API Documentation ​

Authentication ​

Getting Started ​

To authenticate your requests, include your JWT token in the Authorization header:

curl -H "Authorization: Bearer YOUR_JWT_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Origin: https://swiftor.io" \
     http://api.swiftor.io/vms

Public Endpoints ​

These endpoints are accessible without authentication:

User Profiles ​

• GET /@{username} - Get user's public profile
• GET /@{username}/pfp - Get profile picture
• GET /@{username}/banner - Get profile banner

Public Reports ​

• GET /@{username}/{reportid} - Get public report
• POST /@{username}/{reportid} - Get public report details. Requires a JSON body, potentially with a password field if the report is protected.

Authenticated Endpoints ​

We use redis for caching.

User Management ​

• GET /init - Get current authenticated user's comprehensive information (profile, VMs, reports, payloads, notifications).
• GET /get-usage - Get Sparks usage details.

Virtual Machines → ​

• GET /vms - List VMs
• POST /vms/create - Create VM
• GET /vms/start/{vmid} - Start VM
• GET /vms/stop/{vmid} - Stop VM
• GET /vms/delete/{vmid} - Delete VM
• GET /vms/secrets - Manage Environment Variables
• GET /vms/networking - Manage Subdomain Mapping

Reports → ​

• GET /reports - List reports
• POST /reports/create - Create report
• PUT /reports/publish/{report_id} - Update report (used to manage content, theme, protection status, etc.)
• DELETE /reports/{report_id} - Delete report

Payloads → ​

• POST /payloads/install - Install payload
• POST /payloads/abuse - Report abuse
• GET /payloads/abuse/{payloadid} - Get abuse reports (admin only)

Storage → ​

• GET /storage - List storage usage
• POST /storage/upload - Upload file
• DELETE /storage/{file_id} - Delete file

Additional Services ​

Notifications ​

• GET /notifications - Get notifications
• POST /notifications/read - Mark as read

Payment ​

• POST /payment/test/create-checkout-session - Create checkout

AI Services ​

• POST /ai/chat - Chat with AI (streaming)

Account Deletion ​

• Endpoints under /delete handle account-related deletion tasks. (Details TBC)

Security ​

CORS Policy ​

Error Handling ​

The API uses standard HTTP status codes with JSON error responses:

{
  "detail": "Error description"
}

Common status codes: