API documentation for partners

# your details (treat the token like a password: environment variable, never in code)
export NBT_API=https://server.nbt-host.com/api
export NBT_ORG=…        # your partner organisation
export NBT_TOKEN=…      # <tokenId>_<cheie>

curl -sS "$NBT_API/orgs/$NBT_ORG" -H "Authorization: Bearer $NBT_TOKEN"
# your subscription: used / total resources
curl -sS "$NBT_API/orgs/$NBT_ORG/subscriptions" -H "Authorization: Bearer $NBT_TOKEN"

<?php
// nbt-api.php — PHP 7.4+, cURL extension; retries on 429 / 503
function nbt_api(string $method, string $path, ?array $body = null): array
{
    $url = (getenv('NBT_API') ?: 'https://server.nbt-host.com/api') . $path;
    for ($try = 1; ; $try++) {
        $ch = curl_init($url);
        $headers = ['Authorization: Bearer ' . getenv('NBT_TOKEN'), 'Accept: application/json'];
        if ($body !== null) {
            $headers[] = 'Content-Type: application/json';
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
        }
        curl_setopt_array($ch, [
            CURLOPT_CUSTOMREQUEST  => $method,
            CURLOPT_HTTPHEADER     => $headers,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HEADER         => true,
            CURLOPT_TIMEOUT        => 120,
        ]);
        $raw = curl_exec($ch);
        if ($raw === false) {
            throw new RuntimeException('cURL: ' . curl_error($ch));
        }
        $code = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $head = substr($raw, 0, curl_getinfo($ch, CURLINFO_HEADER_SIZE));
        $text = substr($raw, strlen($head));
        if (($code === 429 || $code === 503) && $try < 4) {
            preg_match('/^retry-after:\s*(\d+)/mi', $head, $m);
            sleep((int) ($m[1] ?? 2 ** $try));
            continue;
        }
        $data = json_decode($text, true);
        if ($code >= 400) {
            $msg = is_array($data) ? trim(($data['code'] ?? '') . ' ' . ($data['message'] ?? $data['detail'] ?? '')) : $text;
            throw new RuntimeException("HTTP $code: $msg", $code);
        }
        return is_array($data) ? $data : ['value' => $data ?? $text];
    }
}

$org = getenv('NBT_ORG');                       // your partner organisation
print_r(nbt_api('GET', "/orgs/$org"));
print_r(nbt_api('GET', "/orgs/$org/subscriptions"));   // your subscription: used / total resources

// nbt-api.mjs — Node.js 18+ (built-in fetch); retries on 429 / 503
const API = process.env.NBT_API ?? 'https://server.nbt-host.com/api';

export async function api(method, path, body) {
  for (let attempt = 1; ; attempt++) {
    const res = await fetch(API + path, {
      method,
      headers: {
        Authorization: `Bearer ${process.env.NBT_TOKEN}`,
        Accept: 'application/json',
        ...(body !== undefined && { 'Content-Type': 'application/json' }),
      },
      body: body !== undefined ? JSON.stringify(body) : undefined,
    });
    if ((res.status === 429 || res.status === 503) && attempt < 4) {
      const wait = Number(res.headers.get('retry-after')) || 2 ** attempt;
      await new Promise((r) => setTimeout(r, wait * 1000));
      continue;
    }
    const text = await res.text();
    let data;
    try { data = text ? JSON.parse(text) : null; } catch { data = text; }
    if (!res.ok) {
      const msg = typeof data === 'object' && data ? `${data.code ?? ''} ${data.message ?? data.detail ?? ''}` : data;
      throw Object.assign(new Error(`HTTP ${res.status}: ${String(msg).trim()}`), { status: res.status, body: data });
    }
    return data;
  }
}

// node verifica.mjs — your partner organisation
// import { api } from './nbt-api.mjs';
const org = process.env.NBT_ORG;
console.log(await api('GET', `/orgs/${org}`));
console.log(await api('GET', `/orgs/${org}/subscriptions`)); // your subscription: used / total resources

curl -sS -X POST "$NBT_API/orgs/$NBT_ORG/access_tokens" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"roles":["SuperAdmin"],"friendlyName":"billing","tokenExpires":"2027-01-01T00:00:00Z","allowedIps":["203.0.113.10"],"ipRestricted":true}'

