Skip to content
Core Cloud cloud.core.gen.tr
0 Your cart

For developers

C2 Cloud API

Everything your machines, volumes, networks, DNS and subscriptions can be asked or told over HTTP. This page is generated from the same description a client generator reads, so it cannot say something the API does not do.

Base URL
https://cloud.core.gen.tr/api/v1
Version
1.0.0
Operations
227
On this page

01 Overview

What this API is

The customer API for the cloud at https://cloud.core.gen.tr.

Authenticate with a personal access token, created under Settings → API Tokens in the panel, sent as Authorization: Bearer <token>.

Every token carries a set of abilities. A request whose token lacks the ability an endpoint requires is rejected with 403, regardless of what the token's owner is otherwise allowed to do.

Errors are RFC 9457 problem details with the media type application/problem+json.

The description this page is generated from is published as well, so you can generate a client rather than write one: OpenAPI, as YAML · OpenAPI, as JSON

Use it from an assistant

Everything below is HTTP, for a program you write. If what you want instead is to ask an assistant in your own words — Claude Code, Claude Desktop, or the assistant already in your panel — the same cloud is reachable over the Model Context Protocol, with the same tokens and the same checks.

Use it from Claude

02 Authentication

A token, and what it may reach

Create a personal access token in the panel under Settings → API Tokens, and send it on every request:

curl 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

A token reaches the smaller of two things

An ability says what the token was created to do. Your account capability says what you are still allowed to do today. Every request is checked against both, so a token can never grant its holder something their account does not already permit — and a member whose access was narrowed after they created a token cannot keep working at the old level through it.

Either refusal answers 403, with the reason in the problem document's detail. Ask GET /me for the abilities the presented token actually carries rather than probing endpoints and collecting refusals.

The abilities a token may carry

Ability What it permits Account capability Endpoints it opens
cloud:read Read your cloud — instances, volumes and their snapshots, ISOs, templates, firewall rules, public IP addresses, VPN and affinity groups, the offerings behind them, and your usage records. Also reveals an instance's saved password. cloud: view GET /affinity-groups GET /compute-offerings GET /disk-offerings GET /egress-rules GET /ingress-rules GET /instances GET /instances/{instance} GET /instances/{instance}/annotations GET /instances/{instance}/events GET /instances/{instance}/networks GET /instances/{instance}/password GET /instances/{instance}/schedules GET /instances/{instance}/vm-snapshots GET /isos GET /isos/{iso} GET /networks GET /networks/{network} GET /public-ip-addresses GET /public-ip-addresses/{publicIPAddress} GET /public-ip-addresses/{publicIPAddress}/move-plan GET /templates GET /templates/{template} GET /usage GET /volumes GET /volumes/{volume} GET /volumes/{volume}/snapshot-policies GET /volumes/{volume}/snapshots GET /volumes/{volume}/snapshots/{snapshot} GET /vpn GET /vpn/users
cloud:write Start, stop, restart and rename your machines, reset a password, open a console, attach and detach ISOs and volumes, take disk snapshots, and manage firewall rules, VPN users and affinity groups. cloud: manage POST /affinity-groups DELETE /affinity-groups/{affinityGroup} PATCH /affinity-groups/{affinityGroup} POST /egress-rules DELETE /egress-rules/{egressRule} POST /ingress-rules DELETE /ingress-rules/{ingressRule} PATCH /ingress-rules/{ingressRule} PATCH /instances/{instance} POST /instances/{instance}/actions/attach-iso POST /instances/{instance}/actions/detach-iso POST /instances/{instance}/actions/reset-password POST /instances/{instance}/actions/restart POST /instances/{instance}/actions/start POST /instances/{instance}/actions/stop POST /instances/{instance}/annotations DELETE /instances/{instance}/annotations/{annotation} GET /instances/{instance}/console POST /instances/{instance}/networks/{network}/actions/attach POST /instances/{instance}/networks/{network}/actions/change-ip POST /instances/{instance}/networks/{network}/actions/detach POST /instances/{instance}/networks/{network}/actions/make-primary POST /instances/{instance}/networks/{network}/actions/move POST /instances/{instance}/schedules DELETE /instances/{instance}/schedules/{schedule} PATCH /instances/{instance}/schedules/{schedule} POST /instances/{instance}/vm-snapshots DELETE /instances/{instance}/vm-snapshots/{vmSnapshot} POST /instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert POST /isos/uploads DELETE /isos/uploads/{upload} GET /isos/uploads/{upload} POST /isos/uploads/{upload}/actions/complete POST /isos/uploads/{upload}/chunks DELETE /isos/{iso} PATCH /isos/{iso} DELETE /networks/{network} PATCH /networks/{network} POST /public-ip-addresses/{publicIPAddress}/actions/move PATCH /volumes/{volume} POST /volumes/{volume}/actions/attach POST /volumes/{volume}/actions/detach POST /volumes/{volume}/snapshot-policies POST /volumes/{volume}/snapshots DELETE /volumes/{volume}/snapshots/{snapshot} POST /volumes/{volume}/snapshots/{snapshot}/actions/restore PATCH /vpn POST /vpn/users DELETE /vpn/users/{vpnUser}
dns:read Read your DNS zones and every record in them. dns: view GET /dns-zones GET /dns-zones/{zone} GET /dns-zones/{zone}/records
dns:write Create and delete DNS zones, add, change and remove records, and set the reverse DNS record of a public IP address. dns: manage POST /dns-zones DELETE /dns-zones/{zone} POST /dns-zones/{zone}/records DELETE /dns-zones/{zone}/records/{record} PATCH /dns-zones/{zone}/records/{record} PATCH /public-ip-addresses/{publicIPAddress}
billing:read Read your subscriptions, orders, payments, refunds, saved cards, account balance and the product catalogue. billing: view GET /billing/account GET /billing/credits GET /credit-cards GET /domain-name-products GET /domain-name-products/{domainNameProduct} GET /ip-address-products GET /ip-address-products/{ipAddressProduct} GET /network-products GET /network-products/{networkProduct} GET /payments GET /payments/{payment} GET /payments/{payment}/invoice GET /payments/{payment}/proforma GET /refunds GET /service-products GET /service-products/{serviceProduct} GET /subscriptions GET /subscriptions/{subscription} GET /subscriptions/{subscription}/resize-quote GET /virtual-machine-products GET /virtual-machine-products/{virtualMachineProduct} GET /volume-products GET /volume-products/{volumeProduct}
billing:write Pay an open bill with a saved card, ask for a refund inside the refund window, confirm that your company's invoice may be cancelled, and delete a saved card. Paying charges the card with no further confirmation; a card that needs 3-D Secure is sent back to the panel. Adding a card stays in the panel. billing: manage DELETE /credit-cards/{creditCard} POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm POST /payments/{payment}/actions/pay POST /subscriptions/{subscription}/actions/refund
order:write Places orders, resizes and cancels subscriptions. Ordering and resizing spend money — they are carried out with no further confirmation, and a bill left owing is paid in the panel or with billing:write. Grant it only to a client you trust with your money. shop: manage POST /orders POST /subscriptions/{subscription}/actions/cancel POST /subscriptions/{subscription}/actions/cancel-resize POST /subscriptions/{subscription}/actions/resize
account:read Read your own profile, contact details and the abilities of the token being used. account: view GET /account/billing-information GET /activity-log GET /me GET /me/settings
account:write Change your own profile, your notification settings and the account's billing information. account: manage PATCH /account/billing-information PATCH /me PATCH /me/settings
tickets:read Read your support tickets and the replies on them. tickets: view GET /tickets GET /tickets/{ticket}
tickets:write Open support tickets, reply to them and close them — each is sent to our support staff in your name. tickets: manage POST /tickets POST /tickets/{ticket}/actions/close POST /tickets/{ticket}/comments
ai:read Read your AI gateway keys, the limits our staff set on them and what they have spent. ai: view GET /ai/keys GET /ai/usage
ai:write Create an AI gateway key, whose secret is shown once, and revoke one. The limits on the keys are set by our staff and cannot be changed here. ai: manage POST /ai/keys DELETE /ai/keys/{aiKey}
admin:read admin Read any customer's account, their machines, DNS zones, subscriptions and the audit records. Also requires the admin role — a token never grants authority its owner lacks. — GET /admin/ai/prompts GET /admin/audit-logs GET /admin/audit-logs/{auditLog} GET /admin/customers GET /admin/customers/{user} GET /admin/customers/{user}/dns-zones GET /admin/customers/{user}/instances GET /admin/customers/{user}/subscriptions GET /admin/failed-jobs GET /admin/failed-jobs/{failedJob} GET /admin/health GET /admin/horizon GET /admin/jobs GET /admin/news GET /admin/news/{news} GET /admin/staged-actions GET /admin/staged-actions/{stagedAction} GET /admin/support-assignments GET /admin/work-queues
admin:write admin Start, stop and restart any customer's machine and attach or detach an ISO on it, write news, FAQ and legal drafts, answer and assign tickets, and manage invitations, support assignments and retention holds. Publishing, credit grants, lockouts and every other outward act it asks for are only put into the approval queue, where an administrator decides them in the panel. Also requires the admin role — a token never grants authority its owner lacks. — POST /admin/ai/prompts POST /admin/customers/{user}/instances/{instance}/actions/attach-iso POST /admin/customers/{user}/instances/{instance}/actions/detach-iso POST /admin/customers/{user}/instances/{instance}/actions/restart POST /admin/customers/{user}/instances/{instance}/actions/start POST /admin/customers/{user}/instances/{instance}/actions/stop POST /admin/news POST /admin/news/{news} POST /admin/news/{news}/publish POST /admin/tickets/{ticket}/assignment POST /admin/tickets/{ticket}/close POST /admin/tickets/{ticket}/comments
support:read support Read the accounts, resources and audit records of the customers assigned to you. Also requires the support role, and passes the same per-assignment checks as the panel. — GET /support/customers GET /support/customers/{user} GET /support/customers/{user}/audit-logs GET /support/customers/{user}/dns-zones GET /support/customers/{user}/instances GET /support/customers/{user}/subscriptions GET /support/customers/{user}/subscriptions/{subscription}/resize-quote GET /support/staged-actions/{stagedAction}
support:write support Act on the customers assigned to you as the support panel does — their machines, networks, VPN, snapshots, DNS, tickets, profile, billing information and members, and the billing acts support may take — each only where your assignment lets you manage. Account credit is only asked for: an administrator approves it. Also requires the support role. — POST /support/customers/{user}/billing-information POST /support/customers/{user}/billing/bill-notices POST /support/customers/{user}/billing/refunds-block POST /support/customers/{user}/billing/shop-block POST /support/customers/{user}/credits POST /support/customers/{user}/credits/{creditGrant}/actions/adjust POST /support/customers/{user}/credits/{creditGrant}/actions/remove POST /support/customers/{user}/dns-zones POST /support/customers/{user}/dns-zones/{zone}/actions/delete POST /support/customers/{user}/dns-zones/{zone}/records POST /support/customers/{user}/dns-zones/{zone}/records/{record} POST /support/customers/{user}/dns-zones/{zone}/records/{record}/actions/delete POST /support/customers/{user}/instances/{instance}/actions/rename POST /support/customers/{user}/instances/{instance}/actions/restart POST /support/customers/{user}/instances/{instance}/actions/start POST /support/customers/{user}/instances/{instance}/actions/stop GET /support/customers/{user}/instances/{instance}/console POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/attach POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/change-ip POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/detach POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/make-primary POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/move POST /support/customers/{user}/instances/{instance}/vm-snapshots POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/delete POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/confirm POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/decline POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/resolve POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/retry POST /support/customers/{user}/members/{member} POST /support/customers/{user}/members/{member}/actions/remove POST /support/customers/{user}/networks/{network}/actions/release POST /support/customers/{user}/password POST /support/customers/{user}/payments/{payment}/chargebacks POST /support/customers/{user}/profile POST /support/customers/{user}/public-ip-addresses/{publicIPAddress}/networks/{network}/actions/move POST /support/customers/{user}/social-accounts/{socialAccount}/actions/unlink POST /support/customers/{user}/subscriptions/{subscription}/actions/cancel POST /support/customers/{user}/subscriptions/{subscription}/actions/force-refund POST /support/customers/{user}/subscriptions/{subscription}/actions/lift-suspension POST /support/customers/{user}/subscriptions/{subscription}/actions/lock POST /support/customers/{user}/subscriptions/{subscription}/actions/request-invoice-cancellation POST /support/customers/{user}/subscriptions/{subscription}/actions/unlock POST /support/customers/{user}/subscriptions/{subscription}/actions/unstage-resize POST /support/customers/{user}/tickets/{ticket}/actions/close POST /support/customers/{user}/tickets/{ticket}/comments POST /support/customers/{user}/volumes/{volume}/snapshot-policies POST /support/customers/{user}/volumes/{volume}/snapshots POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/delete POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/restore POST /support/customers/{user}/vpn POST /support/customers/{user}/vpn/users POST /support/customers/{user}/vpn/users/{vpnUser}/actions/delete

03 Conventions

The things every endpoint does the same way

Requests and responses

Send JSON and ask for JSON. A single resource comes back under a data key; a collection comes back under data with meta and links beside it. Every write requires the email address on the account to be verified, exactly as the panel does.

Pagination

Collections take page and per_page. per_page defaults to 25 and anything above 100 is reduced to 100. meta carries the totals and links carries the neighbouring pages.

Rate limits

Budgets are counted per token, not per account, so one scripted integration cannot starve another. Reads are 120 a minute, writes 60, staff reads of another customer 30, ordering 5, and a reconciling read (refresh=true) 10 — that last one reaches the cloud itself, so it must not be used for polling.

Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, the last of these in seconds. A refusal is 429 with Retry-After.

Retrying safely

Ordering requires an Idempotency-Key header you choose. The key is claimed before the order runs, so a retry that arrives while the first attempt is still going gets 409 rather than a second charge, and a repeat of a finished request replays the first response instead of ordering again.

Errors

One error shape for the whole API — RFC 9457 problem details, served as application/problem+json — so nothing has to branch on which of two formats came back. Branch on type, which is one stable URI per status code. Server-side failures never carry internal detail in production.

Field Type Description
type string A stable URI identifying the error class. One per status code.
title string A short, fixed summary of the error class — the same text for every occurrence of one `type`, so it is safe to show or to match on. `detail` carries what went wrong this time.
status integer The HTTP status code, repeated in the body.
detail string A human-readable explanation for this specific occurrence. For 5xx responses this is a fixed, non-specific string in production — internal detail is logged, never served.
instance string The path of the request that failed.
errors Optional object Present only on 422. Field name to list of messages.
{
    "type": "https://cloud.core.gen.tr/api/errors/validation-failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "The name field is required.",
    "instance": "/api/v1/me"
}

Operations

Identity

Who the presented token belongs to.

GET /me #

The identity behind the presented token

account:read api.read

Returns the authenticated user together with the abilities carried by the token used for this request. Call this to discover what a token may do instead of probing endpoints and collecting 403s.

