●api reference · v1

The whole surface, documented.

Mint a personal access token, set the Authorization header, and ship. Everything on this page works from any script or server. The API is free, and you pay only for what you provision.

Open the whole reference as one plain-text file for LLMs

Base URLhttps://api.evorxa.com/api

Auth headerAuthorization: Bearer <token>

Rate limit60 req/min per token

auth

Authentication

Every request authenticates with a personal access token in the Authorization header. Mint a token in your dashboard at /api-tokens. Each token can be scoped to specific abilities (instances:read, agent:write, waf:*, etc.) or granted full access.

GET/meGet the authenticated user

Returns the user record and the projects they belong to, including the caller's role in each project. next_renewal describes the next scheduled charge across the account: when it falls, what it will cost in cents, and how many instances are in it. It is null when nothing is due.

responses

200User and project list

{
  "user": {
    "id": 42,
    "email": "you@example.com",
    "name": "Jane Operator",
    "wallet_balance": 5240,
    "onboarded": true,
    "next_renewal": { "at": "2026-09-01T00:00:00+00:00", "amount_cents": 8600, "instances": 3 }
  },
  "projects": [
    { "id": 1, "name": "default", "type": "personal", "current_user_role": "owner" }
  ]
}

example

curl https://api.evorxa.com/api/me \
  -H "Authorization: Bearer $EVORXA_TOKEN"

PUT/meUpdate your profile

Updates the authenticated user's personal details. All fields are optional; only the fields you send are changed.

required scope

all

Request body

name	type	description
`first_name`	`string`	Optional. First name.
`last_name`	`string`	Optional. Last name.
`phone`	`string`	Optional. Phone number in international format. Send null to clear.
`country`	`string`	Optional. Two-letter country code (ISO 3166-1 alpha-2).

responses

200Updated user record.

{
  "user": {
    "id": 42,
    "name": "Jane Operator",
    "first_name": "Jane",
    "last_name": "Operator",
    "email": "you@example.com",
    "phone": "+15550001111",
    "country": "US"
  }
}

422Validation failed.

example

curl -X PUT https://api.evorxa.com/api/me \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"first_name":"","last_name":"","phone":"","country":""}'

GET/me/api-tokensList your personal API tokens

required scope

all

responses

200Token list (without the secret)

[
  {
    "id": 7,
    "name": "CI deployer",
    "abilities": ["instances:read", "instances:write"],
    "last_used_at": "2026-05-14T09:12:03.000Z",
    "created_at": "2026-05-01T18:00:00.000Z"
  }
]

example

curl https://api.evorxa.com/api/me/api-tokens \
  -H "Authorization: Bearer $EVORXA_TOKEN"

POST/me/api-tokensMint a new API token

Request body

name	type	description
`name`required	`string`	Human label for this token.
`abilities`	`string[]`	Optional. Defaults to ["*"] (full access). Use scoped abilities like "instances:read" to limit the token.

responses

201Token created. The plaintext token is returned only once, so store it now.

{
  "id": 8,
  "name": "CI deployer",
  "abilities": ["instances:read", "instances:write"],
  "token": "8|aB9xKp2QrLm...",
  "created_at": "2026-05-14T19:42:18.000Z"
}

example

curl -X POST https://api.evorxa.com/api/me/api-tokens \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"","abilities":[]}'

