Skip to content
Core Cloud cloud.core.gen.tr
0 Your cart

For developers

C2 Cloud API

Everything your machines, volumes, networks, DNS and subscriptions can be asked or told over HTTP. This page is generated from the same description a client generator reads, so it cannot say something the API does not do.

Base URL
https://cloud.core.gen.tr/api/v1
Version
1.0.0
Operations
414
On this page

01 Overview

What this API is

The customer API for the cloud at https://cloud.core.gen.tr.

Authenticate with a personal access token, created under Settings → API Tokens in your account, sent as Authorization: Bearer <token>.

Every token carries a set of abilities. A request whose token lacks the ability an endpoint requires is rejected with 403, regardless of what the token's owner is otherwise allowed to do.

Errors are RFC 9457 problem details with the media type application/problem+json.

The description this page is generated from is published as well, so you can generate a client rather than write one: OpenAPI, as YAML · OpenAPI, as JSON

Use it from an assistant

Everything below is HTTP, for a program you write. If what you want instead is to ask an assistant in your own words — Claude Code, Claude Desktop, or the assistant already in your account — the same cloud is reachable over the Model Context Protocol, with the same tokens and the same checks.

Use it from Claude

02 Authentication

A token, and what it may reach

Create a personal access token in your account under Settings → API Tokens, and send it on every request:

curl 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

A token reaches the smaller of two things

An ability says what the token was created to do. Your account capability says what you are still allowed to do today. Every request is checked against both, so a token can never grant its holder something their account does not already permit — and a member whose access was narrowed after they created a token cannot keep working at the old level through it.

Either refusal answers 403, with the reason in the problem document's detail. Ask GET /me for the abilities the presented token actually carries rather than probing endpoints and collecting refusals.

The abilities a token may carry

Ability What it permits Account capability Endpoints it opens
cloud:read Read your cloud — instances, volumes and their snapshots, ISOs, templates, firewall rules, public IP addresses, VPN and affinity groups, the offerings behind them, and your usage records. Also reveals an instance's saved password. cloud: view GET /affinity-groups GET /compute-offerings GET /disk-offerings GET /egress-rules GET /ingress-rules GET /instances GET /instances/{instance} GET /instances/{instance}/annotations GET /instances/{instance}/events GET /instances/{instance}/networks GET /instances/{instance}/password GET /instances/{instance}/schedules GET /instances/{instance}/vm-snapshots GET /isos GET /isos/{iso} GET /networks GET /networks/{network} GET /public-ip-addresses GET /public-ip-addresses/{publicIPAddress} GET /public-ip-addresses/{publicIPAddress}/move-plan GET /templates GET /templates/{template} GET /usage GET /volumes GET /volumes/{volume} GET /volumes/{volume}/snapshot-policies GET /volumes/{volume}/snapshots GET /volumes/{volume}/snapshots/{snapshot} GET /vpn GET /vpn/users
cloud:write Start, stop, restart and rename your machines, reset a password, open a console, attach and detach ISOs and volumes, take disk snapshots, and manage firewall rules, VPN users and affinity groups. cloud: manage POST /affinity-groups DELETE /affinity-groups/{affinityGroup} PATCH /affinity-groups/{affinityGroup} POST /egress-rules DELETE /egress-rules/{egressRule} POST /ingress-rules DELETE /ingress-rules/{ingressRule} PATCH /ingress-rules/{ingressRule} PATCH /instances/{instance} POST /instances/{instance}/actions/attach-iso POST /instances/{instance}/actions/detach-iso POST /instances/{instance}/actions/reset-password POST /instances/{instance}/actions/restart POST /instances/{instance}/actions/start POST /instances/{instance}/actions/stop POST /instances/{instance}/annotations DELETE /instances/{instance}/annotations/{annotation} GET /instances/{instance}/console POST /instances/{instance}/networks/{network}/actions/attach POST /instances/{instance}/networks/{network}/actions/change-ip POST /instances/{instance}/networks/{network}/actions/detach POST /instances/{instance}/networks/{network}/actions/make-primary POST /instances/{instance}/networks/{network}/actions/move POST /instances/{instance}/schedules DELETE /instances/{instance}/schedules/{schedule} PATCH /instances/{instance}/schedules/{schedule} POST /instances/{instance}/vm-snapshots DELETE /instances/{instance}/vm-snapshots/{vmSnapshot} POST /instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert POST /isos/uploads DELETE /isos/uploads/{upload} GET /isos/uploads/{upload} POST /isos/uploads/{upload}/actions/complete POST /isos/uploads/{upload}/chunks DELETE /isos/{iso} PATCH /isos/{iso} DELETE /networks/{network} PATCH /networks/{network} POST /public-ip-addresses/{publicIPAddress}/actions/move PATCH /volumes/{volume} POST /volumes/{volume}/actions/attach POST /volumes/{volume}/actions/detach POST /volumes/{volume}/snapshot-policies POST /volumes/{volume}/snapshots DELETE /volumes/{volume}/snapshots/{snapshot} POST /volumes/{volume}/snapshots/{snapshot}/actions/restore PATCH /vpn POST /vpn/users DELETE /vpn/users/{vpnUser}
dns:read Read your DNS zones and every record in them. dns: view GET /dns-zones GET /dns-zones/{zone} GET /dns-zones/{zone}/records
dns:write Create and delete DNS zones, add, change and remove records, and set the reverse DNS record of a public IP address. dns: manage POST /dns-zones DELETE /dns-zones/{zone} POST /dns-zones/{zone}/records DELETE /dns-zones/{zone}/records/{record} PATCH /dns-zones/{zone}/records/{record} PATCH /public-ip-addresses/{publicIPAddress}
billing:read Read your subscriptions, orders, payments, refunds, saved cards, account balance and the product catalogue. billing: view GET /billing/account GET /billing/credits GET /credit-cards GET /domain-name-products GET /domain-name-products/{domainNameProduct} GET /ip-address-products GET /ip-address-products/{ipAddressProduct} GET /network-products GET /network-products/{networkProduct} GET /payments GET /payments/{payment} GET /payments/{payment}/invoice GET /payments/{payment}/proforma GET /refunds GET /service-products GET /service-products/{serviceProduct} GET /subscriptions GET /subscriptions/{subscription} GET /subscriptions/{subscription}/resize-quote GET /virtual-machine-products GET /virtual-machine-products/{virtualMachineProduct} GET /volume-products GET /volume-products/{volumeProduct}
billing:write Pay an open bill with a saved card, ask for a refund inside the refund window, confirm that your company's invoice may be cancelled, and delete a saved card. Paying charges the card with no further confirmation; a card that needs 3-D Secure is sent back to the browser. A card is added only on the website. billing: manage PATCH /billing/pay-day DELETE /credit-cards/{creditCard} POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm POST /payments/{payment}/actions/pay POST /subscriptions/{subscription}/actions/refund
order:write Places orders, resizes and cancels subscriptions. Ordering and resizing spend money — they are carried out with no further confirmation, and a bill left owing is paid on the Billing page or with billing:write. Grant it only to a client you trust with your money. shop: manage POST /orders POST /subscriptions/{subscription}/actions/cancel POST /subscriptions/{subscription}/actions/cancel-resize POST /subscriptions/{subscription}/actions/resize
account:read Read your own profile, contact details and the abilities of the token being used. account: view GET /account/billing-information GET /activity-log GET /me GET /me/settings
account:write Change your own profile, your notification settings and the account's billing information. account: manage PATCH /account/billing-information PATCH /me PATCH /me/settings
tickets:read Read your support tickets and the replies on them. tickets: view GET /tickets GET /tickets/{ticket}
tickets:write Open support tickets, reply to them and close them — each is sent to our support staff in your name. tickets: manage POST /tickets POST /tickets/{ticket}/actions/close POST /tickets/{ticket}/comments
ai:read Read your AI gateway keys, the limits our staff set on them and what they have spent. ai: view GET /ai/keys GET /ai/usage
ai:write Create an AI gateway key, whose secret is shown once, and revoke one. The limits on the keys are set by our staff and cannot be changed here. ai: manage POST /ai/keys DELETE /ai/keys/{aiKey}
admin:read admin Read any customer's account, their machines, DNS zones, subscriptions and the audit records. Also requires the admin role — a token never grants authority its owner lacks. — GET /admin/accounts GET /admin/accounts/{accountId} GET /admin/ai-conversations GET /admin/ai-conversations/public/{sessionId} GET /admin/ai-conversations/{conversationId} GET /admin/ai-gateway/models GET /admin/ai/prompts GET /admin/audit-logs GET /admin/audit-logs/search GET /admin/audit-logs/{auditLog} GET /admin/blog/front-page GET /admin/blog/posts GET /admin/carts GET /admin/carts/{cart} GET /admin/catalogue GET /admin/catalogue/building-blocks GET /admin/chargebacks GET /admin/cloud-scans GET /admin/coupons GET /admin/coupons/{coupon} GET /admin/customers GET /admin/customers/{user} GET /admin/customers/{user}/account GET /admin/customers/{user}/dns-zones GET /admin/customers/{user}/firewall-rules GET /admin/customers/{user}/instances GET /admin/customers/{user}/isos GET /admin/customers/{user}/isos/uploads/{upload} GET /admin/customers/{user}/snapshots GET /admin/customers/{user}/subscriptions GET /admin/dns-records GET /admin/dns-zones GET /admin/domain-prices GET /admin/dunning-preview GET /admin/exchange-rates GET /admin/failed-jobs GET /admin/failed-jobs/{failedJob} GET /admin/failed-payments GET /admin/faqs GET /admin/faqs/{faq} GET /admin/health GET /admin/horizon GET /admin/instances GET /admin/instances/{instance} GET /admin/invitations GET /admin/invoice-cancellations GET /admin/invoice-worklist GET /admin/jobs GET /admin/join-requests GET /admin/legal-documents GET /admin/legal-documents/{legalDocument} GET /admin/legal-documents/{legalDocument}/compare GET /admin/legal-documents/{legalDocument}/revisions GET /admin/networks GET /admin/news GET /admin/news/{news} GET /admin/partner-applications GET /admin/partner-rebates GET /admin/partner-setoffs GET /admin/partner-statements GET /admin/payments GET /admin/payments/{payment} GET /admin/price-notices GET /admin/privacy-requests GET /admin/product-prices GET /admin/public-ip-addresses GET /admin/referral-rewards GET /admin/refunds GET /admin/renewal-preview GET /admin/retained-resources GET /admin/roles GET /admin/screenshots GET /admin/seller-identity GET /admin/settings GET /admin/snapshots GET /admin/staff-invitations GET /admin/staged-actions GET /admin/staged-actions/{stagedAction} GET /admin/subscriptions GET /admin/subscriptions/{subscription} GET /admin/support-assignments GET /admin/tags GET /admin/tickets GET /admin/tickets/{ticket} GET /admin/usage GET /admin/volumes GET /admin/work-queues
admin:write admin Start, stop and restart any customer's machine and attach or detach an ISO on it, write news, FAQ and legal drafts, answer and assign tickets, and manage invitations, support assignments and retention holds. Publishing, credit grants, lockouts and every other outward act it asks for are only put into the approval queue, where an administrator decides them in the admin area. Also requires the admin role — a token never grants authority its owner lacks. — POST /admin/accounts/{accountId}/ai-limits POST /admin/accounts/{accountId}/bill-notices POST /admin/accounts/{accountId}/block POST /admin/accounts/{accountId}/combine-bills POST /admin/accounts/{accountId}/default-interest POST /admin/accounts/{accountId}/members/invite POST /admin/accounts/{accountId}/members/{member}/capabilities POST /admin/accounts/{accountId}/members/{member}/remove POST /admin/accounts/{accountId}/merge POST /admin/accounts/{accountId}/partner POST /admin/accounts/{accountId}/partner-bank-details POST /admin/accounts/{accountId}/partnership-end POST /admin/accounts/{accountId}/partnership-end/{notice}/outcome POST /admin/accounts/{accountId}/pay-day POST /admin/accounts/{accountId}/quotas POST /admin/ai/prompts POST /admin/audit-logs/verify POST /admin/blog/front-page POST /admin/blog/front-page/arrange POST /admin/blog/front-page/{cmsPostId}/unfeature POST /admin/carts/{cart}/clear POST /admin/carts/{cart}/coupon POST /admin/carts/{cart}/lines POST /admin/carts/{cart}/lines/{cartItem} POST /admin/carts/{cart}/lines/{cartItem}/move POST /admin/carts/{cart}/lines/{cartItem}/remove POST /admin/carts/{cart}/partner-code POST /admin/catalogue/translate POST /admin/cloud-scans POST /admin/coupons/{coupon} POST /admin/coupons/{coupon}/attach POST /admin/coupons/{coupon}/detach POST /admin/credit-grants/{creditGrant}/reduce POST /admin/credit-grants/{creditGrant}/remove POST /admin/customers POST /admin/customers/{user}/account/ai-limits POST /admin/customers/{user}/account/bill-notices POST /admin/customers/{user}/account/block POST /admin/customers/{user}/account/default-interest POST /admin/customers/{user}/account/members/invite POST /admin/customers/{user}/account/members/{member}/capabilities POST /admin/customers/{user}/account/members/{member}/remove POST /admin/customers/{user}/account/merge POST /admin/customers/{user}/account/partner POST /admin/customers/{user}/account/partner-bank-details POST /admin/customers/{user}/account/partnership-end POST /admin/customers/{user}/account/partnership-end/{notice}/outcome POST /admin/customers/{user}/account/pay-day POST /admin/customers/{user}/account/quotas POST /admin/customers/{user}/billing-info POST /admin/customers/{user}/delete POST /admin/customers/{user}/dns-records/{record} POST /admin/customers/{user}/dns-records/{record}/delete POST /admin/customers/{user}/dns-zones/{zone}/records POST /admin/customers/{user}/egress-rules POST /admin/customers/{user}/egress-rules/{egressRule}/delete POST /admin/customers/{user}/ingress-rules POST /admin/customers/{user}/ingress-rules/{ingressRule} POST /admin/customers/{user}/ingress-rules/{ingressRule}/delete POST /admin/customers/{user}/instances/{instance}/actions/attach-iso POST /admin/customers/{user}/instances/{instance}/actions/detach-iso POST /admin/customers/{user}/instances/{instance}/actions/restart POST /admin/customers/{user}/instances/{instance}/actions/start POST /admin/customers/{user}/instances/{instance}/actions/stop POST /admin/customers/{user}/instances/{instance}/rename POST /admin/customers/{user}/isos/uploads POST /admin/customers/{user}/isos/uploads/{upload}/abort POST /admin/customers/{user}/isos/uploads/{upload}/chunks POST /admin/customers/{user}/isos/uploads/{upload}/complete POST /admin/customers/{user}/notifications POST /admin/customers/{user}/password-reset POST /admin/customers/{user}/profile POST /admin/customers/{user}/public-ip-addresses/{address}/reverse-dns POST /admin/customers/{user}/retention/purge POST /admin/customers/{user}/snapshots/{snapshot}/delete POST /admin/customers/{user}/snapshots/{snapshot}/restore POST /admin/customers/{user}/tickets POST /admin/customers/{user}/volumes/{volume}/attach POST /admin/customers/{user}/volumes/{volume}/detach POST /admin/customers/{user}/volumes/{volume}/snapshots POST /admin/domain-prices POST /admin/exchange-rates/refresh POST /admin/invoice-cancellations/{invoiceCancellation}/confirm POST /admin/invoice-cancellations/{invoiceCancellation}/decline POST /admin/invoice-cancellations/{invoiceCancellation}/resolve POST /admin/invoice-cancellations/{invoiceCancellation}/retry POST /admin/news POST /admin/news/{news} POST /admin/news/{news}/publish POST /admin/news/{news}/schedule POST /admin/news/{news}/unschedule POST /admin/partner-rebates/{partnerRebate}/document POST /admin/partner-setoffs/{setoff}/return-request POST /admin/partner-setoffs/{setoff}/write-off POST /admin/partners/{partner}/reapplication POST /admin/partners/{partner}/statements POST /admin/payments/{payment}/chargebacks POST /admin/payments/{payment}/default-interest/restore POST /admin/payments/{payment}/default-interest/waive POST /admin/payments/{payment}/invoice POST /admin/payments/{payment}/reminder POST /admin/referrals/{referral}/refusal POST /admin/refunds/{refund}/retry POST /admin/refunds/{refund}/settle POST /admin/retention/networks/{network}/purge POST /admin/retention/{retainedResource}/reinstate POST /admin/roles POST /admin/roles/assignments POST /admin/roles/{role} POST /admin/roles/{role}/delete POST /admin/screenshots/{screenshot} POST /admin/screenshots/{screenshot}/delete POST /admin/screenshots/{screenshot}/publish POST /admin/seller-identity POST /admin/settings POST /admin/staff-invitations POST /admin/staff-invitations/{invitation}/resend POST /admin/staff-invitations/{invitation}/revoke POST /admin/subscriptions/{subscription}/agreed-price POST /admin/subscriptions/{subscription}/agreed-price/release POST /admin/tags POST /admin/tags/{tag} POST /admin/tags/{tag}/delete POST /admin/tickets/{ticket}/assignment POST /admin/tickets/{ticket}/close POST /admin/tickets/{ticket}/comments POST /admin/tickets/{ticket}/priority POST /admin/tickets/{ticket}/unassign POST /admin/token-revocation/break-glass
support:read support Read the accounts, resources and audit records of the customers assigned to you. Also requires the support role, and passes the same per-assignment checks as the support area. — GET /support/customers GET /support/customers/{user} GET /support/customers/{user}/audit-logs GET /support/customers/{user}/dns-zones GET /support/customers/{user}/instances GET /support/customers/{user}/subscriptions GET /support/customers/{user}/subscriptions/{subscription}/resize-quote GET /support/staged-actions/{stagedAction}
support:write support Act on the customers assigned to you as the support area does — their machines, networks, VPN, snapshots, DNS, tickets, profile, billing information and members, and the billing acts support may take — each only where your assignment lets you manage. Account credit is only asked for: an administrator approves it. Also requires the support role. — POST /support/customers/{user}/billing-information POST /support/customers/{user}/billing/bill-notices POST /support/customers/{user}/billing/pay-day POST /support/customers/{user}/billing/refunds-block POST /support/customers/{user}/billing/shop-block POST /support/customers/{user}/credits POST /support/customers/{user}/credits/{creditGrant}/actions/adjust POST /support/customers/{user}/credits/{creditGrant}/actions/remove POST /support/customers/{user}/dns-zones POST /support/customers/{user}/dns-zones/{zone}/actions/delete POST /support/customers/{user}/dns-zones/{zone}/records POST /support/customers/{user}/dns-zones/{zone}/records/{record} POST /support/customers/{user}/dns-zones/{zone}/records/{record}/actions/delete POST /support/customers/{user}/instances/{instance}/actions/rename POST /support/customers/{user}/instances/{instance}/actions/restart POST /support/customers/{user}/instances/{instance}/actions/start POST /support/customers/{user}/instances/{instance}/actions/stop GET /support/customers/{user}/instances/{instance}/console POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/attach POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/change-ip POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/detach POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/make-primary POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/move POST /support/customers/{user}/instances/{instance}/vm-snapshots POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/delete POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/confirm POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/decline POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/resolve POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/retry POST /support/customers/{user}/members/{member} POST /support/customers/{user}/members/{member}/actions/remove POST /support/customers/{user}/networks/{network}/actions/release POST /support/customers/{user}/password POST /support/customers/{user}/payments/{payment}/chargebacks POST /support/customers/{user}/profile POST /support/customers/{user}/public-ip-addresses/{publicIPAddress}/networks/{network}/actions/move POST /support/customers/{user}/social-accounts/{socialAccount}/actions/unlink POST /support/customers/{user}/subscriptions/{subscription}/actions/cancel POST /support/customers/{user}/subscriptions/{subscription}/actions/force-refund POST /support/customers/{user}/subscriptions/{subscription}/actions/lift-suspension POST /support/customers/{user}/subscriptions/{subscription}/actions/lock POST /support/customers/{user}/subscriptions/{subscription}/actions/request-invoice-cancellation POST /support/customers/{user}/subscriptions/{subscription}/actions/unlock POST /support/customers/{user}/subscriptions/{subscription}/actions/unstage-resize POST /support/customers/{user}/tickets/{ticket}/actions/close POST /support/customers/{user}/tickets/{ticket}/comments POST /support/customers/{user}/volumes/{volume}/snapshot-policies POST /support/customers/{user}/volumes/{volume}/snapshots POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/delete POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/restore POST /support/customers/{user}/vpn POST /support/customers/{user}/vpn/users POST /support/customers/{user}/vpn/users/{vpnUser}/actions/delete

03 Conventions

The things every endpoint does the same way

Requests and responses

Send JSON and ask for JSON. A single resource comes back under a data key; a collection comes back under data with meta and links beside it. Every write requires the email address on the account to be verified, exactly as the website does.

Pagination

Collections take page and per_page. per_page defaults to 25 and anything above 100 is reduced to 100. meta carries the totals and links carries the neighbouring pages.

Rate limits

Budgets are counted per token, not per account, so one scripted integration cannot starve another. Reads are 120 a minute, writes 60, staff reads of another customer 30, ordering 5, and a reconciling read (refresh=true) 10 — that last one reaches the cloud itself, so it must not be used for polling.

Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, the last of these in seconds. A refusal is 429 with Retry-After.

Retrying safely

Ordering requires an Idempotency-Key header you choose. The key is claimed before the order runs, so a retry that arrives while the first attempt is still going gets 409 rather than a second charge, and a repeat of a finished request replays the first response instead of ordering again.

Errors

One error shape for the whole API — RFC 9457 problem details, served as application/problem+json — so nothing has to branch on which of two formats came back. Branch on type, which is one stable URI per status code. Server-side failures never carry internal detail in production.

Field Type Description
type string A stable URI identifying the error class. One per status code.
title string A short, fixed summary of the error class — the same text for every occurrence of one `type`, so it is safe to show or to match on. `detail` carries what went wrong this time.
status integer The HTTP status code, repeated in the body.
detail string A human-readable explanation for this specific occurrence. For 5xx responses this is a fixed, non-specific string in production — internal detail is logged, never served.
instance string The path of the request that failed.
errors Optional object Present only on 422. Field name to list of messages.
{
    "type": "https://cloud.core.gen.tr/api/errors/validation-failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "The name field is required.",
    "instance": "/api/v1/me"
}

Operations

Identity

Who the presented token belongs to.

GET /me #

The identity behind the presented token

account:read api.read

Returns the authenticated user together with the abilities carried by the token used for this request. Call this to discover what a token may do instead of probing endpoints and collecting 403s.

Responses

  • 200 The authenticated user.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /activity-log #

Read your activity log

account:read api.read

Every audit record about you, newest first — the website's Activity log. The integrity chain, the recorded changes and the request context are never published.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
domain Optional query string one of cloud, billing, dns, tickets, account, auth, shop, privacy, partner, system

Responses

  • 200 A page of audit records.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/activity-log' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Account

Your own profile and notification settings, and the account's billing information — account:read to read, account:write to change. Passwords, sign-in methods, the two security switches and the licence agreement stay on the website.

PATCH /me #

Change your own profile

account:write api.read api.write

The profile form on the website, field for field and with the same rules: your full name, birth date, identity number (or, for a customer whose language is not Turkish, the placeholder 22222222222 and a passport number), phone number and language. The identity document is judged by YOUR language, as the website does. A Turkish identity number is checked against the population register where the installation does so, and a refusal is a 422 on identity_number. Identity documents are never returned.

Requires account:write, whose owner must hold account: manage — stricter than the website, where every member edits their own profile.

Request body Required

Field Type Description
name Required string Your full name — at least two words.
birthdate Required string Your date of birth; you must be at least 18.
identity_number Required string Your T.C. identity number, or `22222222222` with a passport number.
passport_number Optional string Your passport number — required while your language is not Turkish and none is on file.
phone Required string Your phone number in international form, starting with `+`.
language Required string The language you read the website and your notices in.

Responses

  • 200 Your profile, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Ayşe Yılmaz",
    "birthdate": "string",
    "identity_number": "string",
    "phone": "+90 532 000 00 00",
    "language": "tr-TR"
}'
GET /me/settings #

Your notification settings

account:read api.read

Your own notification switches, and the two security switches that are changed only on the website.

Responses

  • 200 Your settings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/me/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /me/settings #

Change your notification settings

account:write api.read api.write

Turns notifications by e-mail and by phone on or off; a field you leave out keeps its value. The Telegram two-factor switch and the API-token revocation switch are not accepted here — each has its own proven door on the website, and a token is exactly the credential a stolen session would use to weaken them. Every change is audited.

Request body Required

Field Type Description
enable_email_notifications Optional boolean Notifications by e-mail.
enable_phone_notifications Optional boolean Notifications by phone (Telegram).

Responses

  • 200 Your settings, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/me/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "enable_email_notifications": true,
    "enable_phone_notifications": true
}'
GET /account/billing-information #

The account's billing information

account:read api.read

What every invoice and proforma of the account is issued to, and the currency its bills are charged in.

Responses

  • 200 The billing information.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/account/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /account/billing-information #

Change the account's billing information

account:write api.read api.write

The billing form on the website, with the same rules. corporate: true makes the company name and tax number required, and the tax office too when the billing country is Türkiye; a company billed anywhere else enters its own tax ID and needs no tax office. A partner account stays corporate whatever corporate says: a body that would leave it without a company name and a tax number is refused with a 422 on corporate. The country decides the currency bills are charged in (Türkiye: TL, anywhere else: USD), so a change that would move the currency while bills are still open is refused with a 422 on country — settle them first. The invoicing name is always the account owner's.

Requires account:write, whose owner must hold account: manage — the same gate as on the website.

Request body Required

Field Type Description
corporate Optional boolean A corporate invoice. Absent or false is a personal one — except on a partner account, which stays corporate whatever this says.
company_name Optional string The company's name; required for a corporate invoice.
tax_number Optional string The company's tax number; required for a corporate invoice. Digits when the billing country is Türkiye; anywhere else the company's own tax ID — letters, digits, spaces, hyphens and dots, up to 32, stored trimmed and upper-cased.
tax_office Optional string The company's tax office; required for a corporate invoice billed to Türkiye, optional anywhere else.
trade_registry_office Optional string The trade registry office, or the registering authority abroad. Optional, except that a partner's cannot be removed. Absent is unchanged.
trade_registry_number Optional string The trade registry number. Optional, except that a partner's cannot be removed. Absent is unchanged.
address Required string The street address.
city Required string The city.
state Optional string The state, province or region — optional. Absent keeps the one on file; an empty value clears it. Outside Türkiye a domain name is registered with it, by the name or code the domain registry knows for the country.
postal_code Required string The postal code.
country Required string The billing country — an ISO 3166 code (`TR`, `792`) or its name.
incorporation_country Optional string The country of incorporation, in the same shapes as `country`; empty means the billing country. Absent is unchanged.

Responses

  • 200 The billing information, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/account/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "address": "string",
    "city": "string",
    "postal_code": "string",
    "country": "TR"
}'

Operations

AI gateway

The account's keys to the AI gateway — list them and what they have spent (ai:read), create one and revoke one (ai:write). The limits on the keys are set by our staff. Every route answers 403 while the gateway is switched off.

GET /ai/keys #

List the account's AI gateway keys

ai:read api.read

Every key on the account, live and revoked, newest first — never a secret. meta carries the account's key cap, how many keys are live, and the gateway address your code points at. While the AI gateway is switched off for the installation, every route here answers 403.

Responses

  • 200 The keys.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ai/keys' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /ai/keys #

Create an AI gateway key

ai:write api.read api.order

Mints a key against the account's gateway budget and answers 201 with its secret. The secret is in this response only — it is stored nowhere, and a lost secret is replaced by creating a new key. The key counts against the account's max_keys; at the cap, or while another key is being created for the account, or while the login or the account is barred, the request is refused with 409 and nothing is created. The limits that bind the key (budget, requests and tokens per minute, allowed models) are set by our staff and cannot be changed here. Every key created is audited.

Request body Required

Field Type Description
name Required string Your label for the key — how you will tell it apart when one has to be revoked.
expires_at Optional string When the key stops working on its own; in the future. Omit for never.

Responses

  • 201 The key, with its secret — shown this once.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 At the key cap, another key is being created, or the login or account is barred. Nothing was created.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/ai/keys' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "ci runner"
}'
DELETE /ai/keys/{aiKey} #

Revoke an AI gateway key

ai:write api.read api.write

Tells the gateway to stop honouring the key, then records the revocation — never the other way round, so a key shown as revoked is really dead. Any member who may manage the account's AI keys may revoke one a colleague created. Idempotent: revoking a key that is already revoked answers 200 with it. A key of another account is 404.

Parameters

Name In Type Description
aiKey Required path integer The key's id.

Responses

  • 200 The key, revoked.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/ai/keys/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ai/usage #

The AI gateway limits and spend

ai:read api.read

The limits our staff set on the account's gateway team — the budget, requests and tokens per minute, and the models the keys may call — and what the team has spent, live from the gateway. The limits are read-only here: the website offers no door to change them either. When the gateway does not answer, the limits still read and spend.error says why the figure is missing. Both are null before the account's first key.

