CUSTOMER API · V1 BETA
REST API for
VPS & Dedicated Servers
Manage your servers from code: order and destroy hourly VPS, run power actions and reinstalls, capture and deploy your own images and pay invoices from credit.
The X-ZoneServers Customer API (v1, public beta) exposes 92 operations over HTTPS with an OpenAPI 3.0 spec, scoped API keys and a default limit of 1,000 requests per hour per key. It is included with every account at no extra cost.
92 API operations1,000 requests per hour per key
Your first call
Create a key in the client panel under Profile → API Keys, then ask the API who you are.
curl https://my.x-zoneservers.com/api/v1/ \
-H "Authorization: Bearer $XZ_API_KEY"
{ "success": true,
"data": {
"version": "1",
"key": { "scopes": ["read", "services"] },
"rate_limit": { "limit": 1000, "remaining": 999 }
} }01Features
What You Can Automate
The API covers the whole lifecycle of a server, from the order to the invoice, with the same permissions as the client panel.
Deploy & Destroy
Order a VPS on hourly or monthly billing, pass cloud-init user-data and SSH keys for first boot, and delete it when the job is done. Hourly billing stops the moment the server is gone.
Power, Reinstall & Stats
Start, stop, reboot and reinstall your VPS, reset root passwords, and read usage and traffic statistics from your monitoring scripts.
Custom Images
Capture a VPS as an image (up to 3 per account), or register your own qcow2 or raw image (verified by SHA-256) and deploy new servers from it.
Billing & Usage
Read your credit balance and this month's hourly charges, list invoices and proformas, and pay them from credit — useful for cost dashboards and budget alerts.
Add-ons & Upgrades
Buy add-ons for an existing service, such as additional IP addresses, or move it to a bigger plan without opening the panel.
Projects & Scoped Keys
Group servers into projects and mint keys bound to a single project, so a staging key can never see or touch production.
02How it works
Example: An Hourly VPS for One CI Job
Create a clean build machine, run the pipeline, delete it — and pay for the hours it existed.
Hourly services are charged from your account credit rather than invoiced, so keep a balance on the account. Send an Idempotency-Key header with every order: a request that timed out can then be retried without creating a second server.
1. Pick a plan: list products with their hourly and monthly prices.
curl https://my.x-zoneservers.com/api/v1/products \
-H "Authorization: Bearer $XZ_API_KEY"2. Order it on hourly billing, with a first-boot script and your SSH key.
curl -X POST https://my.x-zoneservers.com/api/v1/orders \
-H "Authorization: Bearer $XZ_API_KEY" \
-H "Idempotency-Key: ci-run-4812" \
-H "Content-Type: application/json" \
-d '{"productId": "<plan-id>", "billingCycle": "hourly",
"hostname": "ci-4812.example.com", "location": "<location>",
"configOptions": {"os_image_id": "<image-id>",
"ssh_keys": ["ssh-ed25519 AAAA... ci@runner"],
"user_data": "#!/bin/sh\n/opt/ci/run-pipeline.sh"}}'3. When the job finishes, delete the server. Billing stops immediately.
curl -X DELETE https://my.x-zoneservers.com/api/v1/vps/<vps-id> \
-H "Authorization: Bearer $XZ_API_KEY" \
-H "Content-Type: application/json" \
-d '{"immediate": true}'03API
Built for Scripts and AI Agents
Predictable behaviour matters more than endpoint count when a program, not a person, is clicking the buttons.
Scoped keys
Each key carries only the scopes you grant — read, services, orders, billing, destructive — plus an optional IP allowlist and expiry date.
Published rate limits
1,000 requests per hour per key by default, reported in X-RateLimit headers, with short per-server cool-downs on power and reinstall actions.
Safe retries
Orders accept an Idempotency-Key, and every refusal returns a machine-readable error code, so automation can tell a retryable failure from a real one.
Machine-readable docs
An OpenAPI 3.0 spec for client generators and a plain-Markdown guide that coding assistants and AI agents can read directly.
04Related
Selling Servers to Your Own Customers?
This Customer API automates your own account. To resell under your own brand, join the reseller program and use the Reseller API instead: wholesale prices with volume tiers, HMAC-signed requests, webhooks, customer-bound keys and console links your customers open without an account with us.
05Questions
API FAQ
Common questions about automating X-ZoneServers.
Does X-ZoneServers have an API?
Yes. The Customer API (v1) is a REST API over HTTPS at https://my.x-zoneservers.com/api/v1 with 92 operations covering VPS, dedicated servers, orders, add-ons, upgrades, invoices, SSH keys and custom images. It is in public beta: stable enough to build on, but endpoints and response shapes may still change.
Is API access free?
Yes. API access is included with every account at no extra cost; you pay only for the servers and add-ons you order, at the same prices as the website and client panel.
Can I create and delete hourly VPS through the API?
Yes. Place an order with the billing cycle set to hourly, optionally with cloud-init user-data and SSH keys, then delete the VPS when you no longer need it. Hourly services are charged from account credit and stop billing as soon as they are deleted.
Does the API work with dedicated servers?
Partly. For dedicated servers the API covers ordering, add-ons, invoices and service details. Power control, OS reinstalls and password resets are not available for dedicated servers through the API or the client panel.
How do I authenticate?
Create an API key in the client panel under Profile → API Keys and send it as a Bearer token. Choose its scopes when you create it, and optionally restrict it to specific IP addresses or give it an expiry date. Keys are shown once and can be revoked at any time from the panel.
Is there an OpenAPI or Swagger specification?
Yes. The full OpenAPI 3.0 specification is published at https://my.x-zoneservers.com/api/v1/openapi.json, next to the rendered documentation and a Markdown usage guide.
Get started
Create Your First API Key
Sign in to the client panel, open Profile → API Keys and make your first call in under a minute. API questions go straight to the people who build the platform.