DELETE/me/api-tokens/{id}Revoke an API token
Path parameters
name type description
idrequired integer Token ID.
responses
- 204Revoked.
example
```
curl -X DELETE https://api.evorxa.com/api/me/api-tokens/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

name	type	description
`id`required	`integer`	Token ID.

team

Team

Projects are shared workspaces. Each member holds a role. Owners can invite teammates, manage members, rename or delete the project, and take billing-impacting actions (create, upgrade, delete, or reactivate instances). Members get read and non-billing access. Invitations go out by email and expire after seven days.

GET/projects/{project}/membersList members and pending invitations

Returns the project's members with their roles plus any pending invitations. Available to every member of the project.

required scope

all

Path parameters

name	type	description
`project`required	`integer`	Project ID.

responses

200Members and pending invitations.

{
  "project": { "id": 1, "name": "default", "type": "personal" },
  "current_user_role": "owner",
  "members": [
    {
      "id": 3,
      "role": "owner",
      "user": { "id": 42, "name": "Jane Operator", "email": "you@example.com" }
    }
  ],
  "invitations": [
    {
      "id": 9,
      "email": "teammate@example.com",
      "role": "member",
      "expires_at": "2026-06-02T12:00:00.000Z",
      "inviter": { "id": 42, "name": "Jane Operator", "email": "you@example.com" }
    }
  ]
}

404You are not a member of this project.

example

curl https://api.evorxa.com/api/projects/{project}/members \
  -H "Authorization: Bearer $EVORXA_TOKEN"

POST/projects/{project}/invitationsInvite a teammate by email

Owner only. Sends an email invitation that the recipient accepts while signed in with the same address. The invitation expires after seven days.

required scope

all

Path parameters

name	type	description
`project`required	`integer`	Project ID.

Request body

name	type	description
`email`required	`string`	Recipient email address.
`role`	`string`	Optional. "owner" or "member". Defaults to "member".
`locale`	`string`	Optional. One of "en", "ar", "de", "nl", "it". Sets the language of the invitation link. Defaults to "en".

responses

201Invitation created and emailed.

{
  "id": 9,
  "project_id": 1,
  "email": "teammate@example.com",
  "role": "member",
  "expires_at": "2026-06-02T12:00:00.000Z"
}

403Only project owners can invite teammates.
409An active invitation already exists for that email.
422That user is already a project member.

example

curl -X POST https://api.evorxa.com/api/projects/{project}/invitations \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"","role":"","locale":""}'

DELETE/projects/{project}/members/{member}Remove a member
Owner only. Removes a member from the project. A project must always keep at least one owner.
required scope
all
Path parameters
name type description
projectrequired integer Project ID.
memberrequired integer Member record ID, from the members list.
responses
- 204Member removed.
- 403Only project owners can remove members.
- 422Cannot remove the last remaining owner.
example
```
curl -X DELETE https://api.evorxa.com/api/projects/{project}/members/{member} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
PUT/projects/{project}Update project details
Owner only. Updates the project's name and organization details. All fields are optional; only the fields you send are changed.
required scope
all
Path parameters
name type description
projectrequired integer Project ID.
Request body
name type description
name string Optional. Project / organization name.
tax_id string Optional. Tax or VAT registration number. Send null to clear.
address string Optional. Billing address. Send null to clear.
responses
- 200Updated project.
  { "id": 1, "name": "Acme Inc", "type": "business", "tax_id": "EG-123456789", "address": "1 Production Way, Cairo" }
- 403Only project owners can update project details.
example
```
curl -X PUT https://api.evorxa.com/api/projects/{project} \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"","tax_id":"","address":""}'
```
DELETE/projects/{project}/invitations/{invite}Cancel a pending invitation
Owner only. Cancels an invitation that has not been accepted yet.
required scope
all
Path parameters
name type description
projectrequired integer Project ID.
inviterequired integer Invitation ID.
responses
- 204Invitation cancelled.
- 403Only project owners can cancel invitations.
- 422Accepted invitations cannot be cancelled.
example
```
curl -X DELETE https://api.evorxa.com/api/projects/{project}/invitations/{invite} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

name	type	description
`name`	`string`	Optional. Project / organization name.
`tax_id`	`string`	Optional. Tax or VAT registration number. Send null to clear.
`address`	`string`	Optional. Billing address. Send null to clear.

instances

Instances

Provision, list, inspect, power-cycle, reinstall, upgrade, and retire VPS instances. Pricing is debited from the wallet at creation and at upgrade.

GET/instancesList instances

required scope

instances:read

Query parameters

name	type	description
`project_id`	`integer`	Filter to one project. Defaults to all projects you own.

responses

200Array of instances.

[
  {
    "id": "01H9...",
    "name": "api-prod-1",
    "hostname": "api-prod-1.server.evorxa.net",
    "plan": "scout-2",
    "status": "running",
    "main_ip": "203.0.113.42",
    "vcpu": 2, "ram": 4, "storage": 60,
    "billed_till": "2026-06-14T00:00:00.000Z",
    "ip_addresses": [...]
  }
]

example

curl https://api.evorxa.com/api/instances \
  -H "Authorization: Bearer $EVORXA_TOKEN"

POST/instancesProvision a new instance

Provisions a server on the Evorxa platform, builds the OS, debits the wallet, and returns the new record. The instance starts in 'provisioning' status and transitions to 'running' once the OS boots.

required scope

instances:write

Request body

name	type	description
`name`required	`string`	Display name, 3-255 characters. Used in hostname derivation.
`hostname`required	`string`	FQDN. Auto-managed reverse DNS.
`project_id`required	`integer`	Owning project.
`package_id`required	`integer`	Plan package ID. See /me/catalog/plans.
`category`required	`string`	Either "standard" or "cpu-optimized".
`os_template_id`required	`integer`	From /catalog/os-templates/{packageId}. Not required when app_slug is given, since the app selects its own base image.
`os_name`required	`string`	Display label for the OS. Not required when app_slug is given.
`billing_cycle`required	`string`	"monthly", "6months", or "yearly".
`coupon`	`string`	Optional coupon code. The discount is applied to the amount debited; an invalid, expired, or inapplicable code fails the request with 422 rather than charging full price.
`app_slug`	`string`	Optional. Install a one-click application on the new server. See /catalog/apps. Replaces os_template_id and os_name.
`app_password`	`string`	Optional, 8-128 characters. The sign-in password for the application. Omit it and a strong one is generated for you. Ignored by applications that create their own first account.
`app_license_key`	`string`	Required only for applications that cannot install without a licence you already own — those are marked license_required_upfront in /catalog/apps. Sent to the server during installation and never returned.
`ssh_key_ids`	`integer[]`	Optional. SSH keys to inject at build time.

responses

201Instance created. Status is 'provisioning'.
402Insufficient wallet balance.
422Invalid plan, package, category, coupon, or app, the app does not fit the plan, or the plan is out of stock.

example

curl -X POST https://api.evorxa.com/api/instances \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"","hostname":"","project_id":0,"package_id":0,"category":"","os_template_id":0,"os_name":"","billing_cycle":"","coupon":"","app_slug":"","app_password":"","app_license_key":"","ssh_key_ids":[]}'

GET/instances/{id}/appGet the application installed on an instance
The one-click application installed on this server, with its sign-in details. Installation continues in the background after the instance is created, so poll this until status is 'ready'. Answers with a null app when the server was built without one.
required scope
instances:read
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200The application, or null.
  { "app": { "slug": "wordpress", "name": "WordPress", "status": "ready", "username": "admin", "password": "generated-at-order-time", "login_url": "http://203.0.113.42/wp-admin", "installed_at": "2026-06-14T10:22:41.000Z" } }
example
```
curl https://api.evorxa.com/api/instances/{id}/app \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

GET/instances/{id}Get an instance

required scope

instances:read

Path parameters

name	type	description
`id`required	`string`	Instance UUID.

responses

200Instance with live runtime state attached.

{
  "id": "01H9...",
  "name": "api-prod-1",
  "status": "running",
  "vf_state": "complete",
  "vf_remote_state": {
    "state": "running",
    "cpu": 12.4,
    "memory": { "memtotal": 4194304, "memfree": 1572864 }
  }
}

404Instance not found or deleted.

example

curl https://api.evorxa.com/api/instances/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"

