Version 2.1.1792967583 · latest Download OpenAPI Markdown

API reference v2.1.1792967583

15 groups · 419 endpoints

Authentication

Send the X-API-Key header (create a key on the API Keys page; the key is shown only once at creation). An Authorization: Bearer token obtained by logging in also works.

X-API-Key

  1. X-API-Key is checked first (not expired or deleted)
  2. otherwise the Authorization: Bearer access token
  3. then the key scopes and the operation scope (tenants only reach their own resources)

Authentication failures return 401; forbidden returns 403 (code such as insufficient_scope).

Responses and errors

Success returns the resource JSON directly (HTTP 2xx); failures return application/problem+json (code, detail, plus errors on validation failures); lists carry items + total.

Success
{
  "id": 1,
  "name": "example"
}
List
{
  "items": [
    {
      "id": 1
    }
  ],
  "page": 1,
  "page_size": 20,
  "total": 1
}
Error
{
  "code": "validation_failed",
  "detail": "Invalid request parameters",
  "errors": [
    {
      "code": "required",
      "field": "/name",
      "message": "name is required"
    }
  ],
  "request_id": "0123456789abcdef",
  "status": 422,
  "title": "Unprocessable Entity",
  "type": "about:blank"
}

Conventions

  • Paging uses page (from 1) and page_size; sort with sort=field or sort=-field.
  • Times are RFC 3339 (UTC); amounts are in cents.
  • Writes return 200/201/204 on success; duplicates of a unique key return 409.

Resources

Authentication

Authentication authLogin, token refresh, logout, password change, TOTP, password reset, captcha and admin SSO. Login endpoints need no authentication.13 endpoints

User accounts

Users usersAdmins manage platform accounts: create, view, update, enable/disable, reset passwords, turn off TOTP. An account must be disabled before it can be deleted.13 endpointsCurrent user meThe signed-in user views or edits their own profile, real-name verification and UI preferences.6 endpointsAPI keys api-keysAPI keys of the current user. The plaintext key is returned only once at creation, and scopes can be limited per domain.4 endpointsRegistration info registration-infoNo authentication needed. Returns whether registration is open, which fields are required or need verification, and the user agreement.1 endpointsRegistrations registrationsNo authentication needed. Submits registration details to create a tenant account; the agreement must be accepted and verified email or phone needs a code.1 endpointsVerification codes verify-codesNo authentication needed. Sends email or SMS codes for binding at registration, password reset and second-factor login; SMS needs a captcha.1 endpointsLogin policy login-policyNo authentication needed. Tells whether an account needs an email or SMS code to log in, with the masked destination.1 endpointsIdentity verification channels certify-channelsAdmin only: merchant credentials of Alipay identity verification and Tencent Cloud FaceID (WeChat face verification); the channel in use is chosen by certify_provider in account settings.2 endpoints

Billing

Account accountThe current users own balance and freeze status; admins manage other users accounts through the user account endpoints.1 endpointsOrders ordersOrders created by recharges, deductions, online payments and package purchases; tenants see only their own, admins can see all tenants, and only the remark can be edited.4 endpointsLedger entries ledger-entriesEvery change to an account balance, each with a balance snapshot taken after posting.1 endpointsOnline payments paymentsStart an online recharge: creates an unpaid order, pre-orders it at the payment gateway and returns the payment URL.1 endpointsRecharge methods payment-methodsThe currently enabled online payment methods, the default method and transfer instructions, used to render the recharge page.1 endpointsPayment channels payment-channelsAdmin settings for which gateway each payment method uses and each gateways merchant parameters; secrets are write-only.2 endpointsPayment notifications payment-notificationsResult notification endpoint called by payment gateways; no authentication, signature verified per gateway rules, and repeated notifications are credited only once.2 endpoints

DNS and access

DNS providers dns-providersAdmin only. Stores DNS provider accounts (such as Alibaba Cloud or Cloudflare); credentials are verified online before saving and only the last 4 characters are ever returned.6 endpointsCNAME access domains cname-domainsAdmin only. Root domains used to build CNAME access names, each owned by a DNS provider account; supports migrating everything to a new root domain and checking whether customers have switched their records.12 endpointsDNS sync dns-syncAdmin only. Makes the scheduler reconcile all DNS records against the desired state right away (the Record repair button in the panel).1 endpoints