Responses

  • 200 The limits and the spend.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ai/usage' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Compute

Virtual machines.

GET /instances #

List virtual machines

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance} #

Read one virtual machine

cloud:read api.read

There is no DELETE for a machine, on purpose: a machine is a paid subscription, and it is removed by cancelling that subscription — POST /subscriptions/{subscription}/actions/cancel, whose id is this machine's subscription in GET /subscriptions. Cancelling stops billing and hands the machine to the retention queue, the same path the website's Cancel takes.

Parameters

Name In Type Description
instance Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The virtual machine.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /instances/{instance} #

Rename a virtual machine

cloud:write api.read api.write

The only mutable attribute. Resizing is a billing event (POST /orders), and lifecycle changes are actions.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
name Required string

Responses

  • 200 The updated virtual machine.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/instances/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
GET /instances/{instance}/networks #

List a machine's networks

cloud:read api.read

The networks this machine is on — its interfaces, read live from the cloud — and the caller's networks it could join. Nothing is reconciled: an interface on a network no stored row names yet answers id: null. Read-only; writes nothing and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The machine's networks.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/networks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/vm-snapshots #

List a machine's live snapshots

cloud:read api.read

Whole-machine copies, for a machine whose plan takes them. Database-backed; pass refresh=true to reconcile against the cloud first (tighter limit, and it deletes local rows the cloud no longer lists). Copies waiting in the retention queue are not listed.

Parameters

Name In Type Description
instance Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of live snapshots.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/vm-snapshots #

Take a live snapshot of a machine

cloud:write api.read api.write

Starts a whole-machine copy (with its memory when with_memory is true). Refused with 409 while live snapshots are switched off, when the machine's plan takes none or its allowance is used, or while the machine is being resized.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
name Required string
description Optional string
with_memory Optional boolean

Responses

  • 201 The snapshot, being taken.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
DELETE /instances/{instance}/vm-snapshots/{vmSnapshot} #

Delete a live snapshot

cloud:write api.read api.write

Deletes the copy in the cloud. It cannot be undone. A copy still being taken is 409.

Parameters

Name In Type Description
instance Required path integer
vmSnapshot Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert #

Put a machine back on a live snapshot

cloud:write api.read api.write

Puts the machine back on this copy, IN PLACE — everything since is lost. The machine must be stopped. A copy with memory is refused while a refund request holds the machine. Each refusal is a 409 saying why.

Parameters

Name In Type Description
instance Required path integer
vmSnapshot Required path integer

Responses

  • 200 The machine after the revert.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots/1/actions/revert' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/schedules #

List a machine's power schedules

cloud:read api.read

The machine's start, stop and reboot schedules, as stored. paused_by names the hold (suspension, retention) that switched a start schedule off.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The schedules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/schedules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/schedules #

Add a power schedule

cloud:write api.read api.write

A cron schedule the cloud runs by itself. A suspended machine cannot be given one; a START schedule is refused with 409 while a refund request holds the machine.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
action Required string
name Optional string
description Optional string
cron_expression Required string
timezone Required string
enabled Optional boolean
start_at Optional string
end_at Optional string

Responses

  • 201 The schedule.
  • 202 Created, not yet listed by the cloud.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/schedules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "action": "start",
    "cron_expression": "0 8 * * 1-5",
    "timezone": "Europe/Istanbul"
}'
PATCH /instances/{instance}/schedules/{schedule} #

Edit or toggle a power schedule

cloud:write api.read api.write

Changes the schedule; send enabled to switch it on or off. Switching a START schedule on is a start, so it is refused on a suspended machine and, with 409, while a refund request holds it. An explicit switch clears paused_by.

Parameters

Name In Type Description
instance Required path integer
schedule Required path integer

Request body Required

Field Type Description
name Optional string
description Optional string
cron_expression Required string
timezone Required string
enabled Optional boolean
start_at Optional string
end_at Optional string

Responses

  • 200 The schedule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/instances/1/schedules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "cron_expression": "0 8 * * 1-5",
    "timezone": "Europe/Istanbul"
}'
DELETE /instances/{instance}/schedules/{schedule} #

Delete a power schedule

cloud:write api.read api.write

Deletes the schedule in the cloud and here.

Parameters

Name In Type Description
instance Required path integer
schedule Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/schedules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/annotations #

List a machine's notes

cloud:read api.read

Notes kept on the machine, read live from the cloud. Writes and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The notes.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/annotations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/annotations #

Add a note to a machine

cloud:write api.read api.write

Adds a note to the machine.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
annotation Required string

Responses

  • 201 The note.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/annotations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "annotation": "string"
}'
DELETE /instances/{instance}/annotations/{annotation} #

Delete a note

cloud:write api.read api.write

Deletes one of this machine's notes; a note on another machine is a 404.

Parameters

Name In Type Description
instance Required path integer
annotation Required path string

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/annotations/annotation' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/events #

List a machine's events

cloud:read api.read

What happened to the machine — starts, stops, restores — read live from the cloud's event log. Writes and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The events.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/events' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/attach #

Put a machine on another network

cloud:write api.read api.write

Adds {network} to the machine as an ADDITIONAL network, leaving the networks it is on in place — the website's Attach. Both the machine and the network must be the caller's (another account's is a 404). A locked machine, or a refusal by the cloud, is a 409 whose detail says why.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/detach #

Take a machine off a network

cloud:write api.read api.write

Takes the machine off {network} — the website's Detach. Refused with 409 when it is the machine's only or primary network, or when rules still forward to it there.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/make-primary #

Make a network the machine's primary

cloud:write api.read api.write

Moves the machine's default route to {network}, which it must already be on. The machine is STOPPED to do it and is not started again.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/make-primary' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/move #

Move a machine to another network

cloud:write api.read api.write

Moves the machine OFF from_network_id and ONTO {network} in one step — the website's Move. The machine is stopped to do it. Refused with 409 when the machine cannot leave the network it is on.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Request body Required

Field Type Description
from_network_id Required integer The network the machine leaves (one of `GET /networks`).

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "from_network_id": 1
}'
POST /instances/{instance}/networks/{network}/actions/change-ip #

Change a machine's private address on a network

cloud:write api.read api.write

Gives the machine the private address ip_address on {network}. The machine is stopped to do it. The same address it already has is a 422; an address outside the network or already taken is a 409 saying so.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Request body Required

Field Type Description
ip_address Required string

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/change-ip' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "ip_address": "10.1.1.20"
}'
POST /instances/{instance}/actions/start #

Start a virtual machine

cloud:write api.read api.write

Idempotent: starting an already-running machine returns 200 immediately without contacting the cloud. Terraform and similar tools reconcile desired state rather than issue commands, so asking for a state the machine is already in must never error.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/stop #

Stop a virtual machine

cloud:write api.read api.write

Idempotent: stopping an already-stopped machine returns 200 immediately without contacting the cloud, for the same reason as start.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, stopped (or already stopped).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/restart #

Restart a virtual machine

cloud:write api.read api.write

Not idempotent — unlike start/stop there is no target state to compare against, so this always reaches the cloud regardless of the machine's current state.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, restarted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/reset-password #

Reset a virtual machine's password

cloud:write api.read api.write

NOT idempotent: every call generates and stores a brand new password, replacing whatever was there before. Fetch the result from GET /instances/{instance}/password afterwards, or from this response's data — the password itself is never included here (see Instance).

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, after the password reset.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/reset-password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/password #

Read a virtual machine's password

cloud:read api.read

Database-backed; never contacts the cloud. Returns null rather than 403 when the owning subscription is locked and the caller is not staff — the machine is visible, its password just is not.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine's password.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/console #

Open a virtual machine console session

cloud:write api.read api.write

Mints a fresh, one-time console session in the cloud on every call — an action against the provider, not a database read, which is why it requires cloud:write rather than cloud:read and is subject to the same rate limit as the lifecycle actions.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 A console session URL.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/console' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/attach-iso #

Attach an ISO to a virtual machine

cloud:write api.read api.write

Idempotent: attaching an ISO already mounted on this instance returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
iso_id Required integer Must name an ISO visible to the caller (public, or their own). A foreign private or missing id fails validation (422) rather than 404 — the addressed resource is the instance, not the ISO.

Responses

  • 200 The virtual machine, with the ISO attached (or already attached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/attach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "iso_id": 5
}'
POST /instances/{instance}/actions/detach-iso #

Detach whatever ISO is mounted on a virtual machine

cloud:write api.read api.write

Idempotent: detaching an instance with no ISO attached returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, with its ISO detached (or already detached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/detach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /isos/{iso} #

Rename one of your ISOs

cloud:write api.read api.write

Changes the name, description and bootable flag of an image you uploaded — the website's edit form, all three fields. A public image, or another account's, is refused.

Parameters

Name In Type Description
iso Required path integer

Request body Required

Field Type Description
name Required string
description Required string
bootable Required boolean

Responses

  • 200 The ISO.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "bootable": true
}'
DELETE /isos/{iso} #

Delete one of your ISOs

cloud:write api.read api.write

Deletes an image you uploaded, in the cloud and here. It cannot be undone. A public image, or another account's, is refused.

Parameters

Name In Type Description
iso Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads #

Begin a chunked ISO upload

cloud:write api.read api.write

Opens an upload for an image of size bytes (at most 4 GiB). Send it as parts of chunk_size bytes (16 MiB; the last may be shorter) with POST /isos/uploads/{upload}/chunks, in any order and again after a failure, then POST …/actions/complete. An account may have three uploads open at once; a fourth is a 422. Uploads idle for six hours are removed.

Request body Required

Field Type Description
name Required string
description Required string
bootable Required boolean
filename Required string The file's name; must end in `.iso` or `.img`.
size Required integer

Responses

  • 201 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "bootable": true,
    "filename": "string",
    "size": 1
}'
GET /isos/uploads/{upload} #

Read an open upload

cloud:write api.read

The upload and the part indexes already received, so a client that lost its place sends only what is missing. Another account's upload is a 404.

Parameters

Name In Type Description
upload Required path string

Responses

  • 200 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /isos/uploads/{upload} #

Abort an upload

cloud:write api.read api.write

Gives up the upload and removes its parts now.

Parameters

Name In Type Description
upload Required path string

Responses

  • 204 Aborted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads/{upload}/chunks #

Send one part of an upload

cloud:write api.read api.write

One part, as multipart/form-data: index (from 0) and file. Every part but the last must be exactly chunk_size bytes; a part of the wrong size, or an index outside the upload, is a 422. Sending a part again replaces it.

Parameters

Name In Type Description
upload Required path string

Responses

  • 200 The upload, with this part received.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload/chunks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads/{upload}/actions/complete #

Complete an upload and register the ISO

cloud:write api.read api.write

Assembles the parts and registers the image with the cloud. 201 with the ISO; 202 when the cloud took the image but has not listed it yet — it appears in GET /isos once it does. A missing part is a 422. The upload is gone afterwards either way.

Parameters

Name In Type Description
upload Required path string

Responses

  • 201 The registered ISO.
  • 202 Registered, not yet listed by the cloud.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload/actions/complete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Storage

Volumes and ISOs.

GET /volumes #

List volumes

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of volumes.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volumes/{volume} #

Read one volume

cloud:read api.read

There is no DELETE for a volume, on purpose: an extra disk is a paid subscription, and it is removed by cancelling that subscription — POST /subscriptions/{subscription}/actions/cancel, whose id is this disk's subscription in GET /subscriptions. A machine's root disk goes with the machine.

Parameters

Name In Type Description
volume Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The volume.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /volumes/{volume} #

Rename a volume

cloud:write api.read api.write

The only mutable attribute. Attach/detach are actions, and resizing is a billing event (POST /orders).

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
name Required string

Responses

  • 200 The updated volume.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/volumes/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /volumes/{volume}/actions/attach #

Attach a volume to one of the caller's instances

cloud:write api.read api.write

Idempotent: attaching a volume already attached to the named instance returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
instance_id Required integer Must name an instance the caller owns. A foreign or missing id fails validation (422) rather than 404 — the addressed resource is the volume, not the instance.

Responses

  • 200 The volume, attached (or already attached to the named instance).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instance_id": 17
}'
POST /volumes/{volume}/actions/detach #

Detach a volume from whatever instance it is attached to

cloud:write api.read api.write

Idempotent: detaching an already-detached volume returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
volume Required path integer

Responses

  • 200 The volume, detached (or already detached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volumes/{volume}/snapshots #

List a volume's snapshots

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile the volume's snapshots against the cloud first — that variant is rate-limited far more tightly, must not be used for polling, and deletes local snapshot records the cloud no longer lists. A snapshot moved to the retention queue (after snapshots were dropped from the disk's plan) is not listed.

Parameters

Name In Type Description
volume Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of the volume's snapshots, newest first.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshots #

Take a manual snapshot of a volume

cloud:write api.read api.write

The snapshot is taken in the background: the response carries it in state Creating. A manual snapshot counts against the snapshot limit. 409 when the limit is reached (only manual snapshots count), when the disk's plan includes no snapshots, or while the disk or its machine is being resized; the body's detail says which. A snapshot is deleted with DELETE /volumes/{volume}/snapshots/{snapshot}, restored into a new volume with POST …/{snapshot}/actions/restore, and scheduled with /volumes/{volume}/snapshot-policies.

Parameters

Name In Type Description
volume Required path integer

Request body Optional

Field Type Description
name Optional string An optional label for the snapshot.

Responses

  • 201 The snapshot, requested and being taken.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "before-upgrade"
}'
GET /volumes/{volume}/snapshots/{snapshot} #

Read one snapshot of a volume

cloud:read api.read

Database-backed. A snapshot of another disk, a snapshot held in the retention queue and an id that does not exist all answer 404.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Responses

  • 200 The snapshot.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /volumes/{volume}/snapshots/{snapshot} #

Delete a snapshot

cloud:write api.read api.write

Deletes the snapshot in the cloud, the same act as the website's Delete. It cannot be undone. A snapshot held in the retention queue is not yours to delete and answers 404.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshots/{snapshot}/actions/restore #

Restore a snapshot into a new volume

cloud:write api.read api.write

Creates a NEW volume named name from the snapshot — never an in-place rollback of the disk it was taken from. The new volume counts against max_vols, and one snapshot can be restored a limited number of times; 409 names the limit that was reached, or says that another restore is already starting on the account. The restore runs in the background: the new volume appears in GET /volumes once the cloud reports it, and the response carries the snapshot with its restore_count moved.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Request body Required

Field Type Description
name Required string The new volume's name.

Responses

  • 202 The restore started; the snapshot it started from.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1/actions/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "restored-data"
}'
GET /volumes/{volume}/snapshot-policies #

List a volume's retention schedules

cloud:read api.read

The schedules the cloud keeps for this disk — "keep 7 daily, 4 weekly". The cloud takes each snapshot on schedule and drops the oldest past the count. Database-backed.

Parameters

Name In Type Description
volume Required path integer

Responses

  • 200 The disk's retention schedules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshot-policies #

Add a retention schedule to a volume

cloud:write api.read api.write

The retention form on the website: an interval and how many snapshots to keep. The cloud runs the schedule at an off-peak time in UTC. max_snaps is bounded by the account's snapshot limit — on a machine's boot disk, by the machine's plan — and 409 says so when the plan takes no disk snapshots at all. There is no delete: the website offers none either.

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
interval_type Required string
max_snaps Required integer How many snapshots of this schedule to keep.

Responses

  • 201 The schedule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "interval_type": "HOURLY",
    "max_snaps": 1
}'
GET /isos #

List ISOs

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Includes every ISO visible to the caller: their own, plus every ISO the provider marks public.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of ISOs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /isos/{iso} #

Read one ISO

cloud:read api.read

Visible when public, or when it belongs to the caller. A private ISO belonging to another customer 404s, indistinguishable from one that does not exist.

Parameters

Name In Type Description
iso Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The ISO.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Catalogue

Templates and offerings — the global, sellable product catalogue every instance and volume is built from. Read-only: see each endpoint's description for why reconciliation is never exposed here.

GET /templates #

List templates

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the site already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of templates.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/templates' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /templates/{template} #

Read one template

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the site already knows.

Parameters

Name In Type Description
template Required path integer

Responses

  • 200 The template.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/templates/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /compute-offerings #

List compute offerings

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the site already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of compute offerings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/compute-offerings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /disk-offerings #

List disk offerings

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the site already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of disk offerings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/disk-offerings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Network

Firewall rules, public IP addresses, VPN and affinity groups. See each collection endpoint's description for the reconciling sibling it exists to keep off the request path — network resources are where that reconciliation compounds hardest, since reading firewall rules can also reconcile instances.

GET /ingress-rules #

List ingress firewall rules

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling. It is also the single most destructive read in this API: the reconciling method it calls deletes local firewall rules the provider listing omits, and its create-branch reconciles the caller's instances too, deleting any of those the listing omits as well.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of ingress rules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ingress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /ingress-rules #

Create an ingress firewall rule

cloud:write api.read api.write

Forwards a public IP/port combination to a private port on one of the caller's own instances. public_ip_address must name one of the caller's own stored public IP addresses, and instance_id one of the caller's own instances; either failing to resolve is 422, not 404 — the addressed resource is this collection endpoint.

Request body Required

Field Type Description
public_ip_address Required string
protocol Required string
public_port_start Required integer
public_port_end Required integer Must be greater than or equal to `public_port_start`.
private_port_start Required integer
private_port_end Required integer Must be greater than or equal to `private_port_start`.
instance_id Required integer

Responses

  • 201 The new ingress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/ingress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip_address": "203.0.113.10",
    "protocol": "tcp",
    "public_port_start": 1,
    "public_port_end": 1,
    "private_port_start": 1,
    "private_port_end": 1,
    "instance_id": 17
}'
PATCH /ingress-rules/{ingressRule} #

Retarget an ingress firewall rule

cloud:write api.read api.write

The only mutable attributes: which private ports the rule forwards to, and which of the caller's own instances it forwards to. instance_id must name an instance the caller owns; a foreign or missing id fails validation (422), not 404 — the addressed resource is the rule, already resolved and owned before this request runs.

Parameters

Name In Type Description
ingressRule Required path integer

Request body Required

Field Type Description
private_port_start Required integer
private_port_end Required integer Must be greater than or equal to `private_port_start`.
instance_id Required integer

Responses

  • 200 The updated ingress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/ingress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "private_port_start": 1,
    "private_port_end": 1,
    "instance_id": 17
}'
DELETE /ingress-rules/{ingressRule} #

Delete an ingress firewall rule

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
ingressRule Required path integer

Responses

  • 204 The rule was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/ingress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /egress-rules #

List egress firewall rules

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of egress rules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/egress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /egress-rules #

Create an egress firewall rule

cloud:write api.read api.write

Permits traffic from source_cidr toward destination_cidr. Both must be well-formed CIDR blocks — a malformed CIDR reaching the cloud from a firewall endpoint is a security defect, not a validation nicety.

Request body Required

Field Type Description
source_cidr Required string
destination_cidr Required string
protocol Required string
port_start Required integer
port_end Required integer Must be greater than or equal to `port_start`.

Responses

  • 201 The new egress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/egress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "source_cidr": "10.0.0.0/24",
    "destination_cidr": "0.0.0.0/0",
    "protocol": "tcp",
    "port_start": 1,
    "port_end": 1
}'
DELETE /egress-rules/{egressRule} #

Delete an egress firewall rule

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
egressRule Required path integer

Responses

  • 204 The rule was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/egress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /networks #

List networks

cloud:read api.read

The caller's own isolated networks, the free one first. Database-backed and never reconciled against the provider — there is no refresh parameter, because a reconciling read deletes local rows. Use an id from here as network_id on an order line.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of networks.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/networks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /networks/{network} #

Read a network

cloud:read api.read

One of the caller's networks. Another account's network is a 404, exactly like an id that does not exist.

Parameters

Name In Type Description
network Required path integer

Responses

  • 200 The network.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /networks/{network} #

Name a network

cloud:write api.read api.write

Sets the caller's own name for the network — a label the cloud never sees. null or an empty string clears it back to the generated name.

Parameters

Name In Type Description
network Required path integer

Request body Required

Field Type Description
label Optional string

Responses

  • 200 The network.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "label": "string"
}'
DELETE /networks/{network} #

Release a network

cloud:write api.read api.write

Hands an emptied network back to the cloud, together with the public address it holds. Whether this network may go is decided at the moment of the release: anything still on it — a machine, a bought address, its subscription — refuses it with a 409 saying what. It cannot be undone.

Parameters

Name In Type Description
network Required path integer

Responses

  • 204 Released.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /public-ip-addresses #

List public IP addresses

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling. It deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of public IP addresses.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /public-ip-addresses/{publicIPAddress} #

Read a public IP address

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile the caller's whole set against the provider first, then pick this address out of it — there is no single-address provider lookup — before responding. That variant is rate-limited far more tightly and must not be used for polling, and, like the collection endpoint, deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
publicIPAddress Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The public IP address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /public-ip-addresses/{publicIPAddress} #

Set the reverse DNS record for a public IP address

dns:write api.read api.write

Writes a PTR record on the DNS service and the local row. It changes nothing in the cloud, which is why this requires dns:write rather than cloud:write, but it first checks that the address is still this account's in the cloud's live listing: 422 when it is not, 502 when the listing cannot be read. See DNSUserService::updatePublicIPAddress().

Parameters

Name In Type Description
publicIPAddress Required path integer

Request body Required

Field Type Description
reverse_record Required string A valid DNS hostname.

Responses

  • 200 The updated public IP address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reverse_record": "host.example.com"
}'
POST /public-ip-addresses/{publicIPAddress}/actions/move #

Move a public address to another network

cloud:write api.read api.write

Puts a BOUGHT address on another of the caller's networks. The cloud cannot re-home an address, so this RELEASES it and acquires a new one on the target network: the address changes, and it cannot be undone. Nothing is charged. A network's own source-NAT address, an address with forwarding rules or a VPN on it, and a target network with nothing running yet are each refused with a 409 saying so.

Parameters

Name In Type Description
publicIPAddress Required path integer

Request body Required

Field Type Description
network_id Required integer The target network (one of `GET /networks`).

Responses

  • 200 The new address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "network_id": 1
}'
GET /public-ip-addresses/{publicIPAddress}/move-plan #

Read where an address could move

cloud:read api.read

Whether this address can be moved and to which of the caller's networks, with the reason when it cannot. Served from the stored networks; nothing is reconciled.

Parameters

Name In Type Description
publicIPAddress Required path integer

Responses

  • 200 The plan.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1/move-plan' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /vpn #

List the caller's VPNs

cloud:read api.read

A collection, not a single object: a customer account may have zero VPNs configured, or in principle more than one. Database-backed by default; pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling, and deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of VPNs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /vpn #

Switch a VPN gateway on or off

cloud:write api.read api.write

Turns the remote-access VPN gateway on one of the caller's public addresses on or off — the website's switch. The gateway appears in GET /vpn?refresh=true once the cloud reports it. A switch the cloud did not make is a 409 saying so; users are managed at /vpn/users.

Request body Required

Field Type Description
public_ip_address_id Required integer
enabled Required boolean

Responses

  • 204 Switched.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip_address_id": 1,
    "enabled": true
}'
GET /vpn/users #

List VPN users

cloud:read api.read

Database-backed; never contacts the cloud. No refresh parameter — unlike public IP addresses and VPNs, this endpoint has no reconciling sibling exposed over the API.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of VPN users.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /vpn/users #

Create a VPN user

cloud:write api.read api.write

Creates a VPN user in the cloud under the caller's account. username must be free of the caller's own VPN users; a name already used by a different customer is not a conflict.

Both fields are validated against the cloud provider's own rule rather than a looser one of ours: each must BEGIN with a letter or a digit, and may then use letters, digits and a small punctuation set — @ . - _ for the username, and @ + = . - _ for the password. A value outside that is 422 here. It used to be accepted and refused by the provider afterwards, which reached the caller as a 502 naming a system they have no access to.

Request body Required

Field Type Description
username Required string
password Required string

Responses

  • 201 The new VPN user.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "jdoe",
    "password": "string"
}'
DELETE /vpn/users/{vpnUser} #

Delete a VPN user

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
vpnUser Required path integer

Responses

  • 204 The VPN user was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/vpn/users/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /affinity-groups #

List affinity groups

cloud:read api.read

Database-backed; never contacts the cloud. No refresh parameter: this endpoint's reconciling sibling is destructive in a way none of the others in this API are — it deletes both local affinity groups the provider listing omits and instance membership rows alongside them — and is never exposed here.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of affinity groups.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/affinity-groups' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /affinity-groups #

Create an affinity group

cloud:write api.read api.write

name must be unique across every customer's affinity groups — the provider does not namespace affinity group names per account. Each instances.* must name one of the caller's own instances; a foreign or missing id is 422, not 404.

Request body Required

Field Type Description
name Required string
description Optional string
affinity_type Required string
instances Optional array of integer

Responses

  • 201 The new affinity group.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/affinity-groups' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "web-tier",
    "affinity_type": "Host Affinity"
}'
PATCH /affinity-groups/{affinityGroup} #

Retarget an affinity group's membership

cloud:write api.read api.write

The only mutable attribute: which of the caller's own instances belong to the group. The provider does not support renaming or retyping an affinity group after creation. Each instances.* must name one of the caller's own instances; a foreign or missing id is 422, not 404 — the addressed resource is the group, already resolved and owned before this request runs. An empty array clears the group's membership.

Parameters

Name In Type Description
affinityGroup Required path integer

Request body Required

Field Type Description
instances Required array of integer

Responses

  • 200 The updated affinity group.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/affinity-groups/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instances": [
        17
    ]
}'
DELETE /affinity-groups/{affinityGroup} #

Delete an affinity group

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
affinityGroup Required path integer

Responses

  • 204 The affinity group was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/affinity-groups/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

DNS

Zones and records on the site's DNS integration. refresh=true on any read here is the widest-blast-radius reconciliation in the whole API — there is no single-zone reconcile primitive, so it always resyncs the caller's entire DNS account, not just the resource addressed by the request.

GET /dns-zones #

List DNS zones

dns:read api.read

Database-backed by default. Pass refresh=true to reconcile against the DNS service first — that variant is rate-limited far more tightly and must not be used for polling. Unlike the equivalent parameter on /instances or /volumes, a DNS refresh reconciles the caller's entire DNS account, not just this listing: there is no cheaper single-zone reconcile primitive in the underlying service. It also deletes local zones (and cascades to their records) that the DNS service's own listing no longer contains.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /dns-zones #

Create a DNS zone

dns:write api.read api.write

Requires at least one of the caller's own subscriptions to be in the deployed state, and refuses a 6th zone — both checked before the zone is created on the DNS service, so a rejected request never leaves an orphan zone upstream.

Request body Required

Field Type Description
name Required string The zone's domain name, without a trailing dot.

Responses

  • 201 The new DNS zone.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "example.com"
}'
GET /dns-zones/{zone} #

Read a DNS zone

dns:read api.read

Database-backed by default. Pass refresh=true to reconcile before responding — like the collection endpoint, this reconciles the caller's entire DNS account (there is no single-zone reconcile primitive), then picks this zone out of the result. That variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
zone Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The DNS zone.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /dns-zones/{zone} #

Delete a DNS zone

dns:write api.read api.write

Deletes the zone on the DNS service and its local row, and all of its records' local rows along with it. The one documented exception to "every mutation returns the current representation": there is nothing left to return, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
zone Required path integer

Responses

  • 204 The zone (and its records) were deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/dns-zones/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /dns-zones/{zone}/records #

List a DNS zone's records

dns:read api.read

Database-backed by default: a plain read of the zone's own records, no provider call involved (the zone itself must already belong to the caller — resolved and 404'd before any record is ever looked up). Pass refresh=true to reconcile first — like the zone endpoints, this reconciles the caller's entire DNS account, not just this zone, and is rate-limited far more tightly.

Parameters

Name In Type Description
zone Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of the zone's DNS records.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /dns-zones/{zone}/records #

Create a DNS record

dns:write api.read api.write

Requires at least one of the caller's own subscriptions to be in the deployed state, and refuses a 256th record on this zone — both checked before the record is created on the DNS service. Creating the record also reconciles the caller's entire DNS account as a side effect of reading the new record back — there is no cheaper way to obtain its local row, since the underlying provider call does not return one. A value the record's name and type already hold is refused with 422 on data before anything is written: one value is one record.

Parameters

Name In Type Description
zone Required path integer

Request body Required

Field Type Description
name Required string A relative value (e.g. `www`) is auto-qualified against the zone's own name; an already fully-qualified value (trailing dot) is used as-is.
type Required string
data Required string

Responses

  • 201 The new DNS record.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "www",
    "type": "A",
    "data": "203.0.113.5"
}'
PATCH /dns-zones/{zone}/records/{record} #

Update a DNS record

dns:write api.read api.write

The only mutable attributes: type and data. Updates the record on the DNS service and the local row directly, preserving the record's id — the underlying service method does not persist the change locally on its own, and reconciling through the account-wide sync instead would delete this record and mint a new one under a different id. A new type and data that another record at this name already holds is refused with 422 on data before anything is written; sending the record's own current value is accepted and changes nothing.