Responses

  • 200 The authenticated user.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /activity-log #

Read your activity log

account:read api.read

Every audit record about you, newest first — the panel's Activity log. The integrity chain, the recorded changes and the request context are never published.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
domain Optional query string one of cloud, billing, dns, tickets, account, auth, shop, privacy, partner, system

Responses

  • 200 A page of audit records.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/activity-log' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Account

Your own profile and notification settings, and the account's billing information — account:read to read, account:write to change. Passwords, sign-in methods, the two security switches and the licence agreement stay in the panel.

PATCH /me #

Change your own profile

account:write api.read api.write

The panel's profile form, field for field and with the same rules: your full name, birth date, identity number (or, for a customer whose language is not Turkish, the placeholder 22222222222 and a passport number), phone number and language. The identity document is judged by YOUR language, as the panel does. A Turkish identity number is checked against the population register where the installation does so, and a refusal is a 422 on identity_number. Identity documents are never returned.

Requires account:write, whose owner must hold account: manage — stricter than the panel, where every member edits their own profile.

Request body Required

Field Type Description
name Required string Your full name — at least two words.
birthdate Required string Your date of birth; you must be at least 18.
identity_number Required string Your T.C. identity number, or `22222222222` with a passport number.
passport_number Optional string Your passport number — required while your language is not Turkish and none is on file.
phone Required string Your phone number in international form, starting with `+`.
language Required string The language you read the panel and your notices in.

Responses

  • 200 Your profile, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/me' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Ayşe Yılmaz",
    "birthdate": "string",
    "identity_number": "string",
    "phone": "+90 532 000 00 00",
    "language": "tr-TR"
}'
GET /me/settings #

Your notification settings

account:read api.read

Your own notification switches, and the two security switches that are changed only in the panel.

Responses

  • 200 Your settings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/me/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /me/settings #

Change your notification settings

account:write api.read api.write

Turns notifications by e-mail and by phone on or off; a field you leave out keeps its value. The Telegram two-factor switch and the API-token revocation switch are not accepted here — each has its own proven door in the panel, and a token is exactly the credential a stolen session would use to weaken them. Every change is audited.

Request body Required

Field Type Description
enable_email_notifications Optional boolean Notifications by e-mail.
enable_phone_notifications Optional boolean Notifications by phone (Telegram).

Responses

  • 200 Your settings, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/me/settings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "enable_email_notifications": true,
    "enable_phone_notifications": true
}'
GET /account/billing-information #

The account's billing information

account:read api.read

What every invoice and proforma of the account is issued to, and the currency its bills are charged in.

Responses

  • 200 The billing information.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/account/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /account/billing-information #

Change the account's billing information

account:write api.read api.write

The panel's billing form, with the same rules. corporate: true makes the company name, tax number and tax office required. A partner account stays corporate whatever corporate says: a body that would leave it without a company name and a tax number is refused with a 422 on corporate. The country decides the currency bills are charged in (Türkiye: TL, anywhere else: USD), so a change that would move the currency while bills are still open is refused with a 422 on country — settle them first. The invoicing name is always the account owner's.

Requires account:write, whose owner must hold account: manage — the panel's gate.

Request body Required

Field Type Description
corporate Optional boolean A corporate invoice. Absent or false is a personal one — except on a partner account, which stays corporate whatever this says.
company_name Optional string The company's name; required for a corporate invoice.
tax_number Optional string The company's tax number (digits); required for a corporate invoice.
tax_office Optional string The company's tax office; required for a corporate invoice.
address Required string The street address.
city Required string The city.
postal_code Required string The postal code.
country Required string The billing country — an ISO 3166 code (`TR`, `792`) or its name.

Responses

  • 200 The billing information, saved.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/account/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "address": "string",
    "city": "string",
    "postal_code": "string",
    "country": "TR"
}'

Operations

AI gateway

The account's keys to the AI gateway — list them and what they have spent (ai:read), create one and revoke one (ai:write). The limits on the keys are set by our staff. Every route answers 403 while the gateway is switched off.

GET /ai/keys #

List the account's AI gateway keys

ai:read api.read

Every key on the account, live and revoked, newest first — never a secret. meta carries the account's key cap, how many keys are live, and the gateway address your code points at. While the AI gateway is switched off for the installation, every route here answers 403.

Responses

  • 200 The keys.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ai/keys' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /ai/keys #

Create an AI gateway key

ai:write api.read api.order

Mints a key against the account's gateway budget and answers 201 with its secret. The secret is in this response only — it is stored nowhere, and a lost secret is replaced by creating a new key. The key counts against the account's max_keys; at the cap, or while another key is being created for the account, or while the login or the account is barred, the request is refused with 409 and nothing is created. The limits that bind the key (budget, requests and tokens per minute, allowed models) are set by our staff and cannot be changed here. Every key created is audited.

Request body Required

Field Type Description
name Required string Your label for the key — how you will tell it apart when one has to be revoked.
expires_at Optional string When the key stops working on its own; in the future. Omit for never.

Responses

  • 201 The key, with its secret — shown this once.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 At the key cap, another key is being created, or the login or account is barred. Nothing was created.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/ai/keys' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "ci runner"
}'
DELETE /ai/keys/{aiKey} #

Revoke an AI gateway key

ai:write api.read api.write

Tells the gateway to stop honouring the key, then records the revocation — never the other way round, so a key shown as revoked is really dead. Any member who may manage the account's AI keys may revoke one a colleague created. Idempotent: revoking a key that is already revoked answers 200 with it. A key of another account is 404.

Parameters

Name In Type Description
aiKey Required path integer The key's id.

Responses

  • 200 The key, revoked.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/ai/keys/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ai/usage #

The AI gateway limits and spend

ai:read api.read

The limits our staff set on the account's gateway team — the budget, requests and tokens per minute, and the models the keys may call — and what the team has spent, live from the gateway. The limits are read-only here: the panel offers no door to change them either. When the gateway does not answer, the limits still read and spend.error says why the figure is missing. Both are null before the account's first key.

Responses

  • 200 The limits and the spend.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ai/usage' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Compute

Virtual machines.

GET /instances #

List virtual machines

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance} #

Read one virtual machine

cloud:read api.read

There is no DELETE for a machine, on purpose: a machine is a paid subscription, and it is removed by cancelling that subscription — POST /subscriptions/{subscription}/actions/cancel, whose id is this machine's subscription in GET /subscriptions. Cancelling stops billing and hands the machine to the retention queue, the same path the panel's Cancel takes.

Parameters

Name In Type Description
instance Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The virtual machine.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /instances/{instance} #

Rename a virtual machine

cloud:write api.read api.write

The only mutable attribute. Resizing is a billing event (POST /orders), and lifecycle changes are actions.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
name Required string

Responses

  • 200 The updated virtual machine.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/instances/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
GET /instances/{instance}/networks #

List a machine's networks

cloud:read api.read

The networks this machine is on — its interfaces, read live from the cloud — and the caller's networks it could join. Nothing is reconciled: an interface on a network no stored row names yet answers id: null. Read-only; writes nothing and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The machine's networks.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/networks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/vm-snapshots #

List a machine's live snapshots

cloud:read api.read

Whole-machine copies, for a machine whose plan takes them. Database-backed; pass refresh=true to reconcile against the cloud first (tighter limit, and it deletes local rows the cloud no longer lists). Copies waiting in the retention queue are not listed.

Parameters

Name In Type Description
instance Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of live snapshots.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/vm-snapshots #

Take a live snapshot of a machine

cloud:write api.read api.write

Starts a whole-machine copy (with its memory when with_memory is true). Refused with 409 while live snapshots are switched off, when the machine's plan takes none or its allowance is used, or while the machine is being resized.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
name Required string
description Optional string
with_memory Optional boolean

Responses

  • 201 The snapshot, being taken.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
DELETE /instances/{instance}/vm-snapshots/{vmSnapshot} #

Delete a live snapshot

cloud:write api.read api.write

Deletes the copy in the cloud. It cannot be undone. A copy still being taken is 409.

Parameters

Name In Type Description
instance Required path integer
vmSnapshot Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert #

Put a machine back on a live snapshot

cloud:write api.read api.write

Puts the machine back on this copy, IN PLACE — everything since is lost. The machine must be stopped. A copy with memory is refused while a refund request holds the machine. Each refusal is a 409 saying why.

Parameters

Name In Type Description
instance Required path integer
vmSnapshot Required path integer

Responses

  • 200 The machine after the revert.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/vm-snapshots/1/actions/revert' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/schedules #

List a machine's power schedules

cloud:read api.read

The machine's start, stop and reboot schedules, as stored. paused_by names the hold (suspension, retention) that switched a start schedule off.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The schedules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/schedules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/schedules #

Add a power schedule

cloud:write api.read api.write

A cron schedule the cloud runs by itself. A suspended machine cannot be given one; a START schedule is refused with 409 while a refund request holds the machine.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
action Required string
name Optional string
description Optional string
cron_expression Required string
timezone Required string
enabled Optional boolean
start_at Optional string
end_at Optional string

Responses

  • 201 The schedule.
  • 202 Created, not yet listed by the cloud.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/schedules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "action": "start",
    "cron_expression": "0 8 * * 1-5",
    "timezone": "Europe/Istanbul"
}'
PATCH /instances/{instance}/schedules/{schedule} #

Edit or toggle a power schedule

cloud:write api.read api.write

Changes the schedule; send enabled to switch it on or off. Switching a START schedule on is a start, so it is refused on a suspended machine and, with 409, while a refund request holds it. An explicit switch clears paused_by.

Parameters

Name In Type Description
instance Required path integer
schedule Required path integer

Request body Required

Field Type Description
name Optional string
description Optional string
cron_expression Required string
timezone Required string
enabled Optional boolean
start_at Optional string
end_at Optional string

Responses

  • 200 The schedule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/instances/1/schedules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "cron_expression": "0 8 * * 1-5",
    "timezone": "Europe/Istanbul"
}'
DELETE /instances/{instance}/schedules/{schedule} #

Delete a power schedule

cloud:write api.read api.write

Deletes the schedule in the cloud and here.

Parameters

Name In Type Description
instance Required path integer
schedule Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/schedules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/annotations #

List a machine's notes

cloud:read api.read

Notes kept on the machine, read live from the cloud. Writes and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The notes.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/annotations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/annotations #

Add a note to a machine

cloud:write api.read api.write

Adds a note to the machine.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
annotation Required string

Responses

  • 201 The note.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/annotations' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "annotation": "string"
}'
DELETE /instances/{instance}/annotations/{annotation} #

Delete a note

cloud:write api.read api.write

Deletes one of this machine's notes; a note on another machine is a 404.

Parameters

Name In Type Description
instance Required path integer
annotation Required path string

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/instances/1/annotations/annotation' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/events #

List a machine's events

cloud:read api.read

What happened to the machine — starts, stops, restores — read live from the cloud's event log. Writes and deletes nothing.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The events.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/events' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/attach #

Put a machine on another network

cloud:write api.read api.write

Adds {network} to the machine as an ADDITIONAL network, leaving the networks it is on in place — the panel's Attach. Both the machine and the network must be the caller's (another account's is a 404). A locked machine, or a refusal by the cloud, is a 409 whose detail says why.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/detach #

Take a machine off a network

cloud:write api.read api.write

Takes the machine off {network} — the panel's Detach. Refused with 409 when it is the machine's only or primary network, or when rules still forward to it there.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/make-primary #

Make a network the machine's primary

cloud:write api.read api.write

Moves the machine's default route to {network}, which it must already be on. The machine is STOPPED to do it and is not started again.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/make-primary' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/networks/{network}/actions/move #

Move a machine to another network

cloud:write api.read api.write

Moves the machine OFF from_network_id and ONTO {network} in one step — the panel's Move. The machine is stopped to do it. Refused with 409 when the machine cannot leave the network it is on.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Request body Required

Field Type Description
from_network_id Required integer The network the machine leaves (one of `GET /networks`).

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "from_network_id": 1
}'
POST /instances/{instance}/networks/{network}/actions/change-ip #

Change a machine's private address on a network

cloud:write api.read api.write

Gives the machine the private address ip_address on {network}. The machine is stopped to do it. The same address it already has is a 422; an address outside the network or already taken is a 409 saying so.

Parameters

Name In Type Description
instance Required path integer
network Required path integer

Request body Required

Field Type Description
ip_address Required string

Responses

  • 200 The machine, as stored after the change.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/networks/1/actions/change-ip' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "ip_address": "10.1.1.20"
}'
POST /instances/{instance}/actions/start #

Start a virtual machine

cloud:write api.read api.write

Idempotent: starting an already-running machine returns 200 immediately without contacting the cloud. Terraform and similar tools reconcile desired state rather than issue commands, so asking for a state the machine is already in must never error.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/stop #

Stop a virtual machine

cloud:write api.read api.write

Idempotent: stopping an already-stopped machine returns 200 immediately without contacting the cloud, for the same reason as start.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, stopped (or already stopped).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/restart #

Restart a virtual machine

cloud:write api.read api.write

Not idempotent — unlike start/stop there is no target state to compare against, so this always reaches the cloud regardless of the machine's current state.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, restarted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/reset-password #

Reset a virtual machine's password

cloud:write api.read api.write

NOT idempotent: every call generates and stores a brand new password, replacing whatever was there before. Fetch the result from GET /instances/{instance}/password afterwards, or from this response's data — the password itself is never included here (see Instance).

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, after the password reset.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/reset-password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/password #

Read a virtual machine's password

cloud:read api.read

Database-backed; never contacts the cloud. Returns null rather than 403 when the owning subscription is locked and the caller is not staff — the machine is visible, its password just is not.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine's password.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /instances/{instance}/console #

Open a virtual machine console session

cloud:write api.read api.write

Mints a fresh, one-time console session in the cloud on every call — an action against the provider, not a database read, which is why it requires cloud:write rather than cloud:read and is subject to the same rate limit as the lifecycle actions.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 A console session URL.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/instances/1/console' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /instances/{instance}/actions/attach-iso #

Attach an ISO to a virtual machine

cloud:write api.read api.write

Idempotent: attaching an ISO already mounted on this instance returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
instance Required path integer

Request body Required

Field Type Description
iso_id Required integer Must name an ISO visible to the caller (public, or their own). A foreign private or missing id fails validation (422) rather than 404 — the addressed resource is the instance, not the ISO.

Responses

  • 200 The virtual machine, with the ISO attached (or already attached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/attach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "iso_id": 5
}'
POST /instances/{instance}/actions/detach-iso #

Detach whatever ISO is mounted on a virtual machine

cloud:write api.read api.write

Idempotent: detaching an instance with no ISO attached returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
instance Required path integer

Responses

  • 200 The virtual machine, with its ISO detached (or already detached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/instances/1/actions/detach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /isos/{iso} #

Rename one of your ISOs

cloud:write api.read api.write

Changes the name, description and bootable flag of an image you uploaded — the panel's edit form, all three fields. A public image, or another account's, is refused.

Parameters

Name In Type Description
iso Required path integer

Request body Required

Field Type Description
name Required string
description Required string
bootable Required boolean

Responses

  • 200 The ISO.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "bootable": true
}'
DELETE /isos/{iso} #

Delete one of your ISOs

cloud:write api.read api.write

Deletes an image you uploaded, in the cloud and here. It cannot be undone. A public image, or another account's, is refused.

