HostoaAPI
Help CentreGet an API token

Hostoa API

A small REST API for the things you may want to automate: creating sites, registering domains and managing credits. Everything else lives in your dashboard.

Authentication

Create a token under API Tokens and send it as a Bearer token on every request.

curl https://api.hostoa.com/api/account \
  -H "Authorization: Bearer $HOSTOA_TOKEN"

Requests and responses are JSON. Tokens act as the account that created them; revoke one at any time.

Quick start

Three calls from a new token to a live website. Set HOSTOA_TOKEN to your token first.

1. Check your token
A 200 response with your account details means the token works.
curl https://api.hostoa.com/api/account \
  -H "Authorization: Bearer $HOSTOA_TOKEN"
2. Find a plan
Copy the id of an active plan — sites are created on a plan.
curl https://api.hostoa.com/api/plans/active \
  -H "Authorization: Bearer $HOSTOA_TOKEN"
3. Create a website
Use the plan id from step 2. WordPress is installed for you.
curl -X POST https://api.hostoa.com/api/sites \
  -H "Authorization: Bearer $HOSTOA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","region":"EU","payloadType":"wordpress","purchasedPlanId":"PLAN_ID"}'

Account & tokens

Create tokens in the dashboard under API Tokens, or with the token endpoints below.

The account the token belongs to.
List your active tokens (the secret is never shown again).
Create a named token. The full token is returned once.
Revoke a token immediately.

Plans

A plan is the hosting package you pay for. Sites are created on a plan.

All plans you can buy, with prices and specs.
Plans you own (any status).
Active plans only — the ones you can create sites on.
Buy a plan, either with a card subscription (returns a checkout URL) or from your credits.
Cancel a plan. Sites on it are suspended when the paid period ends.

Reseller

For reseller plans: create client accounts and their websites from your own system or plugin. Activate your reseller plan in the dashboard first. Clients, plans and sites are all addressed by Hostoa ids — you never deal with a server or panel directly. Creating clients and sites is limited to 120 per hour.

Your activated reseller accounts.
The hosting packages you can put a client site on.
Clients you created through the API. Add ?email= to find one client by email.
Create a client account. They get their own panel login.
Delete a client and everything they own. This cannot be undone.
Create a website for a client.
A client's websites.
Take a client's website offline (for example when they stop paying). Data is kept.
Bring a suspended website back online.
Delete a client website and free its place in your plan. This cannot be undone.
A one-time link that signs the client in to their panel.

Sites

Create and manage hosted websites. Site creation is limited to 10 per hour per account.

Provision a site on a plan. Some servers finish immediately; others finish in the background — poll the site until its status is "deployed".
List your sites.
One site, with its recent history.
Everything that has happened to the site (created, suspended, removed).
Step-by-step provisioning log.
Change a live site.
Take a site offline but keep its data.
Bring a suspended site back online.
Remove the site from its server.
A one-time URL that signs the customer in to the hosting control panel.
Regions that currently have capacity.

Domains

Is a domain available? Public, rate-limited per IP.
Check several domains at once (max 20). Public.
Search with prices.
Check registrar availability and price.
Register a domain. The price is deducted from your credits (100 per day). By default it is registered under your saved registrant contact; send a contact to register it in your own customer's name instead.
Domains registered in your account.
WHOIS lookup.
Your registrant (owner) contact. It is required once before registering or transferring a domain.
Save your registrant contact.
Transfer a domain to Hostoa. The fee (includes one year of renewal) is taken from your credits and the transfer completes in the background.
Expiry, auto-renew, transfer lock, nameservers and transfer status.
Move a domain away: unlocks it and returns the transfer (EPP) code.
Turn the transfer lock on or off.
Use Hostoa nameservers ("basic") or your own ("custom").
DNS records. Records marked "managed" cannot be edited. Edits only apply while the domain uses Hostoa nameservers.
Add or update records (up to 100).
Delete records. Send the same type, name and value you see in the list.
Turn automatic renewal on or off.
Renew now. The price is taken from your credits.

Credits

Credits are a pre-paid balance in your account’s billing currency (USD or EUR), used for domain registration and plans paid from credits.

Balance and auto-refill settings.
Every credit movement, newest first.
Start a card payment to add credits. Returns a checkout URL.
Top up automatically when the balance runs low.

Limits & errors

  • 120 requests per minute per IP, across the API.
  • Per account: site creation 10/hour · suspend and remove 5/hour · domain registration 10/day · credit top-ups 5/day · token creation 20/hour.
  • Exceeding a limit returns 429.

Errors are JSON with a message and a standard HTTP status:

{ "error": "Insufficient credits — balance $2.00, required $8.57" }
  • 400 invalid input · 401 missing or invalid token · 402 not enough credits or plan not active
  • 403 not allowed for this account · 404 not found · 409 conflict (e.g. a website already exists for that domain)
  • 503 no server capacity in the requested region