Parameters

Name In Type Description
zone Required path integer
record Required path integer

Request body Required

Field Type Description
type Required string
data Required string

Responses

  • 200 The updated DNS record.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "A",
    "data": "203.0.113.6"
}'
DELETE /dns-zones/{zone}/records/{record} #

Delete a DNS record

dns:write api.read api.write

Deletes the record on the DNS service and its local row. The one documented exception to "every mutation returns the current representation": there is nothing left to return, so this responds 204 with an empty body rather than 200 with the deleted resource. When the DNS service no longer holds this record's value, the call answers 409, keeps the local row, and refresh=true on the zone's record list reconciles it.

Parameters

Name In Type Description
zone Required path integer
record Required path integer

Responses

  • 204 The record was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Billing

The sellable catalogue, subscriptions and their cancellation, payments, stored credit cards, refunds, the account balance and ordering. POST /orders pays only from the account balance. With billing:write an open bill can be paid with a saved card that has passed 3-D Secure — a card that has not is sent back to the website with an approval_url, because a bank challenge needs a person in a browser — a refund can be asked for, and a saved card deleted; adding a card stays on the website. See each endpoint's description for the reconciling sibling — if any — it deliberately keeps off the request path.

GET /virtual-machine-products #

List virtual machine products

billing:read api.read

The sellable VM catalogue. No refresh parameter: this is database-backed by construction — nothing here ever reconciles against the cloud, unlike the offerings it is built from. Only published products are returned, matching VirtualMachineProductPolicy::view().

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of virtual machine products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/virtual-machine-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /virtual-machine-products/{virtualMachineProduct} #

Read one virtual machine product

billing:read api.read

404s for an unpublished product, matching VirtualMachineProductPolicy::view() — reproduced as a query constraint, the same way GET /isos/{iso} reproduces IsoPolicy::view's visibility rule, rather than a policy check that would 403 instead.

Parameters

Name In Type Description
virtualMachineProduct Required path integer

Responses

  • 200 The virtual machine product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/virtual-machine-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volume-products #

List volume products

billing:read api.read

The sellable volume catalogue. No refresh parameter, for the same reason as GET /virtual-machine-products. Only published products are returned.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of volume products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volume-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volume-products/{volumeProduct} #

Read one volume product

billing:read api.read

404s for an unpublished product, matching VolumeProductPolicy::view() — reproduced as a query constraint rather than a policy check.

Parameters

Name In Type Description
volumeProduct Required path integer

Responses

  • 200 The volume product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volume-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ip-address-products #

List public IP address products

billing:read api.read

The sellable public IPv4 address catalogue. Only products that are published AND priced are returned — the same rule POST /orders sells by. Order one with an ip_address line.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of public IP address products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ip-address-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ip-address-products/{ipAddressProduct} #

Read one public IP address product

billing:read api.read

404s for a product that is unpublished or has no payment plan, the same answer an id that does not exist gets.

Parameters

Name In Type Description
ipAddressProduct Required path integer

Responses

  • 200 The public IP address product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ip-address-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /network-products #

List network products

billing:read api.read

The sellable additional-network catalogue. Only products that are published AND priced are returned. Order one with a network line; every account already holds one free network, which max_networks counts.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of network products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/network-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /network-products/{networkProduct} #

Read one network product

billing:read api.read

404s for a product that is unpublished or has no payment plan.

Parameters

Name In Type Description
networkProduct Required path integer

Responses

  • 200 The network product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/network-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /service-products #

List service products

billing:read api.read

The one-time services the shop sells — READ-ONLY here. A service is bought on the website, never through POST /orders: buying one commits a person to do the work. Only services a customer can actually buy are returned (published, priced, and offered either freely or beside at least one template).

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of service products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/service-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /service-products/{serviceProduct} #

Read one service product

billing:read api.read

404s for a service a customer cannot buy — unpublished, unpriced, offered for nothing, or the partnership training.

Parameters

Name In Type Description
serviceProduct Required path integer

Responses

  • 200 The service product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/service-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /domain-name-products #

List your domain name products

billing:read api.read

The domain names YOUR account has in its cart or has bought — READ-ONLY, and only while domain reselling is switched on; otherwise this answers 404. Another account's names are never listed. A domain is bought on the website, where the registrar is asked whether the name is free.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of your account's domain name products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/domain-name-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /domain-name-products/{domainNameProduct} #

Read one domain name product

billing:read api.read

404s while domain reselling is off, for an unpublished or unpriced product, and for a name that is on no cart and no subscription of YOUR account.

Parameters

Name In Type Description
domainNameProduct Required path integer

Responses

  • 200 The domain name product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/domain-name-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions #

List subscriptions

billing:read api.read

Database-backed only — no refresh parameter. Unlike volumes or instances, the reconciling sibling here (BillingUserService::listSubscriptions()) is not "ask the provider what exists": it is an administrative repair pass that promotes any subscription below deployed to deployed (so merely listing one would mark a Terraform provider's own deployment finished), terminates subscriptions whose instance moved, deletes ROOT-volume subscriptions along with their payments, and dials the cloud. It does not belong behind a customer's GET at any rate limit.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions/{subscription} #

Read one subscription

billing:read api.read

Ownership is enforced as a query constraint, not a policy check: another customer's subscription 404s here, where the website's own route (implicit binding plus SubscriptionPolicy) would 403 it. No refresh parameter, for the same reason as GET /subscriptions.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/cancel #

Cancel a subscription

order:write api.read api.write

Terminates the subscription. Requires order:write, not billing:read: cancelling ends a paid asset, so it sits behind the same deliberate commerce-write opt-in as an order would, even though nothing here charges a card — TokenAbility's docblock is explicit that the read/write grid is not meant to be "completed" with a dedicated billing:write.

Idempotent on an already-terminated subscription: repeating the call returns 200 with the current (already-terminated) representation rather than the 409 a second cancellation would otherwise produce, so a Terraform destroy that retries after a timeout does not fail.

Refuses to cancel anything not currently deployed — an instance still running, a volume still attached, or a missing instance/volume — with 409, since each of those is a conflicting state the caller must resolve first (stop the instance, detach the volume), not a malformed request.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The subscription, terminated (or already terminated).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/cancel' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions/{subscription}/resize-quote #

Price a resize

billing:read api.read

Prices moving this machine, disk or network to product_id — a product of the same kind — without changing anything. Refused with 409 in the service's own words while the purchase can still be refunded (no resize is offered inside the refund window), while a bill is open, or for any other reason the website would refuse it.

Parameters

Name In Type Description
subscription Required path integer
product_id Required query integer

Responses

  • 200 The quote.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions/1/resize-quote' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/resize #

Resize a machine, a disk or a network

order:write api.read api.order

Carries out the resize GET /subscriptions/{subscription}/resize-quote priced, at the instant it was priced: send its token as quote_token, and the resize is refused with 409 if the price has changed since (quotes last five minutes).

A downscale, or a move to the same price, completes at once: a downscale refunds the unused part of the period — to the card that paid where it can, as account credit where it cannot — and refunds says where each part went. An UPSCALE is staged and its bill is left for a person to pay on payment_url (202), exactly like POST /orders: a first card charge needs an interactive 3-D Secure step. The machine keeps its size, and the subscription stays scaling, until that bill is paid; paying it finishes the resize. POST …/actions/cancel-resize on the new subscription backs a staged resize out. A staged resize whose bill stays unpaid for three days is backed out for you: the subscription goes back to its current size and its own billing, the bill is withdrawn, no money moves, and the account is told. A bill that is paid is never withdrawn.

Requires order:write and the billing manage capability. Idempotency-Key is required.

Parameters

Name In Type Description
subscription Required path integer
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
product_id Required integer
quote_token Required string

Responses

  • 200 The resize completed (a downscale, or a move that costs nothing).
  • 202 The upscale is staged; its bill waits on `payment_url` for three days, after which an unpaid resize is backed out.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "product_id": 1,
    "quote_token": "string"
}'
POST /subscriptions/{subscription}/actions/cancel-resize #

Back out of a staged resize

order:write api.read api.write

On the NEW subscription a resize staged (status scaling): its unpaid bill goes, the subscription it replaced is restored, and no money moves. A resize whose bill is already paid is refused with 409. Answers the restored subscription.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The restored subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/cancel-resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/refund #

Ask for a refund

billing:write api.read api.order

The Refund button on the website, run by the same code. Inside the refund window (seven days from the purchase) the money goes back to the card that paid and the purchase ends; a machine must be stopped first, and a machine with a live service bought for it is refused until the service is refunded.

When an issued invoice stands for the purchase, it must be cancelled before any money goes back: the answer is then 202 with outcome: invoice_cancellation_requested, an invoice-cancellation request is opened with a support ticket, and a machine is stopped at once. A company confirms the cancellation with POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm. Asking again while that request is still waiting is refused; asking again once staff have cancelled the invoice retries the refund owed.

200 with outcome: refunded once refunded; 202 with outcome: refund_pending while the bank settles it. Every refusal is a 409 carrying the website's own sentence: the window has closed, refunds are blocked on the account, the purchase was resized, an earlier request is still open, and so on. A subscription of another account is 404.

Requires billing:write, whose owner must hold billing: manage — the same gate as on the website.

Parameters

Name In Type Description
subscription Required path integer The subscription's id.

Responses

  • 200 Refunded.
  • 202 The refund is settling, or an invoice-cancellation request stands in for it.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The refund is refused; `detail` carries the website's own sentence.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/refund' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments #

List payments

billing:read api.read

Database-backed by default. amount/subtotal/taxes/discount/ applied_balance/taxable_base/list_total/catalogue_discount are null on any payment that has never been recalculated — recalculating is a write, so a plain GET never triggers it. Pass refresh=true to recalculate every payment on the returned page; that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of payments.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment} #

Read one payment

billing:read api.read

Ownership is enforced as a query constraint: another customer's payment 404s. Pass refresh=true to force a recalculation of amount and its siblings before responding — see GET /payments's description for why a plain read never does. A chargeback the customer's bank took is published in chargebacks — its amount and date, never the reason or the bank's reference.

Parameters

Name In Type Description
payment Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The payment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment}/invoice #

Download a payment's invoice

billing:read api.read

The invoice document our accountant issued for this payment, as PDF. 404 until one is on file.

Parameters

Name In Type Description
payment Required path integer

Responses

  • 200 The invoice, as PDF.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1/invoice' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment}/proforma #

Download a payment's proforma

billing:read api.read

The proforma for this payment, as PDF — the website's document, in Turkish.

Parameters

Name In Type Description
payment Required path integer

Responses

  • 200 The proforma, as PDF.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1/proforma' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /payments/{payment}/actions/pay #

Pay an open bill with a saved card

billing:write api.read api.order

Charges one of your own saved cards for an open bill, exactly as the Pay button on the website does: granted account credit is applied first, the card is charged for the rest with no further confirmation, and whatever the bill bought — a renewal, a resize, a machine — is completed. This spends money.

A card that has not passed 3-D Secure cannot be charged without a person: the answer is then a 409 whose problem document carries code: three_d_secure_required and approval_url — the bill's page on the website, where a person completes the bank's challenge. No challenge is started here. As on the website, the attempt is recorded on the bill, which reads failed until it is paid.

Refused with 409 and the website's own sentence: a bill already paid, refunded or cancelled, a bill folded into one payment for everything the account owes, and a bill for an order the shop would not sell today. A card that is not one of your own is a 422 on credit_card_id. A bill of another account is 404.

Idempotent. Idempotency-Key is required: a retry after a timeout never charges twice.

Requires billing:write, whose owner must hold billing: manage — the same gate as on the website.

Parameters

Name In Type Description
payment Required path integer The bill's id.
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
credit_card_id Required integer One of your own saved cards, as `GET /credit-cards` lists them.

Responses

  • 200 The bill, paid.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The bill cannot be charged as it stands — or the card needs 3-D Secure, when the document carries `code: three_d_secure_required` and `approval_url`.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/payments/1/actions/pay' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "credit_card_id": 1
}'
GET /credit-cards #

List stored credit cards

billing:read api.read

Database-backed by default. Card enrolment stays on the website, which is already behind a session and 2FA — this API never accepts a PAN, so there is no POST here.

refresh=true asks the payment gateway directly whether it still knows each card, one call per card, and deletes the local row for any card the gateway no longer has — this is not a free "check the status" call, it is a destructive reconciliation the caller is opting into. Rate-limited far more tightly than a plain read.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of stored credit cards.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/credit-cards' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /credit-cards/{creditCard} #

Delete a saved card

billing:write api.read api.write

Removes one of your own saved cards, exactly as the website does: every subscription that renewed on it is detached (its next bill waits for a card or is sent to you), and the card is deleted at the payment gateway too. A card saved by another login — even on the same account — is 404: cards belong to the login that saved them. Adding a card needs the bank's 3-D Secure step and stays on the website.

Requires billing:write, whose owner must hold billing: manage — the same gate as on the website.

Parameters

Name In Type Description
creditCard Required path integer The card's id, as `GET /credit-cards` lists it.

Responses

  • 204 The card was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/credit-cards/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /refunds #

List refunds

billing:read api.read

The caller's own refunds only. No refresh parameter: a refund is a record of something that already happened (or is pending), not a live provider resource to reconcile against.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of refunds.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/refunds' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm #

Confirm that your company's invoice may be cancelled

billing:write api.read api.write

A company's invoice can only be cancelled with its agreement: this records it, exactly as the website's Confirm button does, and staff then cancel the invoice and make the refund. Refused with 409 when the request is not waiting for a confirmation. A request of another account is 404.

Requires billing:write, whose owner must hold billing: manage — the same gate as on the website.

Parameters

Name In Type Description
invoiceRefundRequest Required path integer The invoice-cancellation request's id, as a refund answered it.

Responses

  • 200 Confirmed.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The request is not waiting for a confirmation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/invoice-refund-requests/1/actions/confirm' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /billing/account #

Read the caller's balance and outstanding total

billing:read api.read

No refresh parameter: both balance and due are derived straight from stored rows, so there is nothing to reconcile against a provider.

Responses

  • 200 The caller's account summary.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/billing/account' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /billing/credits #

List granted credits

billing:read api.read

The credits our staff granted the account, newest first — what was given, what is left and when it lapses. Credit is granted, never bought, and is applied as a discount when a bill is paid.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of granted credits.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/billing/credits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /billing/pay-day #

Set the account's pay day

billing:write api.read api.write

The day of the month (1–28) every subscription of your account renews on, so the account gets one bill a month — the Pay day setting on the website. null puts each subscription back on its own date. Nothing already billed changes: the next renewal of each subscription covers only the days until the pay day, at its usual price per day, and after that it renews on the pay day. An annual subscription keeps its month and renews on the pay day of that month. pay_day must be sent; a value outside 1–28 is a 422.

Requires billing:write, whose owner must hold billing: manage — the same gate as on the website.

Request body Required

Field Type Description
pay_day Required integer The day of the month, or null for each subscription's own date.

Responses

  • 200 The pay day was saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/billing/pay-day' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "pay_day": 1
}'
POST /orders #

Place an order, discounted by the account balance

order:write api.read api.order

Buys virtual machines, volumes, public IPv4 addresses and additional networks, applies whatever granted credit the account holds as a discount, and leaves the rest for a card. It commits the account to spending money, as a resize does; the bill it leaves is paid in a browser at payment_url, or with POST /payments/{id}/actions/pay (billing:write) from a saved card that has already passed 3-D Secure.

There is no card path HERE, and this is structural rather than a setting: a stored card's first charge always requires an interactive 3-D Secure challenge in a browser (global_settings.shop_threeds_only defaults to true and credit_cards.threeds_authorized defaults to false), which nothing headless can complete. So the order is PLACED and the subscriptions are created, and the whole bill is left on the payment for a person to settle: needs_card says whether that is the case, credit_applied says what the account's credit will take off it, payable says what a card is then asked for, and payment_url is where a browser finishes it. A card is never charged silently.

Placing an order moves no money. Nothing is taken from the balance here — the credit is applied when the payment is settled, like any other bill, so an order nobody ever pays holds none of the customer's credit. credit_applied and payable are therefore projections of what will happen at payment, while the nested payment object carries the row as it stands: its amount is the whole figure and its applied_balance is 0.00 until it is paid.

Granted credit is a discount on the NET, capped at a share of it, so an order with a price on it normally leaves something payable however large the balance. An order is no longer refused for want of a balance.

Credit is granted by our staff, never bought; there is no way to add it from the API or the website.

Asynchronous. Paying does not provision. A queued listener reacts to the order and dials the cloud, driving each subscription new → pending → deployed or failed. The response is 202 and carries a Location header pointing at the first subscription; poll GET /subscriptions/{id} from there. A subscription that never leaves pending is a failed deployment that has not yet been recorded — check failure_reason on the subscription.

Idempotent. Idempotency-Key is required. The key is claimed before the order runs, so a client that times out and retries while the first request is still in flight gets 409 rather than a second charge; once the first request has finished, the same key with the same body replays the original 202 and creates nothing.

Preconditions, each re-asserted here exactly as the website's checkout enforces them, and each refused with 422 naming the one that is unmet: billing information on file, the end-user licence agreement accepted, an identity or passport number on file, the shop open, and the caller's max_vms, max_vols, max_ips and max_networks quotas not exceeded. An address also needs a network that already runs a machine — or a machine for that network on the same order (network). This endpoint is not a way around any limit the website applies.

Requires order:write, which is off by default when a token is minted and is never implied by another ability.

Parameters

Name In Type Description
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
items Required array of object One entry per unit ordered. Repeat an entry to buy two of the same thing.

Responses

  • 202 The order was paid and provisioning has been queued. `Location` points at the first subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 The `Idempotency-Key` is in use by a request that is still running, or was already used with a different body.
  • 422 The order was refused and nothing was created or charged. `errors` names the reason: `items.*` for an unavailable product, a mismatched payment plan or a network that is not the caller's, and `billing_info`, `eula`, `identity_number`, `shop`, `max_vms`, `max_vols`, `max_ips`, `max_networks` or `network` (an address into a network with nothing running yet) for an unmet precondition. A `balance` shortfall is NOT among them any more — a balance too small no longer refuses an order, it simply discounts it by less and leaves more on `payable`.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/orders' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "items": [
        {
            "type": "virtual_machine",
            "product_id": 1,
            "payment_plan_id": 1
        }
    ]
}'

Operations

Tickets

Your account's own support tickets: read them, open one, reply and close. Every write reaches our support staff at once, in the token owner's name, and has no undo. Files are attached on the website only.

GET /tickets #

List your support tickets

tickets:read api.read

Every support ticket on the caller's account, the ones a colleague opened included — the list the website's Support page shows. The list carries each thread's facts; read one ticket for its messages.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of tickets.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /tickets #

Open a support ticket

tickets:write api.read api.write

Opens a ticket in the token owner's name and sends it to our support staff at once; they are notified and read it. There is no undo. Files cannot be attached here — add them from the ticket's page on the website.

Request body Required

Field Type Description
title Required string A short subject line.
body Required string The message.
category Optional string What the ticket is about. `general` when left out.

Responses

  • 201 The new ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "Mail bounces since this morning",
    "body": "Every mail to our domain has bounced since 08:00."
}'
GET /tickets/{ticket} #

Read one of your support tickets

tickets:read api.read

The ticket with its opening message and every reply, oldest first. Another account's ticket answers 404, exactly like one that does not exist.

Parameters

Name In Type Description
ticket Required path integer

Responses

  • 200 The ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/tickets/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /tickets/{ticket}/comments #

Reply to one of your support tickets

tickets:write api.read api.write

Adds a reply in the token owner's name; our support staff are notified and read it. There is no undo. A ticket that is solved or later takes no reply and answers 409 — open a new one instead. Files cannot be attached here.

Parameters

Name In Type Description
ticket Required path integer

Request body Required

Field Type Description
comment Required string The reply.

Responses

  • 201 The new reply.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The ticket is solved or closed and takes no more replies.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "It works again, thank you."
}'
POST /tickets/{ticket}/actions/close #

Close one of your support tickets

tickets:write api.read api.write

Closes the ticket; our support staff are notified. Answers 409 for a ticket that is already closed, and for the work-order ticket of a purchased service that can still be refunded — closing that ticket ends the right to the refund, so it is closed from the ticket's page on the website only.

Parameters

Name In Type Description
ticket Required path integer

Responses

  • 200 The closed ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The ticket is already closed, or it is the work order of a service that can still be refunded.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets/1/actions/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Usage

What your cloud consumed — machine hours, storage, IP address hours and network traffic. Quantities only; the bill is under Billing.

GET /usage #

Read what your cloud consumed

cloud:read api.read

What the website's Usage page draws: machine hours, storage, IP address hours and network traffic over a window, with one row per machine and per disk and one per day. Quantities only — the bill is on /payments.

The window is days (7, 30 or 90; 30 when missing or anything else) or from and to together. It ends yesterday at the latest, because today is not counted yet, and spans at most 365 days. instance_id or volume_id narrows the figures to one of your machines or disks; one that is not yours answers 404. Only what the cloud meters per machine or per disk survives the narrowing — a machine keeps its hours and its disks' storage, a disk its storage. IP address hours, network traffic, snapshots and templates are metered per address, network or image, so they are not measured there: unmetered names each such key, and its figure is not a measurement, never zero traffic.

This reads the cloud's own usage records, so it is charged against the tighter reconciling-read budget. A window, once read, is kept for an hour. available: false means the records could not be read just now.

Parameters

Name In Type Description
days Optional query integer 7, 30 or 90. Ignored when `from` and `to` are both given.
from Optional query string The first day, YYYY-MM-DD (GMT).
to Optional query string The last day, YYYY-MM-DD (GMT); yesterday at the latest.
instance_id Optional query integer One of your machines, by id.
volume_id Optional query integer One of your disks, by id. Ignored when `instance_id` is given.

Responses

  • 200 The figures for the window.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/usage' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Admin

Staff reads of the whole install, plus a deliberately small set of instance-lifecycle writes, for a token carrying admin:read or admin:write whose owner also holds the admin or super-admin role. The ability alone is never enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The read/write split rests on nothing but the route table. AdminPolicyTrait::before() returns true for anyone holding the admin role, and almost every policy in the application uses it — so no policy can distinguish an admin's read from an admin's write; abilities:admin:read versus abilities:admin:write plus the HTTP verb is the entire enforcement, and a test walks the route table to keep it that way.

Writes are confined to instance lifecycle — start, stop, restart, attach ISO, detach ISO — because an admin already has full write over every customer's cloud through the admin area, so refusing it to an admin:write token bought no safety; it only meant the one channel that could be scripted was the one nobody could audit or rate-limit. Two things are deliberately absent: instance destroy, because subscriptions.instance_id must be released before an instance is deleted and a bare destroy would orphan a live billing row; and volume attach/detach, because it needs a second cross-ownership check with no precedent on this surface. Both are candidates for a later round, not oversights.

Every customer-scoped read on this surface writes an <domain>.pii_read row into the audit trail, exactly as the equivalent admin page does, and is charged against a tighter rate-limit budget than an ordinary read for that reason. Every write writes its own explicit cloud.instance_* row instead — the access-log middleware only records a successful GET — including when idempotency skipped the underlying CloudStack call, because the auditable act is the request an admin made, not whether CloudStack was actually dialled.

Installation content and the approval queue sit beside those customer routes, with no {user} in their paths. News drafts are created and edited directly; publishing one is only ever ASKED for — the request stages it and answers 202 — and GET /admin/staged-actions reports what became of it. Nothing on this API approves or rejects a staged request: that is a signed-in administrator's click on the admin area's approvals page, so a token can ask and can never decide. GET /admin/work-queues and GET /admin/health read the operator board's counts and the installation's health; neither names a person. GET /admin/failed-jobs, GET /admin/jobs and GET /admin/horizon read the queue — its failed jobs, the jobs Horizon tracks and its workers' status — and retry, remove or restart nothing.

GET /admin/customers #

List customers

admin:read api.read

Every account holding the user role, ordered by name.

Requires an admin:read token whose owner also holds the admin (or super-admin) role. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The query selects the published columns explicitly rather than reading whole User models — the same deliberate projection the admin area's customer table uses, after an unprojected version of it once shipped every customer's national identity number into a page payload.

Database-backed, with no refresh variant anywhere on this surface. The reconciling siblings of these reads (listSubscriptions(), listZones(), getInstances()) mutate; at admin scope they mutate the whole install. There is no rate limit at which that belongs behind a GET.

This listing writes no audit row: it publishes no more about any one customer than a name and an email, and a per-request row per page of the roster would swamp the trail without recording an access to anybody's data in particular. The per-customer reads below are the ones that log.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of customers.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers #

Ask for a customer login to be created

admin:write api.read api.privileged

Stages creating a customer login, with a new account of its own, and answers 202. NOTHING IS CREATED by this request: an administrator must approve the entry (approval_url). Nobody chooses the password: approved, the address is e-mailed the ordinary password-reset link and the customer sets their own. Always a customer; a password or a role in the body is refused with 422, as is an address that already has a login or a creation waiting.

The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
name Required string
email Required string
language Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "email": "string",
    "language": "tr-TR"
}'
GET /admin/customers/{user} #

Get one customer

admin:read api.read api.privileged

One customer, with database-derived counts of their instances, volumes, DNS zones, subscriptions, invoices and tickets.

The equivalent admin page returns twenty-four props in a single request and dials CloudStack, PowerDNS and the payment gateway to build them. This is the decomposition of that page: the counts here are plain select count(*), and the detail lives on the four per-domain collections beside this path.

Reading another person's record writes an account.pii_read row into the audit trail, exactly as the equivalent admin page does — the KVKK access-log obligation does not stop at the admin area's edge. Reading your own record writes nothing: the row would be one per page load of your own dashboard, and your own actions are recorded anyway.

Because every call writes an audit row, this path is charged against a tighter rate-limit budget than an ordinary read.

Any account may be addressed here, not only one holding the user role — the equivalent admin page binds any user and an admin can legitimately need to look at a colleague's record. The listing beside this path is customers only. An id that does not exist is a 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/instances #

List one customer's virtual machines

admin:read api.read api.privileged

The customer's instances as currently stored, in the same Instance representation the customer's own /instances returns — so a field withheld from the owner stays withheld from staff.

Served by resolving the customer-scoped cloud service for the target customer and reading it. The admin-scoped variant of that service exists, and overriding only its data-source hooks turns every inherited reconcile-on-read method into a fleet-wide mutation — a read of one page can delete another customer's rows. Nothing on this surface resolves it, and a source-level test keeps it that way.

There is therefore no refresh parameter here, unlike the customer-facing /instances. Reconciliation is a mutation; a third party reading somebody else's machines is the last caller who should trigger one.

Writes a cloud.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/dns-zones #

List one customer's DNS zones

admin:read api.read api.privileged

The customer's zones as currently stored, in the same DNSZone representation the customer's own /dns-zones returns.

Served by resolving the customer-scoped DNS service explicitly. No refresh parameter: the reconciling sibling deletes local zones — and cascades to their records — that PowerDNS's live listing no longer contains, before its own update flag is consulted, and at admin scope it does that to every zone in the install and reassigns unmatched ones to the acting staff member.

Writes a dns.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/subscriptions #

List one customer's subscriptions

admin:read api.read api.privileged

The customer's subscriptions as currently stored, in the same Subscription representation the customer's own /subscriptions returns. Money is always a minor-unit integer with its currency, never a float.

Served by resolving the customer-scoped billing service explicitly. No refresh parameter, and this is the sharpest case for it: the reconciling sibling terminates subscriptions whose linked resource has moved, promotes every pending subscription to deployed and erases its failure reason, deletes root-volume subscriptions together with their payments, and fires orphan events that dial the provider and create further subscriptions — all inside one transaction. At admin scope its input set is the whole table rather than one customer.

Writes a billing.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/start #

Start a customer's virtual machine

admin:write api.read api.privileged

Idempotent: starting an already-running machine returns 200 immediately without contacting CloudStack, exactly as the owner's own /instances/{instance}/actions/start does.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller, whether or not CloudStack was actually dialled by the idempotency check above.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Responses

  • 200 The customer's virtual machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/stop #

Ask for a customer's virtual machine to be stopped

admin:write api.read api.privileged

Stages stopping the machine and answers 202. At approval the cloud is read first, and a machine it already reports stopped is not stopped again; until then the machine keeps running. Refused with 422 for a retired machine, a locked machine (unpaid or suspended), a machine with no owning login, and while another power action on the same machine is waiting. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. /mcp/admin stages the same act for the same token (owner, 2026-09-27: nothing destructive runs over MCP unless confirmed).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/restart #

Ask for a customer's virtual machine to be restarted

admin:write api.read api.privileged

Stages restarting the machine and answers 202. A restart has no target state, so every approval reaches the cloud. Refused with 422 for a retired machine, a locked machine (unpaid or suspended), a machine with no owning login, a machine whose refund request is open, and while another power action on the same machine is waiting. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. /mcp/admin stages the same act for the same token (owner, 2026-09-27: nothing destructive runs over MCP unless confirmed).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/attach-iso #

Ask for an ISO to be attached to a customer's virtual machine

admin:write api.read api.privileged

Stages attaching the ISO (iso_id) to the machine's virtual CD drive and answers 202; the machine may boot from it at its next restart. iso_id must name an ISO visible to the TARGET CUSTOMER — public, or owned by their account — never the acting admin's own; anything else is a 422 before anything is staged. Refused with 422 while another ISO is attached, and for a retired or locked machine. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. /mcp/admin stages the same act for the same token (owner, 2026-09-27: nothing destructive runs over MCP unless confirmed).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the addressed customer.