DELETE/instances/{id}Delete an instance
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
Request body
name type description
moderequired string "immediate" (delete now, prorated refund) or "end_of_cycle" (cancel renewal).
responses
- 200Deleted, with refund amount in cents.
example
```
curl -X DELETE https://api.evorxa.com/api/instances/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":""}'
```
POST/instances/{id}/power/{action}Power action
Boot, shutdown, restart, or hard power-off. Local status moves to a transitional state and syncs from the hypervisor.
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
actionrequired string boot · shutdown · restart · poweroff
responses
- 200Command dispatched.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/power/{action} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/instances/trafficNetwork traffic across every instance
One request for the whole account. Readings are stored every five minutes and summed per bucket, so this is the cheap way to chart bandwidth without asking each instance in turn. Counters are differenced per instance before they are added together, and a reboot that resets a counter contributes nothing rather than a spike.
required scope
analytics:read
Query parameters
name type description
period string "1h", "6h", "12h", "24h". Default "24h".
responses
- 200Totals for the window and a continuous series.
  { "period_minutes": 1440, "bucket_minutes": 30, "instances": 4, "totals": { "rx_bytes": 1363148599296, "tx_bytes": 559532441600 }, "points": [ { "t": "2026-08-18T00:00:00+00:00", "rx_bytes": 28374619136, "tx_bytes": 11653201920 } ] }
example
```
curl https://api.evorxa.com/api/instances/traffic \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/instances/{id}/metricsCPU / RAM / disk / network
Live snapshot from the hypervisor plus stored history for the requested period.
required scope
analytics:read
Path parameters
name type description
idrequired string Instance UUID.
Query parameters
name type description
period string "5m", "30m", "1h", "6h", "12h", "24h". Default "1h".
responses
- 200Current snapshot + history points.
  { "current": { "cpu_percent": 12.4, "memory_used_kb": 2621440, "memory_total_kb": 4194304, "disk_used_bytes": 12884901888, "disk_total_bytes": 64424509440, "network_rx_bytes": 938472847, "network_tx_bytes": 271938247 }, "history": [...] }
example
```
curl https://api.evorxa.com/api/instances/{id}/metrics \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/upgradeUpgrade plan
Prorates the difference and debits the wallet. Optionally reboots immediately.
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
Request body
name type description
package_idrequired integer Target plan package.
rebootrequired boolean Reboot immediately to apply.
responses
- 200Upgraded with prorated charge.
- 402Insufficient wallet balance for the difference.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/upgrade \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"package_id":0,"reboot":false}'
```

name	type	description
`mode`required	`string`	"immediate" (delete now, prorated refund) or "end_of_cycle" (cancel renewal).

name	type	description
`period`	`string`	"1h", "6h", "12h", "24h". Default "24h".

name	type	description
`period`	`string`	"5m", "30m", "1h", "6h", "12h", "24h". Default "1h".

name	type	description
`package_id`required	`integer`	Target plan package.
`reboot`required	`boolean`	Reboot immediately to apply.

POST/instances/{id}/reinstallReinstall the OS or an application

Wipes the disk and rebuilds it. Send either an operating system or an application slug — an application brings its own image, so the two are alternatives rather than a pair. The root password is reissued and returned by GET /instances/{id}.

required scope

instances:write

Path parameters

name	type	description
`id`required	`string`	Instance UUID.

Request body

name	type	description
`os_template_id`	`integer`	Required unless app_slug is sent. From /instances/{id}/reinstall-options.
`os_name`	`string`	Required unless app_slug is sent. Display label.
`app_slug`	`string`	Required unless os_template_id is sent. From /catalog/apps. Refused with 422 if the plan is below the application's minimums.
`app_password`	`string`	Optional. Sign-in password for the application. Generated for you when omitted.
`app_license_key`	`string`	Optional. Required up front by applications that validate a licence during setup.

responses

200Reinstall started. Status moves to 'provisioning'.
422Neither an operating system nor an application was sent, or the plan is too small for the application.

example

curl -X POST https://api.evorxa.com/api/instances/{id}/reinstall \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"os_template_id":0,"os_name":"","app_slug":"","app_password":"","app_license_key":""}'

GET/instances/{id}/reinstall-optionsList OS templates for reinstall
required scope
instances:read
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200OS template groups.
example
```
curl https://api.evorxa.com/api/instances/{id}/reinstall-options \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/reset-passwordGenerate a new root/Administrator password
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200New password returned in cleartext (once).
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/reset-password \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/cancel-deletionUndo a scheduled deletion
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Deletion cancelled, billing resumed.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/cancel-deletion \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/extendExtend the billing period early
Debits one billing cycle from the wallet immediately and pushes billed_till forward by that cycle. Clears any scheduled end-of-cycle deletion. Not available while the instance is suspended.
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Extended; new billed_till returned.
- 402Insufficient wallet balance.
- 422Instance suspended or has no renewable cycle.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/extend \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/reactivateReactivate a suspended instance
Debits the cycle cost from the wallet, extends billed_till, and unsuspends the instance.
required scope
instances:write
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Reactivated.
- 402Insufficient wallet balance.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/reactivate \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

ddos

DDoS Protection

Network-layer DDoS protection is always on for supported locations: attacks are detected and scrubbed at the network edge before they reach your server. These endpoints expose the scrubbing analytics (dropped vs passed traffic), the attack history of an instance, and the per-instance attack notification settings. All of them return supported: false when the instance's IP is not on a protected prefix.

GET/instances/{id}/ddos/overviewDropped vs passed traffic series
Time series of scrubbed (dropped) and clean (passed) traffic for the instance's primary IPv4, normalized to bits per second and ordered oldest first. The live period returns roughly 12-second buckets covering the last 10 minutes; longer periods return coarser buckets.
required scope
analytics:read
Path parameters
name type description
idrequired string Instance UUID.
Query parameters
name type description
period string "live", "1h", "1d", "1w". Default "live".
responses
- 200Traffic points for the period.
  { "supported": true, "period": "live", "points": [ { "time": "2026-08-11T17:12:15Z", "drop_bps": 0, "pass_bps": 470 }, { "time": "2026-08-11T17:12:28Z", "drop_bps": 528000000, "pass_bps": 610 } ], "updated_at": "2026-08-11T17:12:28Z" }
- 502Analytics temporarily unavailable upstream.
example
```
curl https://api.evorxa.com/api/instances/{id}/ddos/overview \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

name	type	description
`period`	`string`	"live", "1h", "1d", "1w". Default "live".

GET/instances/{id}/ddos/incidentsAttack history

Past DDoS attacks against the instance's primary IPv4, newest first. Only attacks that happened after the instance was created are listed.

required scope

analytics:read

Path parameters

name	type	description
`id`required	`string`	Instance UUID.

Query parameters

name	type	description
`page`	`integer`	Page number, starting at 1.

responses

200Attack list with pagination.

{
  "supported": true,
  "items": [
    {
      "id": 106248,
      "started_at": "2026-07-12T11:15:28Z",
      "ended_at": "2026-07-12T11:16:13Z",
      "duration_seconds": 45,
      "vectors": ["UDP_FLOOD"],
      "peak": "771.49 Mbps"
    }
  ],
  "page": 1,
  "page_size": 10,
  "total_items": 1,
  "total_pages": 1,
  "has_next": false,
  "has_previous": false
}

502Analytics temporarily unavailable upstream.

example

curl https://api.evorxa.com/api/instances/{id}/ddos/incidents \
  -H "Authorization: Bearer $EVORXA_TOKEN"

GET/instances/{id}/ddos/settingsGet attack notification settings
Attack notification preferences for this instance. Email alerts are enabled by default. The Discord webhook URL is write-only: reads expose only whether one is configured plus its last four characters.
required scope
instances:read
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Current settings.
  { "email_notifications": true, "discord_webhook_configured": true, "discord_webhook_hint": "a1b2", "affiliate_link_enabled": false, "is_affiliate": true }
example
```
curl https://api.evorxa.com/api/instances/{id}/ddos/settings \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

