We believe automation should be a right, not a premium feature. VPS, domains, DNS, web hosting, billing — 373 documented endpoints cover the things you manage in the HostUp dashboard.
If you can click it, you can script it. The dashboard is built on this same v2 API — what it can do, your integrations can do.
The work you do in the dashboard is in the API. Do a task once, script it, and never do it by hand again.
No enterprise tier, no gated features. The v2 API the HostUp dashboard is built on is the same one you build on.
We treat every support ticket as a product flaw. Predictable shapes, stable error codes, and typed IDs mean fewer surprises.
Model Context Protocol
Hostup runs a remote MCP server. Add it to Claude, ChatGPT, Cursor, Claude Code or Codex, sign in with your Hostup account, and your assistant can manage your VPS, domains, DNS, web hosting and billing, and run website, DNS and mail diagnostics.
# Streamable HTTP endpoint — sign in with your Hostup account https://cloud.hostup.se/mcp # Claude app / claude.ai: Settings → Connectors → Add custom connector → paste the URL → Connect # ChatGPT: Settings → Plugins → New plugin → Server URL → Authentication: OAuth # Claude Code claude mcp add --transport http hostup https://cloud.hostup.se/mcp claude mcp login hostup # Codex codex mcp add hostup --url https://cloud.hostup.se/mcp codex mcp login hostup # Clients without OAuth support: send an API key (cloud.hostup.se/api-management) as a header, for example claude mcp add --transport http hostup https://cloud.hostup.se/mcp \ --header "Authorization: Bearer YOUR_API_KEY"
Step-by-step per app at cloud.hostup.se/api-management.
Your own agent
Every v2 response is shaped so your own assistant or automation can act on it without guessing: typed IDs, units in the field names and a closed error vocabulary.
Finding the latest backup for db-01.
/api/v2/vps/{id}/backups → bkp_01H… · 02:00 /api/v2/vps/{id}/backups/{backupId}/actions/restore → 202 job_… Restore from the 02:00 backup is running — I’ll tell you when db-01 is back.
Every resource is dom_…, vps_…, inv_… — a model can’t mistake a domain for a server.
memoryGb, taxRateDecimal — no guessing what a raw number means.
Every non-2xx response is RFC 7807 Problem Details with a stable code — a closed vocabulary, not free text.
llms.txt hands an agent the whole API in one file, and every endpoint page has a Copy for LLM button.
Authenticate every request with an API key in the Authorization: Bearer <token> header.
Create and manage API keys at cloud.hostup.se/api-management. Each key carries a set of scopes that limit what it can do — see Scopes below.
For detailed setup instructions, see the API Authentication Guide.
curl https://cloud.hostup.se/api/v2/me \ -H "Authorization: Bearer YOUR_API_KEY"
A 200 with your account profile means the key works.
API keys carry scopes such as read:dns or write:vm. A write scope always includes its matching read scope, and read:all grants every read scope (write:all grants write access everywhere and includes read:all). Every endpoint page shows the scopes it requires. You assign scopes when creating a key in the dashboard.
| Scope family | Covers |
|---|---|
| read:vm / write:vm | VPS servers. power:vm, backup:vm, console:vm, and rebuild:vm gate power, backup, console, and reinstall actions. |
| read:domains / write:domains | Domains. delete:domains and transfer:domains gate deletion and transfer actions. |
| read:dns / write:dns | DNS zones and records. |
| read:billing / write:billing | Invoices, payments, and billing activity. write:payment_methods covers stored payment methods. |
| read:hosting / write:hosting | Web hosting accounts. |
| read:network / write:network | IP addresses and private networking. |
| read:cdn / write:cdn | CDN zones. |
| read:support / write:support | Support tickets. |
| read:orders / write:orders | Orders and order previews. |
| read:account / write:account | Account profile and settings. |
250 requests per minute per account, shared across all of the account's API keys. Per-IP limits and stricter limits on some endpoints also apply. When you exceed a limit, you'll receive a 429 Too Many Requests response — honor the Retry-After header before retrying, and use the X-RateLimit-* headers to pace your requests.
| Header | Description |
|---|---|
| X-RateLimit-Limit | Max requests allowed |
| X-RateLimit-Remaining | Requests remaining in current window |
| X-RateLimit-Reset | ISO timestamp when limit resets |
| Retry-After | Seconds until retry (on 429 only) |
List endpoints accept limit and cursor query parameters. Each page includes a nextCursor value — pass it as cursor to fetch the next page, and stop when nextCursor is null.