Request body Required

Field Type Description
iso_id Required integer Must name an ISO visible to the CUSTOMER (public, or owned by their account). A foreign private or missing id fails validation (422) rather than 404 — the addressed resource is the instance, not the ISO.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/attach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "iso_id": 5
}'
POST /admin/customers/{user}/instances/{instance}/actions/detach-iso #

Ask for the ISO to be taken out of a customer's virtual machine

admin:write api.read api.privileged

Stages detaching the ISO in the machine's virtual CD drive and answers 202. Refused with 422 when no ISO is attached, and for a retired or locked machine. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. /mcp/admin stages the same act for the same token (owner, 2026-09-27: nothing destructive runs over MCP unless confirmed).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/detach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/snapshots #

List one customer's disk snapshots

admin:read api.read api.privileged

The customer's disk snapshots as stored, never re-read from the cloud, each with retained — true for a copy in the retention queue, which is handled on the retention page and cannot be deleted or restored here. Filter with volume_id. Writes a cloud.pii_read audit row.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer's snapshots.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/firewall-rules #

Read one customer's firewall

admin:read api.read api.privileged

The customer's port forwards (ingress_rules) and outbound rules (egress_rules) as stored, each with the network it sits on. Writes a cloud.pii_read audit row.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer's firewall.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/firewall-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/isos #

List the ISOs one customer may attach

admin:read api.read api.privileged

The customer's own ISOs plus the public catalogue, each with own. Writes a cloud.pii_read audit row.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The ISOs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/isos/uploads #

Begin a chunked ISO upload for one customer

admin:write api.read api.privileged

Opens an upload of size bytes (at most 4 GiB) whose image lands on the customer's account, attachable to their machines — the REST twin of the admin area's per-customer ISO upload. It runs at once, not staged. Send the parts with POST /admin/customers/{user}/isos/uploads/{upload}/chunks, then …/complete. The three open uploads an account may hold are counted on the CUSTOMER's account; a fourth is a 422.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Required string
description Required string
bootable Required boolean
filename Required string
size Required integer

Responses

  • 201 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos/uploads' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "bootable": true,
    "filename": "string",
    "size": 1
}'
GET /admin/customers/{user}/isos/uploads/{upload} #

Read one customer's open upload

admin:read api.read api.privileged

The upload and the part indexes already received, so a client that lost its place sends only what is missing. An upload that is not this customer's is a 404. Writes a cloud.pii_read audit row.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
upload Required path string

Responses

  • 200 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos/uploads/upload' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/isos/uploads/{upload}/chunks #

Send one part of one customer's upload

admin:write api.read api.privileged

One part, as multipart/form-data: index (from 0) and file. Every part but the last must be exactly chunk_size bytes; a part of the wrong size, or an index outside the upload, is a 422. Sending a part again replaces it. An upload that is not this customer's is a 404.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
upload Required path string

Responses

  • 200 The upload, with this part received.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos/uploads/upload/chunks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/isos/uploads/{upload}/complete #

Complete one customer's upload and register the ISO

admin:write api.read api.privileged

Assembles the parts and registers the image on the customer's account. 201 with the ISO; 202 when the cloud took the image but has not listed it yet — it appears in GET /admin/customers/{user}/isos once it does. A missing part is a 422. The upload is gone afterwards either way. Writes a cloud.iso_uploaded audit row.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
upload Required path string

Responses

  • 201 The registered ISO.
  • 202 Registered, not yet listed by the cloud.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos/uploads/upload/complete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/isos/uploads/{upload}/abort #

Abort one customer's upload

admin:write api.read api.privileged

Gives up the upload and removes its parts now. A POST, as every staff write is. An upload that is not this customer's is a 404.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
upload Required path string

Responses

  • 204 Aborted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/isos/uploads/upload/abort' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/rename #

Rename one customer's machine

admin:write api.read api.privileged

Changes the machine's display name at once, through the customer-scoped cloud service, and writes cloud.instance_renamed against the customer. Rename it back to undo. Refused with 409 for a retired or locked machine.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the addressed customer.

Request body Required

Field Type Description
name Required string

Responses

  • 200 The renamed machine.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/rename' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /admin/customers/{user}/volumes/{volume}/snapshots #

Take a snapshot of one customer's disk

admin:write api.read api.privileged

Takes a manual snapshot at once, through the customer-scoped cloud service, and writes cloud.snapshot_created against the customer. It counts against the customer's snapshot limit and is refused with 409 at the limit, while the disk or its machine is being resized, and for a retired disk.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The disk's id; it must belong to the addressed customer.

Request body Required

Field Type Description
name Optional string

Responses

  • 201 The snapshot being taken.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /admin/customers/{user}/volumes/{volume}/attach #

Ask for a disk to be attached to a machine

admin:write api.read api.privileged

Stages attaching the disk to one of the same customer's machines (instance_id) and answers 202. Refused with 422 for a disk already attached, a retired disk or machine, a locked machine, and a machine of another account. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The disk's id; it must belong to the addressed customer.

Request body Required

Field Type Description
instance_id Required integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/volumes/1/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instance_id": 1
}'
POST /admin/customers/{user}/volumes/{volume}/detach #

Ask for a disk to be detached

admin:write api.read api.privileged

Stages detaching the data disk from its machine and answers 202. At approval the machine's state is read from the cloud, and a machine that is not stopped is refused. A boot disk is never detached. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The disk's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/volumes/1/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/snapshots/{snapshot}/delete #

Ask for a snapshot to be deleted

admin:write api.read api.privileged

Stages deleting the snapshot and answers 202. Approved, the backup is destroyed for good. Refused with 422 for a copy in the retention queue and one still being taken. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
snapshot Required path integer min 1 The snapshot's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/snapshots/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/snapshots/{snapshot}/restore #

Ask for a snapshot to be restored into a new disk

admin:write api.read api.privileged

Stages restoring the snapshot into a NEW disk named name, never in place, and answers 202. It uses one of the snapshot's limited restores and a slot of the customer's disk limit. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
snapshot Required path integer min 1 The snapshot's id; it must belong to the addressed customer.

Request body Required

Field Type Description
name Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/snapshots/1/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /admin/customers/{user}/ingress-rules #

Ask for a port to be opened on a machine

admin:write api.read api.privileged

Stages a port forward from one of the customer's public addresses to one of their machines and answers 202. protocol is tcp, udp or icmp; ports run 1-65535. Whatever listens there becomes reachable from the internet. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
instance_id Required integer
public_ip_address Required string
protocol Required string
public_port_start Required integer
public_port_end Required integer
private_port_start Required integer
private_port_end Required integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/ingress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instance_id": 1,
    "public_ip_address": "string",
    "protocol": "string",
    "public_port_start": 1,
    "public_port_end": 1,
    "private_port_start": 1,
    "private_port_end": 1
}'
POST /admin/customers/{user}/ingress-rules/{ingressRule} #

Ask for a port forward to be changed

admin:write api.read api.privileged

Stages changing the port forward's private ports and, optionally, the machine it forwards to (instance_id, one of the same customer's), and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ingressRule Required path integer min 1 The port forward's id; it must belong to the addressed customer.

Request body Required

Field Type Description
private_port_start Required integer
private_port_end Required integer
instance_id Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/ingress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "private_port_start": 1,
    "private_port_end": 1
}'
POST /admin/customers/{user}/ingress-rules/{ingressRule}/delete #

Ask for a port forward to be closed

admin:write api.read api.privileged

Stages closing the port forward and answers 202. Approved, whatever the customer serves through it stops being reachable. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ingressRule Required path integer min 1 The port forward's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/ingress-rules/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/egress-rules #

Ask for an outbound firewall rule

admin:write api.read api.privileged

Stages an outbound rule on the customer's network (network_id, or the default network) and answers 202. protocol is tcp, udp or icmp. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
source_cidr Required string
destination_cidr Required string
protocol Required string
port_start Required integer
port_end Required integer
network_id Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/egress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "source_cidr": "string",
    "destination_cidr": "string",
    "protocol": "string",
    "port_start": 1,
    "port_end": 1
}'
POST /admin/customers/{user}/egress-rules/{egressRule}/delete #

Ask for an outbound rule to be removed

admin:write api.read api.privileged

Stages removing the outbound rule and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
egressRule Required path integer min 1 The outbound rule's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/egress-rules/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/retention/purge #

Ask for everything retained for the customer to be erased

admin:write api.read api.privileged

Stages the PERMANENT ERASURE of every resource retained for the customer's account, in dependency order, and answers 202. Refused with 422 while any of them is held; refused at approval if the set changed. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/retention/purge' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/dns-zones/{zone}/records #

Ask for a DNS record to be added

admin:write api.read api.privileged

Stages adding one value at name and type to the zone and answers 202. Other values at the same name and type are kept; a value already held is refused. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the addressed customer.

Request body Required

Field Type Description
name Required string
type Required string
data Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "type": "string",
    "data": "string"
}'
POST /admin/customers/{user}/dns-records/{record} #

Ask for a DNS record value to be changed

admin:write api.read api.privileged

Stages changing ONE value of the record (its type and data) and answers 202. Every other value at the same name and type is kept. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
record Required path integer min 1 The DNS record's id; it must belong to the addressed customer.

Request body Required

Field Type Description
type Required string
data Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/dns-records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "string",
    "data": "string"
}'
POST /admin/customers/{user}/dns-records/{record}/delete #

Ask for a DNS record value to be deleted

admin:write api.read api.privileged

Stages deleting ONE value of the record and answers 202. Every other value at the same name and type is kept. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
record Required path integer min 1 The DNS record's id; it must belong to the addressed customer.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/dns-records/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/public-ip-addresses/{address}/reverse-dns #

Ask for an address's reverse DNS name to be set

admin:write api.read api.privileged

Stages setting the address's reverse DNS name (PTR) to reverse_record and answers 202. Refused at approval unless the cloud still lists the address on the customer's account. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
address Required path integer min 1 The public address's id; it must belong to the addressed customer.

Request body Required

Field Type Description
reverse_record Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/public-ip-addresses/1/reverse-dns' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reverse_record": "string"
}'
GET /admin/cloud-scans #

List the cloud scans

admin:read api.read

The cloud scans, newest first, with their counts and the administrator who started each (limit, at most 50). No customer is named, so no access row is written.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The scans.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/cloud-scans' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/cloud-scans #

Ask for a cloud scan

admin:write api.read api.privileged

Stages a cloud scan and answers 202. A scan re-reads the whole cloud and reconciles the catalogue against it — catalogue entries the cloud no longer lists are PRUNED — so it waits for an administrator. Refused while another scan runs. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/cloud-scans' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/screenshots #

List the template screenshots

admin:read api.read

The screenshots of the public product pages' galleries (template_id filters). Editorial content: no access row is written.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The screenshots.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/screenshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/retention/{retainedResource}/reinstate #

Ask for a retained resource to be given back

admin:write api.read api.privileged

Stages giving the resource back to its customer and answers 202. Refused with 422 unless the row is still pending and the money behind it is resolved. note is optional. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
retainedResource Required path integer min 1 The retention-queue row's id.

Request body Required

Field Type Description
note Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/retention/1/reinstate' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "note": "string"
}'
POST /admin/retention/networks/{network}/purge #

Ask for an emptied network to be torn down

admin:write api.read api.privileged

Stages tearing down the network and returning its addresses, and answers 202. Cannot be undone once approved. Refused with 422 while it is paid for or holds a machine or a billed address. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
network Required path integer min 1 The network's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/retention/networks/1/purge' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/screenshots/{screenshot}/publish #

Ask for a screenshot to be published or hidden

admin:write api.read api.privileged

Stages showing (published: true) or hiding the screenshot on the public product page, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
screenshot Required path integer min 1 The screenshot's id.

Request body Required

Field Type Description
published Required boolean

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/screenshots/1/publish' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "published": true
}'
POST /admin/screenshots/{screenshot} #

Ask for a screenshot to be edited

admin:write api.read api.privileged

Stages editing the screenshot's title, description, language (tr-TR, en-US or ar-SA) and order, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
screenshot Required path integer min 1 The screenshot's id.

Request body Required

Field Type Description
title Required string
description Required string
language Required string
order Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/screenshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "description": "string",
    "language": "string"
}'
POST /admin/screenshots/{screenshot}/delete #

Ask for a screenshot to be deleted

admin:write api.read api.privileged

Stages deleting the screenshot and its image file, and answers 202. Cannot be undone once approved. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Everything it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
screenshot Required path integer min 1 The screenshot's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/screenshots/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/profile #

Ask for a customer profile edit

admin:write api.read api.privileged

Stages editing a customer login's profile and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Send only the fields that change; an absent field keeps its value, and the merged profile must still pass the admin area's form rules. Tags are not edited here. Refused with 422 for a staff login, an invalid profile or an edit already waiting.

The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Optional string
birthdate Optional string
identity_number Optional string
passport_number Optional string
phone Optional string
language Optional string
telegram_user_id Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/profile' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "birthdate": "string",
    "identity_number": "string",
    "passport_number": "string",
    "phone": "string",
    "language": "string",
    "telegram_user_id": "string"
}'
POST /admin/customers/{user}/billing-info #

Ask for a customer billing-details edit

admin:write api.read api.privileged

Stages editing the billing details of a customer login's account and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url). Send only the fields that change; the merged record must still pass the admin area's form rules, and a partner's billing stays corporate. A new country that would change the billing currency is refused at approval while the account has bills open.

The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
company_name Optional string
tax_number Optional string
tax_office Optional string
trade_registry_office Optional string
trade_registry_number Optional string
address Optional string
city Optional string
state Optional string The state, province or region — optional. Absent keeps the one on file; an empty value clears it. Outside Türkiye a domain name is registered with it, by the name or code the domain registry knows for the country.
postal_code Optional string
country Optional string
incorporation_country Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/billing-info' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "company_name": "string",
    "tax_number": "string",
    "tax_office": "string",
    "trade_registry_office": "string",
    "trade_registry_number": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "postal_code": "string",
    "country": "string",
    "incorporation_country": "string"
}'
POST /admin/customers/{user}/password-reset #

Ask for a customer password reset

admin:write api.read api.privileged

Stages resetting a customer login's password and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url). Approved, the password is replaced by one nobody knows, the customer is signed out everywhere and e-mailed the ordinary password-reset link to choose a new one. No password is accepted or returned.

The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/password-reset' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/delete #

Ask for a customer login to be deleted

admin:write api.read api.privileged

Stages deleting a customer login and answers 202. NOTHING IS DELETED by this request: an administrator must approve the entry (approval_url). Refused with 422 for a staff login, the owner of an account other logins stand on, and a sole login whose account still holds machines, disks, addresses, live subscriptions, a partnership in force or unfinished refunds; at approval also for a login the database still holds records for.

The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/notifications #

Switch a customer's notifications

admin:write api.read api.privileged

Switches a customer login's e-mail and phone (Telegram) notifications, DIRECTLY: a message preference, reversible with the next request, and audited. Send only the switch you change. Two-factor and token-revocation settings are not changed here.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
email Optional boolean
phone Optional boolean

Responses

  • 200 The switches as they now stand.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/notifications' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": true,
    "phone": true
}'
POST /admin/customers/{user}/account/bill-notices #

Set whether an account is told about new bills

admin:write api.read api.privileged

Sets the account's bill-notice override and answers 200 with the new state: inherit follows the installation's setting, on always tells the account's customers about a new bill, off never does. Takes effect at once; the change is recorded in the audit trail. Staff's own Notify Customer button is not affected.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
notify_pending_payments Required string

Responses

  • 200 The account's bill-notice state after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/bill-notices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "notify_pending_payments": "inherit"
}'
POST /admin/customers/{user}/account/pay-day #

Set the day an account's subscriptions renew on

admin:write api.read api.privileged

Sets the day of the month (1–28) every subscription of the account renews on and answers 200 with it; null puts each subscription back on its own anniversary. The gap up to the new day is billed pro rata at each subscription's next renewal; annual subscriptions keep their month. No open bill is changed. Takes effect at once; the change is recorded in the audit trail.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
day Required integer

Responses

  • 200 The account's pay day after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/pay-day' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "day": 1
}'
POST /admin/customers/{user}/account/default-interest #

Ask for an account's default interest to be switched on or off

admin:write api.read api.privileged

Stages the account's default-interest override and answers 202: inherit follows the installation's switch (billing_default_interest_enabled in GET /admin/settings), on charges default interest on the account's late bills whatever that switch says, off charges none and shows no accrual. Refused with 422 when the account already has that setting, or while another such change on it waits, or with no reason. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
default_interest_enabled Required string
reason Required string Why the setting changes; recorded with the change. Switching interest ON is not retroactive — it accrues only from the moment it came on.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/default-interest' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "default_interest_enabled": "inherit",
    "reason": "string"
}'
POST /admin/customers/{user}/account/block #

Ask for refunds or purchasing to be blocked on an account

admin:write api.read api.privileged

Stages turning one of the account's two staff switches on or off and answers 202. switch: refunds stops the customer's own refund requests (staff refunds still pass; the seven-day window is unchanged); switch: shop disables purchasing while everything the customer holds keeps running. A reason is required to block; staff read it, the customer never does. Refused with 422 when the switch is already in that position and, unless the token's owner is a super-admin, for an account that holds a super-admin login. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
switch Required string
blocked Required boolean
reason Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "switch": "refunds",
    "blocked": true
}'
POST /admin/customers/{user}/account/partner-bank-details #

Ask for a partner's bank details to be recorded

admin:write api.read api.privileged

Stages recording (or replacing) the bank account a partner's rebates are transferred to and answers 202. A partner billed in Türkiye needs account_holder and a TR IBAN; a foreign partner also needs swift and bank_name. The preview and the outcome print only the IBAN's last four characters. Refused with 422 when these are already the details on file. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
account_holder Required string
iban Required string
swift Optional string
bank_name Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/partner-bank-details' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "account_holder": "string",
    "iban": "string"
}'
POST /admin/customers/{user}/account/partnership-end #

Ask for a partner's partnership to end

admin:write api.read api.privileged

Stages ending the account's partnership and answers 202. mode: now ends it at once (ground: breach_immediate, inactivity, insolvency or partner_terminated); mode: schedule ends it at the start of date (ground: convenience — at least 30 days away — inactivity or insolvency); mode: cure sends a breach notice the partner reads (breach_description) and ends the partnership in 30 days unless staff mark it remedied. A reason is required for now and schedule; staff read it, the partner never does. Refused with 422 for an account that is not a partner, an inactivity ground on a partner that is not measured inactive, a second plain end, or a second open breach notice. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
mode Required string
ground Optional string
date Optional string
reason Optional string
breach_description Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/partnership-end' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "mode": "now"
}'
POST /admin/customers/{user}/account/partnership-end/{notice}/outcome #

Ask for an open partnership end notice to be decided

admin:write api.read api.privileged

Stages a decision on one open end notice of the account and answers 202. decision: withdraw takes back an end staff scheduled (never a breach notice, and never the partner's own notice); remedied marks a breach notice put right; escalate ends the partnership now for breach (reason required); open_code and close_code move a breach notice's switch that lets the partner code keep linking new clients while it stands. The partner's own notice is withdrawn only by agreement: the partner asks from its partner page, and accept_withdrawal agrees (the notice is withdrawn) while decline_withdrawal leaves it to run out on its date (reason optional and never shown to the partner; the partner may ask again). Both are refused with 422 unless the partner's request is waiting, or once the notice's date has come; an answer approved after the partner's request changed (declined and asked again) fails rather than answering the new one. Moving the code switch writes to the partner (by e-mail and on its partner page), never with the reason. Refused with 422 for a notice that is not open on this account. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
notice Required path integer min 1 The open end notice's id, on this account.

Request body Required

Field Type Description
decision Required string
reason Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/partnership-end/1/outcome' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "decision": "withdraw"
}'
POST /admin/customers/{user}/account/members/invite #

Ask for an address to be invited onto the account

admin:write api.read api.privileged

Stages inviting email to join the {user}'s account with preset and answers 202. Once approved the invitation is mailed in the account owner's name; nothing changes until the person accepts, and no login is created for them. Refused with 422 for an account with no owner, an unknown preset, an address that already has an invitation and an address already waiting for approval. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
email Required string
preset Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/members/invite' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "string",
    "preset": "owner"
}'
POST /admin/customers/{user}/account/members/{member}/capabilities #

Ask for a member's capabilities to be replaced

admin:write api.read api.privileged

Stages replacing {member}'s capability matrix and answers 202. capabilities maps each domain (cloud, billing, dns, tickets, shop, account, members, ai) to none, view or manage; a domain left out becomes none. Refused with 422 for the account's owner, an unknown domain or level, and — unless the token's owner is a super-admin — a super-admin's login. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer A login of the `{user}`'s account; any other id answers `404`.

Request body Required

Field Type Description
capabilities Required object

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/members/1/capabilities' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "capabilities": []
}'
POST /admin/customers/{user}/account/members/{member}/remove #

Ask for a member login to be removed

admin:write api.read api.privileged

Stages removing {member} from the account and answers 202. The login is deleted; the account keeps everything it owns. Refused with 422 for the account's owner, the only login on the account and — unless the token's owner is a super-admin — a super-admin's login. A login that tickets, orders or invoices still reference cannot be removed: the approval then fails. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer A login of the `{user}`'s account; any other id answers `404`.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/members/1/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/account/merge #

Ask for another account to be merged into this one

admin:write api.read api.privileged

Stages merging the account source_account_id INTO the {user}'s account and answers 202: every login on the source moves here with preset, the source's balance moves with them, and the source is CLOSED. This cannot be undone. Refused with 422 unless the source is mergeable exactly as the admin area's merge dialog says (no blocker — machines, disks, addresses, zones, open subscriptions, unfinished refunds, staff logins, a partnership in force — neither account closed, and not the same account). The approval replaces the admin area's typed confirmation. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
source_account_id Required integer
preset Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/merge' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "source_account_id": 1,
    "preset": "owner"
}'
GET /admin/customers/{user}/account #

Read where an account's controls stand

admin:read api.read api.privileged

The account of {user}: its six quotas, and controls — the AI gateway limits (the budget is shown, never set here), the refund and shop blocks, the bill-notice override, the partner terms and the managing agency, the partner's bank details with the IBAN masked to its last four characters, the partnership-end notices still open, each member's capabilities and the invitations still outstanding. The same stored-state report the admin MCP's get_account prints; nothing is asked of the gateway or the cloud.

Writes an account.pii_read audit row and is charged against the tighter privileged read budget. Requires an admin:read token whose owner holds the admin or super-admin role. A staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The account's controls.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/account/quotas #

Ask for new quotas on an account

admin:write api.read api.privileged

Stages new quotas for the account — machines, disks, manual snapshots, AI gateway keys, public addresses and networks (the free network every account holds counts) — and answers 202. Name only the quotas that change; the rest keep their current figures. The bounds are the account page's own. A lower quota removes nothing the account holds; it stops further orders. Refused with 422 when nothing would change or the same act is already waiting. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
max_vms Optional integer
max_vols Optional integer
max_snapshots Optional integer
ai_max_keys Optional integer
max_ips Optional integer
max_networks Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/quotas' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "max_vms": 1,
    "max_vols": 1,
    "max_snapshots": 1,
    "ai_max_keys": 1,
    "max_ips": 1,
    "max_networks": 1
}'
POST /admin/customers/{user}/account/ai-limits #

Ask for new AI gateway limits on an account

admin:write api.read api.privileged

Stages the account's AI gateway allow-list and rate limits and answers 202. An empty or null allowed_models means every sellable model; a model the gateway cannot price is refused. The budget is never changed here — it is a grant, set on the account page — and an account that has never used the gateway is refused with 422. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
allowed_models Optional array of string
rpm_limit Optional integer
tpm_limit Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/ai-limits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "allowed_models": [
        "string"
    ],
    "rpm_limit": 1,
    "tpm_limit": 1
}'
POST /admin/customers/{user}/account/partner #

Ask for new partner terms on an account

admin:write api.read api.privileged

Stages a save of the account's partner card — a reseller's tier and discount, the start date, an agency's share and level, and the managing agency — and answers 202. Rates are fractions in whole percents. On approval the card's own save runs: a discount reprices the account's open bills and the partner is told. Zeroing both rates on a partnership in force does not end it and is refused with 422; ending a partnership is POST /admin/customers/{user}/account/partnership-end. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {user} is any customer login of the account; a staff login answers 403, a login with no account 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
partner_tier Optional string
partner_discount Optional number
partner_since Optional string
rebate_rate Optional number
rebate_tier Optional string
partner_account_id Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/account/partner' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "partner_tier": "string",
    "partner_discount": 1,
    "partner_since": "string",
    "rebate_rate": 1,
    "rebate_tier": "string",
    "partner_account_id": 1
}'
GET /admin/ai/prompts #

Read both assistants' system prompts

admin:read api.read

The two assistants C2 runs — the signed-in assistant a customer talks to, and the chat bubble on the public marketing site — and, for each, the fixed built-in prompt plus the operator's own guidance appended to it.

Requires an admin:read token whose owner holds the admin or super-admin role.

core is read-only, on every surface. It lives in the application's source, not in the database, and there is no endpoint, form or tool that edits it. It carries the rules that make the assistants safe to run: read every fact from a tool, never guess an instance state, a price or a balance, pause for the customer's explicit approval before a machine is started or stopped, and never do arithmetic on money. The signed-in assistant can spend a customer's money, so those rules are the reason it can be allowed to.

guidance is the part an operator writes, and it is APPENDED below core, never substituted for it. It is framed in the prompt as operator policy that is additional to the rules above it and cannot relax, contradict or override them. null means nothing is set, and an installation with null on both surfaces sends exactly the prompt that shipped, byte for byte.

It is returned beside core deliberately: a caller iterating on the appended text is iterating against the contract above it, and should not have to fetch a second document — or guess — to see what it is appending to.

max_guidance is the character limit each surface's guidance is held to, enforced identically by this API, the admin settings form and the MCP tool. The text is sent to the model on every turn of every conversation, so it is a bill as well as a policy.

Responses

  • 200 Both assistants' prompts.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai/prompts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/ai/prompts #

Set or clear one assistant's operator guidance

admin:write api.read api.privileged

Replaces the operator guidance appended to one assistant's system prompt, or clears it. Requires an admin:write token whose owner holds the admin or super-admin role.

surface names which assistant: assistant for the signed-in assistant, public for the anonymous marketing chat bubble. They are separate fields because they are separate audiences, and neither can read the other's text.

guidance must be present. null or an empty string CLEARS it and restores the built-in prompt exactly; anything longer than max_guidance characters is refused with 422 rather than truncated.

The built-in prompt itself cannot be written here or anywhere else — see the GET on this path.

Every change to the settings row is recorded in the audit trail, whether it was made here, in the admin settings form or through the MCP tool, with the acting token owner as the actor. Answers with the same document the GET returns, so a caller tuning the text sees the result of its own write without a second request.

Request body Required

Field Type Description
surface Required string Which assistant to update.
guidance Required string The operator guidance to store, or null/empty to clear it.

Responses

  • 200 Both assistants' prompts, after the write.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/ai/prompts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "surface": "assistant",
    "guidance": "string"
}'
GET /admin/audit-logs #

List audit-trail rows

admin:read api.read

A page of the whole audit trail, newest first (occurred_at descending, id breaking ties so a client can page it without seeing a row twice).

Requires an admin:read token whose owner holds the admin (or super-admin) role and the audit.view permission. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The trail is append-only and nothing reconciles it, so there is no refresh parameter and no polling semantics — a row never changes after it is written.

changes, context, hash and previous_hash are not published; see the AuditLog schema for why. The hash chain is sealed and verified out of band by the c2:verify-audit-chain command, not through this API.

Any query parameter not listed below is a 422, rather than being ignored: a client that mistypes a filter would otherwise receive the whole unfiltered trail and believe it had asked a narrower question.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
actor_id Optional query integer min 1 Only rows written by this user.
subject_id Optional query integer min 1 Only rows whose data subject is this user.
event Optional query string max length 96 Substring match against the dotted event name.
domain Optional query string one of cloud, billing, dns, tickets, account, auth, shop, privacy, partner, system Kept in lock-step with `App\Enums\AuditDomain`, which is what `IndexAuditLogRequest` derives its own validation rule from — see the `AuditLog` schema's `domain` field.
from Optional query string Inclusive lower bound on `occurred_at`.
to Optional query string Inclusive upper bound on `occurred_at`.

