HF PanelDocsv1.0.0

API: the server

Read the services and health checks, restart a service, check for updates and handle automatic server moves through the API.

These endpoints are for administrator tokens. They show what the Services, Server health and HF Panel updates screens in Server Admin show. A reseller's or customer's token gets 403 "Only administrator tokens can do this."; a read-only administrator login cannot use the update endpoints at all. For the server's load, memory and disk, any token can use GET /v1/status.

bash
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"

Services

bash
curl -s -H "$H" $A/server/services
curl -s -X POST -H "$H" $A/server/services/nginx/restart
json
{
    "ok": true,
    "data": [
        {
            "name": "nginx",
            "state": "active",
            "running": true
        },
        {
            "name": "mariadb",
            "state": "active",
            "running": true
        }
    ]
}

Restarting needs a Read & change token and answers with the service's state afterwards. When it is not running again, the answer is still 200, with "running": false and a warning saying to check the server logs.

Health

GET /v1/server/health runs every health check, as the Server health screen does, worst first within each group.

json
{
    "ok": true,
    "data": {
        "bad": 1,
        "warn": 2,
        "total": 15,
        "checks": [
            {
                "group": "Services",
                "status": "bad",
                "title": "apache2",
                "detail": "not running"
            }
        ]
    }
}

status is ok, warn or bad.

Version and updates

bash
curl -s -H "$H" $A/server/version
curl -s -X POST -H "$H" $A/server/version/check     # ask for the newest release now
json
{
    "ok": true,
    "data": {
        "version": "1.0.0",
        "latest": "1.0.1",
        "published": "2026-10-20",
        "newer": true,
        "update_running": false,
        "auto_update": false,
        "checked_at": "2026-10-25 06:00",
        "error": ""
    }
}

The check needs a Read & change token; when the release server cannot be reached it answers 422 with the reason. The update itself is started in Server Admin › HF Panel updates.

Automatic server moves

The suggestions of Server balancing, for a panel with more than one server.

bash
curl -s -H "$H" $A/server/moves/suggestions              # waiting, planned and running
curl -s -H "$H" "$A/server/moves/suggestions?history=1"  # the last 50 finished, skipped and failed
curl -s -X POST -H "$H" $A/server/moves/check            # read every server now; answers the new suggestions
curl -s -X POST -H "$H" $A/server/moves/suggestions/7/approve
curl -s -X POST -H "$H" $A/server/moves/suggestions/7/skip
json
{
    "ok": true,
    "data": [
        {
            "id": 7,
            "account": "sarahbakes",
            "account_id": 3,
            "from": "Main",
            "to": "London 2",
            "reason": "disk",
            "size_mb": 2048,
            "status": "pending",
            "automatic": false,
            "dry_run": false,
            "run_after": null,
            "move_id": 0
        }
    ]
}

status is pending, scheduled, backing_up, moving, verifying, done, failed, rolled_back, skipped, dry_run or expired; reason is disk, memory, load or accounts. An approved move runs in the next maintenance window, as on the screen.

Config history

Administrator tokens (read only) can read the Config history: the server config files the panel changed and their kept versions. Restoring a version is only possible on the screen.

Method Path What it does
GET /v1/config-history the kept files: file (the name to use below), path, service, versions, last_change, last_actor, exists
GET /v1/config-history/versions?file=… one file's versions, newest first: id, at, size, kind, actor, command, sha256, current
GET /v1/config-history/diff?file=…&from=…&to=… the difference (from and to: a version id or current, the default for to): unified (the diff text) and rows (k hunk, ctx, add or del; o and n the line numbers; t the text). format=html answers html, a page with every character escaped

Put file through URL encoding (it holds % characters).