull and delete staging copies through the token API.

These endpoints do what the App installer and Staging screens in Control Panel do, with the same checks, limits and activity log lines.

bash
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"

The paths name the account (/v1/accounts/{username}/…); the rules are those of every per-account endpoint.

Apps

bash
curl -s -H "$H" $A/accounts/sarahbakes/apps
curl -s -H "$H" $A/accounts/sarahbakes/apps/installs

GET …/apps lists the apps the account can install (the apps the administrator hides are left out): key, name, category, version, requirements (php, node, db), update (how it is updated), installable (its download is pinned to a checksum) and steps (the install steps, in order).

GET …/apps/installs lists the installed apps: id, app, domain, url, version, database, update (current, available, manual, blocked, none or unknown), update_to and created_at.

Staging

bash
curl -s -H "$H" $A/accounts/sarahbakes/staging
curl -s -X POST -H "$H" -H "Content-Type: application/json" \
  -d '{"domain":"example.com","name":"test"}' $A/accounts/sarahbakes/staging
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"what":"files"}' $A/accounts/sarahbakes/staging/4/push
curl -s -X POST -H "$H" $A/accounts/sarahbakes/staging/4/pull
curl -s -X DELETE -H "$H" $A/accounts/sarahbakes/staging/4
Field (POST …/staging) What it does
domain the live website (required)
name the first part of the staging address (test → test.example.com); empty = staging.example.com
replace_urls true replaces the address in the database of an app that isn't WordPress (WordPress is always rewritten)
protect password-protect it (default true); the answer then has password, shown once
noindex tell search engines to stay away (default true)

A staging copy is answered as id, domain, staging, kind (wp, env or none), database, protected, noindex, replace_urls, created_at, pushed_at and pulled_at. A push (what: files, db or both) makes a full backup of the account first and answers its name as backup; it raises the staging.pushed event.