Node scheduling

Regions regionsGeographic regions used to categorize nodes and node groups.5 endpointsNodes nodesApproved edge nodes and sub-IPs; primary nodes self-enroll with an enrollment token, while sub-IPs are added manually by an admin.8 endpointsPending nodes pending-nodesNodes that have enrolled with a token and await admin approval; once approved they become regular nodes.3 endpointsNode enrollment tokens node-enroll-tokensGenerates a one-time enrollment token and a one-line node install command; the token is returned only once, when generated.1 endpointsNode groups node-groupsGroups lines under one access name; a backup threshold can switch to the backup group automatically when usable lines run low.5 endpointsLines linesA resolution record in a node group, showing which DNS line and weight a node appears with; a line must be disabled before it can be deleted.5 endpointsAlert rules alert-rulesBuilt-in alert rules of the control plane with their current settings and status; thresholds are changed via system settings.1 endpointsAlerts alertsRecent alert and recovery events, kept for 30 days.1 endpointsNode monitor logs monitor-logsResults of each probe round the control plane runs against monitored node IPs.1 endpoints

IP product line

IP pools ip-poolsIP pools and the IPs inside them, maintained by admins. A pool belongs to a region and its name is unique platform-wide.12 endpointsIP sites ip-sitesSites served on IPs with custom ports; the IPs must first be selected in the user package.7 endpoints

Certificates

Certificates certsUploaded or automatically issued HTTPS certificates. They can be bound to sites; a certificate in use by a site cannot be deleted or disabled.14 endpointsACME accounts acme-accountsCA accounts used for automatic issuance (Let's Encrypt, ZeroSSL). Registered with the CA on first issuance.5 endpointsDNS API (cert validation) dns-apisDNS provider API credentials used for DNS-01 validation and wildcard certificates. Credentials are write-only; responses return only masks.5 endpointsCertificate settings cert-settingsThe current user's default certificate type for new certificates; leave empty to follow the platform.2 endpointsPanel certificate panel-certAdmin only. Status of the panel's own HTTPS certificate; one click issues a Let's Encrypt certificate for the panel domain, renewed with certificate management.2 endpointsFile validation pki-validationsAdmin only. Provides content for the CA file validation, answered by nodes via the controller; no longer served after expiry.3 endpoints

Protection

Access control lists aclsRule sets that allow or block requests by IP/CIDR and other conditions; the platform provides built-in rules and tenants can create their own.6 endpointsCC matchers cc-matchesConditions that identify requests in CC protection; reusable across rule groups.6 endpointsCC filters cc-filtersHow matched requests are handled: rate limiting or a challenge (JS, slider, captcha and so on).5 endpointsCC rules cc-rulesOrdered combinations of matchers and filters; a site can pick one rule group.6 endpointsBans bansRecords of blocked IPs: bans created by hand, unban by IP or for a whole site with an unban history, and automatic bans reported by nodes.8 endpointsSite IP lists site-ip-listsPermanent IP blacklist and whitelist of one site; blacklisted IPs are dropped and whitelisted IPs skip CC and other protections. The site's temporary whitelist on nodes can also be cleared.7 endpointsGlobal IP lists global-ip-listsPlatform-wide IP blacklist and whitelist with optional expiry, reason and source per entry, plus bulk import and export; admin only.4 endpointsCC settings cc-settingsPlatform-level default CC rule group and automatic switching settings; admin only.2 endpointsBot settings bot-settingsPlatform-wide bot management: the action per class (search engine / monitor and tool / automation tool / headless browser / malicious bot) and for fake crawlers, the challenge kind, behaviour score bands, protected endpoints and exceptions; admin only. Headless browser, malicious bot and fake crawler actions plus behaviour scoring belong to the paid feature WAF enhanced. Each site may override per class in the site config field bot.2 endpointsBot stats bot-statsStats at the top of the bot management page and the per-class "requests today" column: today's requests, requests and action breakdown per bot class, number of sites with replay protection on, and node upgrade progress; tenants see their own sites only.1 endpointsWAF settings waf-settingsPlatform-wide WAF master switch, default blocking threshold and request body inspection limit; admin only. Per-site observe/block mode and exceptions live in the site config field waf.2 endpointsUpload scan settings upload-scan-settingsPlatform-wide upload scanning (files in multipart form uploads only): master switch, dangerous extensions, double extensions, disguised files, webshell signatures, antivirus, per-file limit, scan timeout, action and exceptions; admin only. Webshell signatures, antivirus and the sha256 blocklist belong to the paid feature WAF enhanced.2 endpointsUpload scan stats upload-scan-statsStats at the top of the upload scan page: today's scanned, blocked and over-limit unscanned counts, plus the list of sites that cannot be scanned; admin only.1 endpointsHigh-risk IP library intelThe platform-provided high-risk IP library (paid item rules update, synced hourly): status, platform-wide handling policy, entry lookup, whitelisting a single entry and today's visits that hit it; read-only for tenants.5 endpointsValue-added protection schemes protect-schemesOne scheme each for replay, data leak and web tamper protection (one per tenant; admins edit the platform scheme); saving also updates sites that follow the scheme, sites with their own settings are left alone; part of WAF Enhanced.9 endpointsReplay protection site-replay-guardsReplay protection of one site: protected APIs need a one-time token or the app signature headers, otherwise the request is blocked or challenged; can be set for the site alone or restored to the scheme; part of WAF Enhanced.3 endpointsData leak protection site-leak-guardsData leak protection of one site: checks pages, JSON and text returned by the origin for phone numbers, ID card numbers, bank card numbers, keys and error messages, and masks, blocks or replaces them with an error page; part of WAF Enhanced.3 endpointsNetwork-wide URL protection settings url-guard-settingsPlatform-wide default switch and thresholds for network-wide URL protection; admin only. Per-site switch and thresholds live in the site security settings.2 endpointsNetwork-wide URL protection url-guardTemporary challenge/rate-limit/block rules pushed for a URL once its cross-node request volume exceeds the threshold, revoked automatically on expiry; read-only view of the entries in effect.1 endpointsThreat intelligence reports intel-reportsBatches of threat intelligence this master reports anonymously to the vendor (auto-banned high-risk IPs, upload scan hits and false positives, newly seen file fingerprints), one batch every 5 minutes; nothing is reported while intelligence sharing is off. Admin only.1 endpointsWeb tamper protection site-tamper-guardsWeb tamper protection of one site: protected scopes (home page, pages, directories), what counts as tampering (structure only / any change), serving the baseline page or alerting only, and the observation period; baseline update and diff; part of WAF Enhanced.5 endpointsWeb tamper protection page overview tamper-guardAll protected pages across sites (site, path, scope, baseline time, state, last change) without picking a site first; tenants see their own sites only and may filter by site.1 endpoints

