The API is the same interface the control panel uses, which means anything you can do by clicking you can do by script. Base URL https://api.nimbusvps.com/v1.

Authentication

Generate a scoped token in the panel under Account → API tokens. Tokens can be read-only or read-write and can be limited to specific servers.

export NIMBUSVPS_TOKEN="hn_live_..."

curl https://api.nimbusvps.com/v1/servers \
  -H "Authorization: Bearer $NIMBUSVPS_TOKEN"

Rate limits

600 requests per minute per token. Responses carry X-RateLimit-Remaining and X-RateLimit-Reset. Exceeding it returns 429 with a Retry-After header.

Create a server

curl -X POST https://api.nimbusvps.com/v1/servers \
  -H "Authorization: Bearer $NIMBUSVPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "location": "romania",
    "vcpu": 3,
    "ram_gb": 4,
    "disk_gb": 90,
    "os": "debian-12",
    "hostname": "node-01.example.com",
    "ssh_keys": ["ssh-ed25519 AAAA..."],
    "user_data": "#cloud-config\npackages:\n  - nginx",
    "backups": "weekly",
    "ddos": "advanced"
  }'

{
  "id": "srv_01HQ...",
  "status": "provisioning",
  "ipv4": "89.36.222.101",
  "ipv6": "2a0e:xxxx:xxxx:xxxx::2/64",
  "root_password": "shown once, never again",
  "created_at": "2026-07-20T10:14:22Z"
}

Endpoints

Method	Path	Purpose
`GET`	/servers	List servers
`POST`	/servers	Create a server
`GET`	/servers/{id}	Server detail
`DELETE`	/servers/{id}	Destroy a server
`POST`	/servers/{id}/power	start, stop, reboot, reset
`POST`	/servers/{id}/rebuild	Reinstall the OS
`POST`	/servers/{id}/resize	Change specification
`POST`	/servers/{id}/migrate	Move to another location
`GET`	/servers/{id}/snapshots	List snapshots
`POST`	/servers/{id}/snapshots	Take a snapshot
`POST`	/snapshots/{id}/restore	Restore a snapshot
`PUT`	/servers/{id}/rdns	Set reverse DNS
`GET`	/servers/{id}/metrics	CPU, memory, disk, network
`GET`	/servers/{id}/console	Signed KVM console URL
`GET`	/locations	Available locations
`GET`	/images	Available OS templates
`GET`	/invoices	Invoice history

Errors

{
  "error": {
    "code": "insufficient_capacity",
    "message": "No capacity for 32 vCPU in seychelles. Try netherlands or contact sales.",
    "field": "vcpu"
  }
}

Errors are machine-readable in code and human-readable in message. Where a fix exists, the message names it.

Webhooks

Register an endpoint to receive server lifecycle events — server.provisioned, server.suspended, invoice.due, attack.mitigated. Payloads are signed with HMAC-SHA256 in the X-NimbusVPS-Signature header. Verify it against the raw body before trusting anything in the payload.

REST API reference