Skip to main content

​
Base URL

Prefer an AI agent? You can connect Claude or any MCP client to your account using the same API token — see the MCP server.

​
Authentication

All endpoints under /api/v1 require a Sanctum Bearer token. The one exception, GET /ping, is unauthenticated and lives outside the /api/v1 prefix at /api/ping.
Tokens are created in the reseller dashboard at Settings → API Tokens, or via the admin panel for a given org. Each token has a set of scopes that define what it can do.

​
Scopes

A token can have any combination of scopes. Requesting an endpoint without the required scope returns a 403 with "Scope 'zones:read' required.".
Write scopes follow the token owner’s role. A token acts in the organisation it was created for, and its :write scopes only work while its owner’s role there allows changes (owner, admin or editor). If the owner becomes a viewer, the token can still read but every write returns 403; if they are removed from the organisation, their tokens for it are revoked.

​
Rate Limiting

Starter 60, Pro 300, Agency 1,200 requests per minute, set by your plan. The bucket is keyed by your organisation, so all tokens belonging to the same org share one limit, and the MCP server draws from the same bucket. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining; a 429 carries Retry-After. Separately, 60 failed authentications per minute from one IP address return 429 for the rest of that minute. Successful requests never count toward it.

​
IP Allowlist

Tokens can optionally be restricted to specific IP addresses. Requests from non-whitelisted IPs return 403 with {"ok": false, "message": "This token is restricted to specific IP addresses.", "code": 403} — note this specific error uses the key message, not error. Configure the allowlist in Settings → API Tokens → Edit.

​
OpenAPI Spec

An OpenAPI 3.0 spec is available at GET /api/docs.json and the interactive UI at GET /api/docs on your PanelDNS instance.