# all customers, 100 per page
OFFSET=0; LIMIT=100
while :; do
  PAGE=$(curl -sS "$NBT_API/orgs/$NBT_ORG/customers?offset=$OFFSET&limit=$LIMIT&sortBy=name&sortOrder=asc" \
    -H "Authorization: Bearer $NBT_TOKEN")
  echo "$PAGE" | jq -r '.items[] | [.id, .name, .status, .websitesCount] | @tsv'
  OFFSET=$((OFFSET + LIMIT))
  [ "$OFFSET" -ge "$(echo "$PAGE" | jq .total)" ] && break
done

<?php
require __DIR__ . '/nbt-api.php';
$org = getenv('NBT_ORG');

// all customers, 100 per page
$offset = 0; $limit = 100;
do {
    $page = nbt_api('GET', "/orgs/$org/customers?offset=$offset&limit=$limit&sortBy=name&sortOrder=asc");
    foreach ($page['items'] as $c) {
        printf("%s\t%s\t%s\t%d\n", $c['id'], $c['name'], $c['status'], $c['websitesCount']);
    }
    $offset += $limit;
} while ($offset < $page['total']);

import { api } from './nbt-api.mjs';
const org = process.env.NBT_ORG;

// all customers, 100 per page
async function* customers(limit = 100) {
  for (let offset = 0; ; offset += limit) {
    const page = await api('GET', `/orgs/${org}/customers?offset=${offset}&limit=${limit}&sortBy=name&sortOrder=asc`);
    yield* page.items;
    if (offset + limit >= page.total) return;
  }
}
for await (const c of customers()) console.log(c.id, c.name, c.status, c.websitesCount);

# 1. the customer (a new organisation under yours) — keep the ids: repeating a POST creates another customer
CLIENT=$(curl -sS -X POST "$NBT_API/orgs/$NBT_ORG/customers" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"Client Company Ltd"}' | jq -r .id)

# 2. its subscription to one of your plans (PLAN_ID: GET /orgs/$NBT_ORG/plans)
SUB=$(curl -sS -X POST "$NBT_API/orgs/$NBT_ORG/customers/$CLIENT/subscriptions" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"planId\":$PLAN_ID}" | jq -r .id)

# 3. the website, with its domain and PHP version (one the plan allows)
SITE=$(curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"domain\":\"client-company.com\",\"subscriptionId\":$SUB,\"phpVersion\":\"php83\"}" | jq -r .id)

# 4. the id of the primary domain (needed for email, DNS, SSL)
DOMAIN_ID=$(curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE" \
  -H "Authorization: Bearer $NBT_TOKEN" | jq -r .domain.id)

# 5. the mailbox (password: 10+ characters, upper and lower case, digits, symbols; quota in bytes)
curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites/$SITE/domains/$DOMAIN_ID/emails" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"username\":\"contact\",\"mailboxPassword\":\"$MAIL_PASS\",\"quota\":1073741824}"

<?php
require __DIR__ . '/nbt-api.php';
$org    = getenv('NBT_ORG');
$planId = (int) getenv('PLAN_ID');

// 1. the customer (a new organisation under yours) — keep the ids: repeating a POST creates another customer
$client = nbt_api('POST', "/orgs/$org/customers", ['name' => 'Client Company Ltd'])['id'];

// 2. its subscription to one of your plans (PLAN_ID: GET /orgs/$NBT_ORG/plans)
$sub = nbt_api('POST', "/orgs/$org/customers/$client/subscriptions", ['planId' => $planId])['id'];

// 3. the website, with its domain and PHP version (one the plan allows)
$site = nbt_api('POST', "/orgs/$client/websites", [
    'domain' => 'client-company.com', 'subscriptionId' => $sub, 'phpVersion' => 'php83',
])['id'];

// 4. the id of the primary domain (needed for email, DNS, SSL)
$domainId = nbt_api('GET', "/orgs/$client/websites/$site")['domain']['id'];

// 5. the mailbox (password: 10+ characters, upper and lower case, digits, symbols; quota in bytes)
nbt_api('POST', "/orgs/$client/websites/$site/domains/$domainId/emails", [
    'username' => 'contact', 'mailboxPassword' => getenv('MAIL_PASS'), 'quota' => 1073741824,
]);

echo "client=$client subscription=$sub website=$site domain=$domainId\n";

import { api } from './nbt-api.mjs';
const org = process.env.NBT_ORG;
const planId = Number(process.env.PLAN_ID);

// 1. the customer (a new organisation under yours) — keep the ids: repeating a POST creates another customer
const { id: client } = await api('POST', `/orgs/${org}/customers`, { name: 'Client Company Ltd' });

