Overview

We expose public operations over Hypertext Transfer Protocol (HTTP). Use our application programming interface (API) to script server creation and manage instances from your own tools.

Base URL

https://api.galaxygate.net/v1

Endpoint paths shown here include /v1. Append them to https://api.galaxygate.net once. Most requests and responses use JavaScript Object Notation (JSON).

Authentication

Protected calls carry a bearer token in the Authorization header:

Authorization: Bearer <your-token>

A protected request without a bearer token or authenticated browser cookie returns 403 Forbidden. A request that carries a bearer token the server does not recognize (invalid or expired) is rejected with 401 Unauthorized. Both responses carry an ApiError JSON body with status, error, and optional nullable code. You create an API token in the panel under Security and send it on every request. See Authentication and tokens to mint one.

Workspaces

Most resources belong to a workspace. Your instances, Secure Shell (SSH) keys, and tokens all live inside one. Workspace-scoped endpoints include the workspace identifier (ID) in the path as {wid}, for example:

POST /v1/workspaces/{wid}/orders

You can find your workspace ID in the panel, or by listing your workspaces through the API. Endpoints that act on a single instance are addressed by instance ID instead, for example GET /v1/instances/{iid}.

Asynchronous operations

We create servers through package orders. POST /v1/workspaces/{wid}/orders returns 200 OK with CreateOrderResponse. Complete any approval and payment collection before following provisioning. See Create a server and Place an order.

Single-instance power actions return 202 Accepted with WorkflowData. Other operations may return a resource or workflow wrapper with 200 OK, or an empty 202 response. Read each endpoint's response contract in the reference.

Poll workflows at GET /v1/workspaces/{wid}/workflows/{wfid}, or list instance workflows at GET /v1/workspaces/{wid}/instances/{iid}/workflows. A workflow reaches COMPLETED, FAILED, ABORTED, or TIMED_OUT. For provisioning, inspect the order and the instance's state and live online fields.

We remove delivered servers through POST /v1/subjects/{sid}/cancel, using the instance's billing subject ID. See Cancel a purchase.

Rate limiting

The API is rate limited per client Internet Protocol (IP) address. The general limit is 120 requests per 60 second window. Login, register, password reset, email verification, and account lock have tighter limits. Above the limit the API responds with 429 Too Many Requests and an ApiError JSON body. Retry after a delay, with exponential backoff.

What is in this section

• Authentication and tokens: create and use scoped API tokens for scripts.
• Create a server: place a server package order with POST /v1/workspaces/{wid}/orders.
• Power controls: power a server on or off, and act on many at once.
• Run code with cloud-init: update stored user data and understand first-boot limits.

The reference covers the rest of the API: disks, snapshots, backups, IPs, firewall rules, and more. The same conventions apply to every endpoint.