Parameters

Name In Type Description
iso Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads #

Begin a chunked ISO upload

cloud:write api.read api.write

Opens an upload for an image of size bytes (at most 4 GiB). Send it as parts of chunk_size bytes (16 MiB; the last may be shorter) with POST /isos/uploads/{upload}/chunks, in any order and again after a failure, then POST …/actions/complete. An account may have three uploads open at once; a fourth is a 422. Uploads idle for six hours are removed.

Request body Required

Field Type Description
name Required string
description Required string
bootable Required boolean
filename Required string The file's name; must end in `.iso` or `.img`.
size Required integer

Responses

  • 201 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "description": "string",
    "bootable": true,
    "filename": "string",
    "size": 1
}'
GET /isos/uploads/{upload} #

Read an open upload

cloud:write api.read

The upload and the part indexes already received, so a client that lost its place sends only what is missing. Another account's upload is a 404.

Parameters

Name In Type Description
upload Required path string

Responses

  • 200 The open upload.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /isos/uploads/{upload} #

Abort an upload

cloud:write api.read api.write

Gives up the upload and removes its parts now.

Parameters

Name In Type Description
upload Required path string

Responses

  • 204 Aborted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads/{upload}/chunks #

Send one part of an upload

cloud:write api.read api.write

One part, as multipart/form-data: index (from 0) and file. Every part but the last must be exactly chunk_size bytes; a part of the wrong size, or an index outside the upload, is a 422. Sending a part again replaces it.

Parameters

Name In Type Description
upload Required path string

Responses

  • 200 The upload, with this part received.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload/chunks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /isos/uploads/{upload}/actions/complete #

Complete an upload and register the ISO

cloud:write api.read api.write

Assembles the parts and registers the image with the cloud. 201 with the ISO; 202 when the cloud took the image but has not listed it yet — it appears in GET /isos once it does. A missing part is a 422. The upload is gone afterwards either way.

Parameters

Name In Type Description
upload Required path string

Responses

  • 201 The registered ISO.
  • 202 Registered, not yet listed by the cloud.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/isos/uploads/upload/actions/complete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Storage

Volumes and ISOs.

GET /volumes #

List volumes

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of volumes.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volumes/{volume} #

Read one volume

cloud:read api.read

There is no DELETE for a volume, on purpose: an extra disk is a paid subscription, and it is removed by cancelling that subscription — POST /subscriptions/{subscription}/actions/cancel, whose id is this disk's subscription in GET /subscriptions. A machine's root disk goes with the machine.

Parameters

Name In Type Description
volume Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The volume.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /volumes/{volume} #

Rename a volume

cloud:write api.read api.write

The only mutable attribute. Attach/detach are actions, and resizing is a billing event (POST /orders).

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
name Required string

Responses

  • 200 The updated volume.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/volumes/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /volumes/{volume}/actions/attach #

Attach a volume to one of the caller's instances

cloud:write api.read api.write

Idempotent: attaching a volume already attached to the named instance returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
instance_id Required integer Must name an instance the caller owns. A foreign or missing id fails validation (422) rather than 404 — the addressed resource is the volume, not the instance.

Responses

  • 200 The volume, attached (or already attached to the named instance).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instance_id": 17
}'
POST /volumes/{volume}/actions/detach #

Detach a volume from whatever instance it is attached to

cloud:write api.read api.write

Idempotent: detaching an already-detached volume returns 200 immediately without contacting the cloud.

Parameters

Name In Type Description
volume Required path integer

Responses

  • 200 The volume, detached (or already detached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volumes/{volume}/snapshots #

List a volume's snapshots

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile the volume's snapshots against the cloud first — that variant is rate-limited far more tightly, must not be used for polling, and deletes local snapshot records the cloud no longer lists. A snapshot moved to the retention queue (after snapshots were dropped from the disk's plan) is not listed.

Parameters

Name In Type Description
volume Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of the volume's snapshots, newest first.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshots #

Take a manual snapshot of a volume

cloud:write api.read api.write

The snapshot is taken in the background: the response carries it in state Creating. A manual snapshot counts against the snapshot limit. 409 when the limit is reached (only manual snapshots count), when the disk's plan includes no snapshots, or while the disk or its machine is being resized; the body's detail says which. A snapshot is deleted with DELETE /volumes/{volume}/snapshots/{snapshot}, restored into a new volume with POST …/{snapshot}/actions/restore, and scheduled with /volumes/{volume}/snapshot-policies.

Parameters

Name In Type Description
volume Required path integer

Request body Optional

Field Type Description
name Optional string An optional label for the snapshot.

Responses

  • 201 The snapshot, requested and being taken.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "before-upgrade"
}'
GET /volumes/{volume}/snapshots/{snapshot} #

Read one snapshot of a volume

cloud:read api.read

Database-backed. A snapshot of another disk, a snapshot held in the retention queue and an id that does not exist all answer 404.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Responses

  • 200 The snapshot.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /volumes/{volume}/snapshots/{snapshot} #

Delete a snapshot

cloud:write api.read api.write

Deletes the snapshot in the cloud, the same act as the panel's Delete. It cannot be undone. A snapshot held in the retention queue is not yours to delete and answers 404.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Responses

  • 204 Deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshots/{snapshot}/actions/restore #

Restore a snapshot into a new volume

cloud:write api.read api.write

Creates a NEW volume named name from the snapshot — never an in-place rollback of the disk it was taken from. The new volume counts against max_vols, and one snapshot can be restored a limited number of times; 409 names the limit that was reached, or says that another restore is already starting on the account. The restore runs in the background: the new volume appears in GET /volumes once the cloud reports it, and the response carries the snapshot with its restore_count moved.

Parameters

Name In Type Description
volume Required path integer
snapshot Required path integer

Request body Required

Field Type Description
name Required string The new volume's name.

Responses

  • 202 The restore started; the snapshot it started from.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshots/1/actions/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "restored-data"
}'
GET /volumes/{volume}/snapshot-policies #

List a volume's retention schedules

cloud:read api.read

The schedules the cloud keeps for this disk — "keep 7 daily, 4 weekly". The cloud takes each snapshot on schedule and drops the oldest past the count. Database-backed.

Parameters

Name In Type Description
volume Required path integer

Responses

  • 200 The disk's retention schedules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /volumes/{volume}/snapshot-policies #

Add a retention schedule to a volume

cloud:write api.read api.write

The panel's retention form: an interval and how many snapshots to keep. The cloud runs the schedule at an off-peak time in UTC. max_snaps is bounded by the account's snapshot limit — on a machine's boot disk, by the machine's plan — and 409 says so when the plan takes no disk snapshots at all. There is no delete: the panel offers none either.

Parameters

Name In Type Description
volume Required path integer

Request body Required

Field Type Description
interval_type Required string
max_snaps Required integer How many snapshots of this schedule to keep.

Responses

  • 201 The schedule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "interval_type": "HOURLY",
    "max_snaps": 1
}'
GET /isos #

List ISOs

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Includes every ISO visible to the caller: their own, plus every ISO the provider marks public.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of ISOs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /isos/{iso} #

Read one ISO

cloud:read api.read

Visible when public, or when it belongs to the caller. A private ISO belonging to another customer 404s, indistinguishable from one that does not exist.

Parameters

Name In Type Description
iso Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The ISO.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/isos/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Catalogue

Templates and offerings — the global, sellable product catalogue every instance and volume is built from. Read-only: see each endpoint's description for why reconciliation is never exposed here.

GET /templates #

List templates

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the panel already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of templates.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/templates' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /templates/{template} #

Read one template

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the panel already knows.

Parameters

Name In Type Description
template Required path integer

Responses

  • 200 The template.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/templates/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /compute-offerings #

List compute offerings

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the panel already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of compute offerings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/compute-offerings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /disk-offerings #

List disk offerings

cloud:read api.read

Reconciling the catalogue against the provider is a global administrative operation that can remove sellable products, so it is deliberately not available here. This endpoint always serves what the panel already knows.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of disk offerings.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/disk-offerings' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Network

Firewall rules, public IP addresses, VPN and affinity groups. See each collection endpoint's description for the reconciling sibling it exists to keep off the request path — network resources are where that reconciliation compounds hardest, since reading firewall rules can also reconcile instances.

GET /ingress-rules #

List ingress firewall rules

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling. It is also the single most destructive read in this API: the reconciling method it calls deletes local firewall rules the provider listing omits, and its create-branch reconciles the caller's instances too, deleting any of those the listing omits as well.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of ingress rules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ingress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /ingress-rules #

Create an ingress firewall rule

cloud:write api.read api.write

Forwards a public IP/port combination to a private port on one of the caller's own instances. public_ip_address must name one of the caller's own stored public IP addresses, and instance_id one of the caller's own instances; either failing to resolve is 422, not 404 — the addressed resource is this collection endpoint.

Request body Required

Field Type Description
public_ip_address Required string
protocol Required string
public_port_start Required integer
public_port_end Required integer Must be greater than or equal to `public_port_start`.
private_port_start Required integer
private_port_end Required integer Must be greater than or equal to `private_port_start`.
instance_id Required integer

Responses

  • 201 The new ingress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/ingress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip_address": "203.0.113.10",
    "protocol": "tcp",
    "public_port_start": 1,
    "public_port_end": 1,
    "private_port_start": 1,
    "private_port_end": 1,
    "instance_id": 17
}'
PATCH /ingress-rules/{ingressRule} #

Retarget an ingress firewall rule

cloud:write api.read api.write

The only mutable attributes: which private ports the rule forwards to, and which of the caller's own instances it forwards to. instance_id must name an instance the caller owns; a foreign or missing id fails validation (422), not 404 — the addressed resource is the rule, already resolved and owned before this request runs.

Parameters

Name In Type Description
ingressRule Required path integer

Request body Required

Field Type Description
private_port_start Required integer
private_port_end Required integer Must be greater than or equal to `private_port_start`.
instance_id Required integer

Responses

  • 200 The updated ingress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/ingress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "private_port_start": 1,
    "private_port_end": 1,
    "instance_id": 17
}'
DELETE /ingress-rules/{ingressRule} #

Delete an ingress firewall rule

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
ingressRule Required path integer

Responses

  • 204 The rule was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/ingress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /egress-rules #

List egress firewall rules

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of egress rules.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/egress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /egress-rules #

Create an egress firewall rule

cloud:write api.read api.write

Permits traffic from source_cidr toward destination_cidr. Both must be well-formed CIDR blocks — a malformed CIDR reaching the cloud from a firewall endpoint is a security defect, not a validation nicety.

Request body Required

Field Type Description
source_cidr Required string
destination_cidr Required string
protocol Required string
port_start Required integer
port_end Required integer Must be greater than or equal to `port_start`.

Responses

  • 201 The new egress rule.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/egress-rules' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "source_cidr": "10.0.0.0/24",
    "destination_cidr": "0.0.0.0/0",
    "protocol": "tcp",
    "port_start": 1,
    "port_end": 1
}'
DELETE /egress-rules/{egressRule} #

Delete an egress firewall rule

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
egressRule Required path integer

Responses

  • 204 The rule was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/egress-rules/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /networks #

List networks

cloud:read api.read

The caller's own isolated networks, the free one first. Database-backed and never reconciled against the provider — there is no refresh parameter, because a reconciling read deletes local rows. Use an id from here as network_id on an order line.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of networks.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/networks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /networks/{network} #

Read a network

cloud:read api.read

One of the caller's networks. Another account's network is a 404, exactly like an id that does not exist.

Parameters

Name In Type Description
network Required path integer

Responses

  • 200 The network.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /networks/{network} #

Name a network

cloud:write api.read api.write

Sets the caller's own name for the network — a label the cloud never sees. null or an empty string clears it back to the generated name.

Parameters

Name In Type Description
network Required path integer

Request body Required

Field Type Description
label Optional string

Responses

  • 200 The network.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "label": "string"
}'
DELETE /networks/{network} #

Release a network

cloud:write api.read api.write

Hands an emptied network back to the cloud, together with the public address it holds. Whether this network may go is decided at the moment of the release: anything still on it — a machine, a bought address, its subscription — refuses it with a 409 saying what. It cannot be undone.

Parameters

Name In Type Description
network Required path integer

Responses

  • 204 Released.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/networks/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /public-ip-addresses #

List public IP addresses

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling. It deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of public IP addresses.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /public-ip-addresses/{publicIPAddress} #

Read a public IP address

cloud:read api.read

Database-backed by default. Pass refresh=true to reconcile the caller's whole set against the provider first, then pick this address out of it — there is no single-address provider lookup — before responding. That variant is rate-limited far more tightly and must not be used for polling, and, like the collection endpoint, deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
publicIPAddress Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The public IP address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /public-ip-addresses/{publicIPAddress} #

Set the reverse DNS record for a public IP address

dns:write api.read api.write

Writes a PTR record on the DNS service and the local row. It changes nothing in the cloud, which is why this requires dns:write rather than cloud:write, but it first checks that the address is still this account's in the cloud's live listing: 422 when it is not, 502 when the listing cannot be read. See DNSUserService::updatePublicIPAddress().

Parameters

Name In Type Description
publicIPAddress Required path integer

Request body Required

Field Type Description
reverse_record Required string A valid DNS hostname.

Responses

  • 200 The updated public IP address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reverse_record": "host.example.com"
}'
POST /public-ip-addresses/{publicIPAddress}/actions/move #

Move a public address to another network

cloud:write api.read api.write

Puts a BOUGHT address on another of the caller's networks. The cloud cannot re-home an address, so this RELEASES it and acquires a new one on the target network: the address changes, and it cannot be undone. Nothing is charged. A network's own source-NAT address, an address with forwarding rules or a VPN on it, and a target network with nothing running yet are each refused with a 409 saying so.

Parameters

Name In Type Description
publicIPAddress Required path integer

Request body Required

Field Type Description
network_id Required integer The target network (one of `GET /networks`).

Responses

  • 200 The new address.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "network_id": 1
}'
GET /public-ip-addresses/{publicIPAddress}/move-plan #

Read where an address could move

cloud:read api.read

Whether this address can be moved and to which of the caller's networks, with the reason when it cannot. Served from the stored networks; nothing is reconciled.

Parameters

Name In Type Description
publicIPAddress Required path integer

Responses

  • 200 The plan.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/public-ip-addresses/1/move-plan' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /vpn #

List the caller's VPNs

cloud:read api.read

A collection, not a single object: a customer account may have zero VPNs configured, or in principle more than one. Database-backed by default; pass refresh=true to reconcile against the provider first — that variant is rate-limited far more tightly and must not be used for polling, and deletes local rows the provider listing does not contain.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of VPNs.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
PATCH /vpn #

Switch a VPN gateway on or off

cloud:write api.read api.write

Turns the remote-access VPN gateway on one of the caller's public addresses on or off — the panel's switch. The gateway appears in GET /vpn?refresh=true once the cloud reports it. A switch the cloud did not make is a 409 saying so; users are managed at /vpn/users.

Request body Required

Field Type Description
public_ip_address_id Required integer
enabled Required boolean

Responses

  • 204 Switched.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip_address_id": 1,
    "enabled": true
}'
GET /vpn/users #

List VPN users

cloud:read api.read

Database-backed; never contacts the cloud. No refresh parameter — unlike public IP addresses and VPNs, this endpoint has no reconciling sibling exposed over the API.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of VPN users.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /vpn/users #

Create a VPN user

cloud:write api.read api.write

Creates a VPN user in the cloud under the caller's account. username must be free of the caller's own VPN users; a name already used by a different customer is not a conflict.

