1. Getting started
my.host API
  • Getting started
    • Introduction
    • Base url
    • Authentication
    • Response codes
    • Changelog
  • Domains
    • Domains
      • DNS
        • Zone
          • Get DNS zonefile
          • Import DNS zonefile
        • Dynamic DNS
          • List Dynamic DNS credentials
          • Create Dynamic DNS credential
          • Delete Dynamic DNS credential
          • Reset Dynamic DNS password
        • Get DNS records
        • Update DNS records
        • Update single DNS record
        • Delete single DNS record
        • Add single DNS record
        • Get DNS history
      • List domains
      • Get domain
      • Update domain
      • Cancel domain
      • Cancel domain deletion
      • Get auth code
      • Retry registration or transfer
      • Resend owner verification
    • Contacts
      • List profiles
      • Get profile
      • Create profile
      • Update profile
      • Delete profile
      • Get profile
      • Update profile
    • Nameservers
      • List profiles
      • Get profile
      • Create profile
      • Update profile
      • Delete profile
    • DNS templates
      • List templates
      • Get template
      • Create template
      • Update template
      • Delete template
    • Availability
      • Check domain availability
      • Check availability of several domains
    • Order
      • Order domain
    • Extensions
      • List domain extensions
      • Get domain extension
  • Virtual Private Servers
    • Backups
      • List backups
      • Create backup
      • Restore backup
      • Delete backup
    • SSH keys
      • List SSH keys
      • Delete SSH key
      • Add SSH key
    • Firewall
      • Get VPS firewall
      • Update VPS firewall
    • VPC
      • Get VPS VPC
      • Create VPS VPC
      • Add VPC subnet
      • Attach VPC subnet
    • Order
      • List VPS products
      • Order VPS
    • Floating IPs
      • List floating IPs
      • Reserve floating IP
      • Attach floating IP
      • Detach floating IP
      • Delete floating IP
    • List VPS instances
      GET
    • VPS details
      GET
    • Update VPS
      PUT
    • Restart VPS
      POST
    • Enable or disable rescue mode
      PUT
    • Cancel VPS
      DELETE
    • Cancel VPS deletion
      PUT
    • List available OS images
      GET
    • Reinstall VPS
      POST
    • Start VPS
      POST
    • Stop VPS
      POST
    • Power off VPS
      POST
    • Reset VPS root password
      POST
    • Change VPS hostname
      PUT
    • Get VPS statistics
      GET
    • List VPS licenses
      GET
  • Certificates
    • List certificates
    • Get certificate
    • List certificate products
    • Order certificate
    • Generate CSR
    • Request certificate
  • Orders
    • List orders
    • Get order
    • Update order
  • Affiliate
    • Commissions
      • List affiliate commissions
      • Get affiliate commission
    • Payments
      • List affiliate payments
      • Get affiliate payment
  • Account
    • Profile
      • Get account profile
      • Update account profile
    • Payment methods
      • List payment methods
      • Update default payment method
    • Invoices
      • List invoices
      • Get invoice
      • Download invoice PDF
    • Users
      • List account users
      • Get account user
      • Create account user
      • Update account user
    • Tickets
      • List support tickets
      • Get support ticket
      • Create support ticket
      • Reply to support ticket
  • Tools
    • Get your IP and customer number
  1. Getting started

Changelog

Changes to the my.host API v2 that you can notice as an API user, newest first. Changes that need you to adapt your integration are marked Breaking.
Entries before November 2026 were reconstructed from our version history and are grouped by month. Small fixes are not listed one by one.

2026-11-13#

Changed#

GET /vps/products no longer lists a plan that is only available on request. POST /vps/order with that product id returns 400, the same response as for any other product that is not in that list.

2026-11-12#

Added#

Orders are processed at once. POST /vps/order, POST /domains/order and POST /certificates/order used to wait up to a minute for the next processing run.
?wait=<seconds> (at most 60) on those three endpoints: the answer then says what the order became, in the form of GET /orders/{order_id}. For a VPS that is its id, ipv4 and ipv6, usually within a few seconds. The VPS exists at that moment; its operating system installs in the next minutes, which task on GET /vps/{id} shows. Without wait nothing changes: you get order_id.
GET /orders/{order_id}:
completed on the order and on each service.
id on a service that was created; for a VPS also ipv4 and ipv6.
?wait=<seconds> answers as soon as the order has settled.
processing in the answer of POST /vps/order, POST /domains/order and POST /certificates/order: started when processing began at once, queued when the order is processed within a minute instead.
With ?wait, the answer also has waited_seconds and timed_out. timed_out: true means the wait ended while the order was still being processed; false with completed: false means processing ended without creating everything.
flavor on POST /vps/order: the flavor name of the product, such as vps-xs, instead of product_id. GET /vps/products shows the flavor of each product.

Changed#

Breaking: POST /vps/{id}/reset-password, POST /vps/{id}/reinstall and PUT /vps/{id}/rescue return 403 for a managed VPS. We manage the root account of a managed VPS; contact support if you need it reinstalled or need something done as root. Restoring a backup with PATCH /vps/{id}/backups still works.
GET /domains/{domain}: forwarder_enabled is true only while the domain has a URL redirect. A domain without hosting can now also have free e-mail forwarders, set up in the control panel; those alone leave forwarder_enabled at false.
PUT /domains/{domain} with forwarder.enabled: false removes only the URL redirect. The domain's e-mail forwarders keep working.
GET /orders/{order_id} keeps returning an order after it was processed, with status processed. Before, a processed order without errors answered 404.

Fixed#

?wait answered at once, with completed: false and nothing created, as soon as processing of the order had started. It now waits until everything is created or processing has ended.
GET /orders/{order_id} and ?wait reported a new VPS as not yet created, with completed: false, until the whole order was processed, which can take minutes. A VPS now shows completed: true with its id, ipv4 and ipv6 as soon as it exists, and ?wait answers at that moment.

2026-11-11#

Changed#

Breaking: POST, PATCH and PUT /domains/{domain}/dns accept only the record types A, AAAA, ALIAS, CAA, CNAME, DS, HTTPS, MX, NS, SRV, SSHFP, SVCB, TLSA and TXT, as the control panel does. Other types, such as LUA or SOA, get 400. An ALIAS value must be a hostname.
PUT /domains/{domain}/dns: a refused record stops the whole change. Before, the records before it were still written.
DNS record names are case-insensitive: Mail and mail.example.com. are the same name.
TXT: a quote inside a value is escaped (he said "hi" is stored as "he said \"hi\""). A value that GET returns turns back into the same record.
POST /domains/{domain}/resend-verification: at most once per 10 minutes per domain. Sooner gets 429 with Retry-After.
POST /domains/{domain}/retry-order: at most once per 5 minutes per domain (429 with Retry-After), and 409 while the order is being processed.

Fixed#

GET /domains/{domain}/dns answered 200 with data: null when the nameservers could not be reached. It now answers 400.
POST /domains/{domain}/dns with a name in other capitals than the stored one (Example.com.) replaced the values of the record set instead of adding one.
POST and PATCH /domains/{domain}/dns accepted root NS records when the name was given as @ or as the domain name.

Security#

An IPv6 subnet in the IP whitelist of a token or API key also let in addresses from neighbouring subnets.
Error messages no longer show file paths on our servers.
The request log and the activity overview record the address that connected. A client could set X-Forwarded-For to put another address there.

2026-11-10#

Added#

POST /domains/{domain}/dns: add one value to a record set next to the values it already has, for example a TXT record for a verification without touching the SPF record on the same name.
PATCH /domains/{domain}/dns: an optional old_value changes exactly that value in a set with more than one value.
Idempotency-Key header on POST /domains/order, POST /vps/order, POST /certificates/order and POST /vps/floating-ips: the same request with the same key within 24 hours returns the first answer instead of a second order.
A personal access token also works in the API-Key header, for clients that cannot send Authorization: Bearer, such as older versions of our WHMCS module. It has the same scopes and checks as a bearer token.
GET /domains/{domain}/dns/history: the changes to a domain's DNS records, with who made each change. Filters for action, record type and text; paginated.
Dynamic DNS credentials for routers, NAS devices and scripts that keep an A or AAAA record up to date over dyndns2:
GET /domains/{domain}/dns/dynamic lists the credentials.
POST /domains/{domain}/dns/dynamic creates one.
DELETE /domains/{domain}/dns/dynamic/{id} deletes one.
POST /domains/{domain}/dns/dynamic/{id}/reset-password gives one a new password.
POST /domains/availability: check up to 20 domains in one request.
POST /domains/{domain}/retry-order: process a stopped registration or transfer again, after you fixed the cause.
POST /domains/{domain}/resend-verification: send the domain owner's verification email again.
GET /vps/{id}/stats: CPU, RAM, network and disk usage of a VPS, per month.
GET /vps/{id}/licenses: the software licenses of a VPS.
DELETE /vps/{id}/backups/{key}: delete a manual backup.
Every response has an X-Request-Id header. Quote it when you contact support about a call.
Lists of domains, contacts, nameserver profiles, DNS templates, orders, SSH keys and floating IPs take page and limit, and return data.pagination. Without these parameters you still get the whole list.
OPTIONS on any endpoint answers with the methods it takes, and HEAD works wherever GET does.
A personal access token can be created without an expiry date, for integrations that run unattended. Such a token is revoked after 12 months without use; its user gets an e-mail 30 days before, and using the token again keeps it.

