REST API

Get a token with an email and password:

curl -X POST https://turtleguard.cloud/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@example.com","password":"…","captcha_token":"…"}'

The response carries access_token and refresh_token. Use the first one for further calls:

curl https://turtleguard.cloud/api/v1/auth/me \
  -H 'Authorization: Bearer <access_token>'

When the access token expires (about an hour by default), renew it with POST /auth/refresh and the refresh token.

• GET /api/v1/plans — the list of plans.
• GET /api/v1/addons — the add-on catalogue (DNS proxy, CDN).
• GET /api/v1/status — system state and recent incidents. This is what the status page reads.
• POST /api/v1/auth/register, /auth/login, /auth/forgot-password, /auth/reset-password — sign-up and sign-in.
• POST /api/v1/contact — the contact form on the site.

Account

• GET /auth/me — the current user and the active subscription.
• POST /auth/2fa/setup → /auth/2fa/enable → /auth/2fa/disable — one-time codes.
• POST /auth/change-password.

Subscriptions and billing

• GET /subscriptions — every subscription of the current user, with its domain.
• POST /billing/order — order a service. With trial: true it creates a trial subscription without a charge (once per account).
• POST /billing/top-up — top up the balance.

Add-ons

• GET /subscriptions/{subId}/addons — purchased add-ons and entitlements.
• POST /subscriptions/{subId}/addons {key, auto_renew} — switch one on. It charges monthly_price to the balance and answers HTTP 402 when there is not enough money.
• DELETE /subscriptions/{subId}/addons/{key} — switch it off.

Domains

• GET /domains — your domains with the inspection / CDN / DNS flags.
• GET /domains/{id}/service — the domain, its subscription, entitlements and add-ons.
• PATCH /domains/{id}/settings — settings. Answers HTTP 402 if you switch on something the plan does not include.
• POST /domains/{id}/verify-dns — check whether the A record points at us.
• GET /domains/{id}/dns-instructions — the setup instructions for this domain.

DNS manager

• GET /domains/{id}/dns — the zone: name servers, mode, records.
• POST /domains/{id}/dns/records {type, name, content, ttl, priority?, proxied?}
• PATCH /domains/{id}/dns/records/{recordId} — update.
• DELETE /domains/{id}/dns/records/{recordId} — delete.

The proxy flag: proxied: true works only for A / AAAA / CNAME and needs an entitlement (Standart and above, or the dns_proxy add-on). Without it the server answers HTTP 402.

Rules, subdomains, origins, redirects

• GET/POST/DELETE /domains/{id}/rules — inspection rules.
• GET/POST/DELETE /domains/{id}/subdomains
• GET/POST/DELETE /domains/{id}/origins
• GET/POST/DELETE /domains/{id}/redirects

• 200 — success with a body
• 201 — created
• 204 — success with no body (a delete, for example)
• 400 — the body is not valid
• 401 — not signed in, or the token has expired
• 402 — the plan does not include this, or the balance is too low
• 403 — not allowed for this role
• 404 — not found
• 429 — too many requests
• 5xx — our fault

Anonymous calls: 60 per second per address. Authenticated: 600 per second per token. Going over answers 429 with a Retry-After header.

A machine-readable OpenAPI schema will be published at /api/v1/openapi.json once the endpoints settle.