PUT/instances/{id}/ddos/settingsUpdate attack notification settings

All fields are optional; only the fields you send are changed. The Discord alert is shareable by design: it shows attack details and a 'Server protected by Evorxa' link, but never your IP address. With affiliate_link_enabled (affiliates only) that link becomes your referral shortlink.

required scope

instances:write

Path parameters

name	type	description
`id`required	`string`	Instance UUID.

Request body

name	type	description
`email_notifications`	`boolean`	Optional. Email the project owner when an attack is mitigated.
`discord_webhook_url`	`string`	Optional. A discord.com/api/webhooks/... URL. Send null to remove.
`affiliate_link_enabled`	`boolean`	Optional. Use your affiliate shortlink in the webhook embed.

responses

200Updated settings (same shape as GET).
422Webhook URL is not a valid Discord webhook.

example

curl -X PUT https://api.evorxa.com/api/instances/{id}/ddos/settings \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email_notifications":false,"discord_webhook_url":"","affiliate_link_enabled":false}'

agent

AI Agent

An LLM-driven operator with SSH into your box and a tool kit (shell, file edit, log tail). Open a chat to an instance and stream the agent's actions back. Every account includes a one-time free usage allowance; once it is spent, usage is billed to your wallet balance — but only after you explicitly enable billing.

GET/agent/creditsGet AI agent credit balance
required scope
agent:read
responses
- 200Balances in cents: the remaining free allowance, the wallet, their sum, and whether pay-as-you-go billing has been enabled.
  { "ai_trial_cents": 500, "wallet_cents": 1240, "total_cents": 1740, "billing_enabled": false }
example
```
curl https://api.evorxa.com/api/agent/credits \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/agent/billing/enableEnable pay-as-you-go AI billing
Explicit opt-in to wallet charging. Until this is called the agent only spends the free allowance and stops with a 402 (error `ai_billing_required`) when it runs out; afterwards, usage past the allowance debits the wallet. One-way: there is no disable endpoint. Idempotent.
required scope
agent:write
responses
- 200The updated balance breakdown.
  { "ai_trial_cents": 0, "wallet_cents": 1240, "total_cents": 1240, "billing_enabled": true }
example
```
curl -X POST https://api.evorxa.com/api/agent/billing/enable \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/agent/chatSend a message to the agent
Starts a new conversation or appends to an existing one. The agent may issue tool calls (shell, file edit) which run on your instance via SSH. Each tool call and token is metered.
required scope
agent:write
Path parameters
name type description
idrequired string Instance UUID.
Request body
name type description
messagerequired string User prompt.
conversation_id integer Optional. Continue an existing conversation.
responses
- 200Conversation record with appended assistant message + any tool transcripts.
- 402No spendable AI credit. `error` is `ai_billing_required` when the free allowance is gone and billing was never enabled (fix: POST /agent/billing/enable), or `insufficient_ai_credits` when billing is enabled but the wallet is empty (fix: top up).
- 403Instance is suspended.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/agent/chat \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"message":"","conversation_id":0}'
```
GET/instances/{id}/agent/conversationsList conversations for an instance
required scope
agent:read
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Conversations, newest first. Each carries `cost_cents`, the total that chat has consumed.
example
```
curl https://api.evorxa.com/api/instances/{id}/agent/conversations \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/instances/{id}/agent/conversations/{convId}Get a conversation transcript
required scope
agent:read
Path parameters
name type description
idrequired string Instance UUID.
convIdrequired integer Conversation ID.
responses
- 200Full message + tool call transcript, with the conversation's accumulated `cost_cents`.
example
```
curl https://api.evorxa.com/api/instances/{id}/agent/conversations/{convId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
DELETE/instances/{id}/agent/conversations/{convId}Delete a conversation
required scope
agent:write
Path parameters
name type description
idrequired string Instance UUID.
convIdrequired integer Conversation ID.
responses
- 204Deleted.
example
```
curl -X DELETE https://api.evorxa.com/api/instances/{id}/agent/conversations/{convId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/instances/{id}/agent/telegramGet Telegram link status
required scope
agent:read
Path parameters
name type description
idrequired string Instance UUID.
responses
- 200Linked Telegram chat ID, or null.
example
```
curl https://api.evorxa.com/api/instances/{id}/agent/telegram \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/instances/{id}/agent/telegramLink a Telegram chat to the agent
required scope
agent:write
Path parameters
name type description
idrequired string Instance UUID.
Request body
name type description
telegram_chat_idrequired string From the /start reply.
responses
- 200Linked.
example
```
curl -X POST https://api.evorxa.com/api/instances/{id}/agent/telegram \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"telegram_chat_id":""}'
```

name	type	description
`message`required	`string`	User prompt.
`conversation_id`	`integer`	Optional. Continue an existing conversation.

name	type	description
`telegram_chat_id`required	`string`	From the /start reply.

shield

Shield · Firewall & Visibility

Per-IP firewall rules, RDNS, bandwidth caps, and ingress visibility (top IPs, top ASNs, country breakdown, port mix, PPS). Backed by in-house Shield nodes.

GET/shield/ipsList protected IPs
required scope
shield:read
responses
- 200IPs with rule counts, policy summary, current bandwidth.
example
```
curl https://api.evorxa.com/api/shield/ips \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}Get a protected IP
required scope
shield:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Full IP profile: rules, policy, RDNS.
example
```
curl https://api.evorxa.com/api/shield/ips/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/shield/ips/{id}/rulesCreate a firewall rule
required scope
shield:write
Path parameters
name type description
idrequired integer IP record ID.
Request body
name type description
actionrequired string "allow" or "block".
protocolrequired string "tcp", "udp", or "any".
src_cidr string Source CIDR. Defaults to 0.0.0.0/0.
dst_port integer Destination port. Null = any.
responses
- 201Rule created and pushed to Shield nodes.
example
```
curl -X POST https://api.evorxa.com/api/shield/ips/{id}/rules \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action":"","protocol":"","src_cidr":"","dst_port":0}'
```
PUT/shield/ips/{id}/rules/{ruleId}Update a firewall rule
required scope
shield:write
Path parameters
name type description
idrequired integer IP record ID.
ruleIdrequired integer Rule ID.
responses
- 200Updated.
example
```
curl -X PUT https://api.evorxa.com/api/shield/ips/{id}/rules/{ruleId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
DELETE/shield/ips/{id}/rules/{ruleId}Delete a firewall rule
required scope
shield:write
Path parameters
name type description
idrequired integer IP record ID.
ruleIdrequired integer Rule ID.
responses
- 204Deleted.
example
```
curl -X DELETE https://api.evorxa.com/api/shield/ips/{id}/rules/{ruleId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
PUT/shield/ips/{id}/policyUpdate default policy
required scope
shield:write
Path parameters
name type description
idrequired integer IP record ID.
Request body
name type description
default_in string "allow" or "block".
default_out string "allow" or "block".
responses
- 200Policy updated.
example
```
curl -X PUT https://api.evorxa.com/api/shield/ips/{id}/policy \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"default_in":"","default_out":""}'
```
GET/shield/ips/{id}/bandwidthBandwidth samples
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Time-series of bps in/out.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/bandwidth \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}/visibility/top-ipsTop source IPs
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Ranked list of source IPs by bytes/packets.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/visibility/top-ips \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}/visibility/top-asnsTop source ASNs
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Ranked ASN list.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/visibility/top-asns \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}/visibility/countriesCountry breakdown
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Country share of incoming traffic.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/visibility/countries \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}/visibility/portsPort distribution
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Most-hit destination ports.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/visibility/ports \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/ips/{id}/visibility/ppsPackets per second
required scope
analytics:read
Path parameters
name type description
idrequired integer IP record ID.
responses
- 200Time-series PPS.
example
```
curl https://api.evorxa.com/api/shield/ips/{id}/visibility/pps \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