Both fields are validated against the cloud provider's own rule rather than a looser one of ours: each must BEGIN with a letter or a digit, and may then use letters, digits and a small punctuation set — @ . - _ for the username, and @ + = . - _ for the password. A value outside that is 422 here. It used to be accepted and refused by the provider afterwards, which reached the caller as a 502 naming a system they have no access to.

Request body Required

Field Type Description
username Required string
password Required string

Responses

  • 201 The new VPN user.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "jdoe",
    "password": "string"
}'
DELETE /vpn/users/{vpnUser} #

Delete a VPN user

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
vpnUser Required path integer

Responses

  • 204 The VPN user was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/vpn/users/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /affinity-groups #

List affinity groups

cloud:read api.read

Database-backed; never contacts the cloud. No refresh parameter: this endpoint's reconciling sibling is destructive in a way none of the others in this API are — it deletes both local affinity groups the provider listing omits and instance membership rows alongside them — and is never exposed here.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of affinity groups.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/affinity-groups' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /affinity-groups #

Create an affinity group

cloud:write api.read api.write

name must be unique across every customer's affinity groups — the provider does not namespace affinity group names per account. Each instances.* must name one of the caller's own instances; a foreign or missing id is 422, not 404.

Request body Required

Field Type Description
name Required string
description Optional string
affinity_type Required string
instances Optional array of integer

Responses

  • 201 The new affinity group.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/affinity-groups' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "web-tier",
    "affinity_type": "Host Affinity"
}'
PATCH /affinity-groups/{affinityGroup} #

Retarget an affinity group's membership

cloud:write api.read api.write

The only mutable attribute: which of the caller's own instances belong to the group. The provider does not support renaming or retyping an affinity group after creation. Each instances.* must name one of the caller's own instances; a foreign or missing id is 422, not 404 — the addressed resource is the group, already resolved and owned before this request runs. An empty array clears the group's membership.

Parameters

Name In Type Description
affinityGroup Required path integer

Request body Required

Field Type Description
instances Required array of integer

Responses

  • 200 The updated affinity group.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/affinity-groups/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "instances": [
        17
    ]
}'
DELETE /affinity-groups/{affinityGroup} #

Delete an affinity group

cloud:write api.read api.write

The one documented exception to "every mutation returns the current representation": there is nothing left to return after a delete, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
affinityGroup Required path integer

Responses

  • 204 The affinity group was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/affinity-groups/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

DNS

Zones and records on the panel's DNS integration. refresh=true on any read here is the widest-blast-radius reconciliation in the whole API — there is no single-zone reconcile primitive, so it always resyncs the caller's entire DNS account, not just the resource addressed by the request.

GET /dns-zones #

List DNS zones

dns:read api.read

Database-backed by default. Pass refresh=true to reconcile against the DNS service first — that variant is rate-limited far more tightly and must not be used for polling. Unlike the equivalent parameter on /instances or /volumes, a DNS refresh reconciles the caller's entire DNS account, not just this listing: there is no cheaper single-zone reconcile primitive in the underlying service. It also deletes local zones (and cascades to their records) that the DNS service's own listing no longer contains.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /dns-zones #

Create a DNS zone

dns:write api.read api.write

Requires at least one of the caller's own subscriptions to be in the deployed state, and refuses a 6th zone — both checked before the zone is created on the DNS service, so a rejected request never leaves an orphan zone upstream.

Request body Required

Field Type Description
name Required string The zone's domain name, without a trailing dot.

Responses

  • 201 The new DNS zone.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "example.com"
}'
GET /dns-zones/{zone} #

Read a DNS zone

dns:read api.read

Database-backed by default. Pass refresh=true to reconcile before responding — like the collection endpoint, this reconciles the caller's entire DNS account (there is no single-zone reconcile primitive), then picks this zone out of the result. That variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
zone Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The DNS zone.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /dns-zones/{zone} #

Delete a DNS zone

dns:write api.read api.write

Deletes the zone on the DNS service and its local row, and all of its records' local rows along with it. The one documented exception to "every mutation returns the current representation": there is nothing left to return, so this responds 204 with an empty body rather than 200 with the deleted resource.

Parameters

Name In Type Description
zone Required path integer

Responses

  • 204 The zone (and its records) were deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/dns-zones/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /dns-zones/{zone}/records #

List a DNS zone's records

dns:read api.read

Database-backed by default: a plain read of the zone's own records, no provider call involved (the zone itself must already belong to the caller — resolved and 404'd before any record is ever looked up). Pass refresh=true to reconcile first — like the zone endpoints, this reconciles the caller's entire DNS account, not just this zone, and is rate-limited far more tightly.

Parameters

Name In Type Description
zone Required path integer
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of the zone's DNS records.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /dns-zones/{zone}/records #

Create a DNS record

dns:write api.read api.write

Requires at least one of the caller's own subscriptions to be in the deployed state, and refuses a 256th record on this zone — both checked before the record is created on the DNS service. Creating the record also reconciles the caller's entire DNS account as a side effect of reading the new record back — there is no cheaper way to obtain its local row, since the underlying provider call does not return one. A value the record's name and type already hold is refused with 422 on data before anything is written: one value is one record.

Parameters

Name In Type Description
zone Required path integer

Request body Required

Field Type Description
name Required string A relative value (e.g. `www`) is auto-qualified against the zone's own name; an already fully-qualified value (trailing dot) is used as-is.
type Required string
data Required string

Responses

  • 201 The new DNS record.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "www",
    "type": "A",
    "data": "203.0.113.5"
}'
PATCH /dns-zones/{zone}/records/{record} #

Update a DNS record

dns:write api.read api.write

The only mutable attributes: type and data. Updates the record on the DNS service and the local row directly, preserving the record's id — the underlying service method does not persist the change locally on its own, and reconciling through the account-wide sync instead would delete this record and mint a new one under a different id. A new type and data that another record at this name already holds is refused with 422 on data before anything is written; sending the record's own current value is accepted and changes nothing.

Parameters

Name In Type Description
zone Required path integer
record Required path integer

Request body Required

Field Type Description
type Required string
data Required string

Responses

  • 200 The updated DNS record.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X PATCH 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "A",
    "data": "203.0.113.6"
}'
DELETE /dns-zones/{zone}/records/{record} #

Delete a DNS record

dns:write api.read api.write

Deletes the record on the DNS service and its local row. The one documented exception to "every mutation returns the current representation": there is nothing left to return, so this responds 204 with an empty body rather than 200 with the deleted resource. When the DNS service no longer holds this record's value, the call answers 409, keeps the local row, and refresh=true on the zone's record list reconciles it.

Parameters

Name In Type Description
zone Required path integer
record Required path integer

Responses

  • 204 The record was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Billing

The sellable catalogue, subscriptions and their cancellation, payments, stored credit cards, refunds, the account balance and ordering. POST /orders pays only from the account balance. With billing:write an open bill can be paid with a saved card that has passed 3-D Secure — a card that has not is sent back to the panel with an approval_url, because a bank challenge needs a person in a browser — a refund can be asked for, and a saved card deleted; adding a card stays in the panel. See each endpoint's description for the reconciling sibling — if any — it deliberately keeps off the request path.

GET /virtual-machine-products #

List virtual machine products

billing:read api.read

The sellable VM catalogue. No refresh parameter: this is database-backed by construction — nothing here ever reconciles against the cloud, unlike the offerings it is built from. Only published products are returned, matching VirtualMachineProductPolicy::view().

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of virtual machine products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/virtual-machine-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /virtual-machine-products/{virtualMachineProduct} #

Read one virtual machine product

billing:read api.read

404s for an unpublished product, matching VirtualMachineProductPolicy::view() — reproduced as a query constraint, the same way GET /isos/{iso} reproduces IsoPolicy::view's visibility rule, rather than a policy check that would 403 instead.

Parameters

Name In Type Description
virtualMachineProduct Required path integer

Responses

  • 200 The virtual machine product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/virtual-machine-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volume-products #

List volume products

billing:read api.read

The sellable volume catalogue. No refresh parameter, for the same reason as GET /virtual-machine-products. Only published products are returned.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of volume products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volume-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /volume-products/{volumeProduct} #

Read one volume product

billing:read api.read

404s for an unpublished product, matching VolumeProductPolicy::view() — reproduced as a query constraint rather than a policy check.

Parameters

Name In Type Description
volumeProduct Required path integer

Responses

  • 200 The volume product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/volume-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ip-address-products #

List public IP address products

billing:read api.read

The sellable public IPv4 address catalogue. Only products that are published AND priced are returned — the same rule POST /orders sells by. Order one with an ip_address line.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of public IP address products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ip-address-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /ip-address-products/{ipAddressProduct} #

Read one public IP address product

billing:read api.read

404s for a product that is unpublished or has no payment plan, the same answer an id that does not exist gets.

Parameters

Name In Type Description
ipAddressProduct Required path integer

Responses

  • 200 The public IP address product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/ip-address-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /network-products #

List network products

billing:read api.read

The sellable additional-network catalogue. Only products that are published AND priced are returned. Order one with a network line; every account already holds one free network, which max_networks counts.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of network products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/network-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /network-products/{networkProduct} #

Read one network product

billing:read api.read

404s for a product that is unpublished or has no payment plan.

Parameters

Name In Type Description
networkProduct Required path integer

Responses

  • 200 The network product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/network-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /service-products #

List service products

billing:read api.read

The one-time services the shop sells — READ-ONLY here. A service is bought in the panel, never through POST /orders: buying one commits a person to do the work. Only services a customer can actually buy are returned (published, priced, and offered either freely or beside at least one template).

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of service products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/service-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /service-products/{serviceProduct} #

Read one service product

billing:read api.read

404s for a service a customer cannot buy — unpublished, unpriced, offered for nothing, or the partnership training.

Parameters

Name In Type Description
serviceProduct Required path integer

Responses

  • 200 The service product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/service-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /domain-name-products #

List domain name products

billing:read api.read

The domain-name catalogue — READ-ONLY, and only while domain reselling is switched on; otherwise this answers 404. A domain is bought in the panel, where the registrar is asked whether the name is free.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of domain name products.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/domain-name-products' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /domain-name-products/{domainNameProduct} #

Read one domain name product

billing:read api.read

404s while domain reselling is off, and for an unpublished or unpriced product.

Parameters

Name In Type Description
domainNameProduct Required path integer

Responses

  • 200 The domain name product.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/domain-name-products/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions #

List subscriptions

billing:read api.read

Database-backed only — no refresh parameter. Unlike volumes or instances, the reconciling sibling here (BillingUserService::listSubscriptions()) is not "ask the provider what exists": it is an administrative repair pass that promotes any subscription below deployed to deployed (so merely listing one would mark a Terraform provider's own deployment finished), terminates subscriptions whose instance moved, deletes ROOT-volume subscriptions along with their payments, and dials the cloud. It does not belong behind a customer's GET at any rate limit.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions/{subscription} #

Read one subscription

billing:read api.read

Ownership is enforced as a query constraint, not a policy check: another customer's subscription 404s here, where the panel's own route (implicit binding plus SubscriptionPolicy) would 403 it. No refresh parameter, for the same reason as GET /subscriptions.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/cancel #

Cancel a subscription

order:write api.read api.write

Terminates the subscription. Requires order:write, not billing:read: cancelling ends a paid asset, so it sits behind the same deliberate commerce-write opt-in as an order would, even though nothing here charges a card — TokenAbility's docblock is explicit that the read/write grid is not meant to be "completed" with a dedicated billing:write.

Idempotent on an already-terminated subscription: repeating the call returns 200 with the current (already-terminated) representation rather than the 409 a second cancellation would otherwise produce, so a Terraform destroy that retries after a timeout does not fail.

Refuses to cancel anything not currently deployed — an instance still running, a volume still attached, or a missing instance/volume — with 409, since each of those is a conflicting state the caller must resolve first (stop the instance, detach the volume), not a malformed request.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The subscription, terminated (or already terminated).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/cancel' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /subscriptions/{subscription}/resize-quote #

Price a resize

billing:read api.read

Prices moving this machine, disk or network to product_id — a product of the same kind — without changing anything. Refused with 409 in the service's own words while the purchase can still be refunded (no resize is offered inside the refund window), while a bill is open, or for any other reason the panel would refuse it.

Parameters

Name In Type Description
subscription Required path integer
product_id Required query integer

Responses

  • 200 The quote.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/subscriptions/1/resize-quote' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/resize #

Resize a machine, a disk or a network

order:write api.read api.order

Carries out the resize GET /subscriptions/{subscription}/resize-quote priced, at the instant it was priced: send its token as quote_token, and the resize is refused with 409 if the price has changed since (quotes last five minutes).

A downscale, or a move to the same price, completes at once: a downscale refunds the unused part of the period — to the card that paid where it can, as account credit where it cannot — and refunds says where each part went. An UPSCALE is staged and its bill is left for a person to pay on payment_url (202), exactly like POST /orders: a first card charge needs an interactive 3-D Secure step. The machine keeps its size, and the subscription stays scaling, until that bill is paid; paying it finishes the resize. POST …/actions/cancel-resize on the new subscription backs a staged resize out. A staged resize whose bill stays unpaid for three days is backed out for you: the subscription goes back to its current size and its own billing, the bill is withdrawn, no money moves, and the account is told. A bill that is paid is never withdrawn.

Requires order:write and the billing manage capability. Idempotency-Key is required.

Parameters

Name In Type Description
subscription Required path integer
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
product_id Required integer
quote_token Required string

Responses

  • 200 The resize completed (a downscale, or a move that costs nothing).
  • 202 The upscale is staged; its bill waits on `payment_url` for three days, after which an unpaid resize is backed out.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "product_id": 1,
    "quote_token": "string"
}'
POST /subscriptions/{subscription}/actions/cancel-resize #

Back out of a staged resize

order:write api.read api.write

On the NEW subscription a resize staged (status scaling): its unpaid bill goes, the subscription it replaced is restored, and no money moves. A resize whose bill is already paid is refused with 409. Answers the restored subscription.

Parameters

Name In Type Description
subscription Required path integer

Responses

  • 200 The restored subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/cancel-resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /subscriptions/{subscription}/actions/refund #

Ask for a refund

billing:write api.read api.order

The panel's Refund button, run by the same code. Inside the refund window (seven days from the purchase) the money goes back to the card that paid and the purchase ends; a machine must be stopped first, and a machine with a live service bought for it is refused until the service is refunded.

When an issued invoice stands for the purchase, it must be cancelled before any money goes back: the answer is then 202 with outcome: invoice_cancellation_requested, an invoice-cancellation request is opened with a support ticket, and a machine is stopped at once. A company confirms the cancellation with POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm. Asking again while that request is still waiting is refused; asking again once staff have cancelled the invoice retries the refund owed.

200 with outcome: refunded once refunded; 202 with outcome: refund_pending while the bank settles it. Every refusal is a 409 carrying the panel's sentence: the window has closed, refunds are blocked on the account, the purchase was resized, an earlier request is still open, and so on. A subscription of another account is 404.

Requires billing:write, whose owner must hold billing: manage — the panel's gate.

Parameters

Name In Type Description
subscription Required path integer The subscription's id.

