API
Everything the dashboard does, your scripts can do too, with a token from your account page. The API is JSON over HTTPS; the storefront is its first client.
Authentication
Send the token as a bearer token. Make tokens under Account.
curl -H "Authorization: Bearer <token>" \
-H "Accept: application/json" \
https://api.crocoit.com/api/v1/serversA read-only token can only GET. A manage token can also power, reinstall, back up, order and open tickets — what you can do from the dashboard. Account settings (password, two-factor, team, tokens) are never reachable with a token.
If you were added to another customer's account, name it with X-Account to act on it; your role there applies.
curl -H "Authorization: Bearer <token>" -H "X-Account: 42" https://api.crocoit.com/api/v1/servers
Endpoints
Paths are relative to the base above. Responses wrap records in data; lists under /invoices and /tickets are paginated.
| Endpoint | Needs | What it does |
|---|---|---|
GET /servers | Read only | Your servers, with plan, OS, address and status. |
GET /servers/{id} | Read only | One server with live CPU, memory and uptime. |
POST /servers/{id}/power | Read and manage | action: start, shutdown, reboot or stop. |
GET /servers/{id}/stats?timeframe=hour|day|week | Read only | Usage history for charts. |
POST /servers/{id}/reinstall | Read and manage | os_template_id, confirm (the hostname), optional ssh_key_ids. |
GET /servers/{id}/backups | Read only | Backups and snapshots of the server. |
POST /servers/{id}/backups | Read and manage | Take a backup now (backup add-on). |
POST /servers/{id}/snapshots | Read and manage | name, optional description. |
GET /servers/{id}/firewall | Read only | The firewall switch and rules. |
PUT /servers/{id}/firewall | Read and manage | enabled and the full list of rules; replaces what was there. |
GET /invoices | Read only | Your invoices, newest first. |
GET /invoices/{number}/pdf | Read only | The invoice as PDF (locale=ar|en). |
POST /orders | Read and manage | plan, os_template_id, billing_cycle, hostname, addons, optional coupon and ssh_key_ids. |
GET /tickets | Read only | Your support tickets. |
POST /tickets | Read and manage | subject, message, optional priority and server_id. |
Conventions
- Money is an integer in minor units (piastres). currency says which.
- Validation errors are 422 with an errors object keyed by field; 403 means your role or token cannot do that; 409 means the server is not in a state for it.
- Send X-Locale: ar or en for messages in that language.
- Requests are rate-limited per token; destructive calls more tightly. Back off on 429.