Responses

  • 200 A page of audit rows.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/audit-logs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/audit-logs/{auditLog} #

Get one audit-trail row

admin:read api.read

One row of the append-only trail.

This is the only endpoint on the staff surface that answers 403 rather than 404 for a row the caller may not read. Elsewhere a resource outside the caller's scope is indistinguishable from one that does not exist, because scoping there is per-customer; the trail is a single global collection, so "this row exists but is not yours to read" is the honest answer.

Unlike the collection, this path carries no audit.view requirement in its middleware — authorization is the AuditLogPolicy, which admits an admin holding audit.view, the row's own data subject reading their own trail, and a support agent holding at least view on the row's domain for that row's subject. Rows in the auth, shop, privacy and system domains have no support equivalent and are never visible to a support agent.

changes, context, hash and previous_hash are not published; see the AuditLog schema.

Parameters

Name In Type Description
auditLog Required path integer min 1 The audit row id.

Responses

  • 200 The audit row.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/audit-logs/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/support-assignments #

List the support-assignment matrix

admin:read api.read

Every row of the support-assignment table, most recently updated first: which agent may act on which customer, and at what level in each of the five domains.

Requires an admin:read token whose owner holds the admin (or super-admin) role and the support.manage permission. The equivalent admin route is gated role_or_permission:super-admin|support.manage; a super-admin who does not literally hold the permission is admitted here too, through the application's god-mode gate, which makes the two equivalent. That equivalence is proven by test rather than assumed.

Read-only. This table is the control plane for every gate on the Support surface: a token that could write it could grant any agent manage over any customer, and no policy stands behind such a route. Exposing the write side needs its own threat model, not a verb.

Both sides are projected to {id, name, email} and are null when the account has been deleted. Publishing the matrix read-only lets an operator diff intended access against actual access without touching either.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of assignment rows.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/support-assignments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/staged-actions #

List the approval queue

admin:read api.read

Every action a token has asked for and a person decides — a news item to publish, and later kinds — newest first, with what it will do (preview), who asked, and what became of it. Poll this, or the single entry, to learn whether a request was approved, rejected, lapsed or failed.

Requires an admin:read token whose owner holds the admin or super-admin role.

Read-only, and deliberately so. No endpoint on this API approves or rejects an entry: that is a click by a signed-in administrator on the admin area's approvals page (approval_url). A token can only ask. The frozen payload is not published; preview is the sentence the approver reads.

Parameters

Name In Type Description
status Optional query string one of pending, approved, rejected, expired, failed Only entries in this state.
action Optional query string Only entries of this kind, for example `publish_news`. An unknown kind is refused with `422`.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of queue entries.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/staged-actions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/staged-actions/{stagedAction} #

Get one approval-queue entry

admin:read api.read

One entry of the approval queue, by the staged_action_id the request that created it returned. status moves from pending to exactly one of approved, rejected, expired or failed, and never back.

Requires an admin:read token whose owner holds the admin or super-admin role. Read-only: see the listing for why.

Parameters

Name In Type Description
stagedAction Required path integer min 1 The queue entry id.

Responses

  • 200 The queue entry.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/staged-actions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/news #

List news items

admin:read api.read

The site's news items, newest first — drafts and published alike, filtered by published when it is given.

Requires an admin:read token whose owner holds the admin or super-admin role. Editorial content: no person's data is read, so no access-log row is written.

Parameters

Name In Type Description
published Optional query boolean `true` for published items only, `false` for drafts only.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of news items.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/news' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/news #

Create a news draft

admin:write api.read api.privileged

Creates a DRAFT with the rules the draft tools apply: title up to 255 characters, body up to 2048, language one of tr-TR, en-US, ar-SA, and an optional audience. It is never published, scheduled or sent here: is_published, publish_date and scheduled_for in the body are refused with 422 (a schedule publishes on its own when it falls due), and publishing is a separate request that an administrator must approve (POST /admin/news/{news}/publish).

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
title Required string
body Required string
language Required string
audience Optional string

Responses

  • 201 The draft.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "body": "string",
    "language": "tr-TR"
}'
GET /admin/news/{news} #

Get one news item

admin:read api.read

One news item by id. Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The news item id.

Responses

  • 200 The news item.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/news/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/news/{news} #

Edit a news draft

admin:write api.read api.privileged

Changes only the fields sent (title, body, language, audience), each held to the create rules; an empty body is a 422, and so is is_published, publish_date or scheduled_for. A published item, or a draft somebody scheduled in the admin area, cannot be edited here and answers 422. POST rather than PATCH: every write on the staff API is a POST.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The draft's id.

Request body Required

Field Type Description
title Optional string
body Optional string
language Optional string
audience Optional string

Responses

  • 200 The draft, after the edit.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "body": "string",
    "language": "tr-TR",
    "audience": "everyone"
}'
POST /admin/news/{news}/publish #

Ask for a news item to be published

admin:write api.read api.privileged

Stages the publication of a draft in the approval queue and answers 202. NOTHING IS PUBLISHED OR SENT by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. An item that is already published is refused with 422. Each request stages a new entry.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The draft's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1/publish' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/news/{news}/schedule #

Ask for a news item to be published at a moment

admin:write api.read api.privileged

Stages the scheduled publication of a draft in the approval queue and answers 202, like POST /admin/news/{news}/publish. NOTHING IS SCHEDULED, PUBLISHED OR SENT by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does. Once approved, the item is published and sent to its audience within a minute of publish_at, and that cannot be recalled; until then POST /admin/news/{news}/unschedule takes the schedule back. The approval is refused if publish_at has passed while the entry waited, or if the item changed meanwhile.

publish_at is an ISO-8601 date and time in the future. With an offset (Z, +03:00) it means exactly that moment; without one it is read in timezone (an IANA name, default Europe/Istanbul). The receipt's preview prints the moment in Europe/Istanbul and in UTC. Refused with 422: a moment in the past, an item that is already published, the moment the item is already scheduled for, an item with a scheduling or a publication already waiting for approval, and a draft missing its title, text or language. Staging again for a scheduled draft moves its time.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The draft's id.

Request body Required

Field Type Description
publish_at Required string When to publish, ISO-8601, in the future.
timezone Optional string IANA time zone for a `publish_at` without an offset. Default `Europe/Istanbul`.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1/schedule' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "publish_at": "2026-11-02T09:00:00+03:00"
}'
POST /admin/news/{news}/unschedule #

Take a news item's schedule back

admin:write api.read api.privileged

Takes a scheduled draft back to an unscheduled draft, so it does not go out at its scheduled time. This runs at once, without approval: nothing is published or sent, and the item stays a draft that can be edited again or scheduled again with POST /admin/news/{news}/schedule. The act is recorded in the audit trail. An item that is already published (it has gone out and cannot be recalled), or one that is not scheduled, is refused with 422.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The scheduled draft's id.

Responses

  • 200 The draft, now unscheduled.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1/unschedule' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/coupons #

List coupons

admin:read api.read api.privileged

The installation's coupons, newest first: the code, the terms, the scope (public, or personal to one account with its owner's e-mail), the product restriction, the redemption cap and count, and how many subscriptions carry each. Filter with query (a substring of the code or the description), status and account_id — coupons personal to that account, attached to one of its subscriptions, or redeemed by it.

Requires an admin:read token whose owner holds the admin or super-admin role. A personal coupon names a customer, so every call writes a billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read.

Parameters

Name In Type Description
query Optional query string max length 255 A substring of the code or the description.
status Optional query string one of live, upcoming, expired `live`, `upcoming` or `expired`, by the redemption window.
account_id Optional query integer min 1 Only coupons personal to this account, attached to one of its subscriptions, or redeemed by it.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of coupons.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/coupons' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/coupons/{coupon} #

Get one coupon and every subscription it is on

admin:read api.read api.privileged

One coupon with every subscription it is attached to: the subscription and its status (is_superseded marks an earlier step of a renewal or resize chain), the account and its owner's e-mail, when the coupon was attached, and discount_ends_at — the instant the discount stops on that subscription, by the same rule its bills are priced with: the window's start plus duration_months and 25 days, or valid_before if earlier. The window starts at the attachment, or at the subscription chain's first purchase when the attachment carries no date (window_source: chain_origin).

Requires an admin:read token whose owner holds the admin or super-admin role. Writes a billing.pii_read access row — against the account's owner for a personal coupon, otherwise as a fleet read.

Parameters

Name In Type Description
coupon Required path integer min 1 The coupon's id.

Responses

  • 200 The coupon, with every subscription it is on.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/coupons/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/coupons/{coupon} #

Ask for a coupon's terms to be changed

admin:write api.read api.privileged

Stages an edit of the coupon in the approval queue and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Send any of description, discount_percent (a discount changed here is capped at 50 percent; 422 above it), duration_months (1-120 — lengthen it to carry the discount past a renewal), valid_after and valid_before; an absent key is left as it is. The code, the account scope, the redemption cap and the product scope are not changed here. The preview names every live subscription carrying the coupon with the date its discount ends now and after the edit; an edit does NOT reprice bills already open. A second edit of the same coupon while the first still waits is a 422. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
coupon Required path integer min 1 The coupon's id.

Request body Required

Field Type Description
description Optional string
discount_percent Optional integer
duration_months Optional integer
valid_after Optional string
valid_before Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/coupons/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "string",
    "discount_percent": 1,
    "duration_months": 1,
    "valid_after": "string",
    "valid_before": "string"
}'
POST /admin/coupons/{coupon}/attach #

Ask for a coupon to be attached to a subscription

admin:write api.read api.privileged

Stages attaching the coupon to the subscription named in the body and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the coupon discounts that subscription for duration_months from the approval, and its open (unpaid) bills are repriced; a bill that already took account credit is left as it is and named. A subscription carries one coupon: one already on it is replaced. Refused with 422 — at staging and again at approval — when the coupon cannot discount the subscription today (not yet valid, expired, another customer's personal code, a product it does not cover, its redemption cap reached, or its window already over), for a subscription superseded by a renewal or resize, for one that already carries this coupon, and while another coupon change on the same subscription waits. The preview gives the price now and after. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
coupon Required path integer min 1 The coupon's id.

Request body Required

Field Type Description
subscription_id Required integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/coupons/1/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "subscription_id": 1
}'
POST /admin/coupons/{coupon}/detach #

Ask for a coupon to be removed from a subscription

admin:write api.read api.privileged

Stages removing the coupon from the subscription named in the body and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the subscription is priced without the discount from its next bill on and its open (unpaid) bills are repriced to that figure; a bill that already took account credit is left as it is and named. Removal takes every coupon off the subscription, and the preview names each. Refused with 422 when the subscription does not carry the coupon, and while another coupon change on the same subscription waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
coupon Required path integer min 1 The coupon's id.

Request body Required

Field Type Description
subscription_id Required integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/coupons/1/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "subscription_id": 1
}'
GET /admin/payments #

List payments

admin:read api.read api.privileged

Payments across every customer account, newest first — the answer the admin MCP tool list_payments gives. Each row carries the owning account id and name, the owner's id and e-mail, the payment's stored figures in its own currency, its kind, and whether it is superseded or administrative. Filter with account_id and status.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only payments belonging to this account.
status Optional query string one of new, payed, failed, canceled, expired, refunded, partially_refunded Only payments in this state.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of payments, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/payments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/payments/{payment} #

Read one payment

admin:read api.read api.privileged

One payment from any customer account — the answer the admin MCP tool get_payment gives: its stored figures, the subscriptions it settled, EVERY refund row against it (pending and failed ones included, which are money still owed), the completed refund lines at their frozen figures, what went back to the card and to account credit, and its default-interest state. An unknown id answers 404.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row against the payer's owner. Read-only.

Parameters

Name In Type Description
payment Required path integer The payment id.

Responses

  • 200 One payment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/payments/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/subscriptions #

List subscriptions

admin:read api.read api.privileged

Subscriptions across every customer account, newest first — the answer the admin MCP tool list_subscriptions gives. Each row carries the owning account id and name, the owner's id and e-mail, the contract's fields, whether it is superseded or administrative, and its coupons. Filter with account_id and status (new, pending, failed, deployed, locked, terminated, scaling, unknown).

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only subscriptions owned by this account.
status Optional query string Only subscriptions in this state.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of subscriptions, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/subscriptions/{subscription} #

Read one subscription

admin:read api.read api.privileged

One subscription from any customer account — the answer the admin MCP tool get_subscription gives: the contract, its coupons, its agreed price, its full resize history (every step of the chain, what it charged and what came back, and where) and the payments that settled it. Money in the history is {amount, currency} in minor units. An unknown id answers 404.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row against the account's owner. Read-only.

Parameters

Name In Type Description
subscription Required path integer The subscription id.

Responses

  • 200 One subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/subscriptions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/refunds #

List refunds

admin:read api.read api.privileged

Refunds across every customer account — the answer the admin MCP tool list_refunds gives. Unfinished ones first: pending, then failed, then new, then done, newest first inside each. Each row carries the owning account id and name, the owner's id and e-mail, the payment and subscription it points at, what it returned and where. Filter with account_id and status (new, pending, done, failed).

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only refunds belonging to this account.
status Optional query string Only refunds in this state.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of refunds, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/refunds' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/failed-payments #

List failed payments

admin:read api.read api.privileged

The failed-payment queue — the answer the admin MCP tool list_failed_payments gives: failed payments that can still be collected (a bill a later dues payment absorbed is left out), newest failure first. Rows have the shape of GET /admin/payments. Filter with account_id. Retrying is not offered here.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only this account's failed payments.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of failed payments, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/failed-payments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/invoice-worklist #

List the invoice worklist

admin:read api.read api.privileged

The accountant's invoice worklist, tab for tab — the answer the admin MCP tool list_invoice_queue gives. tab: ready (the default: paid, past the maturity delay, no invoice yet — oldest first), upcoming, review or issued. Each row carries the payment id, the account with its owner's e-mail, when it was charged and matures, and the figures the document must state as plain decimals in the payment's own currency. Also returns the counts per tab and the maturity delay in days.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
tab Optional query string Which tab: ready (the default), upcoming, review or issued.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of the worklist, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/invoice-worklist' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/price-notices #

Preview price-change notices

admin:read api.read api.privileged

The contractual price-change notice preview — the answer the admin MCP tool list_price_notices gives: every account with an agreed price, its owner, whether a notice can be sent, and per subscription the current and new price as plain USD decimals (the answer's currency says USD), the date the new price would apply and the notice deadline. Nothing is sent: sending is a decision made in the admin console.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of accounts, with the totals and the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/price-notices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/dunning-preview #

Preview the dunning pass

admin:read api.read api.privileged

What the next daily suspension (dunning) pass will do, without doing any of it — the answer the admin MCP tool preview_dunning gives: for every overdue subscription the action (warn, suspend, enforce or none), the deadline, its grace period, the customer and the open bill. Urgent first. Filter with action. Nothing is warned, suspended or sent.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
action Optional query string Only rows the pass will: warn, suspend, enforce, or none.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of rows, with the totals and the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/dunning-preview' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/renewal-preview #

Preview the renewal sweep

admin:read api.read api.privileged

What the next hourly renewal sweep will charge — and what it will not, and why — without charging anything: the answer the admin MCP tool preview_renewals gives. Each row carries the subscription, its disposition (bill, comp, stranded, open_bill, paid_ahead, excluded), the periods owed, the net and gross as display strings, how the renewal reaches the customer, the customer and the coupon it is priced with. Filter with disposition. Nothing is charged or sent.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
disposition Optional query string Only rows with this disposition: bill, comp, stranded, open_bill, paid_ahead or excluded.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of rows, with the totals and the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/renewal-preview' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/referral-rewards #

List referral rewards

admin:read api.read api.privileged

Referral rewards — the answer the admin MCP tool list_referral_rewards gives. filter: pending (the default: qualified and waiting for a person's decision), rewarded, rejected or all. Newest first. Each row carries the referrer and the referred customer (id, name, e-mail), the referred account, when it qualified, was rewarded or rejected, the reward as a plain USD decimal (reward_usd) and any self-referral flags.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
filter Optional query string Which rewards: pending (the default), rewarded, rejected or all.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of referral rewards, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/referral-rewards' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/partner-rebates #

List agency rebates

admin:read api.read api.privileged

Agency rebates (hakediş) — the answer the admin MCP tool list_partner_rebates gives. status: held (the default: computed, waiting for the agency's invoice and a person's release) or all. Oldest period first. Each row carries the partner account with its owner's e-mail, the period, the billed volume, the rate and the rebate as plain USD decimals, whether a current invoice is on file, that invoice's number, date and gross, and when the figures were last raised.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes one billing.pii_read access row, as a fleet read. Read-only.

Parameters

Name In Type Description
status Optional query string Which rebates: held (the default) or all.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of rebates, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/partner-rebates' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/instances #

List virtual machines

admin:read api.read api.privileged

Virtual machines across every customer account, oldest first — the answer the admin MCP tool list_instances gives, from the site's stored copy (never a live cloud read). Retired machines waiting in the retention queue are included. Each row carries the owning account id and name, the owner's id and e-mail, the machine's stored fields, and a retired block that is null for a live machine. Filter with account_id and state.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
state Optional query string one of running, stopped, starting, stopping, migrating, shutdown, destroyed, expunging, error, unknown Only machines in this state.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of machines, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/instances/{instance} #

Read one virtual machine

admin:read api.read api.privileged

One virtual machine by id, from any customer account, including a retired one — the answer the admin MCP tool get_instance gives, from the site's stored copy. Returns the machine with its account and owner, its disks, the public IP addresses on its network, the network itself, the subscription that pays for it, and a retired block that is null for a live machine.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes a cloud.pii_read access row against the machine's owner. A missing id answers 404 and records nothing. Read-only.

Parameters

Name In Type Description
instance Required path integer The machine's id, as the listing returns it.

Responses

  • 200 The machine and what stands on it.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/instances/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/volumes #

List disks

admin:read api.read api.privileged

Disks across every customer account, oldest first — the answer the admin MCP tool list_volumes gives, from the site's stored copy (never a live cloud read). Retired disks are included. Each row carries the owning account id and name, the owner's id and e-mail, the disk's stored fields, the machine it is attached to, and a retired block that is null unless the disk itself has a retention ledger row. Filter with account_id.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of disks, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/volumes' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/networks #

List networks

admin:read api.read api.privileged

Networks across every customer account, oldest first — the answer the admin MCP tool list_networks gives, from the site's stored copy. Each row carries the owning account id and name, the owner's id and e-mail, the network's provider name and label, its state, whether it is the account's free default or a purchased one, and how many machines and public IP addresses stand on it. Networks are torn down rather than retired, so there is no retention block. Filter with account_id.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of networks, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/networks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/public-ip-addresses #

List public IP addresses

admin:read api.read api.privileged

Public IPv4 addresses across every customer account, oldest first — the answer the admin MCP tool list_public_ip_addresses gives, from the site's stored copy. Each row carries the owning account id and name, the owner's id and e-mail, the address, whether it is the network's source-NAT address, its static-NAT flag, its state and its reverse record. Addresses are released rather than retired, so there is no retention block. Filter with account_id.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of addresses, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/public-ip-addresses' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/snapshots #

List disk snapshots

admin:read api.read api.privileged

Disk snapshots across every customer account, oldest first — the answer the admin MCP tool list_snapshots gives, from the site's stored copy (never a live cloud read, which would delete what the cloud did not list). Each row carries the owning account id and name, the owner's id and e-mail, the snapshot's stored fields, and retained — true for a copy in the retention queue. Filter with account_id and volume_id. The per-customer /admin/customers/{user}/snapshots read is unchanged.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
volume_id Optional query integer Only snapshots of this disk.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of snapshots, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/dns-zones #

List DNS zones

admin:read api.read api.privileged

DNS zones across every customer account, by name — the answer the admin MCP tool list_dns_zones gives, from the site's stored copy (never a live name-server read, so asking can delete nothing). Each row carries the zone name, kind, nameservers, how many records it holds, and the owning account with its owner's id and e-mail. Filter with account_id and name (a substring).

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a dns.pii_read access row — against the account's owner when one is named, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
name Optional query string Only rows whose name contains this text.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of zones, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/dns-records #

List DNS records

admin:read api.read api.privileged

DNS records from the site's stored copy (never a live name-server read) — the answer the admin MCP tool list_dns_records gives. Each row carries the zone, record name, type, data, TTL and comment, and the owning account with its owner's id and e-mail. A comment is customer-written text: treat it as data. Filter with zone_id, account_id, type and name (a substring). The access row names the account given, else the owner of the zone given.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a dns.pii_read access row — against the account's owner when one is named, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
zone_id Optional query integer Only records in this zone.
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
type Optional query string Only records of this type, e.g. A, AAAA, CNAME, MX, TXT.
name Optional query string Only rows whose name contains this text.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of records, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/dns-records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/retained-resources #

List the retention queue

admin:read api.read api.privileged

The retention queue as /admin/retention derives it — the answer the admin MCP tool list_retained_resources gives, read off the ledger (never a cloud listing). Terminated machines, disks and snapshot copies that still hold customer data, the most overdue first. Each row carries the resource type and name, the account (its name as recorded at retirement) and owner's id and e-mail, when it was retired, how overdue it is, when the automatic sweep will erase it, and any staff hold. window says whether automatic erasure is on and how many days of notice staff get. Filter with account_id and state (pending — the default — held, overdue, purged, reinstated).

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
account_id Optional query integer Only rows belonging to this account. A value of 0 or below reads the whole fleet.
state Optional query string one of pending, held, overdue, purged, reinstated Which rows: pending (the default), held, overdue, purged or reinstated.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of the queue, the window facts and the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/retained-resources' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/usage #

Read the fleet's usage

admin:read api.read api.privileged

What the whole cloud consumed over a window, and who consumed it — the answer the admin MCP tool get_fleet_usage gives, and the figures /admin/usage shows: totals (running and allocated machine hours, storage, snapshot and template averages, address hours, network traffic) and one row per account (the account, its owner's id and e-mail, running machine hours, storage GB, network GB), heaviest first. days takes 7, 30 (the default) or 90; from and to (YYYY-MM-DD, GMT, ending yesterday at the latest) win when both are well formed. A malformed window draws the default. include_series=true adds the per-day series. Quantities only, never prices.

The one staff read that asks the cloud's usage server: the first call for a window can take tens of seconds, then it is cached for an hour (shared with /admin/usage). Nothing is reconciled or deleted. When the usage server is unreachable the answer says available: false. The paging block pages the per-account rows.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a cloud.pii_read access row as a fleet read. Read-only.

Parameters

Name In Type Description
days Optional query integer 7, 30 (the default) or 90. Ignored when from and to are both given.
from Optional query string First day, YYYY-MM-DD (GMT).
to Optional query string Last day, YYYY-MM-DD (GMT); capped at yesterday.
include_series Optional query string one of true, false, 1, 0, yes, no, on, off true adds the per-day series.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 The fleet's usage over the window, a page of per-account rows and the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/usage' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/catalogue #

List the catalogue in full detail

admin:read api.read api.privileged

Catalogue products of one type (vm, volume, ip, network or service) in full detail: everything GET /product-prices returns (prices as ORDINARY USD DECIMALS) plus the copy in English, Turkish and Arabic, front_page, snapshot_mode and snapshot_variant_of_id for machines, network_offering_id for networks, and template_ids, free, per_unit and partner_training for services. The same filters as /product-prices, plus ids (a list of product ids) — the REST twin of the admin MCP's list_catalogue tool.

Requires an admin:read token whose owner holds the admin or super-admin role. UNLOGGED: the catalogue is the installation's own price list, never a customer's data, so no access row is written on either admin surface. Read-only.

Parameters

Name In Type Description
type Optional query string one of vm, volume, ip, network, service vm, volume, ip, network or service. Default vm.
published_only Optional query boolean Only products on sale. Default true.
template Optional query string vm only - a template id, or part of its name.
min_price Optional query number Lowest monthly price in USD (a service: one-time).
max_price Optional query number Highest monthly price in USD (a service: one-time).
ids Optional query array of integer Only these product ids.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of catalogue products, in detail.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/catalogue' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/product-prices #

List catalogue prices for one product type

admin:read api.read api.privileged

Catalogue prices for one product type (vm, volume, ip, network or service), so a change can be staged with set_product_price or set_product_published. Each row: type, id, name, the machine's template, spec (vm: vcpu, ram_gb, disk_gb; volume: size_gb), monthly_price_usd and annual_price_usd (a service: one_time_price_usd) as ORDINARY USD DECIMALS (12.5 means USD 12.50; null = not sold on that period), ispublished, never_priced (no plan, or the scan's placeholder 99), withheld (vm: hidden from customers while its live-VM-snapshot tier is not sellable), live_subscriptions (deployed or locked, not superseded, not comped) and how many of those carry an agreed price. The REST twin of the admin MCP's list_product_prices tool.

Requires an admin:read token whose owner holds the admin or super-admin role. UNLOGGED: no customer row is read, only the installation's own prices and switches and a COUNT of live subscriptions, so no access row is written on either admin surface. Read-only.

Parameters

Name In Type Description
type Optional query string one of vm, volume, ip, network, service vm, volume, ip, network or service. Default vm.
published_only Optional query boolean Only products on sale. Default true.
template Optional query string vm only - a template id, or part of its name.
min_price Optional query number Lowest monthly price in USD (a service: one-time).
max_price Optional query number Highest monthly price in USD (a service: one-time).
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of catalogue prices.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/product-prices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/catalogue/building-blocks #

List what machine configurations are built from

admin:read api.read api.privileged

What machine configurations are built from, so a configuration can be named: kind "templates" (id, name, description, os, retired and retired_at, the marketing copy — excerpt, hero and long_description in English, Turkish and Arabic, manual_url, youtube_url — and how many configurations exist on it, how many are published and how many are actually on sale — none, once the template is retired), "compute_offerings" (id, name, description, vcpu, cpu_speed_mhz, ram_gb) or "disk_offerings" (id, name, description, disk_gb). A vm product is one template x compute offering x disk offering; find its id with /catalogue or /product-prices (template filter). name filters by part of the name. Reads the stored copy only, never the cloud. The REST twin of the admin MCP's list_catalogue_building_blocks tool.

Requires an admin:read token whose owner holds the admin or super-admin role. UNLOGGED: templates and offerings are the installation's own catalogue parts, nobody is named, so no access row is written on either admin surface. Read-only.

Parameters

Name In Type Description
kind Optional query string one of templates, compute_offerings, disk_offerings templates, compute_offerings or disk_offerings. Default templates.
name Optional query string Part of the name.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of templates, compute offerings or disk offerings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/catalogue/building-blocks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/faqs #

List the public FAQ entries

admin:read api.read api.privileged

The public FAQ entries in display order (position, then id): the question and answer in English, Turkish and Arabic, the position and whether it is published. Optional filter published (true/false). Not paged. The REST twin of the admin MCP's list_faqs tool.

Requires an admin:read token whose owner holds the admin or super-admin role. UNLOGGED: this is the installation's own public FAQ text, carrying no customer data, so no access row is written on either admin surface. Read-only.

Parameters

Name In Type Description
published Optional query boolean Only published (true) or only drafts (false).

Responses

  • 200 Every FAQ entry, in display order.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/faqs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/faqs/{faq} #

Read one FAQ entry

admin:read api.read api.privileged

One FAQ entry by id. The REST twin of the admin MCP's get_faq tool.

Requires an admin:read token whose owner holds the admin or super-admin role. UNLOGGED: this is one of the installation's own public FAQ entries, carrying no customer data, so no access row is written on either admin surface. Read-only.

Parameters

Name In Type Description
faq Required path integer min 1 The FAQ id, as GET /faqs returns it.

Responses

  • 200 The FAQ entry.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/faqs/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/accounts #

List customer accounts

admin:read api.read api.privileged

Customer accounts across the whole installation, oldest first — the answer the admin MCP tool list_accounts gives. Each row carries the account id and name, the owner's id and e-mail, the lockout and closure flags, the standing balance and counts of logins, machines, disks and subscriptions. query matches the account name, the owner's name or e-mail, or an exact numeric account id.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read; the search term is recorded only as a flag. Read-only.

Parameters

Name In Type Description
query Optional query string Part of an account name, an owner's name or e-mail, or an exact account id.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of accounts, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/accounts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/accounts/{accountId} #

Read one customer account

admin:read api.read api.privileged

One customer account by id — the answer the admin MCP tool get_account gives: its logins (each with id, e-mail and role), all six resource quotas beside what is in use, the spendable balance, the open bills, the live credit grants, counts of its subscriptions and payments, and controls: where every account control stands (AI gateway limits, refund and shop blocks, the bill-notice override, partner terms and bank details with the IBAN masked, open partnership-end notices, each member's capabilities and the invitations outstanding). Stored state only.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes an account.pii_read access row against the account's owner. A missing id answers 404 and records nothing. Read-only.

Parameters

Name In Type Description
accountId Required path integer The account id, as the account listing returns it.