Responses

  • 200 Refunded.
  • 202 The refund is settling, or an invoice-cancellation request stands in for it.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The refund is refused; `detail` carries the panel's sentence.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/subscriptions/1/actions/refund' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments #

List payments

billing:read api.read

Database-backed by default. amount/subtotal/taxes/discount/ applied_balance/taxable_base/list_total/catalogue_discount are null on any payment that has never been recalculated — recalculating is a write, so a plain GET never triggers it. Pass refresh=true to recalculate every payment on the returned page; that variant is rate-limited far more tightly and must not be used for polling.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of payments.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment} #

Read one payment

billing:read api.read

Ownership is enforced as a query constraint: another customer's payment 404s. Pass refresh=true to force a recalculation of amount and its siblings before responding — see GET /payments's description for why a plain read never does. A chargeback the customer's bank took is published in chargebacks — its amount and date, never the reason or the bank's reference.

Parameters

Name In Type Description
payment Required path integer
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 The payment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment}/invoice #

Download a payment's invoice

billing:read api.read

The invoice document our accountant issued for this payment, as PDF. 404 until one is on file.

Parameters

Name In Type Description
payment Required path integer

Responses

  • 200 The invoice, as PDF.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1/invoice' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /payments/{payment}/proforma #

Download a payment's proforma

billing:read api.read

The proforma for this payment, as PDF — the panel's document, in Turkish.

Parameters

Name In Type Description
payment Required path integer

Responses

  • 200 The proforma, as PDF.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/payments/1/proforma' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /payments/{payment}/actions/pay #

Pay an open bill with a saved card

billing:write api.read api.order

Charges one of your own saved cards for an open bill, exactly as the panel's Pay button does: granted account credit is applied first, the card is charged for the rest with no further confirmation, and whatever the bill bought — a renewal, a resize, a machine — is completed. This spends money.

A card that has not passed 3-D Secure cannot be charged without a person: the answer is then a 409 whose problem document carries code: three_d_secure_required and approval_url — the bill's page in the panel, where a person completes the bank's challenge. No challenge is started here. As in the panel, the attempt is recorded on the bill, which reads failed until it is paid.

Refused with 409 and the panel's sentence: a bill already paid, refunded or cancelled, a bill folded into one payment for everything the account owes, and a bill for an order the shop would not sell today. A card that is not one of your own is a 422 on credit_card_id. A bill of another account is 404.

Idempotent. Idempotency-Key is required: a retry after a timeout never charges twice.

Requires billing:write, whose owner must hold billing: manage — the panel's gate.

Parameters

Name In Type Description
payment Required path integer The bill's id.
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
credit_card_id Required integer One of your own saved cards, as `GET /credit-cards` lists them.

Responses

  • 200 The bill, paid.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The bill cannot be charged as it stands — or the card needs 3-D Secure, when the document carries `code: three_d_secure_required` and `approval_url`.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/payments/1/actions/pay' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "credit_card_id": 1
}'
GET /credit-cards #

List stored credit cards

billing:read api.read

Database-backed by default. Card enrolment stays in the panel, which is already behind a session and 2FA — this API never accepts a PAN, so there is no POST here.

refresh=true asks the payment gateway directly whether it still knows each card, one call per card, and deletes the local row for any card the gateway no longer has — this is not a free "check the status" call, it is a destructive reconciliation the caller is opting into. Rate-limited far more tightly than a plain read.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
refresh Optional query boolean default false Reconcile against the upstream provider before responding, instead of reading the local database. Subject to a much tighter rate limit; do not use it for polling.

Responses

  • 200 A page of stored credit cards.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/credit-cards' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
DELETE /credit-cards/{creditCard} #

Delete a saved card

billing:write api.read api.write

Removes one of your own saved cards, exactly as the panel does: every subscription that renewed on it is detached (its next bill waits for a card or is sent to you), and the card is deleted at the payment gateway too. A card saved by another login — even on the same account — is 404: cards belong to the login that saved them. Adding a card needs the bank's 3-D Secure step and stays in the panel.

Requires billing:write, whose owner must hold billing: manage — the panel's gate.

Parameters

Name In Type Description
creditCard Required path integer The card's id, as `GET /credit-cards` lists it.

Responses

  • 204 The card was deleted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X DELETE 'https://cloud.core.gen.tr/api/v1/credit-cards/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /refunds #

List refunds

billing:read api.read

The caller's own refunds only. No refresh parameter: a refund is a record of something that already happened (or is pending), not a live provider resource to reconcile against.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of refunds.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/refunds' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /invoice-refund-requests/{invoiceRefundRequest}/actions/confirm #

Confirm that your company's invoice may be cancelled

billing:write api.read api.write

A company's invoice can only be cancelled with its agreement: this records it, exactly as the panel's Confirm button does, and staff then cancel the invoice and make the refund. Refused with 409 when the request is not waiting for a confirmation. A request of another account is 404.

Requires billing:write, whose owner must hold billing: manage — the panel's gate.

Parameters

Name In Type Description
invoiceRefundRequest Required path integer The invoice-cancellation request's id, as a refund answered it.

Responses

  • 200 Confirmed.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The request is not waiting for a confirmation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/invoice-refund-requests/1/actions/confirm' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /billing/account #

Read the caller's balance and outstanding total

billing:read api.read

No refresh parameter: both balance and due are derived straight from stored rows, so there is nothing to reconcile against a provider.

Responses

  • 200 The caller's account summary.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/billing/account' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /billing/credits #

List granted credits

billing:read api.read

The credits our staff granted the account, newest first — what was given, what is left and when it lapses. Credit is granted, never bought, and is applied as a discount when a bill is paid.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of granted credits.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/billing/credits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /orders #

Place an order, discounted by the account balance

order:write api.read api.order

Buys virtual machines, volumes, public IPv4 addresses and additional networks, applies whatever granted credit the account holds as a discount, and leaves the rest for a card. It commits the account to spending money, as a resize does; the bill it leaves is paid in a browser at payment_url, or with POST /payments/{id}/actions/pay (billing:write) from a saved card that has already passed 3-D Secure.

There is no card path HERE, and this is structural rather than a setting: a stored card's first charge always requires an interactive 3-D Secure challenge in a browser (global_settings.shop_threeds_only defaults to true and credit_cards.threeds_authorized defaults to false), which nothing headless can complete. So the order is PLACED and the subscriptions are created, and the whole bill is left on the payment for a person to settle: needs_card says whether that is the case, credit_applied says what the account's credit will take off it, payable says what a card is then asked for, and payment_url is where a browser finishes it. A card is never charged silently.

Placing an order moves no money. Nothing is taken from the balance here — the credit is applied when the payment is settled, like any other bill, so an order nobody ever pays holds none of the customer's credit. credit_applied and payable are therefore projections of what will happen at payment, while the nested payment object carries the row as it stands: its amount is the whole figure and its applied_balance is 0.00 until it is paid.

Granted credit is a discount on the NET, capped at a share of it, so an order with a price on it normally leaves something payable however large the balance. An order is no longer refused for want of a balance.

Credit is granted by our staff, never bought; there is no way to add it from the API or the panel.

Asynchronous. Paying does not provision. A queued listener reacts to the order and dials the cloud, driving each subscription new → pending → deployed or failed. The response is 202 and carries a Location header pointing at the first subscription; poll GET /subscriptions/{id} from there. A subscription that never leaves pending is a failed deployment that has not yet been recorded — check failure_reason on the subscription.

Idempotent. Idempotency-Key is required. The key is claimed before the order runs, so a client that times out and retries while the first request is still in flight gets 409 rather than a second charge; once the first request has finished, the same key with the same body replays the original 202 and creates nothing.

Preconditions, each re-asserted here exactly as the panel's checkout enforces them, and each refused with 422 naming the one that is unmet: billing information on file, the end-user licence agreement accepted, an identity or passport number on file, the shop open, and the caller's max_vms, max_vols, max_ips and max_networks quotas not exceeded. An address also needs a network that already runs a machine — or a machine for that network on the same order (network). This endpoint is not a way around any limit the panel applies.

Requires order:write, which is off by default when a token is minted and is never implied by another ability.

Parameters

Name In Type Description
Idempotency-Key Required header string A caller-chosen key that makes this request safe to retry. The key is claimed before the order runs: a retry that arrives while the first request is still in flight gets `409` rather than a second charge, and a repeat of a request that already finished replays the original response with an `Idempotent-Replay: true` header instead of ordering again. Keys are scoped to the caller and honoured for 24 hours. Reusing one with a different body is a `409`.

Request body Required

Field Type Description
items Required array of object One entry per unit ordered. Repeat an entry to buy two of the same thing.

Responses

  • 202 The order was paid and provisioning has been queued. `Location` points at the first subscription.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 409 The `Idempotency-Key` is in use by a request that is still running, or was already used with a different body.
  • 422 The order was refused and nothing was created or charged. `errors` names the reason: `items.*` for an unavailable product, a mismatched payment plan or a network that is not the caller's, and `billing_info`, `eula`, `identity_number`, `shop`, `max_vms`, `max_vols`, `max_ips`, `max_networks` or `network` (an address into a network with nothing running yet) for an unmet precondition. A `balance` shortfall is NOT among them any more — a balance too small no longer refuses an order, it simply discounts it by less and leaves more on `payable`.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/orders' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Idempotency-Key: a-key-you-choose' \
  -H 'Content-Type: application/json' \
  -d '{
    "items": [
        {
            "type": "virtual_machine",
            "product_id": 1,
            "payment_plan_id": 1
        }
    ]
}'

Operations

Tickets

Your account's own support tickets: read them, open one, reply and close. Every write reaches our support staff at once, in the token owner's name, and has no undo. Files are attached from the panel only.

GET /tickets #

List your support tickets

tickets:read api.read

Every support ticket on the caller's account, the ones a colleague opened included — the list the panel's Support page shows. The list carries each thread's facts; read one ticket for its messages.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of tickets.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /tickets #

Open a support ticket

tickets:write api.read api.write

Opens a ticket in the token owner's name and sends it to our support staff at once; they are notified and read it. There is no undo. Files cannot be attached here — add them from the ticket's page in the panel.

Request body Required

Field Type Description
title Required string A short subject line.
body Required string The message.
category Optional string What the ticket is about. `general` when left out.

Responses

  • 201 The new ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "Mail bounces since this morning",
    "body": "Every mail to our domain has bounced since 08:00."
}'
GET /tickets/{ticket} #

Read one of your support tickets

tickets:read api.read

The ticket with its opening message and every reply, oldest first. Another account's ticket answers 404, exactly like one that does not exist.

Parameters

Name In Type Description
ticket Required path integer

Responses

  • 200 The ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/tickets/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /tickets/{ticket}/comments #

Reply to one of your support tickets

tickets:write api.read api.write

Adds a reply in the token owner's name; our support staff are notified and read it. There is no undo. A ticket that is solved or later takes no reply and answers 409 — open a new one instead. Files cannot be attached here.

Parameters

Name In Type Description
ticket Required path integer

Request body Required

Field Type Description
comment Required string The reply.

Responses

  • 201 The new reply.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The ticket is solved or closed and takes no more replies.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "It works again, thank you."
}'
POST /tickets/{ticket}/actions/close #

Close one of your support tickets

tickets:write api.read api.write

Closes the ticket; our support staff are notified. Answers 409 for a ticket that is already closed, and for the work-order ticket of a purchased service that can still be refunded — closing that ticket ends the right to the refund, so it is closed from the ticket's page in the panel only.

Parameters

Name In Type Description
ticket Required path integer

Responses

  • 200 The closed ticket.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The ticket is already closed, or it is the work order of a service that can still be refunded.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/tickets/1/actions/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Usage

What your cloud consumed — machine hours, storage, IP address hours and network traffic. Quantities only; the bill is under Billing.

GET /usage #

Read what your cloud consumed

cloud:read api.read

What the panel's Usage page draws: machine hours, storage, IP address hours and network traffic over a window, with one row per machine and per disk and one per day. Quantities only — the bill is on /payments.

The window is days (7, 30 or 90; 30 when missing or anything else) or from and to together. It ends yesterday at the latest, because today is not counted yet, and spans at most 365 days. instance_id or volume_id narrows the figures to one of your machines or disks; one that is not yours answers 404. Only what the cloud meters per machine or per disk survives the narrowing — a machine keeps its hours and its disks' storage, a disk its storage. IP address hours, network traffic, snapshots and templates are metered per address, network or image, so they are not measured there: unmetered names each such key, and its figure is not a measurement, never zero traffic.

This reads the cloud's own usage records, so it is charged against the tighter reconciling-read budget. A window, once read, is kept for an hour. available: false means the records could not be read just now.

Parameters

Name In Type Description
days Optional query integer 7, 30 or 90. Ignored when `from` and `to` are both given.
from Optional query string The first day, YYYY-MM-DD (GMT).
to Optional query string The last day, YYYY-MM-DD (GMT); yesterday at the latest.
instance_id Optional query integer One of your machines, by id.
volume_id Optional query integer One of your disks, by id. Ignored when `instance_id` is given.

Responses

  • 200 The figures for the window.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/usage' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Admin

Staff reads of the whole install, plus a deliberately small set of instance-lifecycle writes, for a token carrying admin:read or admin:write whose owner also holds the admin or super-admin role. The ability alone is never enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The read/write split rests on nothing but the route table. AdminPolicyTrait::before() returns true for anyone holding the admin role, and almost every policy in the application uses it — so no policy can distinguish an admin's read from an admin's write; abilities:admin:read versus abilities:admin:write plus the HTTP verb is the entire enforcement, and a test walks the route table to keep it that way.

Writes are confined to instance lifecycle — start, stop, restart, attach ISO, detach ISO — because an admin already has full write over every customer's cloud through the panel, so refusing it to an admin:write token bought no safety; it only meant the one channel that could be scripted was the one nobody could audit or rate-limit. Two things are deliberately absent: instance destroy, because subscriptions.instance_id must be released before an instance is deleted and a bare destroy would orphan a live billing row; and volume attach/detach, because it needs a second cross-ownership check with no precedent on this surface. Both are candidates for a later round, not oversights.

Every customer-scoped read on this surface writes an <domain>.pii_read row into the audit trail, exactly as the equivalent panel page does, and is charged against a tighter rate-limit budget than an ordinary read for that reason. Every write writes its own explicit cloud.instance_* row instead — the access-log middleware only records a successful GET — including when idempotency skipped the underlying CloudStack call, because the auditable act is the request an admin made, not whether CloudStack was actually dialled.

Installation content and the approval queue sit beside those customer routes, with no {user} in their paths. News drafts are created and edited directly; publishing one is only ever ASKED for — the request stages it and answers 202 — and GET /admin/staged-actions reports what became of it. Nothing on this API approves or rejects a staged request: that is a signed-in administrator's click on the panel's approvals page, so a token can ask and can never decide. GET /admin/work-queues and GET /admin/health read the operator board's counts and the installation's health; neither names a person. GET /admin/failed-jobs, GET /admin/jobs and GET /admin/horizon read the queue — its failed jobs, the jobs Horizon tracks and its workers' status — and retry, remove or restart nothing.

GET /admin/customers #

List customers

admin:read api.read

Every account holding the user role, ordered by name.

