API Documentation

Integrate WisPanel with your applications using our comprehensive REST API.

Base URL

https://your-server-ip:2083/api/v1

All API endpoints are relative to this base URL.

Domains & Subdomains

Domains & Subdomains

Manage domains/subdomains. Base: /api/v1/domains · Auth: Authorization: Bearer wsp_…

Error envelope: { "success": false, "code": "VALIDATION_ERROR", "error": "Domain name is required", "message": "…", "status": 400 }


List — GET /api/v1/domains/

Response 200 (verified live): [], or domain objects (shape as in Create's response).

Create — POST /api/v1/domains/

Request:

{ "name": "example.com", "php_version": "8.2", "force_ssl": false }
Field Required Note
name FQDN
php_version server default if omitted
force_ssl redirect http→https

Response 201 (verified live):

{ "name": "example.com", "owner": "admin",
  "web_server": "nginx_apache",
  "document_root": "/home/admin/domains/example.com/public_html",
  "custom_doc_root": "public_html", "php_version": "8.2",
  "ssl_enabled": false, "force_ssl": false,
  "www_redirect": "none", "status": "active",
  "created_at": "2026-05-18T17:46:31+07:00",
  "updated_at": "2026-05-18T17:46:31+07:00" }

Response 400 (verified live): { "success": false, "code": "VALIDATION_ERROR", "error": "Domain name is required", "message": "Domain name is required", "status": 400 }

Get / update / delete

GET /api/v1/domains/:name → domain object (shape above). PUT /api/v1/domains/:name Request: { "php_version": "8.3", "force_ssl": true }. DELETE /api/v1/domains/:name200 (verified live):

{ "data_deleted": false, "message": "Domain deleted successfully" }

GET /domains/:name/stats; GET | PUT /domains/:name/vhost; POST /domains/:name/vhost/reset.

Subdomains — /api/v1/domains/:domain/subdomains

POST Request: { "name": "blog", "php_version": "8.2" }. GET /subdomains · /subdomains/:subdomain; PUT | DELETE /subdomains/:subdomain; POST /:subdomain/ssl/issue · /ssl/renew.

Redirects / pointers / protection (under /domains/:domain)

Redirect POST /redirects { "source": "/old", "destination": "/new", "type": 301 }; Pointer POST /pointers { "pointer": "alias.com" }; Protected dir POST /protected-dirs { "path": "/admin", "label": "Staff" }; Handlers/MIME/error-pages/ HSTS/hotlink — see API reference.


Conventions → Authentication, Error Handling.

Rate Limiting

API requests are limited to 60 requests per minute per API token.

  • X-RateLimit-Limit: Maximum requests per minute
  • X-RateLimit-Remaining: Remaining requests
  • X-RateLimit-Reset: Unix timestamp when limit resets