name	type	description
`id`required	`integer`	IP record ID.

name	type	description
`id`required	`integer`	IP record ID.

name	type	description
`action`required	`string`	"allow" or "block".
`protocol`required	`string`	"tcp", "udp", or "any".
`src_cidr`	`string`	Source CIDR. Defaults to 0.0.0.0/0.
`dst_port`	`integer`	Destination port. Null = any.

name	type	description
`id`required	`integer`	IP record ID.
`ruleId`required	`integer`	Rule ID.

name	type	description
`id`required	`integer`	IP record ID.
`ruleId`required	`integer`	Rule ID.

name	type	description
`id`required	`integer`	IP record ID.

waf

Web Application Firewall

Front an instance with a managed WAF + DDoS layer on the network edge. Each application gets its own protected hostname with an automatically issued certificate; point your own domains at it, tune enforcement, and read traffic, threat and live-event analytics.

GET/shield/wafList WAF applications
required scope
waf:read
responses
- 200Applications with their hostnames, enforcement state and origin.
example
```
curl https://api.evorxa.com/api/shield/waf \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

POST/shield/wafCreate a WAF application

required scope

waf:write

Request body

name	type	description
`instance_id`required	`string`	The instance to protect (its IP becomes the origin).
`name`required	`string`	Application label (max 100 chars).
`template`required	`string`	http, https, or custom.
`port`	`integer`	Origin port, required when template is custom (1–65535).

responses

201Application created with its protected hostname; the certificate is issued automatically.
422The instance is not provisioned yet, or it already has the maximum of 2 applications. Delete one to free a slot.

example

curl -X POST https://api.evorxa.com/api/shield/waf \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"instance_id":"","name":"","template":"","port":0}'

GET/shield/waf/{id}Get a WAF application
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
responses
- 200Application with its hostnames and certificate status.
example
```
curl https://api.evorxa.com/api/shield/waf/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
DELETE/shield/waf/{id}Delete a WAF application
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
responses
- 200Deleted, along with its hostnames and certificates.
example
```
curl -X DELETE https://api.evorxa.com/api/shield/waf/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/shield/waf/{id}/firewallToggle WAF enforcement
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
Request body
name type description
enabledrequired boolean true blocks malicious requests; false runs detect-only.
responses
- 200Enforcement updated.
example
```
curl -X POST https://api.evorxa.com/api/shield/waf/{id}/firewall \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled":false}'
```
POST/shield/waf/{id}/under-attackToggle under-attack mode
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
Request body
name type description
enabledrequired boolean Serve from a short-TTL edge cache during a surge so floods never reach the origin.
responses
- 200Mode updated.
example
```
curl -X POST https://api.evorxa.com/api/shield/waf/{id}/under-attack \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled":false}'
```

PUT/shield/waf/{id}/settingsUpdate protection settings

required scope

waf:write

Path parameters

name	type	description
`id`required	`integer`	Application ID.

Request body

name	type	description
`waf_mode`	`string`	block, detect, or off.
`challenge_enabled`	`boolean`	Show a proof-of-work challenge under attack.
`cache_enabled`	`boolean`	Cache eligible responses at the edge.
`attack_cache`	`boolean`	Under-attack micro-cache.
`rate_avg`	`integer`	Sustained requests/sec per client.
`rate_burst`	`integer`	Burst allowance.

responses

200Settings updated (they apply to every hostname of the application).

example

curl -X PUT https://api.evorxa.com/api/shield/waf/{id}/settings \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"waf_mode":"","challenge_enabled":false,"cache_enabled":false,"attack_cache":false,"rate_avg":0,"rate_burst":0}'

GET/shield/waf/{id}/analyticsTraffic & threat analytics
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
Query parameters
name type description
period string 24h (default), 7d, or 30d.
responses
- 200Totals, a time series, top paths/IPs/countries/ASNs, an activity heatmap and threat figures.
- 502Analytics temporarily unavailable.
example
```
curl https://api.evorxa.com/api/shield/waf/{id}/analytics \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/waf/{id}/eventsLive security events
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
Query parameters
name type description
limit integer Max events (1–200, default 100).
responses
- 200Recent blocked/challenged/inspected requests, newest first.
example
```
curl https://api.evorxa.com/api/shield/waf/{id}/events \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/shield/waf/{id}/hostnamesAdd a hostname (verify DNS)
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
Request body
name type description
hostnamerequired string Domain to protect (max 255 chars).
responses
- 200DNS is not pointing at us yet. Returns { verified: false, dns } with the CNAME record to create, and nothing is added. Create the record (DNS-only, no proxy) and call again.
- 201DNS verified; the hostname is added and its certificate is issued automatically. Returns { verified: true, hostname, dns }.
example
```
curl -X POST https://api.evorxa.com/api/shield/waf/{id}/hostnames \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"hostname":""}'
```
POST/shield/waf/{id}/hostnames/{hostnameId}/retry-sslRe-check DNS & issue certificate
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
hostnameIdrequired integer Hostname ID.
responses
- 200Hostname re-checked; certificate issued when DNS is in place.
example
```
curl -X POST https://api.evorxa.com/api/shield/waf/{id}/hostnames/{hostnameId}/retry-ssl \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
DELETE/shield/waf/{id}/hostnames/{hostnameId}Remove a hostname
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
hostnameIdrequired integer Hostname ID.
responses
- 204Removed.
example
```
curl -X DELETE https://api.evorxa.com/api/shield/waf/{id}/hostnames/{hostnameId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/waf/{id}/liveLive view (events, counters, map)
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
Query parameters
name type description
since_id integer Return events after this id (cursor).
responses
- 200Cursor events plus the current 5-minute window: live counters, per-country traffic (for the map), and top paths.
example
```
curl https://api.evorxa.com/api/shield/waf/{id}/live \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/waf/{id}/rulesList custom rules
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
responses
- 200Your allow/block/challenge/log rules, in priority order.
example
```
curl https://api.evorxa.com/api/shield/waf/{id}/rules \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

POST/shield/waf/{id}/rulesCreate a custom rule

required scope

waf:write

Path parameters

name	type	description
`id`required	`integer`	Application ID.

Request body

name	type	description
`name`required	`string`	Label (max 120 chars).
`action`required	`string`	block \| challenge \| allow \| log.
`priority`	`integer`	0–100000, lower runs first (default 100).
`enabled`	`boolean`	Default true.
`match`required	`object`	Conditions (all must match): path {op: prefix\|exact\|regex, value}, method [..], ip {op: in\|not_in, cidrs: [..]}, header {name, op: exists\|missing\|equals, value?}, query {name, op, value?}.

responses

201Rule created.

example

curl -X POST https://api.evorxa.com/api/shield/waf/{id}/rules \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"","action":"","priority":0,"enabled":false,"match":null}'

PUT/shield/waf/{id}/rules/{ruleId}Update a custom rule
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
ruleIdrequired integer Rule ID.
Request body
name type description
(any create field) object Send only the fields to change.
responses
- 200Rule updated.
example
```
curl -X PUT https://api.evorxa.com/api/shield/waf/{id}/rules/{ruleId} \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"(any create field)":null}'
```
DELETE/shield/waf/{id}/rules/{ruleId}Delete a custom rule
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
ruleIdrequired integer Rule ID.
responses
- 200Removed.
example
```
curl -X DELETE https://api.evorxa.com/api/shield/waf/{id}/rules/{ruleId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/shield/waf/{id}/exclusionsList WAF exclusions
required scope
waf:read
Path parameters
name type description
idrequired integer Application ID.
responses
- 200Rules you've excused for your own legitimate traffic.
example
```
curl https://api.evorxa.com/api/shield/waf/{id}/exclusions \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

POST/shield/waf/{id}/exclusionsCreate a WAF exclusion

required scope

waf:write

Path parameters

name	type	description
`id`required	`integer`	Application ID.

Request body

name	type	description
`rule_id`required	`string`	The rule number to relax (digits only).
`path_prefix`	`string`	Optional. Limit to paths starting with this.
`target`	`string`	Optional. A single input to ignore (e.g. REQUEST_COOKIES); empty disables the whole rule.
`note`	`string`	Optional note (max 300 chars).
`enabled`	`boolean`	Default true.

responses

201Exclusion created.

example

curl -X POST https://api.evorxa.com/api/shield/waf/{id}/exclusions \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rule_id":"","path_prefix":"","target":"","note":"","enabled":false}'

PUT/shield/waf/{id}/exclusions/{xid}Update a WAF exclusion
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
xidrequired integer Exclusion ID.
Request body
name type description
(any create field) object Send only the fields to change.
responses
- 200Exclusion updated.
example
```
curl -X PUT https://api.evorxa.com/api/shield/waf/{id}/exclusions/{xid} \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"(any create field)":null}'
```
DELETE/shield/waf/{id}/exclusions/{xid}Delete a WAF exclusion
required scope
waf:write
Path parameters
name type description
idrequired integer Application ID.
xidrequired integer Exclusion ID.
responses
- 200Removed.
example
```
curl -X DELETE https://api.evorxa.com/api/shield/waf/{id}/exclusions/{xid} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

wallet

Wallet & Billing

Balance, transactions, and invoices. Wallet is the money primitive: all paid actions (instance create/upgrade, reactivate) debit from it. Every server issues a renewal invoice 5 days before its due date; invoices are settled from wallet credit or paid directly by card or local payment.

GET/wallet/balanceGet wallet balance

required scope

wallet:read

responses

200Balance and a fresh exchange rate.

{ "balance_cents": 5240, "balance_usd": 52.40 }

example

curl https://api.evorxa.com/api/wallet/balance \
  -H "Authorization: Bearer $EVORXA_TOKEN"

GET/wallet/transactionsList transactions
The wallet ledger, newest first. Every paid action appears here with the balance it left behind.
required scope
wallet:read
Query parameters
name type description
page integer Page number. Default 1.
per_page integer Rows per page. Default 20, maximum 100.
responses
- 200Paginated transaction ledger.
example
```
curl https://api.evorxa.com/api/wallet/transactions \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/invoicesList invoices
Paginated invoice history, newest first. Renewal invoices are issued 5 days before an instance's due date and settle automatically from wallet credit when the balance covers them; wallet top-ups appear as already-paid invoices. Unpaid invoices past their due date carry is_overdue: true.
required scope
wallet:read
Query parameters
name type description
status string Optional filter: "unpaid", "paid", or "cancelled".
page integer Page number, 20 invoices per page.
responses
- 200Paginated invoices
  { "data": [ { "id": 118, "number": "INV-000118", "type": "renewal", "status": "unpaid", "amount_cents": 699, "amount_formatted": "$6.99", "is_overdue": false, "due_date": "2026-08-16", "paid_at": null, "payment_method": null, "instance": { "id": "e2a6…", "name": "web-1" } } ], "current_page": 1, "last_page": 1, "total": 1 }
example
```
curl https://api.evorxa.com/api/invoices \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

GET/invoices/{id}Get an invoice

A single invoice with its line items and billing period.

required scope

wallet:read

Path parameters

name	type	description
`id`required	`integer`	Invoice id.

responses

200Invoice with line items

{
  "id": 118,
  "number": "INV-000118",
  "type": "renewal",
  "status": "unpaid",
  "amount_cents": 699,
  "due_date": "2026-08-16",
  "period_start": "2026-08-16T00:00:00Z",
  "period_end": "2026-09-16T00:00:00Z",
  "items": [
    { "description": "Renewal: web-1 std.1 (monthly)", "item_type": "plan", "amount_cents": 599 },
    { "description": "Extra IP (monthly)", "item_type": "addon", "amount_cents": 100 }
  ]
}

404Invoice not found or not yours.

example

curl https://api.evorxa.com/api/invoices/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"

announcements

Announcements

Platform notices: new regions, planned maintenance, product changes. Read-only, and safe to poll on a schedule.

GET/announcementsList active announcements

Returns up to 10 currently active announcements ordered by sort order, then newest first. Arabic fields are null when no translation was provided; body is null when there is no long-form text.

responses

200Active announcements

[
  {
    "id": 3,
    "title": "New region online",
    "title_ar": "منطقة جديدة متاحة",
    "excerpt": "Deploy servers in our newest location starting today.",
    "excerpt_ar": "انشر خوادمك في أحدث مواقعنا ابتداءً من اليوم.",
    "body": "Full details about the new region...",
    "body_ar": null,
    "image_url": "https://cdn.example.com/announcements/region.png",
    "created_at": "2026-07-20T10:00:00Z"
  }
]

example

curl https://api.evorxa.com/api/announcements \
  -H "Authorization: Bearer $EVORXA_TOKEN"

catalog

Catalog

What you can buy. Public read-only catalog (no auth) plus an authenticated /me view.

GET/catalog/plansPublic plans (no auth)
Query parameters
name type description
currency string Optional. USD (default), SAR, or EGP. Converts prices using the latest stored rate.
responses
- 200Plan categories with per-cycle pricing in the requested currency.
example
```
curl https://api.evorxa.com/api/catalog/plans \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

GET/catalog/regionsPublic regions (no auth)

responses

200Region codes, names, flags.

example

curl https://api.evorxa.com/api/catalog/regions \
  -H "Authorization: Bearer $EVORXA_TOKEN"

GET/catalog/billing-cyclesPublic billing cycles (no auth)
responses
- 200Monthly, 6-month, yearly + their cycle discounts.
example
```
curl https://api.evorxa.com/api/catalog/billing-cycles \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/catalog/exchange-ratesPublic USD-based FX rates (no auth)
responses
- 200Rates for USD, SAR, EGP plus the fetched_at timestamp. Refreshed daily from public reference data.
example
```
curl https://api.evorxa.com/api/catalog/exchange-rates \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/me/catalog/plansAuthenticated plans
responses
- 200Same shape as public, with personalised pricing applied.
example
```
curl https://api.evorxa.com/api/me/catalog/plans \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
GET/catalog/os-templates/{packageId}OS templates for a package
required scope
instances:read
Path parameters
name type description
packageIdrequired integer Plan package ID.
responses
- 200OS groups with template variants.
example
```
curl https://api.evorxa.com/api/catalog/os-templates/{packageId} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

GET/catalog/appsPublic one-click applications (no auth)

Applications that can be installed on a new server at creation time. Pass a slug as app_slug to POST /instances, and read the resulting sign-in details from GET /instances/{id}/app. Check min_ram_mb and min_storage_gb against the plan you intend to buy, since an application larger than its plan is refused.

responses

200Available applications.

{
  "apps": [
    {
      "slug": "wordpress",
      "name": "WordPress",
      "tagline": "The website and blogging platform behind most of the web",
      "category": "cms",
      "default_username": "admin",
      "generates_password": true,
      "setup_note": null,
      "license_required_upfront": false,
      "min_ram_mb": 2048,
      "min_storage_gb": 20
    }
  ]
}

example

curl https://api.evorxa.com/api/catalog/apps \
  -H "Authorization: Bearer $EVORXA_TOKEN"

ssh-keys

SSH Keys

Public SSH keys that can be injected at instance build time. Stored once, reused everywhere.

GET/ssh-keysList SSH keys
required scope
instances:read
responses
- 200Your registered keys.
example
```
curl https://api.evorxa.com/api/ssh-keys \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```
POST/ssh-keysAdd an SSH key
required scope
instances:write
Request body
name type description
namerequired string Label.
public_keyrequired string OpenSSH-format public key.
responses
- 201Created.
example
```
curl -X POST https://api.evorxa.com/api/ssh-keys \
  -H "Authorization: Bearer $EVORXA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"","public_key":""}'
```
DELETE/ssh-keys/{id}Delete an SSH key
required scope
instances:write
Path parameters
name type description
idrequired integer Key ID.
responses
- 204Deleted.
example
```
curl -X DELETE https://api.evorxa.com/api/ssh-keys/{id} \
  -H "Authorization: Bearer $EVORXA_TOKEN"
```

integrations

Reselling & integrations

First-party software built on the same API documented above. Open source, installed on your own server, and driven by a personal access token from your account.

