# Inleed API

> The Inleed hosting control panel as an API: 401 documented REST endpoints and
> 206 MCP tools over the same surface.

## How agents should use the Inleed API

- Base URL: https://mcp.inleed.com/api/v1.
- Auth: `Authorization: Bearer inl_live_…`. Tokens are minted only in the client area UI
  (Menu → API access → Create token); there is no endpoint that creates one, and scopes are
  immutable for a token's lifetime.
- No token? https://mcp.inleed.com/api/public/v1 serves the product catalogue, domain pricing and availability
  with no auth at all, and https://mcp.inleed.com/public/mcp is the same surface as an MCP server.
- MCP endpoint: https://mcp.inleed.com/mcp. For clients that cannot send headers, the token may travel
  in the path as https://mcp.inleed.com/mcp/k/{token} — that URL is password-equivalent.
- Pagination is cursor-based. Pass `nextCursor` back as `cursor`; **stop when it is null**.
  `limit` defaults to 25; the maximum is per-endpoint (200 on most collections, lower on a few).
- Errors are RFC 7807 Problem Details with a stable `code`. Branch on `code`, never on `title`
  or `detail`. `recovery.action` and `recovery.hint` tell you what to do next.
- **Call `GET /resolve` before acting on a domain you did not get from `GET /services`.**
  Ownership is checked per account; a name that exists elsewhere on the platform is a miss.
- **Ask the account owner before any operation that costs money or cannot be undone.** Those
  return a confirmation link rather than executing, and a human approves it in the client area.
- Every money and confirmation-tier call takes an `attempt_key` in the body. Derive it from the
  intent, keep it stable across retries, and a timed-out retry will not buy the same thing twice.
- Append `.md` to any reference URL for its markdown, or send `Accept: text/markdown`.

## Start here

- [Getting started](https://api.inleed.com/docs/getting-started): auth in three steps, the first call, connecting an MCP client.
- [Authentication](https://api.inleed.com/docs/authentication): scopes, the money gate, the header-free fallback.
- [Conventions](https://api.inleed.com/docs/conventions): envelope, pagination, ids, money, dates, naming.
- [Errors](https://api.inleed.com/docs/errors): the Problem Details anatomy and the code table.
- [Rate limits](https://api.inleed.com/docs/rate-limits): 300 requests / 5 min, 60 write calls / hour.
- [Idempotency](https://api.inleed.com/docs/idempotency): attempt_key.
- [Confirmations](https://api.inleed.com/docs/confirmations): the tier that never executes on its own.

## Endpoint groups — federated, one file each

- [Meta & discovery (27)](https://api.inleed.com/reference/meta/llms.txt): Health, token identity, capabilities, and the /resolve disambiguator every other call leans on.
- [Account & access (21)](https://api.inleed.com/reference/account/llms.txt): Profile, preferences, guest access — who the account is and who may act on it.
- [Billing & invoices (24)](https://api.inleed.com/reference/billing/llms.txt): Invoices, PDFs, payment links, billing profiles and the prepaid balance.
- [Products & purchasing (12)](https://api.inleed.com/reference/products/llms.txt): The catalogue and TLD pricing an order is built from.
- [Services (18)](https://api.inleed.com/reference/services/llms.txt): Every subscription: status, renewal quotes, billing cycle, autorenew, cancellation.
- [Domains (45)](https://api.inleed.com/reference/domains/llms.txt): Registrar-side domain state: expiry, nameservers, contacts.
- [DNS zones & records (19)](https://api.inleed.com/reference/dns/llms.txt): Zones and records on our nameservers, plus a derived health check.
- [Web hosting account (24)](https://api.inleed.com/reference/hosting/llms.txt): The DirectAdmin account itself: usage, PHP, resources and single-use panel logins.
- [Email (41)](https://api.inleed.com/reference/email/llms.txt): Mailboxes, quotas, forwarders, autoresponders, vacation and delivery tracing.
- [Databases (17)](https://api.inleed.com/reference/databases/llms.txt): MySQL databases, users, sizes and single-use phpMyAdmin links.
- [FTP & SSH access (9)](https://api.inleed.com/reference/access/llms.txt): FTP accounts, SSH keys and shell access state.
- [SSL / TLS (11)](https://api.inleed.com/reference/ssl/llms.txt): Certificate status and Let’s Encrypt issuance.
- [PHP & runtime (6)](https://api.inleed.com/reference/php/llms.txt): Per-domain PHP version, handler and extensions.
- [Cron jobs (5)](https://api.inleed.com/reference/cron/llms.txt): Scheduled tasks on the hosting account.
- [File manager (12)](https://api.inleed.com/reference/files/llms.txt): Directory listings, disk usage by path, and archive operations.
- [Backups & restores (9)](https://api.inleed.com/reference/backups/llms.txt): Available restore points and the confirmation-tier restore flow.
- [Applications (42)](https://api.inleed.com/reference/applications/llms.txt): WordPress, Installatron and LiteSpeed cache management.
- [Security (12)](https://api.inleed.com/reference/security/llms.txt): IP blocks, malware findings and protected directories.
- [Logs & monitoring (9)](https://api.inleed.com/reference/logs/llms.txt): Error, access and email logs, and what is available to read.
- [VPS (9)](https://api.inleed.com/reference/vps/llms.txt): Power state, console, install media and server detail. Reinstall, resize, delete and snapshots are done in the client area.
- [Broadband (2)](https://api.inleed.com/reference/broadband/llms.txt): Fiber delivery lookup: which addresses we reach, and what the speed tiers cost there.
- [Other service types (8)](https://api.inleed.com/reference/other-services/llms.txt): VPN, storage, colocation and everything else on the account.
- [Migrations & onboarding (5)](https://api.inleed.com/reference/migrations/llms.txt): Inbound migration requests and their progress.
- [Diagnostics (9)](https://api.inleed.com/reference/diagnostics/llms.txt): Composite reads that answer a question instead of returning raw data.
- [Support (5)](https://api.inleed.com/reference/support/llms.txt): Tickets, replies and attachments.

