# sunucu.com

> Turkish-market cloud hosting and VPS platform. Deploy and manage cloud servers, web hosting, domains, billing, support tickets and webhooks programmatically via a scope-gated REST API.

sunucu.com lets customers run cloud servers (power, snapshot, reinstall), web hosting with custom domains, register and manage domains, pay from a prepaid wallet, open support tickets, and subscribe to signed webhook events — all automatable over a REST API authenticated with an API key.

## API

- Base URL: https://api.sunucu.com/v1
- Authentication: Bearer token — `Authorization: Bearer snc_…` (or the `X-API-Key` header). Mint keys in the dashboard under Account → API Keys.
- Format: JSON
- Current version: v1.6 (2026-06-03)

## Machine-Readable Resources

- OpenAPI 3.0.3 spec:       https://sunucu.com/openapi.json
- Plain-text Markdown docs: https://sunucu.com/docs.md
- Human docs page:          https://sunucu.com/developers

## Scopes

- account:read      — Read your account profile.
- servers:read      — List servers and read details, stats, and snapshots.
- servers:write     — Power actions, password reset, create/delete snapshots.
- servers:destroy   — Reinstall, revert a snapshot, or terminate (destructive; not in defaults).
- hosting:read      — List hosting accounts and read details.
- hosting:write     — Attach, verify, and remove a custom domain.
- domains:read      — List domains and read details.
- domains:write     — Update auto-renew, transfer lock, WHOIS privacy, nameservers.
- billing:read      — Read invoices, transactions, and wallet balance.
- tickets:read      — List tickets and read messages.
- tickets:write     — Open tickets, post replies, and close them.
- webhooks:read     — List webhook subscriptions and delivery history.
- webhooks:write    — Create, edit, delete webhooks; rotate secrets; redeliver.

## Endpoints

Account
- GET    /v1/account                                    — Returns the authenticated account profile. (account:read)

Servers
- GET    /v1/servers                                    — List every server on the account. (servers:read)
- GET    /v1/servers/:id                                — Server detail (backbone-scrubbed — no upstream provider, no provisioning logs). (servers:read)
- GET    /v1/servers/:id/stats                          — Live CPU / memory / network / disk usage. (servers:read)
- GET    /v1/servers/:id/snapshots                      — Disk snapshots (restore points) for the server. (servers:read)
- POST   /v1/servers/:id/power/:action                  — Power the server start, stop, or reboot. (servers:write)
- POST   /v1/servers/:id/snapshots                      — Take a disk snapshot. (servers:write)
- DELETE /v1/servers/:id/snapshots/:snapshotId          — Remove a snapshot (non-destructive to the live disk). (servers:write)
- POST   /v1/servers/:id/reinstall                      — DESTRUCTIVE — wipe the disk and rebuild from an OS template. (servers:destroy)
- POST   /v1/servers/:id/snapshots/:snapshotId/revert   — DESTRUCTIVE — roll the live disk back to a snapshot. (servers:destroy)
- DELETE /v1/servers/:id                                — DESTRUCTIVE — permanently terminate the server. (servers:destroy)

Hosting
- GET    /v1/hosting                                    — List web-hosting accounts. (hosting:read)
- GET    /v1/hosting/:id                                — Hosting account detail (connection info, backbone-scrubbed). (hosting:read)
- PUT    /v1/hosting/:id/custom-domain                  — Attach a custom domain to a hosting account. (hosting:write)
- POST   /v1/hosting/:id/custom-domain/verify           — Re-check DNS and attach the custom domain once it points to us. (hosting:write)
- DELETE /v1/hosting/:id/custom-domain                  — Detach the custom domain from the hosting account. (hosting:write)

Domains
- GET    /v1/domains                                    — List registered domains. (domains:read)
- GET    /v1/domains/:id                                — Domain detail. (domains:read)
- PATCH  /v1/domains/:id                                — Update auto-renew, transfer lock, WHOIS privacy, or nameservers. (domains:write)

Billing
- GET    /v1/billing/invoices                           — Paginated invoice list. (billing:read)
- GET    /v1/billing/invoices/:id                       — Single invoice with line items. (billing:read)
- GET    /v1/billing/wallet                             — Prepaid wallet balance and state. (billing:read)
- GET    /v1/billing/wallet/transactions                — Recent wallet transactions. (billing:read)

Support tickets
- GET    /v1/tickets                                    — List support tickets. (tickets:read)
- GET    /v1/tickets/:id                                — Ticket detail with the message thread. (tickets:read)
- POST   /v1/tickets                                    — Open a support ticket. (tickets:write)
- POST   /v1/tickets/:id/reply                          — Post a customer reply on a ticket. (tickets:write)
- POST   /v1/tickets/:id/close                          — Close the ticket. (tickets:write)

Webhooks
- GET    /v1/webhooks                                   — List webhook subscriptions. (webhooks:read)
- POST   /v1/webhooks                                   — Subscribe a URL to events. (webhooks:write)
- GET    /v1/webhooks/:id                               — Webhook subscription detail (secret masked). (webhooks:read)
- PATCH  /v1/webhooks/:id                               — Change url, events, description, or pause/resume (isActive). (webhooks:write)
- DELETE /v1/webhooks/:id                               — Delete a subscription. (webhooks:write)
- POST   /v1/webhooks/:id/rotate-secret                 — Issue a fresh signing secret (returned ONCE). (webhooks:write)
- GET    /v1/webhooks/:id/deliveries                    — Recent delivery attempts. (webhooks:read)
- POST   /v1/webhooks/:id/deliveries/:deliveryId/redeliver — Re-queue a past delivery for another attempt. (webhooks:write)

## Webhooks

Signed (HMAC-SHA256, header `X-Sunucu-Signature: t=<ts>,v1=<hex>` over `"<ts>." + body`). Events:
- server.created           — A server finished provisioning. Payload: serverId, status, label.
- server.power.changed     — A power action ran. Payload: serverId, action (start/stop/reboot).
- server.reinstalled       — A reinstall ran. Payload: serverId, os, osTemplate.
- server.terminated        — A server was terminated. Payload: serverId.
- server.suspended         — A server was suspended (e.g. expiry). Payload: serverId, reason.
- hosting.created          — A web-hosting account finished provisioning. Payload: hostingId, domain, status.
- invoice.created          — A new invoice was issued (any source — order, renewal, admin). Payload: invoiceId, invoiceNumber, status, totalUsdCents, currency.
- invoice.paid             — An invoice transitioned to paid (card, PayPal, crypto, or wallet). Payload: invoiceId, invoiceNumber, totalUsdCents, currency.
- wallet.deposit.received  — A wallet top-up was credited. Payload: amountUsdCents, gateway, transactionId.
- domain.registered        — A domain registration completed (post-payment). Payload: domainId, domain, periodYears, expiresAt.
- ticket.created           — A support ticket was opened. Payload: ticketId, ticketNumber, subject, status, priority.
- ticket.replied           — Support staff replied to your ticket. Payload: ticketId, ticketNumber, subject, status.