Changed#

PATCH /domains/{domain}/dns: a record without ttl keeps the TTL of its set (3600 for a new set).
Breaking: date-times are ISO 8601 with the time zone offset, for example 2026-11-10T09:43:00+01:00 instead of 2026-11-10 09:43:00. Dates without a time, such as renewal_date, stay YYYY-MM-DD.
Breaking: an HTTP method an endpoint does not take returns 405 Method Not Allowed with an Allow header. Some endpoints accepted any method before.
Breaking: rate limits per API key or token: 120 requests per minute, and 30 domain availability checks per minute. The single and the bulk check share those 30, and a bulk check counts once per domain. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Above a limit you get 429 with Retry-After. After 20 failed authentications within 10 minutes, the IP address gets 429 for a while.
The HTTP status code always equals the status field in the body.
Every error is JSON, including an unknown endpoint (404).
A malformed JSON body returns 400 Invalid JSON in request body. It used to read as a missing field.

Deprecated#

API keys: new API keys can no longer be created in the control panel. Existing keys keep working. To replace a key, create a personal access token and put it where the key was; a token also works in the API-Key header.

Fixed#

PATCH /domains/{domain}/dns: a TXT value sent with its quotes was stored with double quotes.

Security#

Passwords, auth codes, transfer codes and private keys are no longer stored in our request log.

2026-11-09#

Added#

Personal access tokens: create them in the control panel and send them as Authorization: Bearer mh_pat_….
A token only has the permissions (scopes) you choose, per area and level: view, change, order, or far-reaching changes.
A token always expires, at the latest after a year.
A token can be limited to IP addresses or subnets.
An activity overview for every API key and token in the control panel.

Changed#

Breaking: an API key belongs to the user who created it, and may do at most what that user may do in the control panel. A key created by a sub-user is limited to that sub-user's permissions. Keys created by the main user, or whose creator is unknown, keep full access.
A missing or invalid credential returns 401 with a WWW-Authenticate header (RFC 6750). A missing permission returns 403 and names the scope.

2026-11-04#

Changed#

GET /domains/extensions and GET /domains/extensions/{extension} return your own prices where a custom price is set.

2026-10#

Added#

Trustee service for extensions that require a local presence (currently .no). The availability check reports has_trustee_available and trustee_price; confirm the price on the order endpoint with trustee and accept_trustee_price.
POST /vps/order: the Copenhagen location.

Changed#

POST /domains/order: an account that cannot pay afterwards yet gets it automatically when it has paid invoices before, with a credit limit based on those invoices.
.ru and .tk are temporarily unavailable. The availability check reports them as unavailable.
POST /domains/order: you may need to accept a registry agreement in the control panel before ordering some extensions.

2026-09#

Added#

VPS SSH keys: GET, POST /vps/ssh-keys and DELETE /vps/ssh-keys/{id}.
GET /vps/products and POST /vps/order: order a VPS through the API, with a choice of location.
VPS firewall: GET, PUT /vps/{id}/firewall.
VPS private networks: GET, POST /vps/{id}/vpc, POST /vps/{id}/vpc/subnets and POST /vps/{id}/vpc/attachments.
Floating IP addresses:
GET, POST /vps/floating-ips list and order them.
POST /vps/floating-ips/{id}/attach and /detach move one between VPSes.
DELETE /vps/floating-ips/{id} cancels one.
POST /domains/order: for transfers, "nameserver": "retrieve" keeps the domain's current nameservers.

Changed#

Product names in VPS responses are in English.
The default VPS location is Rotterdam (nl-rtm01).
Messages say my.host instead of mijn.host, for example "DNS records not managed by my.host".
POST /domains/order: .be transfers (trade requests) are possible for domains already in your account.

2026-08#

Added#

SSL certificates:
GET /certificates, GET /certificates/{id} and GET /certificates/products list your certificates and the products.
POST /certificates/order orders a certificate.
POST /certificates/csr creates a CSR.
POST /certificates/{id}/request requests the certificate. With auto_setup_dns, the DNS validation record is published for you when the domain uses our nameservers.
GET, PUT /domains/{domain}/dns/zone: export and import the DNS zone as a BIND zone file.
VPS power and settings:
POST /vps/{id}/start, /stop, /poweroff and /reset-password.
PUT /vps/{id}/hostname changes the hostname.
GET /vps is paginated and shows whether a VPS is locked by a running task, and its task id.
GET /api/v2/ answers with a JSON message instead of an empty page.