## MCP tool groups

- [Orientation (22)](https://api.inleed.com/tools#catalogue): Where an agent starts when it has a name and no context.
- [Services & subscriptions (23)](https://api.inleed.com/tools#catalogue): Every subscription, and what it costs to keep.
- [Billing (17)](https://api.inleed.com/tools#catalogue): Invoices, the balance, and the one machine-safe way to move money — a link a human clicks.
- [Hosting account (10)](https://api.inleed.com/tools#catalogue): The DirectAdmin account: usage, PHP, and a single-use way in.
- [FTP & SSH access (3)](https://api.inleed.com/tools#catalogue): FTP accounts, SSH keys and the state of shell access.
- [PHP & runtime (3)](https://api.inleed.com/tools#catalogue): Per-domain PHP version, handler and extensions.
- [DNS (14)](https://api.inleed.com/tools#catalogue): Records on our nameservers, plus a health verdict rather than a raw dump.
- [Email (17)](https://api.inleed.com/tools#catalogue): Mailboxes, forwarders and a per-message delivery trace.
- [Databases (5)](https://api.inleed.com/tools#catalogue): MySQL databases, users and a single-use phpMyAdmin link.
- [File manager (9)](https://api.inleed.com/tools#catalogue): Listings, disk usage by path, and archive operations inside the account.
- [Applications (20)](https://api.inleed.com/tools#catalogue): WordPress, Installatron and LiteSpeed cache.
- [Security (3)](https://api.inleed.com/tools#catalogue): IP blocks, malware findings and protected directories.
- [SSL, backups, cron & logs (14)](https://api.inleed.com/tools#catalogue): Certificates, restore points, scheduled jobs and the logs that explain a failure.
- [VPS (9)](https://api.inleed.com/tools#catalogue): Power state, console, install media and server detail.
- [Domains (26)](https://api.inleed.com/tools#catalogue): Registrar-side domain state: expiry, nameservers, contacts, transfers.
- [Broadband (2)](https://api.inleed.com/tools#catalogue): Fibre delivery lookup: which addresses we reach, and what the tiers cost there.
- [Diagnostics (5)](https://api.inleed.com/tools#catalogue): One call that answers a question — disk, firewall, health.
- [Support & migrations (4)](https://api.inleed.com/tools#catalogue): Tickets, replies and inbound migrations.