How reselling from us works

You sell our servers under your own name. There is no reseller programme, no contract and no minimum: one account and a wallet, and the difference between our price and yours is your margin.

Open an Evorxa account and top up the wallet
You buy from us the same way any customer does: one account, one prepaid wallet. There is no reseller tier to apply for, no minimum commitment and no separate contract — the price you see on the pricing page is the price you pay, and longer billing cycles are discounted the same way.
Mint an API token and install the module for your billing system
Create a personal access token with the scopes the module asks for, then install the WHMCS module or the Paymenter extension below. Both are open source and run on your own server; nothing of ours sits between your store and your customer.
Import the plans and set your markup
The module reads our live catalog — specs, prices and stock — and creates products in your store with the markup and price rounding you choose, in your own currency. Sold-out plans stop being orderable on their own, so you never sell what we cannot build.
Your customer orders; we build the server
When your customer's invoice is paid, the module calls the same public API documented on this page and the server is provisioned on your account in about a minute. Your customer gets a control panel on your service page — power, root access, reverse DNS, usage graphs, DDoS figures, firewall rules, reinstall — carrying your brand. Evorxa is never named to them.
You keep the margin, and the billing stays one-directional
Your customer pays you; you pay us from the wallet. We bill you per server per cycle at catalog price, and your margin is the difference you set at import. Terminate a server and we refund the unused time to your wallet, so a cancellation mid-cycle does not cost you the remainder.
Support is split where it belongs
You support your customer, because they are your customer and you own the relationship. We support you: the account, the API, the infrastructure and the modules. The module's admin page shows your wallet balance, the next renewal, your revenue against our cost, and alerts you before a low wallet can fail a build.

Evorxa Cloud for WHMCS
Resell Evorxa VPS and VDS servers from WHMCS, under your own brand.
A provisioning module and admin addon for WHMCS 8. A client orders a VPS in your store; when the invoice is paid the server is built on your Evorxa account in about a minute, and the client gets a white-label control panel on the service page — power, root password, reverse DNS, usage graphs, DDoS figures, firewall rules and reinstall. Suspensions, terminations with prorated refunds, upgrades and renewals are handled for you. It talks to the same public API documented on this page.
- Automatic provisioning on invoice payment, with suspend, unsuspend, terminate and upgrade
- White-label client panel: power, SSH or RDP access, root password reset, editable rDNS, usage graphs, DDoS stats, firewall rules, reinstall
- OS or one-click app chosen on the order form, for every order form template
- Plan import with your own markup and price rounding, plus hourly stock sync so sold-out plans cannot be ordered
- Admin dashboard with wallet balance, next renewal, revenue against Evorxa cost, activity log and low-wallet alerts
- English and Arabic (RTL), and the module only ever touches the servers it created
install
```
curl -fsSL https://raw.githubusercontent.com/ScaleBit-Technologies/evorxa-whmcs/master/install.sh | bash -s -- /path/to/whmcs
```
required scopes
instances:readinstances:writeanalytics:readshield:readshield:writewallet:read
RequirementsWHMCS 8.0+ · PHP 7.4 – 8.3 with cURL · WHMCS cron every 5 minutes
LicenseMIT
Source on GitHub Download the latest release Installation guide
Evorxa Cloud for Paymenter
Resell Evorxa VPS and VDS servers from Paymenter, under your own brand.
A server extension for Paymenter 1.x. The client picks an operating system or a one-click app at checkout; when the invoice is paid the server is built on your Evorxa account in about a minute, and a Server view appears on the service page in your own theme colours — power, root password, reverse DNS, usage graphs, DDoS figures, firewall rules and reinstall. Suspensions, terminations with prorated refunds, upgrades and renewals are handled for you. Install it by uploading a zip in Admin › Extensions, with no SSH required.
- Upload the zip in Admin › Extensions, or install over SSH with one command
- Automatic provisioning on invoice payment, with suspend, unsuspend, terminate and upgrade
- Client Server view in your theme's light and dark colours: power, SSH or RDP access, root password reset, editable rDNS, usage graphs, DDoS stats, firewall rules, reinstall
- OS or one-click app chosen at checkout, kept when the billing cycle changes
- Plan import with your own markup and .99 rounding in every currency, with upgrade paths, and live Evorxa stock
- Admin page with wallet balance, next renewal, revenue against Evorxa cost, activity log and low-wallet alerts
- English and Arabic (RTL), and the extension only ever touches the servers it created
install
```
curl -fsSL https://raw.githubusercontent.com/ScaleBit-Technologies/evorxa-paymenter/master/install.sh | bash -s -- /var/www/paymenter
```
required scopes
instances:readinstances:writeanalytics:readshield:readshield:writewallet:read
RequirementsPaymenter 1.x · PHP 8.3+ with cURL · schedule:run every minute and a running queue worker
LicenseMIT
Source on GitHub Download the latest release Installation guide

name	type	description
`default_in`	`string`	"allow" or "block".
`default_out`	`string`	"allow" or "block".

name	type	description
`page`	`integer`	Page number. Default 1.
`per_page`	`integer`	Rows per page. Default 20, maximum 100.

name	type	description
`status`	`string`	Optional filter: "unpaid", "paid", or "cancelled".
`page`	`integer`	Page number, 20 invoices per page.

name	type	description
`name`required	`string`	Label.
`public_key`required	`string`	OpenSSH-format public key.

The whole surface, documented.

Authentication

Team

Instances

DDoS Protection

AI Agent

Shield · Firewall & Visibility

Web Application Firewall

Wallet & Billing

Announcements

Catalog

SSH Keys

Reselling & integrations

How reselling from us works

Open an Evorxa account and top up the wallet

Mint an API token and install the module for your billing system

Import the plans and set your markup

Your customer orders; we build the server

You keep the margin, and the billing stays one-directional

Support is split where it belongs

Evorxa Cloud for WHMCS

Evorxa Cloud for Paymenter