REST-API

Quick start

1. In the customer portal under API create a token with the required permissions.
2. Send the token as a header: Authorization: Bearer hgg_…
3. Responses are JSON: success { data, meta? }, errors { error: { code, message } }.

curl https://hoster.gg/api/v1/domains \
  -H "Authorization: Bearer hgg_…"

Base URL: https://hoster.gg/api/v1 · at most 120 requests per minute and token · lists with ?limit= (max. 100) and ?page=

Permissions

Endpoints

curl -X PATCH https://hoster.gg/api/v1/domains/beispiel.de \
  -H "Authorization: Bearer hgg_…" -H "Content-Type: application/json" -d '{"autoRenew":false}'

curl -X POST https://hoster.gg/api/v1/domains/beispiel.de/dns \
  -H "Authorization: Bearer hgg_…" -H "Content-Type: application/json" \
  -d '{"type":"A","name":"www","content":"203.0.113.10","ttl":3600}'

curl -X POST https://hoster.gg/api/v1/hosting/<id>/backups -H "Authorization: Bearer hgg_…"

curl -X POST https://hoster.gg/api/v1/cdn/zones/<id>/purge \
  -H "Authorization: Bearer hgg_…" -H "Content-Type: application/json" \
  -d '{"urls":["https://www.beispiel.de/style.css"]}'

curl -X POST https://hoster.gg/api/v1/deploy/projects/<id>/deployments \
  -H "Authorization: Bearer hgg_…"

Command line: hgg

Download hgg.mjs – a single file without dependencies, requires Node.js 20 or newer. It asks for the token hgg login (it does not end up in your shell history) and stores it readable only by you under ~/.config/hgg/config.json.

node hgg.mjs login
node hgg.mjs domains
node hgg.mjs dns beispiel.de
node hgg.mjs dns add beispiel.de TXT @ "v=spf1 -all" --ttl 3600
node hgg.mjs dns rm beispiel.de <eintrag-id>
node hgg.mjs invoices --open --json

In scripts, instead of login the environment variable HGG_TOKEN . Every command needs the matching token permission.

Webhooks

Under API → Webhooks you can add up to five https addresses. We send every event from your notification centre (e.g. invoice.created, domain.registered, hosting.ready) as POST – optionally only certain areas. If your address does not respond with 2xx, we retry up to seven times (after 1 min. up to 24 hrs.); after 20 failures in a row we pause the webhook.

POST /dein/pfad
X-Hoster-Event: invoice.created
X-Hoster-Delivery: <ID>
X-Hoster-Signature: t=1760262000,v1=<HMAC-SHA256>

{ "id": "…", "event": "invoice.created", "category": "billing", "createdAt": "…",
  "data": { "title": "…", "body": "…", "link": "https://hoster.gg/portal/…" } }

Verify the signature (Node.js):

const [t, v1] = header.split(",").map((p) => p.split("=")[1]);
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const ok = crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected)) && Math.abs(Date.now() / 1000 - Number(t)) < 300;

Error codes