Using the API

Everything you can do in the control panel, you can do over HTTP. The API is how you script server creation, wire GalaxyGate into your own tools, or manage fleets of instances.

Base URL

https://api.galaxygate.net/v1

All endpoints on this site are relative to that base. Requests and responses are JSON.

Authentication

Every call carries a bearer token:

Authorization: Bearer <your-token>

You get a token by logging in (a session token) or by creating a long-lived API token for scripts. Tokens carry a permission map that decides what they can read and write. Start at Authentication & tokens to mint one.

Workspaces

Most resources belong to a workspace — your instances, SSH keys, and tokens all live inside one. Workspace-scoped endpoints include the workspace ID in the path, for example:

POST /v1/workspaces/{wid}/instances
POST /v1/workspaces/{wid}/ssh

You can find your workspace ID in the panel, or by listing your workspaces via the API.

Asynchronous operations (workflows)

Creating, deleting, upgrading, and power-cycling an instance don't finish instantly. These endpoints return a workflow object right away and continue the work in the background. The response tells you a workflow was started; poll the instance (GET /v1/instances/{id}) to watch its state settle.

Wherever a call is asynchronous, this documentation says so.

Rate limiting

The API is rate limited per client. If you're bulk-creating or polling in a tight loop and start getting 429 Too Many Requests, back off and retry with a delay rather than hammering.

What's in this section

Page	Endpoint
Authentication & tokens	POST /v1/tokens, POST /v1/login
Create a VPS	POST /v1/workspaces/{wid}/instances
Power controls	POST /v1/instances/{id}/power
Upgrade & resize	POST /v1/commands/upgrade-instance, apply-upgrades
Delete a VPS	DELETE /v1/instances/{id}

Full specification

This section covers the operations most people need day to day. GalaxyGate's control panel is backed by a much larger REST surface (instances, disks, snapshots, backups, IPs, firewall rules, load balancers, Kubernetes, and more). The patterns here — bearer auth, workspace scoping, workflow responses — apply across all of it.