Requires an admin:read token whose owner also holds the admin (or super-admin) role. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The query selects the published columns explicitly rather than reading whole User models — the same deliberate projection the panel's customer table uses, after an unprojected version of it once shipped every customer's national identity number into a page payload.

Database-backed, with no refresh variant anywhere on this surface. The reconciling siblings of these reads (listSubscriptions(), listZones(), getInstances()) mutate; at admin scope they mutate the whole install. There is no rate limit at which that belongs behind a GET.

This listing writes no audit row: it publishes no more about any one customer than a name and an email, and a per-request row per page of the roster would swamp the trail without recording an access to anybody's data in particular. The per-customer reads below are the ones that log.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of customers.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user} #

Get one customer

admin:read api.read api.privileged

One customer, with database-derived counts of their instances, volumes, DNS zones, subscriptions, invoices and tickets.

The panel's equivalent page returns twenty-four props in a single request and dials CloudStack, PowerDNS and the payment gateway to build them. This is the decomposition of that page: the counts here are plain select count(*), and the detail lives on the four per-domain collections beside this path.

Reading another person's record writes an account.pii_read row into the audit trail, exactly as the equivalent panel page does — the KVKK access-log obligation does not stop at the panel's edge. Reading your own record writes nothing: the row would be one per page load of your own dashboard, and your own actions are recorded anyway.

Because every call writes an audit row, this path is charged against a tighter rate-limit budget than an ordinary read.

Any account may be addressed here, not only one holding the user role — the equivalent panel page binds any user and an admin can legitimately need to look at a colleague's record. The listing beside this path is customers only. An id that does not exist is a 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/instances #

List one customer's virtual machines

admin:read api.read api.privileged

The customer's instances as currently stored, in the same Instance representation the customer's own /instances returns — so a field withheld from the owner stays withheld from staff.

Served by resolving the customer-scoped cloud service for the target customer and reading it. The admin-scoped variant of that service exists, and overriding only its data-source hooks turns every inherited reconcile-on-read method into a fleet-wide mutation — a read of one page can delete another customer's rows. Nothing on this surface resolves it, and a source-level test keeps it that way.

There is therefore no refresh parameter here, unlike the customer-facing /instances. Reconciliation is a mutation; a third party reading somebody else's machines is the last caller who should trigger one.

Writes a cloud.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/dns-zones #

List one customer's DNS zones

admin:read api.read api.privileged

The customer's zones as currently stored, in the same DNSZone representation the customer's own /dns-zones returns.

Served by resolving the customer-scoped DNS service explicitly. No refresh parameter: the reconciling sibling deletes local zones — and cascades to their records — that PowerDNS's live listing no longer contains, before its own update flag is consulted, and at admin scope it does that to every zone in the install and reassigns unmatched ones to the acting staff member.

Writes a dns.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/customers/{user}/subscriptions #

List one customer's subscriptions

admin:read api.read api.privileged

The customer's subscriptions as currently stored, in the same Subscription representation the customer's own /subscriptions returns. Money is always a minor-unit integer with its currency, never a float.

Served by resolving the customer-scoped billing service explicitly. No refresh parameter, and this is the sharpest case for it: the reconciling sibling terminates subscriptions whose linked resource has moved, promotes every pending subscription to deployed and erases its failure reason, deletes root-volume subscriptions together with their payments, and fires orphan events that dial the provider and create further subscriptions — all inside one transaction. At admin scope its input set is the whole table rather than one customer.

Writes a billing.pii_read audit row and is charged against the tighter privileged read budget.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/customers/1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/start #

Start a customer's virtual machine

admin:write api.read api.privileged

Idempotent: starting an already-running machine returns 200 immediately without contacting CloudStack, exactly as the owner's own /instances/{instance}/actions/start does.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller, whether or not CloudStack was actually dialled by the idempotency check above.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Responses

  • 200 The customer's virtual machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/stop #

Stop a customer's virtual machine

admin:write api.read api.privileged

Idempotent: stopping an already-stopped machine returns 200 immediately without contacting CloudStack, for the same reason as start.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller, whether or not CloudStack was actually dialled by the idempotency check above.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Responses

  • 200 The customer's virtual machine, stopped (or already stopped).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/restart #

Restart a customer's virtual machine

admin:write api.read api.privileged

Not idempotent — unlike start/stop there is no target state to compare against, so this always reaches CloudStack regardless of the machine's current state.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Responses

  • 200 The customer's virtual machine, restarted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/customers/{user}/instances/{instance}/actions/attach-iso #

Attach an ISO to a customer's virtual machine

admin:write api.read api.privileged

Idempotent: attaching an ISO already mounted on this instance returns 200 immediately without contacting CloudStack.

iso_id must name an ISO visible to the TARGET CUSTOMER — public, or owned by their account — never the acting admin's own account. Scoping on the admin's account instead would offer the admin's private images and reject the customer's own.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Request body Required

Field Type Description
iso_id Required integer Must name an ISO visible to the CUSTOMER (public, or owned by their account). A foreign private or missing id fails validation (422) rather than 404 — the addressed resource is the instance, not the ISO.

Responses

  • 200 The customer's virtual machine, with the ISO attached (or already attached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/attach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "iso_id": 5
}'
POST /admin/customers/{user}/instances/{instance}/actions/detach-iso #

Detach whatever ISO is mounted on a customer's virtual machine

admin:write api.read api.privileged

Idempotent: detaching an instance with no ISO attached returns 200 immediately without contacting CloudStack.

Served by resolving the customer-scoped cloud service for the target customer, never the admin-scoped variant — see the "customer-scoped service" note on GET /admin/customers/{user}/instances for why that distinction is load-bearing here too.

audit.access:cloud on this route is inert (it only records a successful GET); the admin-acting-on-a-customer's-machine row is written explicitly by the controller.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer

Responses

  • 200 The customer's virtual machine, with its ISO detached (or already detached).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/customers/1/instances/1/actions/detach-iso' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/ai/prompts #

Read both assistants' system prompts

admin:read api.read

The two assistants C2 runs — the panel assistant a signed-in customer talks to, and the chat bubble on the public marketing site — and, for each, the fixed built-in prompt plus the operator's own guidance appended to it.

Requires an admin:read token whose owner holds the admin or super-admin role.

core is read-only, on every surface. It lives in the application's source, not in the database, and there is no endpoint, form or tool that edits it. It carries the rules that make the assistants safe to run: read every fact from a tool, never guess an instance state, a price or a balance, pause for the customer's explicit approval before a machine is started or stopped, and never do arithmetic on money. The panel assistant can spend a customer's money, so those rules are the reason it can be allowed to.

guidance is the part an operator writes, and it is APPENDED below core, never substituted for it. It is framed in the prompt as operator policy that is additional to the rules above it and cannot relax, contradict or override them. null means nothing is set, and an installation with null on both surfaces sends exactly the prompt that shipped, byte for byte.

It is returned beside core deliberately: a caller iterating on the appended text is iterating against the contract above it, and should not have to fetch a second document — or guess — to see what it is appending to.

max_guidance is the character limit each surface's guidance is held to, enforced identically by this API, the admin settings form and the MCP tool. The text is sent to the model on every turn of every conversation, so it is a bill as well as a policy.

Responses

  • 200 Both assistants' prompts.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/ai/prompts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/ai/prompts #

Set or clear one assistant's operator guidance

admin:write api.read api.privileged

Replaces the operator guidance appended to one assistant's system prompt, or clears it. Requires an admin:write token whose owner holds the admin or super-admin role.

surface names which assistant: assistant for the signed-in panel assistant, public for the anonymous marketing chat bubble. They are separate fields because they are separate audiences, and neither can read the other's text.

guidance must be present. null or an empty string CLEARS it and restores the built-in prompt exactly; anything longer than max_guidance characters is refused with 422 rather than truncated.

The built-in prompt itself cannot be written here or anywhere else — see the GET on this path.

Every change to the settings row is recorded in the audit trail, whether it was made here, in the admin settings form or through the MCP tool, with the acting token owner as the actor. Answers with the same document the GET returns, so a caller tuning the text sees the result of its own write without a second request.

Request body Required

Field Type Description
surface Required string Which assistant to update.
guidance Required string The operator guidance to store, or null/empty to clear it.

Responses

  • 200 Both assistants' prompts, after the write.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/ai/prompts' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "surface": "assistant",
    "guidance": "string"
}'
GET /admin/audit-logs #

List audit-trail rows

admin:read api.read

A page of the whole audit trail, newest first (occurred_at descending, id breaking ties so a client can page it without seeing a row twice).

Requires an admin:read token whose owner holds the admin (or super-admin) role and the audit.view permission. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The trail is append-only and nothing reconciles it, so there is no refresh parameter and no polling semantics — a row never changes after it is written.

changes, context, hash and previous_hash are not published; see the AuditLog schema for why. The hash chain is sealed and verified out of band by the c2:verify-audit-chain command, not through this API.

Any query parameter not listed below is a 422, rather than being ignored: a client that mistypes a filter would otherwise receive the whole unfiltered trail and believe it had asked a narrower question.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
actor_id Optional query integer min 1 Only rows written by this user.
subject_id Optional query integer min 1 Only rows whose data subject is this user.
event Optional query string max length 96 Substring match against the dotted event name.
domain Optional query string one of cloud, billing, dns, tickets, account, auth, shop, privacy, partner, system Kept in lock-step with `App\Enums\AuditDomain`, which is what `IndexAuditLogRequest` derives its own validation rule from — see the `AuditLog` schema's `domain` field.
from Optional query string Inclusive lower bound on `occurred_at`.
to Optional query string Inclusive upper bound on `occurred_at`.

Responses

  • 200 A page of audit rows.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/audit-logs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/audit-logs/{auditLog} #

Get one audit-trail row

admin:read api.read

One row of the append-only trail.

This is the only endpoint on the staff surface that answers 403 rather than 404 for a row the caller may not read. Elsewhere a resource outside the caller's scope is indistinguishable from one that does not exist, because scoping there is per-customer; the trail is a single global collection, so "this row exists but is not yours to read" is the honest answer.

Unlike the collection, this path carries no audit.view requirement in its middleware — authorization is the AuditLogPolicy, which admits an admin holding audit.view, the row's own data subject reading their own trail, and a support agent holding at least view on the row's domain for that row's subject. Rows in the auth, shop, privacy and system domains have no support equivalent and are never visible to a support agent.

changes, context, hash and previous_hash are not published; see the AuditLog schema.

Parameters

Name In Type Description
auditLog Required path integer min 1 The audit row id.

Responses

  • 200 The audit row.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/audit-logs/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/support-assignments #

List the support-assignment matrix

admin:read api.read

Every row of the support-assignment table, most recently updated first: which agent may act on which customer, and at what level in each of the five domains.

Requires an admin:read token whose owner holds the admin (or super-admin) role and the support.manage permission. The panel's equivalent route is gated role_or_permission:super-admin|support.manage; a super-admin who does not literally hold the permission is admitted here too, through the application's god-mode gate, which makes the two equivalent. That equivalence is proven by test rather than assumed.

Read-only. This table is the control plane for every gate on the Support surface: a token that could write it could grant any agent manage over any customer, and no policy stands behind such a route. Exposing the write side needs its own threat model, not a verb.

Both sides are projected to {id, name, email} and are null when the account has been deleted. Publishing the matrix read-only lets an operator diff intended access against actual access without touching either.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of assignment rows.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/support-assignments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/staged-actions #

List the approval queue

admin:read api.read

Every action a token has asked for and a person decides — a news item to publish, and later kinds — newest first, with what it will do (preview), who asked, and what became of it. Poll this, or the single entry, to learn whether a request was approved, rejected, lapsed or failed.

Requires an admin:read token whose owner holds the admin or super-admin role.

Read-only, and deliberately so. No endpoint on this API approves or rejects an entry: that is a click by a signed-in administrator on the panel's approvals page (approval_url). A token can only ask. The frozen payload is not published; preview is the sentence the approver reads.

Parameters

Name In Type Description
status Optional query string one of pending, approved, rejected, expired, failed Only entries in this state.
action Optional query string Only entries of this kind, for example `publish_news`. An unknown kind is refused with `422`.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of queue entries.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/staged-actions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/staged-actions/{stagedAction} #

Get one approval-queue entry

admin:read api.read

One entry of the approval queue, by the staged_action_id the request that created it returned. status moves from pending to exactly one of approved, rejected, expired or failed, and never back.

Requires an admin:read token whose owner holds the admin or super-admin role. Read-only: see the listing for why.

Parameters

Name In Type Description
stagedAction Required path integer min 1 The queue entry id.

Responses

  • 200 The queue entry.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/staged-actions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/news #

List news items

admin:read api.read

The panel's news items, newest first — drafts and published alike, filtered by published when it is given.

Requires an admin:read token whose owner holds the admin or super-admin role. Editorial content: no person's data is read, so no access-log row is written.

Parameters

Name In Type Description
published Optional query boolean `true` for published items only, `false` for drafts only.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of news items.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/news' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/news #

Create a news draft

admin:write api.read api.privileged

Creates a DRAFT with the rules the draft tools apply: title up to 255 characters, body up to 2048, language one of tr-TR, en-US, ar-SA, and an optional audience. It is never published, scheduled or sent here: is_published, publish_date and scheduled_for in the body are refused with 422 (a schedule publishes on its own when it falls due), and publishing is a separate request that an administrator must approve (POST /admin/news/{news}/publish).

Requires an admin:write token whose owner holds the admin or super-admin role.

Request body Required

Field Type Description
title Required string
body Required string
language Required string
audience Optional string

Responses

  • 201 The draft.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "body": "string",
    "language": "tr-TR"
}'
GET /admin/news/{news} #

Get one news item

admin:read api.read

One news item by id. Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The news item id.

Responses

  • 200 The news item.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/news/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/news/{news} #

Edit a news draft

admin:write api.read api.privileged

Changes only the fields sent (title, body, language, audience), each held to the create rules; an empty body is a 422, and so is is_published, publish_date or scheduled_for. A published item, or a draft somebody scheduled in the panel, cannot be edited here and answers 422. POST rather than PATCH: every write on the staff API is a POST.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The draft's id.

Request body Required

Field Type Description
title Optional string
body Optional string
language Optional string
audience Optional string

Responses

  • 200 The draft, after the edit.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "string",
    "body": "string",
    "language": "tr-TR",
    "audience": "everyone"
}'
POST /admin/news/{news}/publish #

Ask for a news item to be published

admin:write api.read api.privileged

Stages the publication of a draft in the approval queue and answers 202. NOTHING IS PUBLISHED OR SENT by this request: an administrator must approve the entry in the panel (approval_url), and it lapses after 24 hours if nobody does. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. An item that is already published is refused with 422. Each request stages a new entry.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
news Required path integer min 1 The draft's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/news/1/publish' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /admin/tickets/{ticket}/comments #

Reply to a support ticket as staff

admin:write api.read api.privileged

Posts a staff reply in your name — the REST twin of the admin MCP's reply_to_ticket, through the same service, so the customer and the account owner are notified exactly as for a reply from the panel. Text only, up to 10000 characters. A thread that is solved or closed takes no reply (422). A service work-order thread whose customer can still refund the service is refused with 409: a staff reply there would end their refund window for good, so book the work (staged) first, or reply from the panel.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Request body Required

Field Type Description
comment Required string The reply. The customer reads it.