Responses

  • 200 The account.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/accounts/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/accounts/{accountId}/bill-notices #

Set whether an account is told about new bills

admin:write api.read api.privileged

Sets the account's bill-notice override and answers 200 with the new state: inherit follows the installation's setting, on always tells the account's customers about a new bill, off never does. Takes effect at once; the change is recorded in the audit trail. Staff's own Notify Customer button is not affected.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
notify_pending_payments Required string

Responses

  • 200 The account's bill-notice state after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/bill-notices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "notify_pending_payments": "inherit"
}'
POST /admin/accounts/{accountId}/pay-day #

Set the day an account's subscriptions renew on

admin:write api.read api.privileged

Sets the day of the month (1–28) every subscription of the account renews on and answers 200 with it; null puts each subscription back on its own anniversary. The gap up to the new day is billed pro rata at each subscription's next renewal; annual subscriptions keep their month. No open bill is changed. Takes effect at once; the change is recorded in the audit trail.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
day Required integer

Responses

  • 200 The account's pay day after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/pay-day' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "day": 1
}'
POST /admin/accounts/{accountId}/default-interest #

Ask for an account's default interest to be switched on or off

admin:write api.read api.privileged

Stages the account's default-interest override and answers 202: inherit follows the installation's switch (billing_default_interest_enabled in GET /admin/settings), on charges default interest on the account's late bills whatever that switch says, off charges none and shows no accrual. Refused with 422 when the account already has that setting, or while another such change on it waits, or with no reason. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
default_interest_enabled Required string
reason Required string Why the setting changes; recorded with the change. Switching interest ON is not retroactive — it accrues only from the moment it came on.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/default-interest' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "default_interest_enabled": "inherit",
    "reason": "string"
}'
POST /admin/accounts/{accountId}/block #

Ask for refunds or purchasing to be blocked on an account

admin:write api.read api.privileged

Stages turning one of the account's two staff switches on or off and answers 202. switch: refunds stops the customer's own refund requests (staff refunds still pass; the seven-day window is unchanged); switch: shop disables purchasing while everything the customer holds keeps running. A reason is required to block; staff read it, the customer never does. Refused with 422 when the switch is already in that position and, unless the token's owner is a super-admin, for an account that holds a super-admin login. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
switch Required string
blocked Required boolean
reason Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "switch": "refunds",
    "blocked": true
}'
POST /admin/accounts/{accountId}/combine-bills #

Ask for a customer's open bills to be combined into one payment

admin:write api.read api.privileged

Stages combining every open bill of the account into ONE payment — the staff twin of the customer's own "Pay all" — and answers 202. Once approved the customer has one bill to pay with one card charge and one 3-D Secure check; nothing is charged by the approval, no figure changes (each period stays priced as it was), the customer's own card is kept and nothing is sent to the customer. Refused with 422 — at staging and again at approval — when the account has fewer than two open bills or bills in more than one currency, and the approval is refused when the open bills changed after staging. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/combine-bills' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/accounts/{accountId}/partner-bank-details #

Ask for a partner's bank details to be recorded

admin:write api.read api.privileged

Stages recording (or replacing) the bank account a partner's rebates are transferred to and answers 202. A partner billed in Türkiye needs account_holder and a TR IBAN; a foreign partner also needs swift and bank_name. The preview and the outcome print only the IBAN's last four characters. Refused with 422 when these are already the details on file. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
account_holder Required string
iban Required string
swift Optional string
bank_name Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/partner-bank-details' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "account_holder": "string",
    "iban": "string"
}'
POST /admin/accounts/{accountId}/partnership-end #

Ask for a partner's partnership to end

admin:write api.read api.privileged

Stages ending the account's partnership and answers 202. mode: now ends it at once (ground: breach_immediate, inactivity, insolvency or partner_terminated); mode: schedule ends it at the start of date (ground: convenience — at least 30 days away — inactivity or insolvency); mode: cure sends a breach notice the partner reads (breach_description) and ends the partnership in 30 days unless staff mark it remedied. A reason is required for now and schedule; staff read it, the partner never does. Refused with 422 for an account that is not a partner, an inactivity ground on a partner that is not measured inactive, a second plain end, or a second open breach notice. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
mode Required string
ground Optional string
date Optional string
reason Optional string
breach_description Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/partnership-end' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "mode": "now"
}'
POST /admin/accounts/{accountId}/partnership-end/{notice}/outcome #

Ask for an open partnership end notice to be decided

admin:write api.read api.privileged

Stages a decision on one open end notice of the account and answers 202. decision: withdraw takes back an end staff scheduled (never a breach notice, and never the partner's own notice); remedied marks a breach notice put right; escalate ends the partnership now for breach (reason required); open_code and close_code move a breach notice's switch that lets the partner code keep linking new clients while it stands. The partner's own notice is withdrawn only by agreement: the partner asks from its partner page, and accept_withdrawal agrees (the notice is withdrawn) while decline_withdrawal leaves it to run out on its date (reason optional and never shown to the partner; the partner may ask again). Both are refused with 422 unless the partner's request is waiting, or once the notice's date has come; an answer approved after the partner's request changed (declined and asked again) fails rather than answering the new one. Moving the code switch writes to the partner (by e-mail and on its partner page), never with the reason. Refused with 422 for a notice that is not open on this account. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.
notice Required path integer min 1 The open end notice's id, on this account.

Request body Required

Field Type Description
decision Required string
reason Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/partnership-end/1/outcome' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "decision": "withdraw"
}'
POST /admin/accounts/{accountId}/members/invite #

Ask for an address to be invited onto the account

admin:write api.read api.privileged

Stages inviting email to join the {accountId} account with preset and answers 202. Once approved the invitation is mailed in the account owner's name; nothing changes until the person accepts, and no login is created for them. Refused with 422 for an account with no owner, an unknown preset, an address that already has an invitation and an address already waiting for approval. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
email Required string
preset Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/members/invite' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "string",
    "preset": "owner"
}'
POST /admin/accounts/{accountId}/members/{member}/capabilities #

Ask for a member's capabilities to be replaced

admin:write api.read api.privileged

Stages replacing {member}'s capability matrix and answers 202. capabilities maps each domain (cloud, billing, dns, tickets, shop, account, members, ai) to none, view or manage; a domain left out becomes none. Refused with 422 for the account's owner, an unknown domain or level, and — unless the token's owner is a super-admin — a super-admin's login. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.
member Required path integer A login of the `{accountId}` account; any other id answers `404`.

Request body Required

Field Type Description
capabilities Required object

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/members/1/capabilities' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "capabilities": []
}'
POST /admin/accounts/{accountId}/members/{member}/remove #

Ask for a member login to be removed

admin:write api.read api.privileged

Stages removing {member} from the account and answers 202. The login is deleted; the account keeps everything it owns. Refused with 422 for the account's owner, the only login on the account and — unless the token's owner is a super-admin — a super-admin's login. A login that tickets, orders or invoices still reference cannot be removed: the approval then fails. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.
member Required path integer A login of the `{accountId}` account; any other id answers `404`.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/members/1/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/accounts/{accountId}/merge #

Ask for another account to be merged into this one

admin:write api.read api.privileged

Stages merging the account source_account_id INTO the {accountId} account and answers 202: every login on the source moves here with preset, the source's balance moves with them, and the source is CLOSED. This cannot be undone. Refused with 422 unless the source is mergeable exactly as the admin area's merge dialog says (no blocker — machines, disks, addresses, zones, open subscriptions, unfinished refunds, staff logins, a partnership in force — neither account closed, and not the same account). The approval replaces the admin area's typed confirmation. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
source_account_id Required integer
preset Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/merge' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "source_account_id": 1,
    "preset": "owner"
}'
POST /admin/accounts/{accountId}/quotas #

Ask for new quotas on an account

admin:write api.read api.privileged

Stages new quotas for the account — machines, disks, manual snapshots, AI gateway keys, public addresses and networks (the free network every account holds counts) — and answers 202. Name only the quotas that change; the rest keep their current figures. The bounds are the account page's own. A lower quota removes nothing the account holds; it stops further orders. Refused with 422 when nothing would change or the same act is already waiting. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
max_vms Optional integer
max_vols Optional integer
max_snapshots Optional integer
ai_max_keys Optional integer
max_ips Optional integer
max_networks Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/quotas' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "max_vms": 1,
    "max_vols": 1,
    "max_snapshots": 1,
    "ai_max_keys": 1,
    "max_ips": 1,
    "max_networks": 1
}'
POST /admin/accounts/{accountId}/ai-limits #

Ask for new AI gateway limits on an account

admin:write api.read api.privileged

Stages the account's AI gateway allow-list and rate limits and answers 202. An empty or null allowed_models means every sellable model; a model the gateway cannot price is refused. The budget is never changed here — it is a grant, set on the account page — and an account that has never used the gateway is refused with 422. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
allowed_models Optional array of string
rpm_limit Optional integer
tpm_limit Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/ai-limits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "allowed_models": [
        "string"
    ],
    "rpm_limit": 1,
    "tpm_limit": 1
}'
POST /admin/accounts/{accountId}/partner #

Ask for new partner terms on an account

admin:write api.read api.privileged

Stages a save of the account's partner card — a reseller's tier and discount, the start date, an agency's share and level, and the managing agency — and answers 202. Rates are fractions in whole percents. On approval the card's own save runs: a discount reprices the account's open bills and the partner is told. Zeroing both rates on a partnership in force does not end it and is refused with 422; ending a partnership is POST /admin/accounts/{accountId}/partnership-end. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role. {accountId} is the account's id, as GET /admin/accounts returns it — an account with no login left (the closed source of a merge) included; an unknown id answers 404.

Parameters

Name In Type Description
accountId Required path integer min 1 The account's id, as `GET /admin/accounts` returns it. It names the ACCOUNT, not a login, so an account with no login left — the closed source of a merge — is reachable. Named `accountId`, never `account`: only `user` may scope a staff route to a person.

Request body Required

Field Type Description
partner_tier Optional string
partner_discount Optional number
partner_since Optional string
rebate_rate Optional number
rebate_tier Optional string
partner_account_id Optional integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/accounts/1/partner' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "partner_tier": "string",
    "partner_discount": 1,
    "partner_since": "string",
    "rebate_rate": 1,
    "rebate_tier": "string",
    "partner_account_id": 1
}'
GET /admin/privacy-requests #

List data-subject requests

admin:read api.read api.privileged

Personal-data export and erasure requests, oldest legal due date first — the answer the admin MCP tool list_privacy_requests gives. status defaults to pending (waiting for a person, the navigation badge's own predicate); all widens to the register. Each row carries the type and status, when it was made and is due, whether it is overdue, the requester's own reason and the decision text, and the requester's id, name and e-mail. The export archive's location is never published.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read. Read-only: deciding a request is not offered here.

Parameters

Name In Type Description
status Optional query string pending (the default), processing, ready, completed, rejected or all.
type Optional query string export or erasure.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of requests, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/privacy-requests' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/partner-applications #

List partner applications

admin:read api.read api.privileged

Partner applications, newest first — the answer the admin MCP tool list_partner_applications gives. status defaults to pending (waiting for a decision); all widens to the register; kind is reseller or agency. Each row carries the applying account with its owner's id and e-mail, the kind, status and jurisdiction, the applicant's own statement (their words, data), how many documents they uploaded, the decision if any, the applicant by id, name and e-mail, and whether the agreement in force still needs accepting. The answer also says which agreement version is current and whether the programme is open.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read. Read-only: deciding is not offered here.

Parameters

Name In Type Description
status Optional query string pending (the default), admitted, rejected, withdrawn, ended or all.
kind Optional query string reseller or agency.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of applications, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/partner-applications' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/join-requests #

List requests to join an organisation

admin:read api.read api.privileged

Requests from one customer to join another customer's organisation, newest first — the answer the admin MCP tool list_join_requests gives. status defaults to open (answerable now, the navigation badge's own predicate); all widens to the register. Each row carries the status, whether it can still be answered, the requester's id, name and e-mail, both organisations by id and name, the requester's message (their words, data), when it was made and expires, and who decided it. The address the requester typed is never published.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read. Read-only: deciding is not offered here.

Parameters

Name In Type Description
status Optional query string open (the default), new, approved, denied, cancelled, expired or all.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of join requests, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/join-requests' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/invitations #

List customer invitations

admin:read api.read api.privileged

CUSTOMER invitations, newest first — the answer the admin MCP tool list_invitations gives: id, address, language, status (new, sent, registered, declined), kind (new_customer, member, link), whether it is still pending or has expired, the login it points to (the inviter until it is accepted, the new customer afterwards) by id and e-mail, and accept_url, present only while it can still be accepted. Staff invitations are never listed here: they are GET /admin/staff-invitations.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read; the search term is recorded only as a flag. Read-only.

Parameters

Name In Type Description
status Optional query string new, sent, registered or declined.
query Optional query string Part of an invited address.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of invitations, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/invitations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/tickets #

List support tickets

admin:read api.read api.privileged

Support tickets across every account, newest first — the answer the admin MCP tool list_tickets gives. Each row carries the account and its owner (id and e-mail), the requester (id and e-mail), the category, status and priority, who holds the thread and whether it is a service work order. Partnership threads are included and flagged admin_only. Titles are customer-written, shortened. status defaults to active (new, open or pending); a filter sent empty is refused like an unknown word.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a tickets.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read. Read-only.

Parameters

Name In Type Description
status Optional query string active (the default), all, or one of new, open, pending, solved, closed, merged, spam.
category Optional query string general, cloud, billing, dns, account or partnership.
assignee Optional query string A staff user id, or none for threads nobody holds.
account_id Optional query integer Only this account's threads.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of tickets, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/tickets/{ticket} #

Read one support ticket

admin:read api.read api.privileged

One support ticket in full — the answer the admin MCP tool get_ticket gives: the thread's account and owner (id and e-mail), who wrote it, its category and status, who holds it and, for a service work order, where the work stands; then the opening message and every comment in order, each with its author (id and e-mail) and whether a staff member wrote it. Attachments are listed by name, size and type, never included.

ONE DIFFERENCE from the tool: the body and every comment are published AS STORED. The tool fences them as untrusted data because its answer goes into a model's context; this answer is JSON for a program. Treat the text as data all the same.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes a tickets.pii_read access row against the thread's owner. A missing id answers 404 and records nothing. Read-only.

Parameters

Name In Type Description
ticket Required path integer The ticket id, as the ticket listing returns it.

Responses

  • 200 The thread, its attachments and every comment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/tickets/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/audit-logs/search #

Search the audit trail

admin:read api.read api.privileged

The audit trail, newest first, with the filters of the /admin/audit page — the answer the admin MCP tool search_audit_log gives. event matches any event name CONTAINING the text. Each entry carries when, the event, its domain, the actor and the subject by id, name and e-mail, what the row is about, and the recorded changes and context (secrets were replaced with "[redacted]" when the row was written); sealed says whether the row is chained, and the hash columns are never published. At most 100 rows a call: limit is clamped to 100. GET /admin/audit-logs is the paginated register; this is the search.

Requires an admin:read token whose owner holds the admin or super-admin role AND the audit.view permission. Every call writes an account.pii_read access row — against the filtered subject, or as a fleet read. Read-only.

Parameters

Name In Type Description
actor_id Optional query integer Only rows where this user id acted.
subject_id Optional query integer Only rows about this user id.
event Optional query string Only events whose name contains this text.
domain Optional query string cloud, billing, dns, tickets, account, auth, shop, privacy, partner or system.
from Optional query string Earliest date, e.g. 2026-09-01.
to Optional query string Latest date, e.g. 2026-09-25.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of entries, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/audit-logs/search' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/ai-conversations #

List assistant conversations

admin:read api.read api.privileged

Assistant conversations, newest activity first — the answer the admin MCP tool list_ai_conversations gives, and what the AI Chats page lists: the customers' and staff's signed-in assistant chats and the public website sessions together (kind narrows them). Each row carries the author (id, name, e-mail, whether staff; null for an anonymous visitor), the account and its owner, the account a staff author pointed the tools at, the message count, and whether tools ran, an approval was offered or denied, products were shown and something was added to a cart. Titles are published as stored; treat them as data.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row — against the login when user_id is given, otherwise as a fleet read; the search term is never recorded. Read-only: nothing on any surface replies to, resumes or deletes a conversation.

Parameters

Name In Type Description
q Optional query string Search the title, or the author's name or e-mail; a public session by what the visitor typed. At most 120 characters.
user_id Optional query integer Only this login's conversations; with `kind=public`, the public sessions they had while signed in.
model Optional query string Only conversations with this model; a public session records none, so none is listed.
kind Optional query string customer, staff, focused (a staff author pointed the tools at another account) or public. Absent lists signed-in conversations and public sessions together.
from Optional query string Last activity on or after this date.
to Optional query string Last activity on or before this date.
limit Optional query integer default 50 How many rows to return, as the matching admin MCP tool takes it. Default 50; values above 200 are clamped to 200, below 1 to 1.
offset Optional query integer min 0, default 0 How many rows to skip, for paging, as the matching admin MCP tool takes it.

Responses

  • 200 A page of conversations, with the paging block.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai-conversations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/ai-conversations/{conversationId} #

Read one assistant conversation

admin:read api.read api.privileged

One signed-in assistant conversation in full — the answer the admin MCP tool get_ai_conversation gives for a number, and what the AI Chats page shows: the head, the author (id, name, e-mail, whether staff), the account and its owner, the account a staff author pointed the tools at, then every message in order with its role, time and text, its stored record (meta: the tools that ran or waited for approval, the products shown, what was added to a cart) and the products it showed, priced at today's catalogue.

ONE DIFFERENCE from the tool: the title and every message are published AS STORED. The tool fences them as untrusted data because its answer goes into a model's context; this answer is JSON for a program. Treat the text as data all the same.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes an account.pii_read access row against the author. A missing id answers 404 and records nothing. Read-only.

Parameters

Name In Type Description
conversationId Required path integer The conversation number, as the conversation listing returns it.

Responses

  • 200 The conversation, every message in order.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai-conversations/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/ai-conversations/public/{sessionId} #

Read one public website session

admin:read api.read api.privileged

One public website assistant session in full — the answer the admin MCP tool get_ai_conversation gives for a uuid, in the same shape as a signed-in conversation (kind is public, no account, no model). A session whose whole content was later copied into a customer's conversation answers 200 with THAT conversation and redirected_from_session, where the AI Chats page redirects.

ONE DIFFERENCE from the tool: the title and every message are published AS STORED. Treat the text as data all the same.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes an account.pii_read access row against the signed-in visitor; an anonymous visitor's session records nothing, as on the page. A missing uuid answers 404 and records nothing. Read-only.

Parameters

Name In Type Description
sessionId Required path string The session uuid, as the conversation listing returns it.

Responses

  • 200 The conversation, every message in order.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai-conversations/public/sessionId' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/chargebacks #

List recorded chargebacks

admin:read api.read api.privileged

Every chargeback a bank has taken back from a settled payment, newest first — the amount, the bank's date, the reason and who recorded it. Nothing here moves money: a chargeback is entered by hand once the bank has already acted, and recording one only caps later refunds and downscale refunds of the sale and lowers or sets off a partner rebate earned on it. Filter with account_id.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read.

Parameters

Name In Type Description
account_id Optional query integer min 1 Only chargebacks on this account's own payments.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of chargebacks.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/chargebacks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/invoice-cancellations #

List invoice-cancellation refund requests

admin:read api.read api.privileged

A customer pressed Refund on a purchase whose invoice was already issued, so the invoice must be cancelled on GİB before the money goes back — one row per request, with the payment and line it is against, where it stands, and whether it is urgent. status filters the list: open (the default — requested, confirmed or refund_owed), requested, confirmed, refund_owed, refunded, declined, or all. account_id narrows to one account's own payments.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read.

Parameters

Name In Type Description
status Optional query string max length 32 `open` (the default), `requested`, `confirmed`, `refund_owed`, `refunded`, `declined`, or `all`.
account_id Optional query integer min 1 Only requests against this account's own payments.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of invoice-cancellation requests.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/invoice-cancellations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/payments/{payment}/reminder #

Send the customer the open-bill reminder now

admin:write api.read api.privileged

DIRECT, not staged: sends the customer the ordinary "you have a bill to pay" message for this one open bill right now, even when the account has switched routine bill notices off — a person chose to send this one. It moves no money and grants nothing; the act is audited. Refused with 422 for a bill the customer cannot pay today (already paid, cancelled, absorbed into a combined payment, or refused by a shop block) or an account with nobody to write to.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
payment Required path integer min 1 The payment's id.

Responses

  • 200 The reminder was sent.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/payments/1/reminder' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/payments/{payment}/chargebacks #

Ask for a chargeback to be recorded

admin:write api.read api.privileged

Stages recording a chargeback the bank already took back and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The approval moves no money — the bank already took it — but it is a standing money record: it caps later refunds and downscale refunds of the sale, and lowers or sets off a partner rebate earned on it; administrators are notified. amount is in the payment's own currency, from 0.01 up to what is still on the capture (charged, less refunds and earlier chargebacks); subscription_id names one line of the payment, or the whole payment when left out. Refused with 422 — at staging and again at approval — for an unpaid payment and while another chargeback on the same payment waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
payment Required path integer min 1 The payment's id.

Request body Required

Field Type Description
amount Required number An ordinary decimal, in the payment's own currency, from 0.01 up to what is still on the capture.
bank_date Required string The date on the bank's notice; today or earlier.
reason Required string Why the bank reversed it.
subscription_id Optional integer One line of the payment. Left out, the chargeback is of the whole payment.
bank_reference Optional string The bank's own reference, if it gave one.
note Optional string Anything else worth recording with it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/payments/1/chargebacks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "amount": 1,
    "bank_date": "string",
    "reason": "string"
}'
POST /admin/payments/{payment}/invoice #

Ask for a sale's invoice document to be filed

admin:write api.read api.privileged

Stages filing the invoice document of one paid sale and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. On approval the document is recorded with the sale's own frozen figures and the customer is sent it; a payment that already has one gets a new version — the old file is kept, never deleted. Multipart: invoice is a PDF of at most 4096 KB; number is the invoice's serial, and must be unique if given. Refused with 422 — at staging and again at approval — for a payment that is not a straightforward paid sale, while an invoice-cancellation request on it is still unfinished, and while another document for the same payment waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
payment Required path integer min 1 The payment's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/payments/1/invoice' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/payments/{payment}/default-interest/waive #

Ask for a bill's default interest to be waived

admin:write api.read api.privileged

Stages forgiving the default (late-payment) interest on one bill and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The bill itself still has to be paid — only the interest is forgiven. Refused with 422 — at staging and again at approval — for a bill that bears no default interest, whose interest was already billed, or whose interest is already waived. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
payment Required path integer min 1 The payment's id.

Request body Required

Field Type Description
reason Required string Why the interest is forgiven.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/payments/1/default-interest/waive' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /admin/payments/{payment}/default-interest/restore #

Ask for a waived default interest to be put back

admin:write api.read api.privileged

Stages lifting a default-interest waiver and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Once approved, the interest runs again from the same due date it always had — this is the mirror of waiving it, not a fresh clock. Refused with 422 — at staging and again at approval — for a bill whose interest is not waived. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
payment Required path integer min 1 The payment's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/payments/1/default-interest/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/subscriptions/{subscription}/agreed-price #

Ask for a subscription to be fixed at an agreed price

admin:write api.read api.privileged

Stages fixing the subscription at the agreed figure, in place of the catalogue price, any coupon and any partner rate, until released, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. On approval the subscription's open (unpaid) bills are repriced to the agreed figure; a bill that already took account credit is left as it is and named. agreed_price is the USD NET price per billing period, before VAT and before FX. Refused with 422 — at staging and again at approval — for a subscription superseded by a renewal or resize, while another price act on the same subscription waits, and for a domain name line: domain names always renew at the registrar's list price and never carry an agreed price (an agreement one already carries is ended by releasing it). The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
subscription Required path integer min 1 The subscription's id.

Request body Required

Field Type Description
agreed_price Required number An ordinary decimal — the USD net price per billing period, before VAT and before FX.
agreed_price_note Optional string A pointer to the agreement — a ticket number, a contract reference.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/subscriptions/1/agreed-price' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "agreed_price": 1
}'
POST /admin/subscriptions/{subscription}/agreed-price/release #

Ask for an agreed price to be released

admin:write api.read api.privileged

Stages releasing a subscription's agreed price and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The agreed price keeps governing until the first renewal a full contractual notice period away (EULA 15.2), and on approval the account owner is mailed the written price-change notice. Refused with 422 — at staging and again at approval — when there is no agreed price on the subscription or it is already released. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
subscription Required path integer min 1 The subscription's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/subscriptions/1/agreed-price/release' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/invoice-cancellations/{invoiceCancellation}/confirm #

Ask for a company's confirmation to be recorded

admin:write api.read api.privileged

Stages recording a confirmation given elsewhere and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The approval records that a COMPANY confirmed the cancellation of its own invoice — reason says who confirmed and where (by phone, by e-mail) — and unlocks the resolve step, which cancels the fiscal document on GİB and pays the refund. Nothing is cancelled or paid by this request alone. Refused with 422 — at staging and again at approval — unless the request is a company's and is waiting for confirmation. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invoiceCancellation Required path integer min 1 The invoice-cancellation request's id.

Request body Required

Field Type Description
reason Required string Who confirmed, and where (by phone, by e-mail).

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/invoice-cancellations/1/confirm' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /admin/invoice-cancellations/{invoiceCancellation}/resolve #

Ask for an invoice-cancellation request to be resolved

admin:write api.read api.privileged

Stages recording that the invoice HAS BEEN CANCELLED on GİB and sending the refund the customer's own request owes, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. This is NOT a new refund — the customer asked for it on their own Refund door, and the refund was held only for the invoice. On approval, every refusal the refund would meet is asked first, judged as of the day the customer asked; a refusal there cancels nothing. Once past that, the invoice is marked cancelled and the refund is sent; a refund that does not complete leaves the request refund_owed rather than failing the approval, because the invoice is cancelled either way. Refused with 422 — at staging and again at approval — unless the request is confirmed. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invoiceCancellation Required path integer min 1 The invoice-cancellation request's id.

Request body Required

Field Type Description
reason Required string A note on the resolution.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/invoice-cancellations/1/resolve' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /admin/invoice-cancellations/{invoiceCancellation}/decline #

Ask for an invoice-cancellation request to be declined

admin:write api.read api.privileged

Stages declining an invoice-cancellation request and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. On approval the invoice stays valid and nothing is refunded; reason is posted on the customer's own ticket as the answer, and the customer is notified. Refused with 422 — at staging and again at approval — once the invoice has already been cancelled. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invoiceCancellation Required path integer min 1 The invoice-cancellation request's id.

Request body Required

Field Type Description
reason Required string Why the request is declined. The customer reads it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/invoice-cancellations/1/decline' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /admin/invoice-cancellations/{invoiceCancellation}/retry #

Ask for an invoice-cancellation request's owed refund to be retried

admin:write api.read api.privileged

Stages retrying the refund a refund_owed request still owes, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The invoice is already cancelled on GİB, so this finishes money already owed — it starts no new refund. Refused with 422 — at staging and again at approval — unless the request is refund_owed. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invoiceCancellation Required path integer min 1 The invoice-cancellation request's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/invoice-cancellations/1/retry' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/refunds/{refund}/retry #

Ask for an owed refund to be retried

admin:write api.read api.privileged

Stages retrying an existing PENDING or FAILED refund row and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. This finishes money already owed — it starts no new refund. Refused with 422 — at staging and again at approval — for a row that is already settled, one whose resize was reverted, a card row already returned as account credit, and a card row that was sent to the gateway with no outcome recorded (that one is finished by checking the gateway's console and calling the settle act instead). The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
refund Required path integer min 1 The refund row's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/refunds/1/retry' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/refunds/{refund}/settle #

Ask for a refund sent with no answer to be settled

admin:write api.read api.privileged

Stages recording what the gateway did with a card refund that was sent with no outcome recorded, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. This is a HUMAN judgement — what the gateway's own console shows — never a new refund: landed: true means the gateway shows the refund landed, and the row is marked done with nothing sent; landed: false means it never took it, and the amount is returned to the customer as account credit instead. Refused with 422 — at staging and again at approval — unless the row is a PENDING card refund that was already sent to the gateway. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
refund Required path integer min 1 The refund row's id.

Request body Required

Field Type Description
landed Required boolean `true` if the gateway's console shows the refund landed; `false` if it never took it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/refunds/1/settle' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "landed": true
}'
POST /admin/credit-grants/{creditGrant}/reduce #

Ask for a granted credit to be reduced

admin:write api.read api.privileged

Stages lowering a granted credit's remainder and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. What is taken off is gone: it is not paid out and not returned to a card. The remainder is frozen at staging, so credit spent between staging and approval refuses the act. Only down to what remains — a raise is a new grant, made through the admin area. Refused with 422 — at staging and again at approval — for a remainder above what is currently left and for a grant that has already expired, been used up or been removed. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
creditGrant Required path integer min 1 The credit grant's id.

