HF PanelDocsv1.0.0

API: SSL and backups

Read each domain's certificate, issue, renew and remove certificates, run AutoSSL, and make, restore and share backups through the token API.

These endpoints do what the SSL/TLS and Backups screens in Control Panel do, with the same checks and activity log lines.

bash
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"

The paths name the account (/v1/accounts/{username}/…); the rules are those of every per-account endpoint.

Certificates

GET /v1/accounts/{username}/ssl: each domain's certificate as the server reports it.

json
{
    "ok": true,
    "data": {
        "autossl": true,
        "certificates": [
            {
                "domain": "example.com",
                "type": "le",
                "expires": "2027-01-12",
                "days_left": 79,
                "issuer": "Let's Encrypt",
                "names": "example.com, www.example.com",
                "force_https": true,
                "autossl": true,
                "autossl_note": ""
            }
        ]
    }
}
Field What it is
autossl (top) whether AutoSSL is on for the server
type none, or the kind of certificate (le for a free Let's Encrypt one)
expires, days_left, issuer, names null when there is no certificate
autossl whether AutoSSL looks after this domain (it stops when you remove the certificate)
autossl_note why AutoSSL is waiting, for example because the domain does not point here yet

Issue, renew and remove

bash
curl -s -X POST -H "$H" $A/accounts/sarahbakes/ssl/example.com/issue     # a free certificate now; https:// on
curl -s -X POST -H "$H" $A/accounts/sarahbakes/ssl/example.com/renew
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"on":false}' $A/accounts/sarahbakes/ssl/example.com/force-https
curl -s -X DELETE -H "$H" $A/accounts/sarahbakes/ssl/example.com          # http:// only; AutoSSL stops for it

Each answers with the domain's settings:

json
{
    "ok": true,
    "data": {
        "domain": "example.com",
        "ssl": true,
        "type": "le",
        "expires": "2027-01-12",
        "force_https": true,
        "autossl": true
    }
}

A certificate the server could not issue (for example because the domain does not point to the server yet) answers 500 with the server's message, starting with Server:.

Run AutoSSL

POST /v1/ssl/autossl (administrator tokens, Read & change) runs one AutoSSL pass now, as the server does by itself on its schedule: the panel's own certificate first, then the domains that are due. The answer lists what it did in log. When a pass is already running it says "autossl: previous run still busy".

Backups

bash
curl -s -H "$H" $A/accounts/sarahbakes/backups                       # newest first
curl -s -X POST -H "$H" $A/accounts/sarahbakes/backups               # make one now (201)
curl -s -X DELETE -H "$H" $A/accounts/sarahbakes/backups/sarahbakes-20261024-030001.tar.gz
json
{
    "ok": true,
    "data": [
        {
            "name": "sarahbakes-20261024-030001.tar.gz",
            "size": 48213504,
            "created_at": "2026-10-24 03:00:01"
        }
    ]
}

Making a backup waits until it is done and keeps as many as the server's backup settings say, deleting the oldest.

Restore a backup

POST /v1/accounts/{username}/backups/{backup}/restore with what: all, files, databases, mail or cron. What is there now is overwritten.

bash
curl -s -X POST -H "$H" -H "Content-Type: application/json" -d '{"what":"databases"}' \
  $A/accounts/sarahbakes/backups/sarahbakes-20261024-030001.tar.gz/restore

When a whole restore needs another administrator's approval (or the reseller's restores need the administrator's), the answer is 403 and the restore must be done in the panel, where it is sent for approval.

POST /v1/accounts/{username}/backups/{backup}/link makes a link that downloads the backup without signing in, for as long as the account's backup plan allows (201). The link is shown only in this answer.

json
{
    "ok": true,
    "data": {
        "backup": "sarahbakes-20261024-030001.tar.gz",
        "url": "https://panel.yourdomain.com:8443/?r=backup-link&t=…",
        "expires_at": "2026-10-26 10:15:00"
    }
}

When download links are not part of the plan the answer is 422 "Download links are not part of your plan."; an account can have 10 links at a time.