Responses

  • 201 The reply.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 A service work order the customer can still refund; a staff reply would end that window.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "string"
}'
POST /admin/tickets/{ticket}/assignment #

Hand a support ticket to an agent

admin:write api.read api.privileged

Hands the thread to a support agent, replacing whoever held it — the REST twin of the admin MCP's assign_ticket and the panel's Assign, through the same service. level is view (a reader) or manage (the working assignment, the default). A partnership thread and anyone who is not support staff are refused with 422. The hand-over is recorded in the ticket's audit history.

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Request body Required

Field Type Description
agent_id Required integer The support agent's user id.
level Optional string What the agent may do on the thread; `manage` by default.

Responses

  • 200 The assignment.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/assignment' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "agent_id": 1
}'
POST /admin/tickets/{ticket}/close #

Ask for a support ticket to be closed

admin:write api.read api.privileged

Stages closing the thread in the approval queue and answers 202. NOTHING IS CLOSED by this request: an administrator must approve the entry in the panel (approval_url), and it lapses after 24 hours if nobody does; the customer is told when it is approved. On a service work-order thread, closing also ends the customer's own refund window — the preview says so when it applies. The Location header and staged_action_id point at GET /admin/staged-actions/{stagedAction}, which reports the outcome. A thread already closed, merged or marked spam is refused with 422, and so is a second close of the same thread while the first still waits for a decision (the error names the waiting entry).

Requires an admin:write token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
ticket Required path integer min 1 The ticket's id.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/admin/tickets/1/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/work-queues #

List what is waiting on a person

admin:read api.read api.privileged

Every operator queue — the erasure queue, privacy requests, failed payments, dunning, approvals (what the admin MCP or the admin API staged and no administrator has decided yet), referral rewards, partner applications and trainings, open tickets, join requests, held partner rebates, the invoice worklist and price notices — with how many items wait and since when. Zeroes are included, in a fixed order, so an absent queue never reads as an empty one. Counts only: nobody is named, so no access-log row is written. The same figures the admin board and the admin MCP server read. The one money figure, the referrals queue's amount, is Money in minor units like the rest of this API — the MCP twin prints the same figure as a plain decimal.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 Every queue, zeroes included.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/work-queues' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/health #

Read the installation's health

admin:read api.read api.privileged

One read for the installation's health: the application version, failed queue jobs (count, and the most recent by job name and exception class only — never the payload or the message, which can quote a customer's record), queue depth and whether Horizon runs, every scheduled command with its cadence, next due time and last FAILURE in 30 days, pending database migrations, and which configuration keys changed recently (never their values). C2 records a scheduled command's failures, not its successes, so there is no last successful run. The same report the admin MCP server's get_system_health returns.

Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 The health report.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/health' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/failed-jobs #

List failed queue jobs

admin:read api.read api.privileged

The failed queue jobs — the failed_jobs table, where every job that exhausted its tries is recorded — newest first. Each row carries the job's display name, queue, connection, when it failed, its attempts and maximum tries when the payload records them, the exception's class and its FIRST LINE only (secrets redacted, at most 300 characters), and Horizon's tags (model class:id). The payload itself is never published.

Beside the page: every failed job (total), those since since (total_since), how many match the filters (matched), and the matching jobs grouped by job name (by_job) and by exception class (by_exception). The same answer the admin MCP server's list_failed_jobs returns.

An exception message can name a person (a rejected recipient), so every call is recorded as an access in the audit trail (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
since Optional query string Only jobs that failed at or after this date or time.
job Optional query string max length 200 Part of the job's display name.
queue Optional query string max length 100 The queue name.
exception Optional query string max length 200 The start of the exception class — letters, digits, backslashes and underscores only. The message is never matched; anything else is refused with 422.

Responses

  • 200 A page of failed jobs, with the totals and the groups.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/failed-jobs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/failed-jobs/{failedJob} #

Read one failed queue job

admin:read api.read api.privileged

One failed queue job by its uuid or its numeric id: everything the listing shows, plus the exception's first 30 lines (message and stack, secrets redacted) and what the job carried — the command class and each model it held, by class and id. The payload itself is never published. The same answer the admin MCP server's get_failed_job returns.

Recorded as an access in the audit trail (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
failedJob Required path string max length 64 The failed job's uuid, or its numeric id.

Responses

  • 200 The failed job.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/failed-jobs/failedJob' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/jobs #

List the queue jobs Horizon is tracking

admin:read api.read api.privileged

The jobs Horizon is tracking, newest first, by status: recent (the default — everything pushed within Horizon's trim window), pending (waiting or running), completed, failed or silenced. Each job carries Horizon's id, the job name, queue, connection, status, attempts, when it was pushed, reserved, completed or failed, Horizon's tags (model class:id), whether it was retried, and for a failed job the exception's first line (secrets redacted). The payload is never published. The job, queue and tag filters are matched within the newest 1000 jobs of the chosen list (scanned). Horizon keeps these only for its trim window (kept_minutes); the durable record of a failure is GET /admin/failed-jobs.

Horizon's lists live in redis: an unreachable redis answers available: false with the exception's class instead of an error. The same answer the admin MCP server's list_jobs returns. A job's tags name the customer rows it carried, so every call is recorded as an access (account.pii_read, scope fleet). Requires an admin:read token whose owner holds the admin or super-admin role.

Parameters

Name In Type Description
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.
status Optional query string one of recent, pending, completed, failed, silenced Which of Horizon's lists to read. Default recent.
job Optional query string max length 200 Part of the job name.
queue Optional query string max length 100 The queue name.
tag Optional query string max length 200 An exact tag the job carries, for example a model class and id. Matched on each job's own tags within the newest 1000 jobs of the chosen status; `scanned` says how many were read.

Responses

  • 200 The jobs, or `available false` when redis cannot be reached.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/jobs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /admin/horizon #

Read the queue workers' status

admin:read api.read api.privileged

The queue workers' state as the Horizon dashboard shows it: the overall status (running, paused, no_workers, inactive), each master and supervisor with its worker processes per queue, each queue's length, expected wait and processes, jobs per minute, throughput and average runtime per queue, and Horizon's recent, pending, completed and failed counts. Beside it, recommendations: suggestions derived from those figures and from the failed-job table — a queue falling behind, no workers with jobs waiting, one job failing repeatedly — each saying what it rests on, what to look at next, and whether only the host operator can act (owner_side). Suggestions only: nothing is done automatically.

An unreachable redis answers horizon.available: false. Names nobody, so it records no access. The same answer the admin MCP server's get_horizon_status returns. Requires an admin:read token whose owner holds the admin or super-admin role.

Responses

  • 200 Horizon's status and the suggestions derived from it.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/admin/horizon' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Operations

Support

Assignment-scoped reads of one customer's data, for a token carrying support:read whose owner holds the support or super-admin role — and, with support:write, every write the support panel offers on that customer, each at the assignment's manage level for its domain. Account credit is only ASKED for — it is staged, and an administrator approves it on /admin/approvals. A write names rows by id; one of another customer is 404.

A support agent sees only the customers they hold a support_assignments row for, and within those only the domains their per-domain capability level covers. A super-admin short-circuits both checks, matching the panel. Reads are audited identically to the panel's.

GET maps to the view capability level and mutations to manage — with one deliberate exception on the panel that must never be relaxed if it is ever ported here: minting a VM console session is gated at manage, not view, because a console is effective full control of the machine.

GET /support/customers #

List the customers assigned to the calling agent

support:read api.read

Only the customers the calling agent holds a support_assignments row for, ordered by name, each with the capability map the agent holds over them. An agent with no assignments gets an empty page — never the roster.

A super-admin sees every customer instead, matching the panel: both User::supportCan() and User::isAssignedTo() short-circuit for that role, so the assignment matrix is not a constraint on it.

Requires a support:read token whose owner holds the support (or super-admin) role. The ability alone is not enough: a token outlives the role its holder had when it was minted, so the role is checked on every request.

The equivalent panel route carries no gate at all — its filter lives in the controller — so an API port that simply queried "every customer" would hand the whole install to any support:read token. The scoping here is the endpoint's single most important property and is asserted in both directions by test.

Writes no audit row: it publishes no more about any one customer than a name and an email, and the per-customer reads beside it are the ones that log.

Parameters

Name In Type Description
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the agent's assigned customers.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user} #

Get one assigned customer

support:read api.read api.privileged

The cross-domain dashboard for one assigned customer: the record, the capability map, and database-derived counts of their instances, volumes, DNS zones, subscriptions, invoices and tickets.

Gated on the assignment alone — not on any per-domain capability — which matches the panel deliberately. The point of this record is to tell an agent where a customer's problem might be before they have a domain to look in, so gating it at account,view would break the dashboard for a cloud-only agent. The per-domain collections beside this path each require their own capability.

Because the gate is that broad, the payload is narrower than the admin equivalent: phone is not published here. An agent whose assignment reads none on all five domains can reach this record, and the panel does hand them a phone number for it; the API being stricter than the panel is allowed, the reverse is not.

A customer the agent is not assigned to is a 403, not a 404 — the assignment gate runs before anything looks the record up, and that matches the panel's answer. An id that does not exist at all is a 403 for the same reason, and that is the intended answer: it makes "no such account" and "not yours to see" indistinguishable. Nothing on the support surface returns 404.

Writes an account.pii_read audit row, exactly as the equivalent panel page does, and is charged against a tighter rate-limit budget for that reason.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Responses

  • 200 The customer.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/instances #

List an assigned customer's virtual machines

support:read api.read api.privileged

Identical in payload to the admin equivalent — the same Instance representation the customer's own /instances returns — and identical in how it is served: the customer-scoped cloud service, its non-reconciling reader, no refresh variant. Only the gate stack differs.

Requires at least view on the cloud domain of an assignment covering this customer. An agent assigned to the customer but holding none on cloud is a 403, as is an agent with no assignment at all.

Writes a cloud.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's virtual machines.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/dns-zones #

List an assigned customer's DNS zones

support:read api.read api.privileged

Identical in payload and in service resolution to the admin equivalent; only the gate stack differs. Requires at least view on the dns domain of an assignment covering this customer.

No refresh parameter: the reconciling sibling deletes local zones — and cascades to their records — that PowerDNS's live listing no longer contains, before its own update flag is consulted.

Writes a dns.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's DNS zones.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones #

Create a DNS zone for an assigned customer

support:write api.read api.privileged

The support panel's door, on the customer's own DNS service.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Required string The zone's domain name.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
GET /support/customers/{user}/subscriptions #

List an assigned customer's subscriptions

support:read api.read api.privileged

Identical in payload and in service resolution to the admin equivalent; only the gate stack differs. Requires at least view on the billing domain of an assignment covering this customer. Money is always a minor-unit integer with its currency, never a float.

No refresh parameter, and this is the sharpest case for it: the reconciling sibling terminates subscriptions whose linked resource has moved, promotes every pending subscription to deployed and erases its failure reason, deletes root-volume subscriptions together with their payments, and fires orphan events that dial the provider — all inside one transaction.

Writes a billing.pii_read audit row and is charged against the tighter privileged read budget.

An unknown id, or one the agent is not assigned to, is a 403 — the gate runs before anything looks the record up, so "no such account" and "not yours to see" stay indistinguishable. Nothing on the support surface returns 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's subscriptions.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/audit-logs #

List an assigned customer's audit trail

support:read api.read api.privileged

The rows whose data subject is this customer, newest first, filtered to the domains the calling agent holds at least view on.

Two gates, both required: an assignment covering this customer, and account at view — the same pair the equivalent panel page carries. The per-domain filter inside is what stops a tickets-only agent from reading that customer's billing rows once they are in. An agent holding view on nothing sees zero rows, not every row: the empty domain list is an explicit "no domains", never a missing constraint.

The auth, shop, privacy, partner and system domains have no support-assignment equivalent and are therefore never visible here, whatever the agent holds. A data-subject request is between the customer and the controller, and a partner's commercial terms are between the partner and the business.

changes, context, hash and previous_hash are not published; see the AuditLog schema for why.

Unlike the panel's equivalent page, this does write an account.pii_read row of its own and is charged against the tighter privileged read budget. Every {user}-scoped staff read on this API leaves a trail, without exception — a rule with one exemption is a rule that rots, and reading somebody's whole audit history is not the access to leave unrecorded. It does mean a client paging this collection appends to it.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
page Optional query integer min 1, default 1 1-based page number.
per_page Optional query integer min 1, max 100, default 25 Items per page. Values above 100 are clamped to 100.

Responses

  • 200 A page of the customer's audit rows, in the domains the agent may see.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/audit-logs' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/start #

Start an assigned customer's virtual machine

support:write api.read api.privileged

The support panel's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Idempotent: starting a machine that is already running answers 200 without asking the cloud to do anything. A machine another customer owns is 404; a machine held by an open refund request is 409; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, started (or already running).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/start' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/stop #

Stop an assigned customer's virtual machine

support:write api.read api.privileged

The support panel's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Idempotent: stopping a machine that is already stopped answers 200 without asking the cloud to do anything. A machine another customer owns is 404; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, stopped (or already stopped).
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/stop' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/restart #

Restart an assigned customer's virtual machine

support:write api.read api.privileged

The support panel's own door, over a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. Not idempotent: a restart always reaches the cloud. A machine another customer owns is 404; a machine held by an open refund request is 409; a job the cloud refused is 502. Every call is audited with you as the actor and the customer as the subject.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer The machine's id, as `GET /support/customers/{user}/instances` lists it.

Responses

  • 200 The machine, restarted.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/restart' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/credits #

Ask for account credit to be granted to a customer

support:write api.read api.privileged

Credit lowers the next payments and lapses at its expiry; it is never cash.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
amount_usd Required number The amount, as a decimal in USD.
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.
expires_at Optional string When it lapses (YYYY-MM-DD); three months by default.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "amount_usd": 1,
    "reason": "string"
}'
POST /support/customers/{user}/credits/{creditGrant}/actions/adjust #

Ask for a customer's credit to be reduced

support:write api.read api.privileged

Only down to what remains; the remainder at the time of asking must still stand at approval.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
creditGrant Required path integer min 1 The credit's id; it must be the customer's.

Request body Required

Field Type Description
remaining_usd Required number What should remain, as a decimal in USD.
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits/1/actions/adjust' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "remaining_usd": 1,
    "reason": "string"
}'
POST /support/customers/{user}/credits/{creditGrant}/actions/remove #

Ask for a customer's credit to be removed

support:write api.read api.privileged

What remains is taken away; it is not paid out.

STAGED: nothing happens until an administrator approves it on /admin/approvals; it lapses after 24 hours. Answers 202 with a Location to GET /support/staged-actions/{stagedAction}. Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A credit of another customer is 404.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
creditGrant Required path integer min 1 The credit's id; it must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 202 Staged; nothing has happened yet.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/credits/1/actions/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/password #

Set a customer's password

support:write api.read api.privileged

The support panel's helpdesk reset: the password is set and every other sign-in the customer held is ended.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
password Required string The new password.
password_confirmation Required string The same password again.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/password' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "password": "string",
    "password_confirmation": "string"
}'
GET /support/customers/{user}/instances/{instance}/console #

Open a console on a customer's machine

support:write api.read api.privileged

A one-time console URL, proxied through this site as the panel serves it, or url: null. A console is effective full control of the machine, so it asks the write ability and manage, like the panel door.