## Error codes

- [invalid_request](https://api.inleed.com/errors/invalid_request): 400 — The request could not be understood
- [invalid_pagination_limit](https://api.inleed.com/errors/invalid_pagination_limit): 400 — Pagination limit out of range
- [unauthorized](https://api.inleed.com/errors/unauthorized): 401 — Missing or invalid API token
- [token_revoked](https://api.inleed.com/errors/token_revoked): 401 — This API token has been revoked
- [token_expired](https://api.inleed.com/errors/token_expired): 401 — This API token has expired
- [payment_required](https://api.inleed.com/errors/payment_required): 402 — Payment required
- [insufficient_scope](https://api.inleed.com/errors/insufficient_scope): 403 — This token does not have the required scope
- [readonly_scope](https://api.inleed.com/errors/readonly_scope): 403 — This token is read-only
- [not_owned](https://api.inleed.com/errors/not_owned): 403 — Not owned by this account
- [domain_not_owned](https://api.inleed.com/errors/domain_not_owned): 403 — Domain not owned by this account
- [node_not_allowed](https://api.inleed.com/errors/node_not_allowed): 403 — That hosting node is not permitted
- [ip_not_allowed](https://api.inleed.com/errors/ip_not_allowed): 403 — This token may not be used from this IP address
- [origin_not_allowed](https://api.inleed.com/errors/origin_not_allowed): 403 — Requests from this origin are not accepted
- [suspended](https://api.inleed.com/errors/suspended): 403 — This service is suspended
- [access_blocked](https://api.inleed.com/errors/access_blocked): 403 — This request could not be completed
- [not_found](https://api.inleed.com/errors/not_found): 404 — Not found
- [service_not_found](https://api.inleed.com/errors/service_not_found): 404 — Service not found
- [invoice_not_found](https://api.inleed.com/errors/invoice_not_found): 404 — Invoice not found
- [record_not_found](https://api.inleed.com/errors/record_not_found): 404 — DNS record not found
- [mailbox_not_found](https://api.inleed.com/errors/mailbox_not_found): 404 — Mailbox not found
- [database_not_found](https://api.inleed.com/errors/database_not_found): 404 — Database not found
- [job_not_found](https://api.inleed.com/errors/job_not_found): 404 — Job not found
- [pending_action_not_found](https://api.inleed.com/errors/pending_action_not_found): 404 — Pending action not found
- [method_not_allowed](https://api.inleed.com/errors/method_not_allowed): 405 — Method not allowed on this resource
- [conflict](https://api.inleed.com/errors/conflict): 409 — The request conflicts with the current state
- [hosting_not_ready](https://api.inleed.com/errors/hosting_not_ready): 409 — The hosting account is not ready yet
- [attempt_replayed](https://api.inleed.com/errors/attempt_replayed): 409 — This attempt key has already been used
- [quota_exceeded](https://api.inleed.com/errors/quota_exceeded): 409 — Quota exceeded
- [confirmation_expired](https://api.inleed.com/errors/confirmation_expired): 410 — The confirmation window has closed
- [validation_failed](https://api.inleed.com/errors/validation_failed): 422 — The request failed validation
- [password_too_weak](https://api.inleed.com/errors/password_too_weak): 422 — The password does not meet the policy
- [job_not_allowed](https://api.inleed.com/errors/job_not_allowed): 422 — That background job is not on the allow-list
- [rate_limited](https://api.inleed.com/errors/rate_limited): 429 — Too many requests
- [confirmation_required](https://api.inleed.com/errors/confirmation_required): 202 — A human must confirm this action
- [internal_error](https://api.inleed.com/errors/internal_error): 500 — Something went wrong on our side
- [capability_missing](https://api.inleed.com/errors/capability_missing): 501 — This node does not support that operation
- [feature_not_available](https://api.inleed.com/errors/feature_not_available): 501 — That feature is not available on this account
- [upstream_error](https://api.inleed.com/errors/upstream_error): 502 — An upstream system returned an error
- [client_area_error](https://api.inleed.com/errors/client_area_error): 502 — The Inleed client area returned an error
- [da_error](https://api.inleed.com/errors/da_error): 502 — DirectAdmin returned an error
- [node_error](https://api.inleed.com/errors/node_error): 502 — The hosting node could not be reached
- [circuit_open](https://api.inleed.com/errors/circuit_open): 503 — That node is temporarily unavailable
- [upstream_timeout](https://api.inleed.com/errors/upstream_timeout): 504 — An upstream system timed out
- [shell_not_enabled](https://api.inleed.com/errors/shell_not_enabled): 409 — Shell access is not enabled for this account
- [shell_failed](https://api.inleed.com/errors/shell_failed): 502 — The command could not be run on the hosting server
- [command_blocked](https://api.inleed.com/errors/command_blocked): 422 — This command is not allowed on the shell

## Machine-readable

- [llms-full.txt](https://api.inleed.com/llms-full.txt): the whole corpus in one file.
- [openapi.json](https://api.inleed.com/openapi.json): OpenAPI 3.1, public and uncontested.
- [docs-search.json](https://api.inleed.com/docs-search.json): the search index behind the docs MCP tools.
- [console-index.json](https://api.inleed.com/console-index.json): every operation's method, path, scopes and
  request shape in ~130 KB — the slim alternative to openapi.json when you only need to find a call.
- [design-tokens.json](https://api.inleed.com/design-tokens.json): the design system, machine-readable.