Packages

Packages packagesBase packages for sale, defining quotas such as traffic, bandwidth and domains, and prices.7 endpointsPackage groups package-groupsGroups that organize packages so customers can browse and choose.5 endpointsUpgrade packs package-upgradesQuotas or features bought per unit on top of a base package.5 endpointsPackage catalog package-catalogThe catalog of packages, groups and upgrade packs a customer can buy.1 endpointsPurchased packages user-packagesPackages a tenant has bought: purchase, renew, change, add upgrade packs and view usage.16 endpointsPackage monitor package-monitorAdmin only: bandwidth and connections of each purchased package over the last minute.2 endpoints

Sites

Sites sitesCDN-accelerated sites. Creating one needs at least a domain and an origin; admins can manage any tenant's sites.27 endpointsSite groups site-groupsGroups for organizing sites; names are unique within a tenant and a group that still contains sites cannot be deleted.5 endpoints

Cache

Cache groups cache-groupsA set of cache rules that many sites can reference; either platform groups or tenant-owned groups.7 endpointsCache policy cache-policySets the tenant's default cache group and can reset all sites to follow it.3 endpointsCache presets cache-presetsFactory default cache rules, usable as a reference when creating a cache group.1 endpointsSite cache mode cache-sitesView or set the cache group or custom rules used by one site.2 endpointsPurge and prefetch cache-jobsPurge cached URLs or directories, and prefetch given URLs.3 endpointsPurge and prefetch quota cache-quotaDaily purge and prefetch limits and today's usage.1 endpoints

TCP/UDP forwarding

TCP/UDP forwarding streamsTCP/UDP port forwarding rules. Each rule has listen ports and protocols, an origin list and a balancing method; (protocol, port) is unique platform-wide.6 endpointsForwarding groups stream-groupsGroups that organize forwarding rules for bulk management. Group names are unique per tenant, and a group that still has rules cannot be deleted.5 endpoints

Tiered origin

Tiered origin (L2) l2Edges fetch through L2 nodes in their region first, so cached content no longer hits the origin. Paid feature l2; inactive when not licensed.25 endpoints

Messages

Messages messagesIn-app messages and announcements; admins publish announcements and tenants read and mark them as read.8 endpointsMessage subscriptions message-subscriptionsChoose which notification types to receive.2 endpointsDelivery channels message-channelsConfigure and test the email (SMTP) and SMS delivery channels.3 endpointsAlert webhooks message-webhooksDingTalk, Feishu, WeCom, Telegram and generic JSON alert outputs; several can be configured, and addresses and secrets show only the last 4 characters.6 endpoints

Reports

Reports reportsReal-time curves, rankings and usage for sites and TCP/UDP forwarding, node monitoring curves and rankings, unconfigured-domain Top, temporary whitelist and access logs; tenants see only their own data.44 endpoints