Requires a token carrying support:write whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. The read is recorded against the customer.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/console' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/customers/{user}/subscriptions/{subscription}/resize-quote #

Price a resize for a customer

support:read api.read api.privileged

Priced, never placed — the panel's quote, through the same quoteScale(). A refusal (inside the refund window, a withdrawn product, …) is a 409 with its sentence.

Requires a token carrying support:read whose owner holds the support or super-admin role and an assignment for this customer at billing: view. The read is recorded against the customer.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.
product_id Required query integer min 1 The product to resize to, of the same kind.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/resize-quote' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
GET /support/staged-actions/{stagedAction} #

Get one of your staged requests

support:read api.read

What became of something you asked for over this surface — a credit grant, reduction or removal — by the staged_action_id the request returned. status moves from pending to exactly one of approved, rejected, expired or failed, and never back. Only your own requests are visible: another staff member's is 404. Read-only: an administrator decides it in the panel.

Requires a support:read token whose owner holds the support or super-admin role.

Parameters

Name In Type Description
stagedAction Required path integer min 1 The queue entry id.

Responses

  • 200 The queue entry.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X GET 'https://cloud.core.gen.tr/api/v1/support/staged-actions/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/actions/rename #

Rename an assigned customer's machine

support:write api.read api.privileged

The support panel's rename, on the customer's own cloud service.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The new name.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/actions/rename' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/attach #

Attach the machine to one of the customer's networks

support:write api.read api.privileged

The support panel's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/attach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/detach #

Detach the machine from the network

support:write api.read api.privileged

The support panel's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/detach' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/make-primary #

Make the network the machine's primary one

support:write api.read api.privileged

The support panel's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/make-primary' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/move #

Move the machine onto the network, off the one named in `from`

support:write api.read api.privileged

The support panel's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Request body Required

Field Type Description
from Required integer The network to move the machine off.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "from": 1
}'
POST /support/customers/{user}/instances/{instance}/networks/{network}/actions/change-ip #

Change the machine's address on the network

support:write api.read api.privileged

The support panel's door, through the same shared body the customer's and the admin's use; the machine is stopped where the cloud needs it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Request body Required

Field Type Description
ip_address Required string The new address on that network.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/networks/1/actions/change-ip' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "ip_address": "string"
}'
POST /support/customers/{user}/public-ip-addresses/{publicIPAddress}/networks/{network}/actions/move #

Move a customer's public address to another of their networks

support:write api.read api.privileged

The address is released and another acquired on the target network; nothing is charged.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
publicIPAddress Required path integer min 1 The public address's id; it must belong to the customer.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/public-ip-addresses/1/networks/1/actions/move' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/networks/{network}/actions/release #

Release an emptied network of the customer

support:write api.read api.privileged

Hands the network back with the address it holds. Refused while anything still uses it.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
network Required path integer min 1 The network's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/networks/1/actions/release' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/vpn #

Turn a customer's VPN gateway on or off

support:write api.read api.privileged

On one of the customer's own public addresses.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
public_ip Required string The gateway's public address.
enable Required boolean On or off.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "public_ip": "string",
    "enable": true
}'
POST /support/customers/{user}/vpn/users #

Create a VPN user for the customer

support:write api.read api.privileged

The support panel's door, owner ruling 2026-08-29: servicing the customer's VPN is the job.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
username Required string The login.
password Required string The password.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn/users' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "string",
    "password": "string"
}'
POST /support/customers/{user}/vpn/users/{vpnUser}/actions/delete #

Delete one of the customer's VPN users

support:write api.read api.privileged

A VPN user of another account is 404.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
vpnUser Required path integer min 1 The VPN user's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/vpn/users/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/volumes/{volume}/snapshots #

Take a snapshot of a customer's volume

support:write api.read api.privileged

Counts against the customer's snapshot cap, as in the panel.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.

Request body Required

Field Type Description
name Optional string An optional name.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/delete #

Delete a customer's volume snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.
snapshot Required path integer min 1 The snapshot's id; it must be a copy of that volume.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/volumes/{volume}/snapshots/{snapshot}/actions/restore #

Make a new volume from a customer's snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.
snapshot Required path integer min 1 The snapshot's id; it must be a copy of that volume.

Request body Required

Field Type Description
name Required string The new volume's name.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshots/1/actions/restore' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/volumes/{volume}/snapshot-policies #

Set a snapshot schedule on a customer's volume

support:write api.read api.privileged

The cloud takes the copies and expires the oldest past max_snaps.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
volume Required path integer min 1 The volume's id; it must belong to the customer.

Request body Required

Field Type Description
interval_type Required string hourly, daily, weekly or monthly.
max_snaps Required integer How many copies to keep.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/volumes/1/snapshot-policies' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "interval_type": "string",
    "max_snaps": 1
}'
POST /support/customers/{user}/instances/{instance}/vm-snapshots #

Take a snapshot of a customer's machine

support:write api.read api.privileged

Refused while live snapshots are switched off here.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The copy's name.
description Optional string An optional note.
with_memory Optional boolean Include the machine's memory.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string"
}'
POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/delete #

Delete a customer's machine snapshot

support:write api.read api.privileged

A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
vmSnapshot Required path integer min 1 The machine snapshot's id; it must be a copy of that machine.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/instances/{instance}/vm-snapshots/{vmSnapshot}/actions/revert #

Revert a customer's machine to a snapshot

support:write api.read api.privileged

Everything written since the copy is lost. A copy held in retention is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at cloud: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
instance Required path integer min 1 The machine's id; it must belong to the customer.
vmSnapshot Required path integer min 1 The machine snapshot's id; it must be a copy of that machine.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/instances/1/vm-snapshots/1/actions/revert' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones/{zone}/actions/delete #

Delete a customer's DNS zone

support:write api.read api.privileged

The zone and every record in it are removed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/dns-zones/{zone}/records #

Add a record to a customer's zone

support:write api.read api.privileged

One value; other values at the same name and type are kept.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.

Request body Required

Field Type Description
name Required string The record's name.
type Required string The record type.
data Required string The value.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "type": "string",
    "data": "string"
}'
POST /support/customers/{user}/dns-zones/{zone}/records/{record} #

Change a record in a customer's zone

support:write api.read api.privileged

Refused with 422 when the value changed since it was read.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.
record Required path integer min 1 The record's id; it must be in that zone.

Request body Required

Field Type Description
type Required string The record type.
data Required string The new value.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "string",
    "data": "string"
}'
POST /support/customers/{user}/dns-zones/{zone}/records/{record}/actions/delete #

Delete a record from a customer's zone

support:write api.read api.privileged

Refused with 422 when the value changed since it was read.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at dns: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
zone Required path integer min 1 The DNS zone's id; it must belong to the customer.
record Required path integer min 1 The record's id; it must be in that zone.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/dns-zones/1/records/1/actions/delete' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/cancel #

Cancel a customer's subscription

support:write api.read api.privileged

Ends the contract as the panel's Cancel does; the service's refusals are 409.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/cancel' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/unstage-resize #

Cancel a customer's staged resize

support:write api.read api.privileged

Deletes the unpaid bill and restores the previous subscription; moves no money; a paid resize is refused.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/unstage-resize' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/lock #

Lock a customer's subscription

support:write api.read api.privileged

The panel's lock.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/lock' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/unlock #

Unlock a customer's subscription

support:write api.read api.privileged

The panel's unlock.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/unlock' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/lift-suspension #

Lift a customer's suspension

support:write api.read api.privileged

Puts the service back; the bill is still owed and no money moves.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/lift-suspension' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/subscriptions/{subscription}/actions/force-refund #

Force a refund of a customer's one-time service

support:write api.read api.privileged

Services only, inside the forced-refund window, never a delivered one. Ignores the customer's refunds block, as every staff refund does. When an issued invoice stands, a forced invoice-cancellation request is opened instead (202).

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/force-refund' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/subscriptions/{subscription}/actions/request-invoice-cancellation #

Open an invoice-cancellation request for a customer

support:write api.read api.privileged

For a purchase whose issued invoice must be cancelled before it is refunded; a machine is stopped at once.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
subscription Required path integer min 1 The subscription's id; it must belong to the customer.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/subscriptions/1/actions/request-invoice-cancellation' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/confirm #

Record a company's confirmation

support:write api.read api.privileged

Staff record that the company agreed its invoice may be cancelled.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/confirm' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/resolve #

Cancel the invoice and make the refund

support:write api.read api.privileged

The whole refund precheck runs first; a refund that does not complete answers 202 and stays owed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/resolve' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/retry #

Retry an owed refund

support:write api.read api.privileged

For a request whose invoice is cancelled and whose refund is still owed.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Responses

  • 200 Done.
  • 202 Accepted; not finished yet — see the message.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.
  • 502 The cloud's underlying IaaS control plane failed to carry out the request. The detail is a fixed, non-specific string in production — the provider's own error text routinely names internal hosts, pods and hypervisors. Treat this as retryable rather than as a client error.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/retry' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/invoice-refund-requests/{invoiceRefundRequest}/actions/decline #

Decline an invoice-cancellation request

support:write api.read api.privileged

The invoice stays valid and the customer is told why.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
invoiceRefundRequest Required path integer min 1 The invoice-cancellation request's id; its payment must be the customer's.

Request body Required

Field Type Description
reason Required string Why — recorded with the act and shown to the customer where the panel shows it.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/invoice-refund-requests/1/actions/decline' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "string"
}'
POST /support/customers/{user}/payments/{payment}/chargebacks #

Record a chargeback on a customer's payment

support:write api.read api.privileged

Records what the bank took back.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
payment Required path integer min 1 The payment's id; it must be the customer's.

Request body Required

Field Type Description
amount Required number The amount the bank took back, as a decimal in the payment's own currency (TL or USD), e.g. 12.50.
bank_date Required string The bank's date (YYYY-MM-DD), not in the future.
reason Required string The bank's reason.
bank_reference Optional string The bank's reference.
note Optional string A staff note.
subscription_id Optional integer The line of the payment it concerns, if one.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/payments/1/chargebacks' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "amount": 1,
    "bank_date": "string",
    "reason": "string"
}'
POST /support/customers/{user}/billing/bill-notices #

Set whether the customer is sent bill notices

support:write api.read api.privileged

default follows the installation's setting.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
notify_pending_payments Required string on, off or default.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/bill-notices' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "notify_pending_payments": "string"
}'
POST /support/customers/{user}/billing/refunds-block #

Block or allow a customer's own refunds

support:write api.read api.privileged

Stops the customer's own Refund, never a staff refund. A reason is required to block and is never shown to the customer.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
blocked Required boolean Block (true) or allow (false).
reason Optional string Why — required to block.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/refunds-block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "blocked": true
}'
POST /support/customers/{user}/billing/shop-block #

Disable or enable purchasing for a customer

support:write api.read api.privileged

Existing subscriptions keep running. A reason is required to block and is never shown to the customer.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at billing: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
blocked Required boolean Block (true) or allow (false).
reason Optional string Why — required to block.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 409 The addressed resource has drifted from the upstream provider in a way this request cannot resolve. Refresh and retry.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing/shop-block' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "blocked": true
}'
POST /support/customers/{user}/tickets/{ticket}/comments #

Reply to a customer's ticket

support:write api.read api.privileged

Filed under YOU, as the support panel files it. A solved or closed thread takes no reply; a partnership thread is 404. Text only.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at tickets: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ticket Required path integer min 1 The ticket's id; it must be the customer's and reachable by you at manage.

Request body Required

Field Type Description
comment Required string The reply, up to 10000 characters.

Responses

  • 201 Created.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/tickets/1/comments' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "string"
}'
POST /support/customers/{user}/tickets/{ticket}/actions/close #

Close a customer's ticket

support:write api.read api.privileged

The customer is told, as from the panel.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at tickets: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
ticket Required path integer min 1 The ticket's id; it must be the customer's and reachable by you at manage.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/tickets/1/actions/close' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'
POST /support/customers/{user}/profile #

Change a customer's profile

support:write api.read api.privileged

The staff profile form; the identity document is judged by the customer's language. A Telegram id or tags left out keep their values. The birthdate, identity number and phone must be sent — leaving one out is a 422 — and a null clears that field, as the panel form does.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
name Required string Full name.
birthdate Required string Date of birth; null clears it.
identity_number Required string T.C. number, or the placeholder with a passport; null clears it.
passport_number Optional string Passport number.
phone Required string Phone in international form; null clears it.
language Required string tr-TR, en-US or ar-SA.
telegram_user_id Optional string Telegram id.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/profile' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "string",
    "birthdate": "string",
    "identity_number": "string",
    "phone": "string",
    "language": "string"
}'
POST /support/customers/{user}/billing-information #

Change a customer's billing information

support:write api.read api.privileged

A country change that would move the currency while bills are open is refused on country. A partner account stays corporate whatever corporate says: a body that would leave it without a company name and a tax number is refused on corporate. Otherwise an absent company field is written empty — absent or false corporate is a personal invoice.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.

Request body Required

Field Type Description
corporate Optional boolean A corporate invoice. Absent or false is a personal one — except on a partner account, which stays corporate whatever this says.
company_name Optional string Company name.
tax_number Optional string Tax number.
tax_office Optional string Tax office.
address Required string Address.
city Required string City.
postal_code Required string Postal code.
country Required string Country.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/billing-information' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "address": "string",
    "city": "string",
    "postal_code": "string",
    "country": "string"
}'
POST /support/customers/{user}/members/{member} #

Change a member's capabilities

support:write api.read api.privileged

The whole matrix, keyed by account domain. Never above your own assignment; the owner is never reduced.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer min 1 A login of the customer's account.

Request body Required

Field Type Description
capabilities Required object Domain => none, view or manage.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/members/1' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "capabilities": []
}'
POST /support/customers/{user}/members/{member}/actions/remove #

Remove a member from a customer's account

support:write api.read api.privileged

The owner cannot be removed; a member with records must be anonymised instead.

Requires a support:write token whose owner holds the support or super-admin role and an assignment for this customer at account: manage. A row of another customer is 404. Audited with you as the actor.

Parameters

Name In Type Description
user Required path integer min 1 The target customer's user id. The parameter is named `user` rather than `customer` on purpose: the capability gate, the assignment gate and the access-log middleware all read it by that literal name, and the last of those fails *open* — it would stop writing the access-log row — if it were renamed.
member Required path integer min 1 A login of the customer's account.

Responses

  • 200 Done.
  • 401 No token was presented, or it is invalid or expired.
  • 403 Authenticated, but not permitted — the token lacks the required ability, a policy denied the action, the email address is unverified, or a support capability is insufficient.
  • 404 No such resource, or it belongs to another customer. The two cases are deliberately indistinguishable.
  • 422 The request body or query string failed validation.
  • 429 Too many requests. Retry after the interval given in `Retry-After`.

Example request

curl -X POST 'https://cloud.core.gen.tr/api/v1/support/customers/1/members/1/actions/remove' \
  -H 'Authorization: Bearer $C2_TOKEN' \
  -H 'Accept: application/json'

Get Started Now

Create your account in minutes, set up your own cloud environment, and take control. With cloud.core.gen.tr, everything is faster, safer, and simpler.

Book a Meeting

Let us help you grow your business. Book a 15 minute meeting now.

Book Now