Request body Required

Field Type Description
remaining_usd Required number An ordinary decimal — the new remainder, in USD, at most what remains now.
reason Required string Why — recorded with the act and shown to the customer where the account page shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/credit-grants/1/reduce' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "remaining_usd": 1,
    "reason": "string"
}'
POST /admin/credit-grants/{creditGrant}/remove #

Ask for a granted credit to be removed

admin:write api.read api.privileged

Stages taking a granted credit away entirely and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. What remains is gone: it is not paid out and not returned to a card. The remainder is frozen at staging, so credit spent between staging and approval refuses the act. Refused with 422 — at staging and again at approval — for a grant that has already expired, been used up or been removed. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
creditGrant Required path integer min 1 The credit grant's id.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the account page shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/credit-grants/1/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
GET /admin/carts #

List customer carts

admin:read api.read api.privileged

Every cart on the installation, newest first — an ordinary account cart, a guest cart with no login yet, or an API order's cart. Filter with account_id, kind (account, guest or api) and non_empty (only carts that carry at least one line).

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row — against the account's owner when account_id is given, otherwise as a fleet read.

Parameters

Name In Type Description
account_id Optional query integer min 1 Only this account's carts.
kind Optional query string one of account, guest, api `account`, `guest` or `api`.
non_empty Optional query boolean Only carts that carry at least one line.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of carts.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/carts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/carts/{cart} #

Get one cart in full

admin:read api.read api.privileged

One cart with every line it carries (the product, the plan, the effective unit price, the machine a service line is for), its coupon, its partner (or the code a guest cart is keeping until a login adopts it), and the staged checkout bill if one is on it.

Requires an admin:read token whose owner holds the admin or super-admin role. Writes a billing.pii_read access row — against the account's owner for an account cart, otherwise as a fleet read.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.

Responses

  • 200 The cart, in full.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/carts/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/carts/{cart}/lines #

Add a product to a cart

admin:write api.read api.privileged

Adds one line to the cart and answers 201 with the new line's id and the cart in full. DIRECT — nothing is staged, and the request either succeeds or is refused. Name product_type (virtualMachine, volume, ipAddress, service or network), product_id and payment_plan_id; a service line also takes for_cart_item_id or for_subscription_id to name the machine it is for, and quantity (only a per-unit service accepts more than one; every other product is added one at a time — raise it afterwards with POST /admin/carts/{cart}/lines/{cartItem}).

Refused with 422: the product does not exist or is not published (or a VM row withheld while its snapshot tier is unknown), the plan is not this product's own, a service with no machine named, a service already bought once for that machine, a service of another billing period than its machine, the partnership training service without an admitted application, a shop-blocked account, a guest or API cart (nothing here edits one), this is not the customer's current cart, or the cart is already checking out (a bill is staged on it).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.

Request body Required

Field Type Description
product_type Required string
product_id Required integer
payment_plan_id Required integer
for_cart_item_id Optional integer
for_subscription_id Optional integer
quantity Optional integer Per-unit services only; every other product is one unit at a time.

Responses

  • 201 The line was added.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/lines' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "product_type": "virtualMachine",
    "product_id": 1,
    "payment_plan_id": 1
}'
POST /admin/carts/{cart}/lines/{cartItem} #

Set a cart line's quantity

admin:write api.read api.privileged

Sets the line's quantity to the given amount, 1 to 100, and answers 200 with the previous and the new value. DIRECT. Zero is not a quantity here — remove the line instead. No line holds more than 100 units, the ceiling of the admin area's own cart stepper. Refused with 422: a quantity below one or above 100, a domain-name line (it has none), a shop-blocked account raising a line, or a cart that is a guest's, an API order's, not the customer's current one, or already checking out.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.
cartItem Required path integer min 1 The line's id. A line of another cart is a `404` here, as on the admin cart page.

Request body Required

Field Type Description
quantity Required integer

Responses

  • 200 The quantity was set.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/lines/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "quantity": 1
}'
POST /admin/carts/{cart}/lines/{cartItem}/move #

Move a service line to another machine

admin:write api.read api.privileged

Points the service line at another machine of the same account and answers 200 with its new target. DIRECT. Name for_cart_item_id (another line of this cart) or for_subscription_id (an already-deployed subscription); either may be null to leave the service unplaced. Refused with 422 on a line that is not a service bought for a machine, and on a cart that is a guest's, an API order's, not the customer's current one, or already checking out.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.
cartItem Required path integer min 1 The line's id. A line of another cart is a `404` here, as on the admin cart page.

Request body Required

Field Type Description
for_cart_item_id Optional integer
for_subscription_id Optional integer

Responses

  • 200 The service line was moved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/lines/1/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "for_cart_item_id": 1,
    "for_subscription_id": 1
}'
POST /admin/carts/{cart}/lines/{cartItem}/remove #

Remove a cart line

admin:write api.read api.privileged

Removes the line from the cart and answers 200 with the id removed and, when the line was a machine, the display names of every service bought for it that left with it. DIRECT, no body. Refused with 422 on a cart that is a guest's, an API order's, not the customer's current one, or already checking out.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.
cartItem Required path integer min 1 The line's id. A line of another cart is a `404` here, as on the admin cart page.

Responses

  • 200 The line was removed.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/lines/1/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/carts/{cart}/coupon #

Ask for a cart's coupon to be set or taken off

admin:write api.read api.privileged

Stages putting an existing coupon on the cart, or taking the cart's coupon off, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Send coupon_id — an id to put that coupon on the cart (replacing any coupon already there), or null to take the cart's coupon off. Approval runs the admin area's own door, for the cart's customer: the coupon's redemption rules (validity, the personal-coupon rule judged against this customer, the redemption caps, a coupon that applies to nothing in the cart), checked again exactly as at staging. Refused with 422 — at staging and again at approval — on a guest or API cart, on a cart that is not the customer's current one, on a cart already checking out (the edit would withdraw the staged bill), when the coupon is already on the cart or, for a removal, when the cart carries none, and while another coupon change on the same cart waits. Nothing is charged by the approval; the customer still pays at checkout. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.

Request body Required

Field Type Description
coupon_id Required integer A coupon's id, or `null` to take the cart's coupon off.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/coupon' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "coupon_id": 1
}'
POST /admin/carts/{cart}/partner-code #

Ask for a cart's partner code to be set or cleared

admin:write api.read api.privileged

Stages setting a partner code on the cart, or clearing it, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Send code — a partner's code, or null to clear it. This moves STANDING, not a price: on a cart that already has a customer, approval LINKS that account to the named partner as a staff link (replacing any current partner), and from then on the partner is paid a share of the account's spend — nothing on the cart is repriced, a client still pays list price; clearing it UNLINKS the account instead. Either act on such a cart also clears a partner code the cart keeps for sign-in (one deferred there at a sign-in on its way to an organisation invitation); on an account no partner manages, clearing that code is the whole act. On a guest cart with no customer yet, the code (or its absence) is only kept, and takes effect only once a login adopts the cart. Refused with 422 — at staging and again at approval — on an API order's cart, on an unknown code, on a partner that takes no share, when the account is already linked to the named partner, when an account would be its own partner, when the account is managed by no partner, its cart keeps no code for sign-in and the request clears one anyway, when a guest cart keeps no code and the request clears one anyway, and while another partner-code change on the same cart waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.

Request body Required

Field Type Description
code Required string A partner's code, or `null` to take the partner off.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/partner-code' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "code": "string"
}'
POST /admin/carts/{cart}/clear #

Ask for a cart to be deleted

admin:write api.read api.privileged

Stages deleting the cart and every line in it, and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. No body. The customer's selection is removed for good; nothing is charged, refunded or cancelled by it. Refused with 422 — at staging and again at approval — while a bill that can still be paid settles through the cart, on an API order's cart (it belongs to the request that placed it, not to staff), and while another delete of the same cart waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cart Required path integer min 1 The cart's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/carts/1/clear' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/staff-invitations #

List staff invitations

admin:read api.read api.privileged

The installation's STAFF invitations, newest first — the list on /admin/settings/staff: the address, language, role and specialist grants, status, deadline and who sent it. accept_url is the link the invitation e-mail carries, present only while the invitation can still be accepted (and, for an invitation that would grant super-admin, only to a super-admin), so it can be copied and sent to the person directly. It is a credential: anyone holding it can accept the invitation. Filter with pending and query (part of an address). Customer invitations are never listed here.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes an account.pii_read access row as a fleet read.

Parameters

Name In Type Description
pending Optional query boolean True lists only invitations still awaiting acceptance.
query Optional query string max length 255 Part of an invited address.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of staff invitations.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/staff-invitations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/staff-invitations #

Ask for a colleague to be invited

admin:write api.read api.privileged

Stages a STAFF invitation and answers 202. NOTHING IS SENT by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the invitation is written and e-mailed through the staff page's own invite, as the approving administrator, and the outcome's result.invitation_link carries the link to copy while it can still be accepted. role is support or admin (never super-admin); permissions (optional, only with support) are specialist grants such as legal.manage (the lawyer) or finance.manage (the accountant). Refused with 422 when the address already has a login or an invitation, or an invitation for it is already waiting for approval; every check is asked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
email Required string
role Required string
language Required string
permissions Optional array of string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/staff-invitations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "string",
    "role": "support",
    "language": "tr-TR"
}'
POST /admin/staff-invitations/{invitation}/resend #

Ask for a staff invitation to be re-sent

admin:write api.read api.privileged

Stages re-sending a STAFF invitation and answers 202. NOTHING IS SENT by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the e-mail goes again through the staff page's own Re-send and the link is valid for seven more days; an expired link is replaced by a new one, which the outcome's result.invitation_link carries. Refused with 422 for an invitation whose link is still live, one that was accepted or declined, a customer invitation (answered as a missing one), and — unless the token's owner is a super-admin — one that would grant super-admin. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invitation Required path integer min 1 The staff invitation's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/staff-invitations/1/resend' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/staff-invitations/{invitation}/revoke #

Ask for a staff invitation to be withdrawn

admin:write api.read api.privileged

Stages withdrawing a STAFF invitation and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the staff page's own Withdraw deletes the invitation, its link stops working at once, and the address can be invited again. Refused with 422 for an invitation that was already accepted, a customer invitation (answered as a missing one), and — unless the token's owner is a super-admin — one that would grant super-admin. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
invitation Required path integer min 1 The staff invitation's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/staff-invitations/1/revoke' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/settings #

Read the installation's settings

admin:read api.read api.privileged

Every key the settings pages edit, with its stored value (null usually means the built-in default), the VAT rates, whether each AI gateway credential is set (the credentials themselves are never returned), and changed_with: the keys another door changes (maintenance mode, the seller identity, the assistants' guidance) and the ones only the settings page may change. The same read as get_global_settings on the admin MCP server. Names nobody, so no access row is written.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The settings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/settings #

Ask for a change to the installation's settings

admin:write api.read api.privileged

Stages a change to the keys named in settings (only the keys sent change) and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. The body is validated by the settings form's own rules, at staging and again at approval; the preview shows each key's current and new value and what the change does — shop test mode compresses every shop clock, the erasure switch arms the unattended nightly erasure, a partner programme term mails every current partner. Refused with 422 for a key another door changes (maintenance mode, the seller identity, the assistants' guidance), for the gateway credentials and endpoint (the settings page only), for a change that changes nothing, and while another settings change waits. Refused at approval if any key it names was changed in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
settings Required object

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "settings": []
}'
GET /admin/seller-identity #

Read the seller identity

admin:read api.read api.privileged

The registered company, the signatory, the address, the tax office and the tax number printed on every EULA, proforma and partner statement: stored is what was saved (null means the built-in default is printed), defaults those built-in values, and printed what documents carry today. The same read as get_seller_details on the admin MCP server. The installation's own letterhead, so no access row is written.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The seller identity.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/seller-identity' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/seller-identity #

Ask for a change to the seller identity

admin:write api.read api.privileged

Stages a change to the fields sent (an absent field is unchanged; an empty string puts back the built-in default) and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Validated by the seller identity page's own rules. Refused with 422 for a change that changes nothing and while another seller identity change waits; refused at approval if the identity was changed in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
seller_company Optional string
seller_signatory Optional string
seller_address Optional string
seller_tax_office Optional string
seller_tax_number Optional string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/seller-identity' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "seller_company": "string",
    "seller_signatory": "string",
    "seller_address": "string",
    "seller_tax_office": "string",
    "seller_tax_number": "string"
}'
GET /admin/ai-gateway/models #

List the AI gateway's models and the stored allow-list

admin:read api.read api.privileged

The models the AI gateway serves — sellable (priced, so customers may be sold them), unsellable (no price) and every name in names; priced says whether prices could be read — beside the stored allow-list (allowed_models: the models customers may buy; null means every sellable one) and the assistant's model. Answered from the settings pages' one-minute cache; a miss asks the gateway with the stored credentials. When the gateway cannot be asked, available is false and reason says why (no_credential, refused, unreachable). The allow-list is changed through POST /admin/settings. The same read as list_ai_gateway_models on the admin MCP server.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The catalogue and the allow-list.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai-gateway/models' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/roles #

List roles

admin:read api.read api.privileged

The installation's roles — the list on /admin/settings/roles: each role's id, name, whether it is protected (cannot be deleted), its permissions and how many logins hold it, plus the permission groups a role can be given. With query (part of a name or e-mail address) it also lists up to 50 matching logins by id, name, e-mail and roles.

Requires an admin:read token whose owner holds the super-admin role or the roles.manage permission, as the roles page does. Every call writes an account.pii_read access row as a fleet read.

Parameters

Name In Type Description
query Optional query string max length 255 Part of a login's name or e-mail address.

Responses

  • 200 The roles, the permission groups and any matching logins.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/roles' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/roles #

Ask for a role to be created

admin:write api.read api.privileged

Stages creating a new, empty role named name (lowercase letters, digits and hyphens, at most 64 characters, unused) and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. A new role has no permission and no member; giving it either is its own approval. Refused with 422 for a name the roles page refuses, and at approval if the name was taken in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the super-admin role or the roles.manage permission, as the roles page does; the same is asked of the approver.

Request body Required

Field Type Description
name Required string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/roles' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /admin/roles/assignments #

Ask for a login's roles to be replaced

admin:write api.read api.privileged

Stages replacing the roles of the login named in the body with roles — the WHOLE new set — and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, the login gains or loses what those roles grant at once. Granting super-admin, or changing the roles of a login that holds it, needs a super-admin to stage it and to approve it. Refused with 422 when the login already holds exactly that set, when another change for it waits, and at approval when its roles moved in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the super-admin role or the roles.manage permission, as the roles page does; the same is asked of the approver.

Request body Required

Field Type Description
user_id Required integer
roles Required array of string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/roles/assignments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "user_id": 1,
    "roles": [
        "string"
    ]
}'
POST /admin/roles/{role} #

Ask for a role's permissions to be replaced

admin:write api.read api.privileged

Stages replacing the role's permissions with permissions — the WHOLE new set, registry names only — and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, every holder of the role gains or loses those permissions at once. Changing the super-admin role, or giving any role roles.manage, needs a super-admin to stage it and to approve it. Refused with 422 when the role already holds exactly that set, when another change to it waits, and at approval when it was edited in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the super-admin role or the roles.manage permission, as the roles page does; the same is asked of the approver.

Parameters

Name In Type Description
role Required path integer min 1 The role's id, as the roles listing returns it.

Request body Required

Field Type Description
permissions Required array of string

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/roles/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "permissions": [
        "string"
    ]
}'
POST /admin/roles/{role}/delete #

Ask for a role to be deleted

admin:write api.read api.privileged

Stages deleting the role and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, every holder loses what the role granted at once, and it cannot be undone. A protected role (user, support, admin, super-admin) is refused with 422, as is a second deletion of the same role while one waits; at approval it is refused if the role gained permissions or members in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the super-admin role or the roles.manage permission, as the roles page does; the same is asked of the approver.

Parameters

Name In Type Description
role Required path integer min 1 The role's id, as the roles listing returns it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/roles/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/token-revocation/break-glass #

Ask for the break-glass on a login's token-revocation switch

admin:write api.read api.privileged

Stages the break-glass: turning OFF another login's "revoke API tokens when the password changes" setting, without their consent and without a code — for a person who has lost both channels its code goes to — and answers 202. NOTHING CHANGES by this request: a super-admin must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Approved, it is audited as a break-glass. Refused with 422 when the setting is already off, for your own login, and while another break-glass for the login waits. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the super-admin ROLE (never a permission); the approver must be a super-admin too, and neither may be the login named.

Request body Required

Field Type Description
user_id Required integer

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/token-revocation/break-glass' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "user_id": 1
}'
GET /admin/domain-prices #

Read the domain price list

admin:read api.read api.privileged

Per ending: the registrar's PUBLIC retail price the shop sells at (registration, renewal, transfer — Turkish lira, EXCLUDING KDV, which is added per line), any staff override (it wins), a held change of more than half waiting for a person, the selling figures in force, our cost from the registrar's interface (cost.verified false means the interface has not answered), the margin, and whether the ending is sold in the shop, on sale now, and sold only to customers in Türkiye. selling.renewal is what a renewal is BILLED at: the renewal retail, the registrar's list price always, never moved toward our cost (renewal_below_cost true means the retail is below our renewal cost: each renewal is still billed at the list and each renewal loses the difference, and the administrators are told once per ending). A registration listed below our cost likewise still sells at the list.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The domain price list.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/domain-prices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/domain-prices #

Ask for a domain price override

admin:write api.read api.privileged

Stages a staff override of the selling price for one to fifty endings and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Each item names an ending on the list and its registration, renewal and transfer figures in Turkish lira excluding KDV; a null figure clears that override. Refused with 422 while another such act waits; refused at approval if a named row changed in between. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
items Required array of object

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/domain-prices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "items": [
        {
            "ending": "string"
        }
    ]
}'
GET /admin/tags #

List the product tags

admin:read api.read api.privileged

Every product tag with how many accounts and templates carry it. shop_bypass marks alpha1, the tag whose holders may buy while the shop is closed.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The tags.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/tags' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/tags #

Create a product tag

admin:write api.read api.privileged

Creates a tag at once, as the settings page does, and records it in the audit trail. The name is stored lower-cased. Refused with 422 for a name already in use and for alpha1, the shop-closed bypass tag, which is made in the admin area.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
name Required string
description Required string
front_page Required boolean
priority Optional integer

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tags' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "front_page": true
}'
POST /admin/tags/{tag} #

Edit a product tag

admin:write api.read api.privileged

Edits the tag at once and records it in the audit trail. Send only what changes; the rest is kept. Refused with 422 for a name another tag has and for a rename to or from alpha1, the shop-closed bypass tag (renaming it moves who may buy while the shop is closed, so it is done in the admin area).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
tag Required path integer min 1 The tag's id.

Request body Required

Field Type Description
name Optional string
description Optional string
front_page Optional boolean
priority Optional integer

Responses

  • 200 The tag as stored.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tags/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "front_page": true,
    "priority": 1
}'
POST /admin/tags/{tag}/delete #

Ask for a product tag to be deleted

admin:write api.read api.privileged

Stages deleting the tag and answers 202. NOTHING CHANGES by this request: an administrator must approve the entry (approval_url), and it lapses after 24 hours if nobody does. Refused with 422 — at staging and again at approval — for a tag an account or a template still carries, and while another delete of the same tag waits; refused at approval if the tag changed in between. The preview says plainly when the tag is alpha1. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
tag Required path integer min 1 The tag's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tags/1/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/exchange-rates #

Read the exchange-rate table

admin:read api.read api.privileged

The USD rows of the TCMB rate table, newest first, each with how many payments were converted at it, and the status: the one column that prices a sale (banknote_selling), the rate in force, when it was fetched, when a refresh will next fetch, and whether the USD-to-USD row every USD payment needs still exists.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
limit Optional query integer min 1, max 100 How many rows, newest first; default 30, at most 100.

Responses

  • 200 The rates and the status.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/exchange-rates' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/exchange-rates/refresh #

Fetch today's exchange rates

admin:write api.read api.privileged

Fetches today's rates from TCMB, exactly as the settings page's refresh does, and adds them; rows are never edited and no rate can be set by hand. Nothing is fetched while the newest rate is under a day old, and nothing is written if TCMB cannot be read: refreshed is then false and refreshes_after says when a refresh will next fetch. A fetch that wrote rows is recorded in the audit trail.

Requires an admin:write token whose owner holds the admin or super-admin role.

Responses

  • 200 What the fetch did.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/exchange-rates/refresh' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/blog/posts #

Browse the blog's published posts

admin:read api.read api.privileged

One page of the CMS's published posts, optionally searched, each with featured: true when it is already on the front page; each row carries the fields the feature request takes. Asks the CMS: error carries its failure, and configured is false when no CMS is set up.

Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
page Optional query integer min 1 Page number, from 1.
per_page Optional query integer min 1, max 100 Posts per page, 1 to 100; default 10.
search Optional query string Optional search text.

Responses

  • 200 One page of posts.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/blog/posts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/blog/front-page #

List the posts featured on the front page

admin:read api.read api.privileged

The blog posts on the front page, in their front-page order.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The featured posts.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/blog/front-page' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/blog/front-page #

Put a blog post on the front page

admin:write api.read api.privileged

Puts a published CMS post on the front page, or refreshes the snapshot of one already there, and records it in the audit trail. Send only cms_post_id (from the post listing): the title, excerpt, link, image, language and date are read from the CMS at that moment, and any other field in the body is ignored. Answers 422 on cms_post_id when the CMS cannot be reached, does not hold the post or has not published it. A new post goes to the end of the order.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
cms_post_id Required integer

Responses

  • 200 Featured; the front page's order now.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/blog/front-page' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "cms_post_id": 1
}'
POST /admin/blog/front-page/arrange #

Set the front page's post order

admin:write api.read api.privileged

Sets the order of the featured posts, first to last, as the blog page's drag does, and records it in the audit trail. Posts not named keep their relative order after the named ones; an id that is not featured is ignored.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
cms_post_ids Required array of integer

Responses

  • 200 Arranged; the front page's order now.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/blog/front-page/arrange' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "cms_post_ids": [
        1
    ]
}'
POST /admin/blog/front-page/{cmsPostId}/unfeature #

Take a blog post off the front page

admin:write api.read api.privileged

Takes the post off the front page and records it in the audit trail; the post stays on the blog. 404 for a post that is not on the front page.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
cmsPostId Required path integer min 1 The CMS post id of a featured post.

Responses

  • 200 Taken off; the front page's order now.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/blog/front-page/1/unfeature' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/catalogue/translate #

Draft a translation of catalogue copy

admin:write api.read api.privileged shop-translate

Drafts a Turkish (tr) or Arabic (ar) translation of one catalogue text field and returns it. NOTHING IS SAVED: the draft is a proposal for a person to paste into the product form. Each draft spends AI gateway tokens and is recorded in the audit trail against the record named. 422 when the draft cannot be made (no gateway configured, or the gateway failed); at most 20 drafts a minute per administrator.

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
text Required string
target Required string
field Required string
subject_type Optional string
subject_id Optional integer

Responses

  • 200 The draft; nothing was saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/catalogue/translate' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "text": "string",
    "target": "tr",
    "field": "string"
}'
POST /admin/audit-logs/verify #

Verify the audit trail's hash chain

admin:write api.read api.privileged

Checks the audit trail's tamper-evident hash chain and its ledger of declared rewrites, as the audit page's Verify button does, and returns the verdict: intact, the check's exit code and its own report (on a break, the first row that diverges and whether a declared rewrite covers it). Changes nothing in the trail; the check itself is recorded.

Requires an admin:write token whose owner holds the admin or super-admin role and the audit.view permission.

Responses

  • 200 The verdict.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/audit-logs/verify' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/tickets/{ticket}/comments #

Reply to a support ticket as staff

admin:write api.read api.privileged

Posts a staff reply in your name — the REST twin of the admin MCP's reply_to_ticket, through the same service, so the customer and the account owner are notified exactly as for a reply from the admin area. Text only, up to 10000 characters. A thread that is solved or closed takes no reply (422). A service work-order thread whose customer can still refund the service is refused with 409: a staff reply there would end their refund window for good, so book the work (staged) first, or reply from the admin area.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Request body Required

Field Type Description
comment Required string The reply. The customer reads it.

Responses

  • 201 The reply.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 A service work order the customer can still refund; a staff reply would end that window.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "string"
}'
POST /admin/tickets/{ticket}/assignment #

Hand a support ticket to an agent

admin:write api.read api.privileged

Hands the thread to a support agent, replacing whoever held it — the REST twin of the admin MCP's assign_ticket and the admin area's Assign, through the same service. level is view (a reader) or manage (the working assignment, the default). A partnership thread and anyone who is not support staff are refused with 422. The hand-over is recorded in the ticket's audit history.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Request body Required

Field Type Description
agent_id Required integer The support agent's user id.
level Optional string What the agent may do on the thread; `manage` by default.

Responses

  • 200 The assignment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/assignment' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "agent_id": 1
}'
POST /admin/tickets/{ticket}/close #

Ask for a support ticket to be closed

admin:write api.read api.privileged

Stages closing the thread in the approval queue and answers 202. NOTHING IS CLOSED by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; the customer is told when it is approved. On a service work-order thread, closing also ends the customer's own refund window — the preview says so when it applies. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. A thread already closed, merged or marked spam is refused with 422, and so is a second close of the same thread while the first still waits for a decision (the error names the waiting entry).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/tickets/{ticket}/priority #

Change a support ticket's priority

admin:write api.read api.privileged

Sets the thread's priority — the REST twin of the admin MCP's set_ticket_priority and the admin area's priority menu, through the same service and the admin area's own rule: 0 none, 1 low, 2 normal, 3 high, 4 blocker. Internal triage only: the customer is not told. Recorded in the ticket's audit history.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Request body Required

Field Type Description
priority Required integer 0 none, 1 low, 2 normal, 3 high, 4 blocker.

Responses

  • 200 The priority now.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/priority' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "priority": 1
}'
POST /admin/tickets/{ticket}/unassign #

Take a support ticket off its agent

admin:write api.read api.privileged

Removes the thread's assignment, leaving it unassigned — the REST twin of the admin MCP's unassign_ticket and the admin area's Unassign, through the same service. A thread with nobody on it is left as it is (unassigned: false). The hand-over is recorded in the ticket's audit history; the customer is not told.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Responses

  • 200 Who held the thread, if anybody.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/unassign' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/tickets #

Ask for a ticket to be opened in a customer's name

admin:write api.read api.privileged

Stages opening a support ticket ON BEHALF of the customer and answers 202 — the REST twin of the admin MCP's open_customer_ticket and the admin area's New ticket on a customer. On approval the thread is filed IN THE CUSTOMER'S NAME: they are its author, it appears in their own ticket list and they are told at once. The admin area's own rules apply (title 3 to 255 characters, body up to 10000, category optional, general by default). Text only: a staged entry holds no files, so attach them afterwards as a reply in the admin area. A staff login is refused with 403; an identical ticket already waiting for approval with 422.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
user Required path integer min 1 The customer login the ticket is opened for.

Request body Required

Field Type Description
title Required string The ticket title, 3 to 255 characters.
body Required string The opening message, up to 10000 characters.
category Optional string The category; `general` when left out.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "body": "string"
}'
GET /admin/partner-setoffs #

List partner set-offs

admin:read api.read api.privileged

What a released rebate overpaid once a sale behind it was refunded or charged back, owed back by the partner — the REST twin of the admin MCP's list_partner_setoffs, newest first, with the outstanding figure the partner card prints. status is outstanding (the default: still owed, not written off) or all. Only an ENDED partner's set-off is decided by staff (partner_in_force false); a current partner's next rebate absorbs it.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row (against the partner's owner when account_id is given, else as a fleet read).

Parameters

Name In Type Description
status Optional query string one of outstanding, all outstanding (default) or all.
account_id Optional query integer min 1 One partner account.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of set-offs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/partner-setoffs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/partner-setoffs/{setoff}/return-request #

Ask for a set-off return request to be recorded

admin:write api.read api.privileged

Stages recording that an ENDED partner was asked to return a set-off — the REST twin of the admin MCP's request_setoff_return and the admin area's Repayment requested. On approval the request is recorded with its date; nothing is charged or deducted and the partner is not told from here. Refused with 422 while the partnership is in force (its next rebate absorbs the set-off), for a set-off written off or with nothing outstanding, and while another decision on it waits.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
setoff Required path integer min 1 The set-off, by id, as `GET /admin/partner-setoffs` lists it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/partner-setoffs/1/return-request' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/partner-setoffs/{setoff}/write-off #

Ask for a partner set-off to be written off

admin:write api.read api.privileged

Stages writing off an ENDED partner's set-off with a reason — the REST twin of the admin MCP's write_off_setoff and the admin area's Write off. On approval what is outstanding is forgiven for good: no later rebate absorbs it and it cannot be undone. Refused with 422 while the partnership is in force, for a set-off already written off or with nothing outstanding, and while another decision on it waits.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
setoff Required path integer min 1 The set-off, by id, as `GET /admin/partner-setoffs` lists it.

Request body Required

Field Type Description
reason Required string Why it is written off.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/partner-setoffs/1/write-off' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
GET /admin/partner-statements #

List partner monthly statements

admin:read api.read api.privileged

Every issued partner statement version, newest month first and newest version first within a month — the REST twin of the admin MCP's list_partner_statements. Each row carries its totals, never its client lines (those name customer accounts and stay on the statement's PDF in the admin area). Narrow with account_id and period (YYYY-MM). A new version is the staged POST /admin/partners/{partner}/statements.

