REST API Reference

BlitzPress REST API Reference

The BlitzPress panel exposes a REST API for managing servers, sites, and all platform features programmatically. All endpoints require authentication unless noted.

Base URL

https://app.blitzpress.dev/api/v1/

Authentication

All API requests require a JWT bearer token in the Authorization header:

Authorization: Bearer <your-jwt-token>

Obtain a token via the login endpoint. Tokens expire after 24 hours.

Rate Limits

Endpoint	Limit
General API	100 requests/minute/IP
Login / Register	5 requests/15 minutes/IP
Agent Heartbeat	120 requests/minute/IP

---

Authentication

Method	Endpoint	Description
POST	/auth/register	Create a new account
POST	/auth/login	Login and receive JWT token
GET	/auth/me	Get current user profile
PUT	/auth/password	Change password

POST /auth/login

{
  "email": "[email protected]",
  "password": "your-password"
}

// Response
{
  "token": "eyJhbGciOiJIUzI...",
  "user": { "id": "uuid", "email": "...", "plan": "pro" }
}

---

Servers

Method	Endpoint	Description
GET	/servers	List all servers
POST	/servers	Connect a new server
GET	/servers/:id	Server details + sites + metrics
GET	/servers/:id/metrics	Historical metrics (CPU, RAM, disk)
DELETE	/servers/:id	Disconnect server
GET	/servers/:id/sites	List sites on server
POST	/servers/:id/sites	Create a WordPress site
POST	/servers/:id/purge	Purge all caches on server

POST /servers/:id/sites

{
  "domain": "example.com",
  "php_version": "8.3",
  "wp_admin_user": "admin",
  "wp_admin_email": "[email protected]",
  "wp_title": "My Site"
}

---

Sites

Method	Endpoint	Description
GET	/sites/:id	Site details
DELETE	/sites/:id	Delete site
POST	/sites/:id/ssl	Issue/renew SSL certificate
POST	/sites/:id/php	Change PHP version
POST	/sites/:id/autologin	Generate WP admin auto-login URL
GET	/sites/:id/backups	List site backups
POST	/sites/:id/backup	Create a new backup
POST	/sites/:id/restore	Restore from backup
POST	/sites/:id/staging	Create/push/delete staging
POST	/sites/:id/clone	Clone site
GET	/sites/:id/logs	View access/error logs
GET	/sites/:id/wp-config	Read wp-config.php
POST	/sites/:id/wp-config	Update wp-config.php
POST	/sites/:id/phpmyadmin	Get phpMyAdmin SSO URL
GET	/sites/:id/php-settings	Get PHP settings
POST	/sites/:id/php-settings	Update PHP settings
POST	/sites/:id/migrate	Import/migrate a site
GET	/sites/:id/security	Get security settings
POST	/sites/:id/security	Update security settings
POST	/sites/:id/files	File manager operations
POST	/sites/:id/cron	Manage cron jobs
POST	/sites/:id/remote-backup	Configure remote backup
POST	/sites/:id/terminal	Run WP-CLI command
GET	/sites/:id/uptime	Uptime status
GET	/sites/apps	List installable apps

Email Management

Method	Endpoint	Description
GET	/sites/:id/list-emails	List email accounts
GET	/sites/:id/check-email-dns	Verify email DNS records
POST	/sites/:id/setup-email	Deploy Postal email server

---

BitNinja Security

Method	Endpoint	Description
GET	/bitninja/:serverId	Get BitNinja status (installed, running, version, modules)
POST	/bitninja/:serverId/install	Install BitNinja with license key
POST	/bitninja/:serverId/uninstall	Remove BitNinja completely
POST	/bitninja/:serverId/restart	Restart BitNinja agent
GET	/bitninja/:serverId/modules	List all modules with status
POST	/bitninja/:serverId/toggle	Enable/disable a module

POST /bitninja/:serverId/install

{
  "license_key": "your-bitninja-license-key"
}

// Response
{
  "status": "success",
  "message": "BitNinja installed and configured for OpenLiteSpeed",
  "data": {
    "installed": true,
    "service_running": true,
    "version": "8.x.x",
    "senselog_ols_configured": true,
    "dashboard_url": "https://admin.bitninja.io/site/login"
  }
}