// 2. its subscription to one of your plans (PLAN_ID: GET /orgs/$NBT_ORG/plans)
const { id: sub } = await api('POST', `/orgs/${org}/customers/${client}/subscriptions`, { planId });

// 3. the website, with its domain and PHP version (one the plan allows)
const { id: site } = await api('POST', `/orgs/${client}/websites`, {
  domain: 'client-company.com', subscriptionId: sub, phpVersion: 'php83',
});

// 4. the id of the primary domain (needed for email, DNS, SSL)
const { domain } = await api('GET', `/orgs/${client}/websites/${site}`);

// 5. the mailbox (password: 10+ characters, upper and lower case, digits, symbols; quota in bytes)
await api('POST', `/orgs/${client}/websites/${site}/domains/${domain.id}/emails`, {
  username: 'contact', mailboxPassword: process.env.MAIL_PASS, quota: 1073741824,
});

console.log({ client, sub, site, domainId: domain.id });

curl -sS "$NBT_API/orgs/$CLIENT" -H "Authorization: Bearer $NBT_TOKEN"

# the customer's subscription
SUB=$(curl -sS "$NBT_API/orgs/$CLIENT/subscriptions" -H "Authorization: Bearer $NBT_TOKEN" | jq -r '.items[0].id')

# suspend (the customer's websites answer 404) / reactivate
curl -sS -X PATCH "$NBT_API/orgs/$CLIENT/subscriptions/$SUB" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' -d '{"isSuspended":true}'
curl -sS -X PATCH "$NBT_API/orgs/$CLIENT/subscriptions/$SUB" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' -d '{"isSuspended":false}' 

<?php
require __DIR__ . '/nbt-api.php';
$client = getenv('CLIENT');

// the customer's subscription
$sub = nbt_api('GET', "/orgs/$client/subscriptions")['items'][0]['id'];

// suspend (the customer's websites answer 404) / reactivate
nbt_api('PATCH', "/orgs/$client/subscriptions/$sub", ['isSuspended' => true]);
nbt_api('PATCH', "/orgs/$client/subscriptions/$sub", ['isSuspended' => false]);

import { api } from './nbt-api.mjs';
const client = process.env.CLIENT;

// the customer's subscription
const { items: [sub] } = await api('GET', `/orgs/${client}/subscriptions`);

// suspend (the customer's websites answer 404) / reactivate
await api('PATCH', `/orgs/${client}/subscriptions/${sub.id}`, { isSuspended: true });
await api('PATCH', `/orgs/${client}/subscriptions/${sub.id}`, { isSuspended: false });

curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE/backups" -H "Authorization: Bearer $NBT_TOKEN"   # which backups exist
curl -sS -X DELETE "$NBT_API/orgs/$CLIENT/websites/$SITE" -H "Authorization: Bearer $NBT_TOKEN"
curl -sS -X DELETE "$NBT_API/orgs/$CLIENT/subscriptions/$SUB" -H "Authorization: Bearer $NBT_TOKEN"
curl -sS -X DELETE "$NBT_API/orgs/$CLIENT" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS -X POST "$NBT_API/orgs/$NBT_ORG/plans" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"Business website",
       "resources":[{"name":"websites","total":1},{"name":"diskspace","total":5368709120},
                    {"name":"mailboxes","total":5},{"name":"mysqlDbs","total":2},
                    {"name":"subdomains","total":5},{"name":"domainAliases","total":2},{"name":"forwarders"},{"name":"transfer"}],
       "allowances":[{"name":"featureLetsEncrypt"},{"name":"backupsAllowAutomatic"},{"name":"featureDNSEditor"},{"name":"wptoolkit"}],
       "selections":[],
       "allowedPhpVersions":["php83","php84"],"defaultPhpVersion":"php83"}'

curl -sS "$NBT_API/orgs/$CLIENT/subscriptions" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS "$NBT_API/orgs/$CLIENT/websites?limit=20&offset=0&sortBy=domain" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites/$SITE/domains" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"domain":"blog.client-company.com","kind":"subdomain","documentRoot":"public_html/blog"}'

curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE/domains/$DOMAIN_ID/dns-zone" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites/$SITE/domains/$DOMAIN_ID/dns-zone/records" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"kind":"TXT","name":"@","value":"google-site-verification=…","ttl":3600}'

curl -sS -X POST "$NBT_API/v2/domains/$DOMAIN_ID/letsencrypt_preflight" -H "Authorization: Bearer $NBT_TOKEN"
curl -sS -X POST "$NBT_API/v2/domains/$DOMAIN_ID/letsencrypt" -H "Authorization: Bearer $NBT_TOKEN"
curl -sS -X PUT "$NBT_API/v2/domains/$DOMAIN_ID/ssl/force_ssl" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' -d 'true'
# the status, without the private key:
curl -sS "$NBT_API/v2/domains/$DOMAIN_ID/ssl" -H "Authorization: Bearer $NBT_TOKEN" | jq '{cn, issuer, expires, sans, forceHttps}'

