API & integrations

🔌 API & integrations

Create tokens, scope them, lock them to an IP, and drive the panel from your billing system or scripts

Create a token

Open API, scroll to the create form and give the token a name you will recognise.

Tick the narrowest scopes that do the job, or “Full access” only if you really need it.

Optionally restrict to allowed IPs (CIDR supported). Blank means any IP.

Create it and copy the token — treat it exactly like a password.

Group	Scopes it contains
🌐 Websites `sites:*`	`sites:read` — List sites, read details and bandwidth `sites:write` — Create new websites `sites:delete` — Delete websites (including ?purge=1, which drops files and databases) `sites:php` — Switch a site PHP version `sites:wordpress` — Install WordPress on a site `sites:suspend` — Suspend / unsuspend a site
📁 Files `files:*`	`files:write` — Upload files into a site and extract .zip archives `files:link` — Mint a one-time link into the file manager
🗄 Databases `db:*`	`db:read` — List a site databases (never passwords) `db:write` — Create a database for a site `db:import` — Import a dump over a database `db:link` — Mint a one-time link into phpMyAdmin
👥 Members `members:*`	`members:read` — List members, read their details and usage `members:write` — Create member accounts `members:password` — Set a member panel password `members:plan` — Move a member to another plan `members:suspend` — Suspend / unsuspend a member account `members:ssh` — Grant or revoke a member shell access `members:delete` — Delete a member (including ?purge=1, which deletes all their sites)
🔑 Login links & provisioning `access:*`	`sso` — Mint a one-time login link as a user (120s TTL) `provision` — Provision in one call: member + site + WordPress + DNS zone + login link
📦 Plans `plans:*`	`plans:read` — List the plans you may sell `plans:write` — Create and edit plans `plans:delete` — Delete a plan
📊 Server & cron `monitor:*`	`server:read` — Read server statistics `cron:read` — Read the cron job list

💡 A scope is one action on one group — sites:read only reads, while sites:* is the whole group. Older tokens using the names sites, members, plans, server and cron keep working unchanged and need no reissuing.

Making a call

Every request carries the token in an Authorization: Bearer … header. The base URL is https://host-th-sv1.f4host.com/api/v1.

curl -H "Authorization: Bearer f4_xxxxxxxx" \ https://host-th-sv1.f4host.com/api/v1/sites # ทดสอบได้โดยไม่เปลี่ยนอะไรจริง — sandbox / dry-run: curl -H "Authorization: Bearer f4_xxxxxxxx" \ https://host-th-sv1.f4host.com/api/sandbox/v1/sites

💡 The /api/sandbox/v1/… prefix authenticates and validates exactly like production but changes nothing — ideal while you build.

One-time login links (SSO)

Your billing system calls POST /api/v1/sso to mint a single-use login link for a customer. They click it on your site and land in the panel with no second password to remember — and you can attach a destination, e.g. straight into a site's file manager.

See every endpoint with examples →

← Previous⏰ Cron jobs — scheduled work Next →👤 Your account & security

Every chapter

🚀 Getting started 🌐 Creating & managing websites 🛰 Pointing DNS at this server 🔒 SSL / HTTPS certificates 🌿 Subdomains & extra domains 📁 File manager & code editor 📡 FTP / FTPS 🖥 SSH / SFTP and the web terminal 🐙 Deploying from Git 🗄 Databases 🧩 The app installer ⏰ Cron jobs — scheduled work 🔌 API & integrations 👤 Your account & security 🧯 Common problems