POST /bitninja/:serverId/toggle

{
  "module": "WAFManager",
  "enabled": false
}

---

Firewall (UFW)

Method	Endpoint	Description
GET	/firewall/:serverId	List rules + status
POST	/firewall/:serverId	Add a firewall rule
DELETE	/firewall/:serverId/:ruleNum	Delete a rule
POST	/firewall/:serverId/toggle	Enable/disable UFW

POST /firewall/:serverId

{
  "port": "8080",
  "proto": "tcp",
  "direction": "allow",
  "from_ip": "any"
}

---

Cloudflare

Method	Endpoint	Description
GET	/cloudflare/:serverId	Get Cloudflare config + zones
POST	/cloudflare/:serverId	Save CF API credentials
POST	/cloudflare/:serverId/enable-cache/:siteId	Enable CF proxy + cache
POST	/cloudflare/:serverId/purge/:siteId	Purge CF cache for site
GET	/cloudflare/:serverId/settings/:siteId	Get CF settings for site
POST	/cloudflare/:serverId/action/:siteId	Toggle dev mode, security level, etc.

---

WAF (Web Application Firewall)

Method	Endpoint	Description
GET	/waf/:siteId	WAF status
POST	/waf/:siteId/install	Install WAF rules
POST	/waf/:siteId/enable	Enable WAF
POST	/waf/:siteId/disable	Disable WAF
GET	/waf/:siteId/rules	List WAF rule files
POST	/waf/:siteId/rules/:filename/toggle	Toggle a rule file
GET	/waf/:siteId/audit-log	View WAF audit log

---

Databases

Method	Endpoint	Description
GET	/databases/:siteId	List databases
GET	/databases/:siteId/:dbName/tables	List tables
POST	/databases/:siteId/:dbName/query	Run SQL query
GET	/databases/:siteId/:dbName/size	Database size
POST	/databases/:siteId/:dbName/export	Export database (mysqldump)
POST	/databases/:siteId/:dbName/import	Import SQL file

---

Docker

Method	Endpoint	Description
GET	/docker/:serverId/containers	List containers
POST	/docker/:serverId/containers	Create container
POST	/docker/:serverId/containers/:id/action	Start/stop/restart/remove
GET	/docker/:serverId/containers/:id/logs	Container logs
GET	/docker/:serverId/containers/:id/stats	Container resource stats
POST	/docker/:serverId/pull	Pull a Docker image

---

Backups

Method	Endpoint	Description
GET	/backups/dashboard	Backup overview (all repos)
GET	/backups/repos	List backup repositories
POST	/backups/repos/:id/check	Verify repo integrity
POST	/backups/repos/:id/prune	Prune old archives
POST	/backups/repos/:id/compact	Compact freed space
POST	/backups/repos/refresh	Refresh repo list
GET	/backups/archives/:repoId	List archives in repo
GET	/backups/archives/:repoId/:name/browse	Browse archive contents
POST	/backups/archives/:repoId/:name/restore	Restore from archive
POST	/backups/archives/:repoId/:name/diff	Compare archive with current
DELETE	/backups/archives/:repoId/:name	Delete specific archive
POST	/backups/run	Run backup now
GET	/backups/history	Backup job history
GET	/backups/schedules	List backup schedules
POST	/backups/schedules	Create backup schedule
PUT	/backups/schedules/:id	Update schedule
DELETE	/backups/schedules/:id	Delete schedule
POST	/backups/schedules/:id/toggle	Enable/disable schedule
POST	/backups/schedules/:id/run-now	Trigger scheduled backup
GET	/backups/remotes	List remote storage configs
POST	/backups/remotes	Add remote storage
DELETE	/backups/remotes/:id	Remove remote storage
POST	/backups/remotes/:id/test	Test remote connection
POST	/backups/remotes/:id/sync	Sync backups to remote
GET	/backups/analytics	Backup analytics (sizes, frequency)

