HF PanelDocsv1.0.0

API: domains, mail and databases

Read a hosting account's domains, email accounts and MySQL databases, and add, change and remove domains through the token API.

These read-only endpoints list what one hosting account has. With a customer's token they show the token's own account. With an administrator's or reseller's token, add ?account=<username>; without it they answer 400 "Add ?account= to say which account."

Any token may use them, Read only tokens included. A customer's token gets 403 "This feature is not part of your hosting plan." when the account's plan does not include domains, email or MySQL databases.

bash
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"

GET /v1/domains

The account's domains, subdomains and parked domains, sorted by name.

bash
curl -s -H "$H" "$A/domains?account=sarahbakes"
json
{
    "ok": true,
    "data": [
        {
            "domain": "example.com",
            "type": "domain",
            "ssl": true,
            "ssl_expires": "2026-12-30",
            "php": "8.3",
            "folder": "web/example.com/public_html"
        },
        {
            "domain": "shop.example.com",
            "type": "subdomain",
            "ssl": false,
            "ssl_expires": null,
            "php": "8.3",
            "folder": "web/shop.example.com/public_html"
        }
    ]
}
Field What it is
type domain, subdomain or parked
ssl whether the domain has an SSL certificate
ssl_expires when the certificate expires, or null
php the PHP version the website runs
folder the website's folder, from the account's home folder

GET /v1/mailboxes

The account's email accounts, sorted by domain and address.

bash
curl -s -H "$H" "$A/mailboxes?account=sarahbakes"
json
{
    "ok": true,
    "data": [
        {
            "address": "hello@example.com",
            "quota_mb": 1024,
            "used_mb": 37
        },
        {
            "address": "orders@example.com",
            "quota_mb": 2048,
            "used_mb": 210
        }
    ]
}
Field What it is
quota_mb the mailbox's storage limit in MB
used_mb the space it uses, in MB

GET /v1/databases

The account's MySQL databases, sorted by name.

bash
curl -s -H "$H" "$A/databases?account=sarahbakes"
json
{
    "ok": true,
    "data": [
        {
            "name": "sarahbakes_shop",
            "created_at": "2026-09-14 10:40:12"
        }
    ]
}

Note: MongoDB databases have their own endpoints. See MongoDB.

Manage domains

To add, change and remove domains, use the per-account endpoints under /v1/accounts/{username}/domains. They work like the Domains screen: the same checks and package limits, the website is set up on the server at once, and the change is written to the activity log. The rules are those of every per-account endpoint; changes need a Read & change token.

bash
curl -s -H "$H" $A/accounts/sarahbakes/domains

The list has the fields of GET /v1/domains above, and target: the website a parked domain shows (null otherwise).

Add a domain

POST /v1/accounts/{username}/domains. 201 with the new domain.

bash
# a website (its folder: web/example.org/public_html unless you give one)
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"domain":"example.org"}' $A/accounts/sarahbakes/domains
# a subdomain of one of the account's main domains
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"domain":"blog.example.com","type":"sub","folder":"blog"}' $A/accounts/sarahbakes/domains
# a parked domain that shows example.com
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"domain":"example.net","type":"parked","target":"example.com"}' $A/accounts/sarahbakes/domains
Field What it does
domain required; for a subdomain the full name, or only its first part together with parent
type addon (a website, the default), sub or parked
folder the document folder inside web/ (websites and subdomains)
parent sub: the main domain; found from the name when left out
target parked: the website it shows

Change a website's folder or PHP version

PATCH /v1/accounts/{username}/domains/{domain} (or PUT) with folder, php, or both.

bash
curl -s -X PATCH -H "$H" -H "Content-Type: application/json" -d '{"folder":"example.com/public","php":"8.4"}' \
  $A/accounts/sarahbakes/domains/example.com

php must be a version installed on the server ("That PHP version is not available." otherwise). A parked domain always shows its main domain's folder.

Remove a domain

DELETE /v1/accounts/{username}/domains/{domain}; add ?purge=1 to delete its files too.

json
{
    "ok": true,
    "data": {
        "deleted": "example.org",
        "files_deleted": true
    }
}

Site checks

The same as Site checks in the Control Panel, for a website (not a parked domain):

Endpoint What it does
GET /v1/accounts/{username}/domains/{domain}/site-check the schedule (frequency, emails, next_at, running, queued, allowed), the newest run in latest (null before the first) with its problems by kind and fixed_problems, and every kept run in history
POST /v1/accounts/{username}/domains/{domain}/site-check check now (starts within a minute; refused while one waits or runs, and within 10 minutes of the last)
PATCH /v1/accounts/{username}/domains/{domain}/site-check (or PUT) change frequency (daily, weekly or off) and emails (true / false: the weekly summary when something changes)
bash
curl -s -X PATCH -H "$H" -H "Content-Type: application/json" -d '{"frequency":"daily"}' \
  $A/accounts/sarahbakes/domains/example.com/site-check

Speed settings, page cache and speed test

The same as Speed test in the Control Panel, for a website (not a parked domain):

Endpoint What it does
GET /v1/accounts/{username}/domains/{domain}/speed the speed settings
PATCH /v1/accounts/{username}/domains/{domain}/speed (or PUT) change them: page_cache (0, 5, 10, 30 or 60 minutes), cache_query_strings and compression (on, off or default), browser_cache_days (0, 1, 7, 30, 365 or default)
POST /v1/accounts/{username}/domains/{domain}/cache/purge empty the page cache
POST /v1/accounts/{username}/domains/{domain}/speed-test run a speed test now (at most 20 an hour per account) and return it
GET /v1/accounts/{username}/domains/{domain}/speed-test the latest speed test (null before the first)
bash
curl -s -X PATCH -H "$H" -H "Content-Type: application/json" -d '{"page_cache":10,"compression":"on"}' \
  $A/accounts/sarahbakes/domains/example.com/speed
json
{
    "ok": true,
    "data": {
        "domain": "example.com",
        "page_cache": 10,
        "cache_query_strings": "default",
        "compression": "on",
        "browser_cache_days": "default",
        "default_browser_cache_days": 7,
        "default_cache_query_strings": false
    }
}