Orax Orax
Sign in

Public REST API

2 min read13.10.2026116 views
On this page

Orax has a public REST API: anything you do in the cabinet can be done by a program.

Two halves

The open half needs no token at all. The same pages a guest reads, served as JSON: the knowledge base, blog, reviews, glossary, templates, status, exchange rates, the list of domain zones and a domain check. The ?lang=uz|ru|en parameter resolves translations to one string.

The closed half needs an OAuth2 token: profile, services and their management, orders, wallet, domains, monitors, security scans, a service's uptime, servers, AI.

Scopes

A token is issued for exactly what is needed: profile, services:read/write, orders:read/write, wallet:read/write, ai:read/write, domains:read/write, monitors:read/write.

Domains and monitors are separate on purpose: that way a read-only uptime dashboard can be granted without handing over the right to spend money along with it.

Getting started

  1. Authorise over OAuth2 and get a token with the scopes you need.
  2. Call /api/v1 with the authorisation header.
  3. Respect the rate limit — 90 requests a minute.

Documentation

  • /developers — the overview: what the API can do, and a first request that works with no token.
  • /api/docs — the full reference (OpenAPI/Redoc). It is generated from the code itself: the documented scopes are read off the routes, so the documentation cannot promise a permission the server does not enforce.

Worth knowing

  • Money is always in dollars, in minor units (cents).
  • Lists answer with {data, meta} and pagination; a refusal returns a stable error key plus a readable message.
  • No response ever contains a password: server, FTP and database passwords have no API representation at all — a read token must not become root.
  • A section switched off in the settings returns 404 over the API too. That is by design.

For ai agents

There is an MCP server (/api/v1/mcp) — the same account over the standard Model Context Protocol. Version one only reads: no money, nothing irreversible.

The mobile app runs on this same API. Partners have a separate reseller API with a key.

Was this helpful?

Related articles