ADDR=contact%40client-company.com
curl -sS -X PATCH "$NBT_API/orgs/$CLIENT/websites/$SITE/emails/$ADDR" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"mailboxPassword":"'"$NEW_PASSWORD"'","forwarders":["jane.doe@gmail.com"]}'

curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE/emails/$ADDR" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE/mysql-users" -H "Authorization: Bearer $NBT_TOKEN"

curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites/$SITE/backups?includeEmails=true" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' -d '{"description":"before update"}'

curl -sS -X PUT "$NBT_API/orgs/$CLIENT/websites/$SITE/backups/$BACKUP_ID" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"restoreFiles":true,"restoreAllEmails":true,"restoreDatabases":["client_1_shop"]}'

curl -sS -X POST "$NBT_API/orgs/$CLIENT/websites/$SITE/apps" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"app":"wordpress","path":"","adminUsername":"client-admin","adminPassword":"'"$WP_PASS"'","adminEmail":"jane@client-company.com"}'

curl -sS "$NBT_API/orgs/$CLIENT/websites/$SITE/apps/$APP/wordpress/info" -H "Authorization: Bearer $NBT_TOKEN"

# the customer's login, in your realm (orgId = the CUSTOMER organisation)
LOGIN=$(curl -sS -X POST "$NBT_API/logins?orgId=$CLIENT" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"email\":\"jane@client-company.com\",\"name\":\"Jane Doe\",\"password\":\"$LOGIN_PASS\"}" | jq -r .id)

# member with the Owner role in the customer organisation
MEMBER=$(curl -sS -X POST "$NBT_API/orgs/$CLIENT/members" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"loginId\":\"$LOGIN\",\"roles\":[\"Owner\"]}" | jq -r .id)

# one-time, short-lived login link on your panel domain
curl -sS "$NBT_API/orgs/$CLIENT/members/$MEMBER/sso" -H "Authorization: Bearer $NBT_TOKEN"

<?php
require __DIR__ . '/nbt-api.php';
$client = getenv('CLIENT');

// the customer's login, in your realm (orgId = the CUSTOMER organisation)
$login = nbt_api('POST', "/logins?orgId=$client", [
    'email' => 'jane@client-company.com', 'name' => 'Jane Doe', 'password' => getenv('LOGIN_PASS'),
])['id'];

// member with the Owner role in the customer organisation
$member = nbt_api('POST', "/orgs/$client/members", ['loginId' => $login, 'roles' => ['Owner']])['id'];

// one-time, short-lived login link on your panel domain
$link = nbt_api('GET', "/orgs/$client/members/$member/sso")['value'];
header('Location: ' . $link);

import { api } from './nbt-api.mjs';
const client = process.env.CLIENT;

// the customer's login, in your realm (orgId = the CUSTOMER organisation)
const { id: loginId } = await api('POST', `/logins?orgId=${client}`, {
  email: 'jane@client-company.com', name: 'Jane Doe', password: process.env.LOGIN_PASS,
});

// member with the Owner role in the customer organisation
const { id: member } = await api('POST', `/orgs/${client}/members`, { loginId, roles: ['Owner'] });

// one-time, short-lived login link on your panel domain
const link = await api('GET', `/orgs/${client}/members/${member}/sso`);
console.log(link);

curl -sS -X POST "$NBT_API/orgs/$CLIENT/invites" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' \
  -d '{"email":"jane@client-company.com","name":"Jane Doe","roles":["SuperAdmin"]}'

curl -sS -X POST "$NBT_API/orgs/$NBT_ORG/websites?kind=controlPanel" \
  -H "Authorization: Bearer $NBT_TOKEN" -H 'Content-Type: application/json' -d '{"domain":"panel.your-agency.com"}'

curl -sS -X PUT "$NBT_API/orgs/$NBT_ORG/branding/logo" -H "Authorization: Bearer $NBT_TOKEN" -F 'logo=@logo.svg'