Skip to content
Developers

Build on the VASTROX API

A clean, token-authenticated REST API to manage your account, services, invoices, orders and tickets programmatically.

Base URL  https://vastrox.com/api/v1

1Authenticate

Create a personal access token in your Account → API Keys, then send it as a Bearer token:

Authorization: Bearer <your-key>

2Choose a scope

Read-only keys can view everything in your account. Read & write keys can also open/reply to tickets and power VPS servers. Write calls with a read key return 403.

3Read responses

Every response uses one envelope:

{ "ok": true, "data": … }
or
{ "ok": false, "error": {…} }

Endpoints

Catalog
GET /catalog Browse orderable plans & pricing (public, no token)
Account
GET /me Your profile, company & balance
Services
GET /services List your services
GET /services/{id} A single service
GET /services/{id}/usage Live usage: VPS stats or storage bytes / objects
POST /services/{id}/power write Start / stop / restart a VPS
POST /services/{id}/reset-password write Reset the VPS root or hosting panel password
Invoices
GET /invoices List invoices
GET /invoices/{id} A single invoice
Orders
GET /orders List your orders
GET /orders/{id} A single order + items
Tickets
GET /tickets List tickets
GET /tickets/{id} A ticket + replies
POST /tickets write Open a new ticket
POST /tickets/{id}/reply write Reply to a ticket

Example

# List your services
curl -H "Authorization: Bearer <your-key>" \
     https://vastrox.com/api/v1/services

# Open a ticket (needs a Read & write key)
curl -X POST https://vastrox.com/api/v1/tickets \
  -H "Authorization: Bearer <your-key>" \
  -H "Content-Type: application/json" \
  -d '{"department":"support","subject":"Hi","priority":"low","message":"Hello"}'

Rate limit: 90 requests/minute per token. All data is scoped to the token owner.

Errors

Failures return the same envelope with an HTTP status and a stable error.code you can switch on: { "ok": false, "error": { "code", "message" } }.

401unauthenticatedMissing or invalid Bearer token.
403forbiddenA read-only key tried a write call — create a Read & write key.
404not_foundThe resource doesn't exist, or isn't owned by your token.
422unavailable / validationThe request is malformed, or the action isn't valid for that resource (e.g. power on a non-VPS).
429rate_limitedOver 90 requests/minute — back off and retry.
502panel_errorAn upstream panel (VPS / hosting) rejected the request — safe to retry.

Webhooks

Instead of polling, register an HTTPS endpoint under API Keys and we push events to you as they happen. Available events: invoice.paid, service.created, service.activated, service.suspended and service.terminated. 

# Every delivery is a signed JSON POST
POST https://example.com/hooks/vastrox
X-Vastrox-Event:     invoice.paid
X-Vastrox-Delivery:  8f14e45f-ceea-467f-a1d2-91a3c5f0f3aa
X-Vastrox-Signature: sha256=<hmac>

{"id":"8f14e45f...","event":"invoice.paid","created_at":"2026-07-04T12:00:00+00:00",
 "data":{"invoice_id":1234,"total":12.99,"currency":"USD"}}

# Verify the signature (PHP)
$valid = hash_equals(
    'sha256=' . hash_hmac('sha256', $rawBody, $yourSecret),
    $_SERVER['HTTP_X_VASTROX_SIGNATURE']
);

Respond with any 2xx within 10 seconds. Failed deliveries retry twice with backoff; endpoints pause automatically after 10 consecutive failures.

Get your API key