2026-07#

Added#

The default-myhost nameserver profile.

Fixed#

PUT /domains/{domain} ignored the nameservers array.

2026-06#

Added#

GET /whoami: the IP address the API sees and your customer id.
Premium domains:
The availability check reports is_premium and premium_price.
Ordering a premium domain requires accept_premium_price.
GET /domains/{domain}: dnssec_ds for registries that work with DS records (.nu, .se).

Changed#

POST /domains/order checks whether the extension is supported.
Our own nameserver hostnames are refused in custom nameserver profiles. Use the default profiles instead.

2026-05#

Added#

DELETE /domains/{domain}/dns: delete a single DNS record.

Changed#

PATCH /domains/{domain}/dns changes only the record you send, instead of rewriting the whole zone.

2026-04#

Added#

Affiliate: GET /affiliate/commissions, GET /affiliate/commissions/{id}, GET /affiliate/payments and GET /affiliate/payments/{id}.
Account:
Profile: GET, PUT /account/profile.
Payment method: GET, PUT /account/paymethods.
Invoices: GET /account/invoices, GET /account/invoices/{invoice_nr} and GET /account/invoices/{invoice_nr}/pdf.
Users: GET, POST /account/users, and GET, PUT /account/users/{id}.
Tickets: GET, POST /account/tickets, GET /account/tickets/{ticket_number} and POST /account/tickets/{ticket_number}/reply.
GET /domains/extensions and GET /domains/extensions/{extension}: prices, features and requirements per extension.
PUT /domains/{domain}: "dnssec": {"enabled": false} removes DNSSEC.

Changed#

Breaking: dates are YYYY-MM-DD, for example renewal_date: "2030-01-01" instead of "01-01-2030".

2026-03#

Added#

VPS:
GET /vps, GET /vps/{id} and GET /vps/images list your VPSes and the available images.
PUT /vps/{id} sets reverse DNS.
POST /vps/{id}/restart and /reinstall restart or reinstall a VPS.
PUT /vps/{id}/rescue starts rescue mode.
DELETE /vps/{id} cancels a VPS and PUT /vps/{id}/cancel-delete undoes that.
VPS backups: GET, POST, PATCH /vps/{id}/backups list, create and restore.

Changed#

DNS templates no longer depend on the registrar and apply cleanly to new orders.

2026-01 and 2026-02#

Added#

DELETE /domains/dns-templates/{id}, DELETE /domains/contacts/{id} and DELETE /domains/nameservers/{alias}.
Orders: GET /orders, GET /orders/{order_id} and PUT /orders/{order_id} list, show and change open orders.

Changed#

POST /domains/order returns an error when an order for that domain already exists.
Nameservers of a suspended domain cannot be changed.

2025-08 to 2025-12#

Added#

DNS templates: GET, POST /domains/dns-templates, and GET, PUT /domains/dns-templates/{id}.
PUT /domains/{domain}/cancel-delete: undo the cancellation of a domain.
.be domains: cancelling, and updating the technical contact.
The default-webhost-company nameserver profile for resellers.
More domain statuses in GET /domains/{domain}.

Changed#

The nameserver profile alias default-mijnhost is reserved.

2025-06 and 2025-07#

Added#

GET /domains/nameservers/{alias} and GET /domains/contacts/{id}.
PUT /domains/contacts/{id}, and additional registry data when creating a contact.
PUT /domains/{domain}: is_locked sets the domain lock.
DNS: SVCB, HTTPS and ALIAS records.
GET /domains/{domain}: the status for a pending transfer.

Changed#

Breaking: nameserver profile fields are alias, hostname, ipv4 and updated (were name, name, ip and edited).
Breaking: contacts have firstname and lastname instead of name.

2024-05 to 2024-12#

Added#

API v2 with domains, contacts, nameserver profiles, DNS templates, availability and ordering.
DNS management: GET, PUT /domains/{domain}/dns, and PATCH for a single record.
GET /domains/{domain}/auth-code.
GET /domains?tags=…: filter domains by tag.
API keys with an expiry date and an IP whitelist.

Changed#

Breaking (June 2024): paths without a trailing slash, with contacts, nameserver profiles and DNS templates under /domains: /domains/contacts, /domains/nameservers and /domains/dns-templates. The domain to check goes in the URL: /domains/availability/{domain}.
The availability check counts against the hourly limit set on an API key.
Modified at 2026-11-13 09:40:29
Previous
Response codes
Next
Get DNS zonefile
Built with