---

Monitoring

Method	Endpoint	Description
GET	/monitoring	All monitored sites + status
GET	/monitoring/sparkline/:siteId	Uptime sparkline data
GET	/monitoring/chart/:siteId	Response time chart data
GET	/monitoring/incidents	List downtime incidents
GET	/monitoring/channels	Notification channels
POST	/monitoring/channels	Add notification channel
PUT	/monitoring/channels/:id	Update channel
DELETE	/monitoring/channels/:id	Delete channel
POST	/monitoring/channels/:id/test	Send test notification

---

Updates

Method	Endpoint	Description
GET	/updates	List all sites with available updates
GET	/updates/history	Update history
POST	/updates/scan/:siteId	Scan site for updates
POST	/updates/scan-all	Scan all sites
POST	/updates/install/:siteId	Install updates
POST	/updates/auto-update/:siteId	Toggle auto-updates

---

Billing

Method	Endpoint	Description
GET	/billing/plans	Available plans
POST	/billing/checkout	Create Stripe checkout session
POST	/billing/portal	Stripe customer portal URL

---

Teams

Method	Endpoint	Description
GET	/teams	List team members
POST	/teams/invite	Invite a member
PUT	/teams/members/:id	Update member role
DELETE	/teams/members/:id	Remove member

---

Settings

Method	Endpoint	Description
GET	/settings	All settings
GET	/settings/:category	Settings by category
POST	/settings/:category	Update settings
DELETE	/settings/:category/:key	Delete a setting
POST	/settings/smtp/test	Test SMTP configuration

---

Status Pages

Method	Endpoint	Description
GET	/status/:token	Public status page data
GET	/status/manage/list	List your status pages
POST	/status/manage/create	Create status page
PUT	/status/manage/:id	Update status page
DELETE	/status/manage/:id	Delete status page

---

Error Responses

All errors follow a consistent format:

{
  "error": "Description of what went wrong"
}

// HTTP Status Codes:
// 400 — Bad request (missing/invalid params)
// 401 — Authentication required
// 403 — Forbidden (not your server/site)
// 404 — Resource not found
// 429 — Rate limited
// 500 — Internal server error
// 504 — Agent timeout (command didn't complete in time)

Agent Command Pattern

Most site and server operations use an async command queue. The panel inserts a command into the database, and the agent on the VPS polls for it, executes it, and reports the result. The API endpoint waits (polls up to 90 times at 2-second intervals) for the result before responding.

If the agent doesn’t respond in time, you’ll receive a 504 timeout. The command may still complete on the server — check the panel dashboard for status.

Total API Surface

• 17 route files
• 120+ endpoints
• Covers: servers, sites, SSL, PHP, backups, staging, cloning, email, databases, firewall, WAF, Docker, monitoring, updates, Cloudflare, BitNinja, billing, teams, settings, status pages

---

Install Script & Agent Downloads

The installer and all agent files are served from blitzpress.dev:

URL	Purpose
/install	Install script (clean URL)
/bp-install/install.sh	Install script (direct)
/bp-install/agent.py	Agent daemon
/bp-install/commands/{name}.py	42 command modules
/bp-install/mu-plugins/{name}.php	7 mu-plugins

Install command

curl -sSL /install | bash -s -- <server-token>

The server token is generated when you click “Connect Server” in the panel. The install script registers the server with the panel API at https://app.blitzpress.dev/api/v1/agent/register.

Agent Communication

After installation, the agent daemon (blitzpress-agent.service) runs on the server and:

• Sends heartbeat metrics every 60 seconds to POST /api/v1/agent/heartbeat
• Polls for pending commands every 3 seconds via GET /api/v1/agent/commands
• Reports command results to POST /api/v1/agent/commands/:id/result

Agent Endpoints (internal)

Method	Endpoint	Description
POST	/agent/register	Register new server (during install)
POST	/agent/heartbeat	Server metrics (CPU, RAM, disk)
GET	/agent/commands	Poll for pending commands
POST	/agent/commands/:id/result	Report command result

Agent endpoints use Bearer token auth with the server-specific token stored in /opt/blitzpress/config.json.