Requires an admin:read token whose owner holds the admin or super-admin role. Every call writes a billing.pii_read access row (against the partner's owner when account_id is given, else as a fleet read).

Parameters

Name In Type Description
account_id Optional query integer min 1 One partner account.
period Optional query string One month, YYYY-MM.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of statements.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/partner-statements' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/partners/{partner}/statements #

Ask for a new version of a partner's monthly statement

admin:write api.read api.privileged

Stages issuing a NEW VERSION of the partner's statement for period (YYYY-MM, a month that has ended), with a reason — the REST twin of the admin MCP's regenerate_partner_statement and the admin area's Regenerate. On approval the figures are computed as they stand then, the version is issued beside the older ones (never rewriting them) and the partner is told. It is also how a month the scheduled run did not issue gets its version 1. Refused with 422 for a malformed or unfinished month, or while another regeneration for the account waits; refused at approval if a version was issued meanwhile.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
partner Required path integer min 1 The partner account, by id.

Request body Required

Field Type Description
period Required string The month, YYYY-MM. It must have ended.
reason Required string Why the statement is regenerated.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/partners/1/statements' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "period": "string",
    "reason": "string"
}'
POST /admin/partners/{partner}/reapplication #

Ask for an account to be blocked from, or allowed back into, partner applications

admin:write api.read api.privileged

Stages blocking (blocked: true) or lifting the block on (blocked: false) an account applying to the partner programme again — the REST twin of the admin MCP's set_partner_reapplication and the admin area's re-application switch. Nobody is told. Refused with 422 when the account is already in the state asked for, or another such change for it waits.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
partner Required path integer min 1 The account, by id.

Request body Required

Field Type Description
blocked Required boolean true blocks re-application, false allows it again.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/partners/1/reapplication' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "blocked": true
}'
POST /admin/referrals/{referral}/refusal #

Ask for a referral reward to be refused

admin:write api.read api.privileged

Stages refusing a referral's reward — the REST twin of the admin MCP's refuse_referral_reward and the admin area's Refuse on the referral queue. On approval the referrer is not paid for that referral; nobody is told, and a refused reward can still be paid later. reason is optional. Refused with 422 for a reward already paid or already refused, and while a pay or refuse decision on the same referral waits.

NOTHING HAPPENS by this request: an administrator must approve the entry in the admin area (approval_url), and it lapses after 24 hours if nobody does; what it relies on is checked again at approval. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
referral Required path integer min 1 The referral, by id.

Request body Optional

Field Type Description
reason Optional string Optional. Why the reward is refused.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/referrals/1/refusal' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /admin/partner-rebates/{partnerRebate}/document #

File an agency's hakediş invoice for a held rebate

admin:write api.read api.privileged

Files the agency's invoice (hakediş) for a HELD rebate that has no document on file yet — the REST twin of the admin MCP's upload_partner_hakedis_document and the admin area's staff upload, through the same write: for an invoice the partner e-mailed, or a closed partner account. Multipart, with the admin area's own rules: invoice a PDF or a JPEG/PNG/WebP photograph up to 10 MB, invoice_number, invoice_date (not in the future) and invoice_gross (the total the paper states). Refused with 409 when a document is already on file (replacing it deletes the partner's copy, so that stays in the admin area), for a released rebate and one with nothing to pay; with 422 when the partner has no bank details. NOTHING IS PAID by this request: paying is the staged release_partner_rebate. Administrators are told the document was filed.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
partnerRebate Required path integer min 1 The held rebate, by id.

Responses

  • 201 The document is on file. Nothing has been paid.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/partner-rebates/1/document' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/work-queues #

List what is waiting on a person

admin:read api.read api.privileged

Every operator queue — the erasure queue, privacy requests, failed payments, dunning, approvals (what the admin MCP or the admin API staged and no administrator has decided yet), referral rewards, partner applications and trainings, open tickets, join requests, held partner rebates, the invoice worklist and price notices — with how many items wait and since when. Zeroes are included, in a fixed order, so an absent queue never reads as an empty one. Counts only: nobody is named, so no access-log row is written. The same figures the admin board and the admin MCP server read. The one money figure, the referrals queue's amount, is Money in minor units like the rest of this API — the MCP twin prints the same figure as a plain decimal.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 Every queue, zeroes included.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/work-queues' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/health #

Read the installation's health

admin:read api.read api.privileged

One read for the installation's health: the application version, failed queue jobs (count, and the most recent by job name and exception class only — never the payload or the message, which can quote a customer's record), queue depth and whether Horizon runs, every scheduled command with its cadence, next due time and last FAILURE in 30 days, whether e-mail is being delivered (mail: failing since when, the last error's first line, the last success, and how many mail jobs failed since), whether the domain registrar can be reached (registrar: enabled only while domain reselling is on; its host, failing since when, the last error's first line), pending database migrations, and which configuration keys changed recently (never their values). C2 records a scheduled command's failures, not its successes, so there is no last successful run. The same report the admin MCP server's get_system_health returns.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The health report.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/health' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/failed-jobs #

List failed queue jobs

admin:read api.read api.privileged

The failed queue jobs — the failed_jobs table, where every job that exhausted its tries is recorded — newest first. Each row carries the job's display name, queue, connection, when it failed, its attempts and maximum tries when the payload records them, the exception's class and its FIRST LINE only (secrets redacted, at most 300 characters), and Horizon's tags (model class:id). The payload itself is never published.

Beside the page: every failed job (total), those since since (total_since), how many match the filters (matched), and the matching jobs grouped by job name (by_job) and by exception class (by_exception). The same answer the admin MCP server's list_failed_jobs returns.

An exception message can name a person (a rejected recipient), so every call is recorded as an access in the audit trail (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
since Optional query string Only jobs that failed at or after this date or time.
job Optional query string max length 200 Part of the job's display name.
queue Optional query string max length 100 The queue name.
exception Optional query string max length 200 The start of the exception class — letters, digits, backslashes and underscores only. The message is never matched; anything else is refused with 422.

Responses

  • 200 A page of failed jobs, with the totals and the groups.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/failed-jobs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/failed-jobs/{failedJob} #

Read one failed queue job

admin:read api.read api.privileged

One failed queue job by its uuid or its numeric id: everything the listing shows, plus the exception's first 30 lines (message and stack, secrets redacted) and what the job carried — the command class and each model it held, by class and id. The payload itself is never published. The same answer the admin MCP server's get_failed_job returns.

Recorded as an access in the audit trail (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
failedJob Required path string max length 64 The failed job's uuid, or its numeric id.

Responses

  • 200 The failed job.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/failed-jobs/failedJob' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/jobs #

List the queue jobs Horizon is tracking

admin:read api.read api.privileged

The jobs Horizon is tracking, newest first, by status: recent (the default — everything pushed within Horizon's trim window), pending (waiting or running), completed, failed or silenced. Each job carries Horizon's id, the job name, queue, connection, status, attempts, when it was pushed, reserved, completed or failed, Horizon's tags (model class:id), whether it was retried, and for a failed job the exception's first line (secrets redacted). The payload is never published. The job, queue and tag filters are matched within the newest 1000 jobs of the chosen list (scanned). Horizon keeps these only for its trim window (kept_minutes); the durable record of a failure is GET /admin/failed-jobs.

Horizon's lists live in redis: an unreachable redis answers available: false with the exception's class instead of an error. The same answer the admin MCP server's list_jobs returns. A job's tags name the customer rows it carried, so every call is recorded as an access (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
status Optional query string one of recent, pending, completed, failed, silenced Which of Horizon's lists to read. Default recent.
job Optional query string max length 200 Part of the job name.
queue Optional query string max length 100 The queue name.
tag Optional query string max length 200 An exact tag the job carries, for example a model class and id. Matched on each job's own tags within the newest 1000 jobs of the chosen status; `scanned` says how many were read.

Responses

  • 200 The jobs, or `available false` when redis cannot be reached.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/jobs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/horizon #

Read the queue workers' status

admin:read api.read api.privileged

The queue workers' state as the Horizon dashboard shows it: the overall status (running, paused, no_workers, inactive), each master and supervisor with its worker processes per queue, each queue's length, expected wait and processes, jobs per minute, throughput and average runtime per queue, and Horizon's recent, pending, completed and failed counts. Beside it, recommendations: suggestions derived from those figures and from the failed-job table — a queue falling behind, no workers with jobs waiting, one job failing repeatedly — each saying what it rests on, what to look at next, and whether only the host operator can act (owner_side). Suggestions only: nothing is done automatically.

An unreachable redis answers horizon.available: false. Names nobody, so it records no access. The same answer the admin MCP server's get_horizon_status returns. Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 Horizon's status and the suggestions derived from it.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/horizon' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Support

Assignment-scoped reads of one customer's data, for a token carrying support:read whose owner holds the support or super-admin role — and, with support:write, every write the support area offers on that customer, each at the assignment's manage level for its domain. Account credit is only ASKED for — it is staged, and an administrator approves it on /admin/approvals. A write names rows by id; one of another customer is 404.

A support agent sees only the customers they hold a support_assignments row for, and within those only the domains their per-domain capability level covers. A super-admin short-circuits both checks, matching the support area. Reads are audited identically to the support area's.

GET maps to the view capability level and mutations to manage — with one deliberate exception in the support area that must never be relaxed if it is ever ported here: minting a VM console session is gated at manage, not view, because a console is effective full control of the machine.

GET /support/customers #

List the customers assigned to the calling agent

support:read api.read

Only the customers the calling agent holds a support_assignments row for, ordered by name, each with the capability map the agent holds over them. An agent with no assignments gets an empty page — never the roster.

A super-admin sees every customer instead, matching the support area: both User::supportCan() and User::isAssignedTo() short-circuit for that role, so the assignment matrix is not a constraint on it.

Requires a support:read token whose owner holds the support (or super-admin) role. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The equivalent support-area route carries no gate at all — its filter lives in the controller — so an API port that simply queried "every customer" would hand the whole install to any support:read token. The scoping here is the endpoint's single most important property and is asserted in both directions by test.

Writes no audit row: it publishes no more about any one customer than a name and an email, and the per-customer reads beside it are the ones that log.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the agent's assigned customers.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user} #

Get one assigned customer

support:read api.read api.privileged

The cross-domain dashboard for one assigned customer: the record, the capability map, and database-derived counts of their instances, volumes, DNS zones, subscriptions, invoices and tickets.

Gated on the assignment alone — not on any per-domain capability — which matches the support area deliberately. The point of this record is to tell an agent where a customer's problem might be before they have a domain to look in, so gating it at account,view would break the dashboard for a cloud-only agent. The per-domain collections beside this path each require their own capability.

Because the gate is that broad, the payload is narrower than the admin equivalent: phone is not published here. An agent whose assignment reads none on all five domains can reach this record, and the support area does hand them a phone number for it; the API being stricter than the support area is allowed, the reverse is not.

A customer the agent is not assigned to is a 403, not a 404 — the assignment gate runs before anything looks the record up, and that matches the support area's answer. An id that does not exist at all is a 403 for the same reason, and that is the intended answer: it makes "no such account" and "not yours to see" indistinguishable. Nothing on the support surface returns 404.

Writes an account.pii_read audit row, exactly as the equivalent support page does, and is charged against a tighter rate-limit budget for that reason.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/instances #

List an assigned customer's virtual machines

support:read api.read api.privileged

Identical in payload to the admin equivalent — the same Instance representation the customer's own /instances returns — and identical in how it is served: the customer-scoped cloud service, its non-reconciling reader, no refresh variant. Only the gate stack differs.

Requires at least view on the cloud domain of an assignment covering this customer. An agent assigned to the customer but holding none on cloud is a 403, as is an agent with no assignment at all.

Writes a cloud.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/dns-zones #

List an assigned customer's DNS zones

support:read api.read api.privileged

Identical in payload and in service resolution to the admin equivalent; only the gate stack differs. Requires at least view on the dns domain of an assignment covering this customer.

No refresh parameter: the reconciling sibling deletes local zones — and cascades to their records — that PowerDNS's live listing no longer contains, before its own update flag is consulted.

Writes a dns.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones #

Create a DNS zone for an assigned customer

support:write api.read api.privileged

The support area's door, on the customer's own DNS service.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Required string The zone's domain name.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
GET /support/customers/{user}/subscriptions #

List an assigned customer's subscriptions

support:read api.read api.privileged

Identical in payload and in service resolution to the admin equivalent; only the gate stack differs. Requires at least view on the billing domain of an assignment covering this customer. Money is always a minor-unit integer with its currency, never a float.

No refresh parameter, and this is the sharpest case for it: the reconciling sibling terminates subscriptions whose linked resource has moved, promotes every pending subscription to deployed and erases its failure reason, deletes root-volume subscriptions together with their payments, and fires orphan events that dial the provider — all inside one transaction.

Writes a billing.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/audit-logs #

List an assigned customer's audit trail

support:read api.read api.privileged

The rows whose data subject is this customer, newest first, filtered to the domains the calling agent holds at least view on.

Two gates, both required: an assignment covering this customer, and account at view — the same pair the equivalent support page carries. The per-domain filter inside is what stops a tickets-only agent from reading that customer's billing rows once they are in. An agent holding view on nothing sees zero rows, not every row: the empty domain list is an explicit "no domains", never a missing constraint.

The auth, shop, privacy, partner and system domains have no support-assignment equivalent and are therefore never visible here, whatever the agent holds. A data-subject request is between the customer and the controller, and a partner's commercial terms are between the partner and the business.

changes, context, hash and previous_hash are not published; see the AuditLog schema for why.

Unlike the equivalent support page, this does write an account.pii_read row of its own and is charged against the tighter privileged read budget. Every {user}-scoped staff read on this API leaves a trail, without exception — a rule with one exemption is a rule that rots, and reading somebody's whole audit history is not the access to leave unrecorded. It does mean a client paging this collection appends to it.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's audit rows, in the domains the agent may see.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/audit-logs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/start #

Start an assigned customer's virtual machine

support:write api.read api.privileged

The support area's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Idempotent: starting a machine that is already running answers 200 without asking the cloud to do anything. A machine another customer owns is 404; a machine held by an open refund request is 409; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/stop #

Stop an assigned customer's virtual machine

support:write api.read api.privileged

The support area's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Idempotent: stopping a machine that is already stopped answers 200 without asking the cloud to do anything. A machine another customer owns is 404; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, stopped (or already stopped).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/restart #

Restart an assigned customer's virtual machine

support:write api.read api.privileged

The support area's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Not idempotent: a restart always reaches the cloud. A machine another customer owns is 404; a machine held by an open refund request is 409; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, restarted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/credits #

Ask for account credit to be granted to a customer

support:write api.read api.privileged

Credit lowers the next payments and lapses at its expiry; it is never cash.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
amount_usd Required number The amount, as a decimal in USD.
reason Required string Why — recorded with the act and shown to the customer where their account shows it.
expires_at Optional string When it lapses (YYYY-MM-DD); three months by default.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "amount_usd": 1,
    "reason": "string"
}'
POST /support/customers/{user}/credits/{creditGrant}/actions/adjust #

Ask for a customer's credit to be reduced

support:write api.read api.privileged

Only down to what remains; the remainder at the time of asking must still stand at approval.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
creditGrant Required path integer min 1 The credit's id; it must be the customer's.

Request body Required

Field Type Description
remaining_usd Required number What should remain, as a decimal in USD.
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits/1/actions/adjust' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "remaining_usd": 1,
    "reason": "string"
}'
POST /support/customers/{user}/credits/{creditGrant}/actions/remove #

Ask for a customer's credit to be removed

support:write api.read api.privileged

What remains is taken away; it is not paid out.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
creditGrant Required path integer min 1 The credit's id; it must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits/1/actions/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/password #

Set a customer's password

support:write api.read api.privileged

The support area's helpdesk reset: the password is set and every other sign-in the customer held is ended.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
password Required string The new password.
password_confirmation Required string The same password again.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "password": "string",
    "password_confirmation": "string"
}'
GET /support/customers/{user}/instances/{instance}/console #

Open a console on a customer's machine

support:write api.read api.privileged

A one-time console URL, proxied through this site as the support area serves it, or url: null. A console is effective full control of the machine, so it asks the write ability and manage, like the support area door.

Requires a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. The read is recorded against the customer.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/console' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/subscriptions/{subscription}/resize-quote #

Price a resize for a customer

support:read api.read api.privileged

Priced, never placed — the support area's quote, through the same quoteScale(). A refusal (inside the refund window, a withdrawn product, …) is a 409 with its sentence.

Requires a token carrying support:read whose owner holds the support or super-admin role and an assignment for this customer at billing: view. The read is recorded against the customer.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.
product_id Required query integer min 1 The product to resize to, of the same kind.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/resize-quote' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/staged-actions/{stagedAction} #

Get one of your staged requests

support:read api.read

What became of something you asked for over this surface — a credit grant, reduction or removal — by the staged_action_id the request returned. status moves from pending to exactly one of approved, rejected, expired or failed, and never back. Only your own requests are visible: another staff member's is 404. Read-only: an administrator decides it in the admin area.

Requires a support:read token whose owner holds the support or super-admin role.

Parameters

Name In Type Description
stagedAction Required path integer min 1 The queue entry id.

Responses

  • 200 The queue entry.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/staged-actions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/rename #

Rename an assigned customer's machine

support:write api.read api.privileged

The support area's rename, on the customer's own cloud service.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The new name.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/rename' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/attach #

Attach the machine to one of the customer's networks

support:write api.read api.privileged

The support area's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/detach #

Detach the machine from the network

support:write api.read api.privileged

The support area's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/make-primary #

Make the network the machine's primary one

support:write api.read api.privileged

The support area's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/make-primary' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/move #

Move the machine onto the network, off the one named in `from`

support:write api.read api.privileged

The support area's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Request body Required

Field Type Description
from Required integer The network to move the machine off.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "from": 1
}'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/change-ip #

Change the machine's address on the network

support:write api.read api.privileged

The support area's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Request body Required

Field Type Description
ip_address Required string The new address on that network.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/change-ip' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "ip_address": "string"
}'
POST /support/customers/{user}/public-ip-addresses/{publicIPAddress}/networks/{network}/actions/move #

Move a customer's public address to another of their networks

support:write api.read api.privileged

The address is released and another acquired on the target network; nothing is charged.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
publicIPAddress Required path integer min 1 The public address's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/public-ip-addresses/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/networks/{network}/actions/release #

Release an emptied network of the customer

support:write api.read api.privileged

Hands the network back with the address it holds. Refused while anything still uses it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/networks/1/actions/release' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/vpn #

Turn a customer's VPN gateway on or off

support:write api.read api.privileged

On one of the customer's own public addresses.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
public_ip Required string The gateway's public address.
enable Required boolean On or off.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip": "string",
    "enable": true
}'
POST /support/customers/{user}/vpn/users #

Create a VPN user for the customer

support:write api.read api.privileged

The support area's door, owner ruling 2026-08-29: servicing the customer's VPN is the job.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
username Required string The login.
password Required string The password.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "string",
    "password": "string"
}'
POST /support/customers/{user}/vpn/users/{vpnUser}/actions/delete #

Delete one of the customer's VPN users

support:write api.read api.privileged

A VPN user of another account is 404.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
vpnUser Required path integer min 1 The VPN user's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn/users/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/volumes/{volume}/snapshots #

Take a snapshot of a customer's volume

support:write api.read api.privileged

Counts against the customer's snapshot cap, as in the support area.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.

Request body Required

Field Type Description
name Optional string An optional name.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/delete #

Delete a customer's volume snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.
snapshot Required path integer min 1 The snapshot's id; it must be a copy of that volume.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/restore #

Make a new volume from a customer's snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.
snapshot Required path integer min 1 The snapshot's id; it must be a copy of that volume.

Request body Required

Field Type Description
name Required string The new volume's name.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots/1/actions/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/volumes/{volume}/snapshot-policies #

Set a snapshot schedule on a customer's volume

support:write api.read api.privileged

The cloud takes the copies and expires the oldest past max_snaps.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.

Request body Required

Field Type Description
interval_type Required string hourly, daily, weekly or monthly.
max_snaps Required integer How many copies to keep.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "interval_type": "string",
    "max_snaps": 1
}'
POST /support/customers/{user}/instances/{instance}/vm-snapshots #

Take a snapshot of a customer's machine

support:write api.read api.privileged

Refused while live snapshots are switched off here.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The copy's name.
description Optional string An optional note.
with_memory Optional boolean Include the machine's memory.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/delete #

Delete a customer's machine snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
vmSnapshot Required path integer min 1 The machine snapshot's id; it must be a copy of that machine.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert #

Revert a customer's machine to a snapshot

support:write api.read api.privileged

Everything written since the copy is lost. A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
vmSnapshot Required path integer min 1 The machine snapshot's id; it must be a copy of that machine.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots/1/actions/revert' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones/{zone}/actions/delete #

Delete a customer's DNS zone

support:write api.read api.privileged

The zone and every record in it are removed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones/{zone}/records #

Add a record to a customer's zone

support:write api.read api.privileged

One value; other values at the same name and type are kept.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The record's name.
type Required string The record type.
data Required string The value.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "type": "string",
    "data": "string"
}'
POST /support/customers/{user}/dns-zones/{zone}/records/{record} #

Change a record in a customer's zone

support:write api.read api.privileged

Refused with 422 when the value changed since it was read.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.
record Required path integer min 1 The record's id; it must be in that zone.

Request body Required

Field Type Description
type Required string The record type.
data Required string The new value.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "string",
    "data": "string"
}'
POST /support/customers/{user}/dns-zones/{zone}/records/{record}/actions/delete #

Delete a record from a customer's zone

support:write api.read api.privileged

Refused with 422 when the value changed since it was read.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.
record Required path integer min 1 The record's id; it must be in that zone.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/cancel #

Cancel a customer's subscription

support:write api.read api.privileged

Ends the contract as the support area's Cancel does; the service's refusals are 409.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/cancel' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/unstage-resize #

Cancel a customer's staged resize

support:write api.read api.privileged

Deletes the unpaid bill and restores the previous subscription; moves no money; a paid resize is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/unstage-resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/lock #

Lock a customer's subscription

support:write api.read api.privileged

The support area's lock.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/lock' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/unlock #

Unlock a customer's subscription

support:write api.read api.privileged

The support area's unlock.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/unlock' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/lift-suspension #

Lift a customer's suspension

support:write api.read api.privileged

Puts the service back; the bill is still owed and no money moves.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/lift-suspension' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/force-refund #

Force a refund of a customer's one-time service

support:write api.read api.privileged

Services only, inside the forced-refund window, never a delivered one. Ignores the customer's refunds block, as every staff refund does. When an issued invoice stands, a forced invoice-cancellation request is opened instead (202).

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/force-refund' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/subscriptions/{subscription}/actions/request-invoice-cancellation #

Open an invoice-cancellation request for a customer

support:write api.read api.privileged

For a purchase whose issued invoice must be cancelled before it is refunded; a machine is stopped at once.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/request-invoice-cancellation' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/confirm #

Record a company's confirmation

support:write api.read api.privileged

Staff record that the company agreed its invoice may be cancelled.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/confirm' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/resolve #

Cancel the invoice and make the refund

support:write api.read api.privileged

The whole refund precheck runs first; a refund that does not complete answers 202 and stays owed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/resolve' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/retry #

Retry an owed refund

support:write api.read api.privileged

For a request whose invoice is cancelled and whose refund is still owed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/retry' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/decline #

Decline an invoice-cancellation request

support:write api.read api.privileged

The invoice stays valid and the customer is told why.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where their account shows it.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/decline' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/payments/{payment}/chargebacks #

Record a chargeback on a customer's payment

support:write api.read api.privileged

Records what the bank took back.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
payment Required path integer min 1 The payment's id; it must be the customer's.

Request body Required

Field Type Description
amount Required number The amount the bank took back, as a decimal in the payment's own currency (TL or USD), e.g. 12.50.
bank_date Required string The bank's date (YYYY-MM-DD), not in the future.
reason Required string The bank's reason.
bank_reference Optional string The bank's reference.
note Optional string A staff note.
subscription_id Optional integer The line of the payment it concerns, if one.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/payments/1/chargebacks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "amount": 1,
    "bank_date": "string",
    "reason": "string"
}'
POST /support/customers/{user}/billing/bill-notices #

Set whether the customer is sent bill notices

support:write api.read api.privileged

default follows the installation's setting.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
notify_pending_payments Required string on, off or default.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/bill-notices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "notify_pending_payments": "string"
}'
POST /support/customers/{user}/billing/pay-day #

Set the day the customer's subscriptions renew on

support:write api.read api.privileged

Sets the day of the month (1–28) every subscription of the account renews on and answers 200 with it; null puts each subscription back on its own anniversary. The gap up to the new day is billed pro rata at each subscription's next renewal; annual subscriptions keep their month. No open bill is changed. Takes effect at once; the change is recorded in the audit trail.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
day Required integer

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/pay-day' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "day": 1
}'
POST /support/customers/{user}/billing/refunds-block #

Block or allow a customer's own refunds

support:write api.read api.privileged

Stops the customer's own Refund, never a staff refund. A reason is required to block and is never shown to the customer.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
blocked Required boolean Block (true) or allow (false).
reason Optional string Why — required to block.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/refunds-block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "blocked": true
}'
POST /support/customers/{user}/billing/shop-block #

Disable or enable purchasing for a customer

support:write api.read api.privileged

Existing subscriptions keep running. A reason is required to block and is never shown to the customer.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
blocked Required boolean Block (true) or allow (false).
reason Optional string Why — required to block.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/shop-block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "blocked": true
}'
POST /support/customers/{user}/tickets/{ticket}/comments #

Reply to a customer's ticket

support:write api.read api.privileged

Filed under YOU, as the support area files it. A solved or closed thread takes no reply; a partnership thread is 404. Text only.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at tickets: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ticket Required path integer min 1 The ticket's id; it must be the customer's and reachable by you at manage.

Request body Required

Field Type Description
comment Required string The reply, up to 10000 characters.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "string"
}'
POST /support/customers/{user}/tickets/{ticket}/actions/close #

Close a customer's ticket

support:write api.read api.privileged

The customer is told, as from the support area.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at tickets: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ticket Required path integer min 1 The ticket's id; it must be the customer's and reachable by you at manage.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/tickets/1/actions/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/profile #

Change a customer's profile

support:write api.read api.privileged

The staff profile form; the identity document is judged by the customer's language. A Telegram id or tags left out keep their values. The birthdate, identity number and phone must be sent — leaving one out is a 422 — and a null clears that field, as the support area form does.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Required string Full name.
birthdate Required string Date of birth; null clears it.
identity_number Required string T.C. number, or the placeholder with a passport; null clears it.
passport_number Optional string Passport number.
phone Required string Phone in international form; null clears it.
language Required string tr-TR, en-US or ar-SA.
telegram_user_id Optional string Telegram id.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/profile' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "birthdate": "string",
    "identity_number": "string",
    "phone": "string",
    "language": "string"
}'
POST /support/customers/{user}/billing-information #

Change a customer's billing information

support:write api.read api.privileged

A country change that would move the currency while bills are open is refused on country. A partner account stays corporate whatever corporate says: a body that would leave it without a company name and a tax number is refused on corporate. Otherwise an absent company field is written empty — absent or false corporate is a personal invoice.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
corporate Optional boolean A corporate invoice. Absent or false is a personal one — except on a partner account, which stays corporate whatever this says.
company_name Optional string Company name.
tax_number Optional string Tax number.
tax_office Optional string Tax office.
trade_registry_office Optional string The trade registry office, or the registering authority abroad. Optional, except that a partner's cannot be removed. Absent is unchanged.
trade_registry_number Optional string The trade registry number. Optional, except that a partner's cannot be removed. Absent is unchanged.
address Required string Address.
city Required string City.
state Optional string The state, province or region — optional. Absent keeps the one on file; an empty value clears it. Outside Türkiye a domain name is registered with it, by the name or code the domain registry knows for the country.
postal_code Required string Postal code.
country Required string Country.
incorporation_country Optional string The country of incorporation, in the same shapes as `country`; empty means the billing country. Absent is unchanged.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "address": "string",
    "city": "string",
    "postal_code": "string",
    "country": "string"
}'
POST /support/customers/{user}/members/{member} #

Change a member's capabilities

support:write api.read api.privileged

The whole matrix, keyed by account domain. Never above your own assignment; the owner is never reduced.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer min 1 A login of the customer's account.

Request body Required

Field Type Description
capabilities Required object Domain => none, view or manage.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/members/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "capabilities": []
}'
POST /support/customers/{user}/members/{member}/actions/remove #

Remove a member from a customer's account

support:write api.read api.privileged

The owner cannot be removed; a member with records must be anonymised instead.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer min 1 A login of the customer's account.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/members/1/actions/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Get Started Now

Create your account in minutes, set up your own cloud environment, and take control. With cloud.core.gen.tr, everything is faster, safer, and simpler.

Book a Meeting

Let us help you grow your business. Book a 15 minute meeting now.

Book Now