Every non-2xx v2 response is an RFC 7807 Problem Details document with a stable code field for client branching:
{
"type": "https://developer.hostup.se/errors/invalid_request",
"title": "Invalid request",
"status": 400,
"detail": "The request body failed validation.",
"code": "invalid_request"
}
Our customer portal at cloud.hostup.se is built on this same v2 API. Open your browser's DevTools (F12), go to the Network tab, and perform an action in the portal to see the API calls being made. Requests under /api/v2/ are the public, documented contract — other paths you may see are internal and not part of it.
Each endpoint page has a "Copy for LLM" button that copies a structured prompt with all the endpoint details. Paste it into ChatGPT, Claude, or your preferred AI assistant to quickly generate integration code, understand the endpoint, or troubleshoot issues.
Domain registration, transfers, nameservers, DNS, redirects, CDN, and forwarding
/api/v2/dns-zones GET /api/v2/dns-zones/{id} GET /api/v2/dns-zones/{id}/records POST /api/v2/dns-zones/{id}/records PUT /api/v2/dns-zones/{id}/records/{recordId} PATCH /api/v2/dns-zones/{id}/records/{recordId} DELETE /api/v2/dns-zones/{id}/records/{recordId} POST /api/v2/dns-zones/{id}/smartcopy-scan CDN zones, edge proxy rules, security settings, and cache behavior
/api/v2/cdn/security-insights GET /api/v2/cdn/zones GET /api/v2/cdn/zones/{id} POST /api/v2/cdn/zones/{id} PATCH /api/v2/cdn/zones/{id} DELETE /api/v2/cdn/zones/{id} GET /api/v2/cdn/zones/{id}/proxy-rules POST /api/v2/cdn/zones/{id}/proxy-rules Hosting accounts, cPanel, files, databases, email, and WordPress operations
/api/v2/mail-profiles/{token} GET /api/v2/shared-hosting GET /api/v2/shared-hosting/{accountId} PATCH /api/v2/shared-hosting/{accountId} GET /api/v2/shared-hosting/{accountId}/account-details GET /api/v2/shared-hosting/{accountId}/account-stats GET /api/v2/shared-hosting/{accountId}/actions/billing-cycle POST /api/v2/shared-hosting/{accountId}/actions/billing-cycle Fixed-cycle VPS instances, actions, backups, snapshots, console, networking, and maintenance
Pay-as-you-go Cloud VPS deployment, quotas, private networks, and block volumes
/api/v2/placement-groups POST /api/v2/placement-groups GET /api/v2/placement-groups/{id} PATCH /api/v2/placement-groups/{id} DELETE /api/v2/placement-groups/{id} POST /api/v2/placement-groups/{id}/actions/resolve POST /api/v2/placement-groups/{id}/members DELETE /api/v2/placement-groups/{id}/members/{vpsId} Invoices, payments, credits, pricing, and order creation
/api/v2/billing/account GET /api/v2/billing/activity GET /api/v2/billing/cards POST /api/v2/billing/cards DELETE /api/v2/billing/cards/{id} POST /api/v2/billing/cards/{id}/actions/set-default GET /api/v2/billing/credit-line POST /api/v2/billing/credit/actions/add-funds Profiles, delegated access, contacts, sessions, and account preferences
/api/v2/account/invoice-lead PATCH /api/v2/account/invoice-lead GET /api/v2/account/service-consolidation PATCH /api/v2/account/service-consolidation GET /api/v2/audit-log GET /api/v2/cancellations GET /api/v2/me PATCH /api/v2/me Support tickets, availability, feedback, and attachments
/api/v2/feedback POST /api/v2/support/attachments GET /api/v2/support/attachments/{id} GET /api/v2/support/departments POST /api/v2/support/port25-requests GET /api/v2/support/tickets POST /api/v2/support/tickets GET /api/v2/support/tickets/{id} We build infrastructure that gives you control. The same API that powers your dashboard is available to you. Our goal is that you should never need to contact support — and when you do, we see it as a sign that we can improve the product.