Maskot beruang kutub NordBastion duduk di workstation kendali misi taktis dengan monitor terminal holografik melayang yang menampilkan kode sian, keyboard mekanikal dengan keycap bercahaya sian dan perisai N-sian bersandar di sampingnya, di dalam ruang konsol batu Nordik terbuka dengan jendela berlatar aurora

API.v1 · REST · 70+ endpoint · 5 SDK

Jalankan NordBastion dari kode.
Bebas KYC, berbayar kripto, dapat di-script sepenuhnya.

Sediakan server, ambil snapshot, isi saldo dalam cryptocurrency, jalankan ping dari benteng mana pun. Setiap tindakan panel memiliki endpoint REST dan empat SDK. Lantai identitas yang sama dengan panel: email dan kata sandi, tidak lebih.

Mulai cepat Semua endpoint

Versi: v1
Endpoint: 70+
SDK: 4 + CLI
Bastion: 4 Nordic
Batas laju: 1000/min read
KYC: Tidak ada

Mulai cepat

Tiga langkah dari akun yang terdaftar ke server yang berjalan dalam kode.

01 Create an account

POST /v1/auth/register

Email + password, no KYC. Returns a 24-hour access token straight away — no email confirmation step.

curl -sS https://nordbastion.com/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"••••••••••••"}'

02 Isi ulang dalam kripto

POST /v1/billing/topups

Open a per-coin invoice. The response carries a deposit address, QR code and expiry timestamp.

amount_usd harus antara $30 dan $10,000 (diberlakukan oleh server). Nilai lebih rendah mengembalikan HTTP 422 amount_too_low, nilai lebih tinggi mengembalikan amount_too_high.

curl -sS https://nordbastion.com/v1/billing/topups \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"amount_usd":50,"coin":"xmr"}'

03 Sediakan server

POST /v1/servers

Pick a tier (service_code), a bastion and an image. Server is booted with SSH in about ninety seconds.

curl -sS https://nordbastion.com/v1/servers \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"service_code":"NB-V3","bastion":"STO","image":"debian-12"}'

SDK & CLI

Empat bahasa, satu biner.

Setiap SDK berlisensi MIT, tersedia sumbernya, semver-stabil dari v1.0. Semua berbagi antarmuka klien terautentikasi yang sama — daftar server, dalam bahasa apa pun.

Planned for v1.1

These SDKs are planned for v1.1. The REST API at /v1/* is fully usable from any HTTP client today — see the agents page for cURL and MCP examples.

Python

pip

pip install nordbastion

from nordbastion import Client
nb = Client(api_key="nb_live_••••")

for s in nb.servers.list():
    print(s.id, s.name, s.status)

TypeScript

npm

npm i @nordbastion/api

import { NordBastion } from '@nordbastion/api';
const nb = new NordBastion({ apiKey: 'nb_live_••••' });

const servers = await nb.servers.list();
servers.forEach(s => console.log(s.id, s.name, s.status));

Go

go install

go get go.nordbastion.com/api

import nb "go.nordbastion.com/api"

c := nb.New(nb.WithAPIKey("nb_live_••••"))
servers, _ := c.Servers.List(ctx)
for _, s := range servers {
    fmt.Println(s.ID, s.Name, s.Status)
}

Rust

cargo

cargo add nordbastion

use nordbastion::Client;
let nb = Client::builder()
    .api_key("nb_live_••••").build()?;

for s in nb.servers().list().await? {
    println!("{} {} {}", s.id, s.name, s.status);
}

CLI · nb

Planned for v1.1

curl -sSL https://get.nordbastion.com | sh

nb auth login --api-key nb_live_••••
nb servers list
nb servers create --tier NB-V3 --bastion STO
nb servers snap NB-srv-1234 --name pre-upgrade

Mengutamakan Curl

REST API berfungsi dengan klien HTTP mana pun. Isi permintaan dan respons JSON, bearer JWT atau kunci API bercakupan, payload webhook bertanda tangan. Tanpa penguncian SDK.

curl -H "Authorization: Bearer nb_live_••••" https://nordbastion.com/v1/servers

Referensi endpoint

70+ endpoint di dua belas grup sumber daya.

Authentication · 14 endpoints

POST	/v1/auth/register LIVE	Create a NordBastion account from email + password (no KYC).
POST	/v1/auth/login LIVE	Exchange email + password for a bearer token. Returns 24-hour JWT.
POST	/v1/auth/login/totp LIVE	Second step when the account has TOTP 2FA enabled.
POST	/v1/auth/token/refresh LIVE	Rotate a bearer token without re-entering credentials.
POST	/v1/auth/recover LIVE	Initiate account recovery (PGP-based, stubbed in v1.0).
GET	/v1/auth/sessions LIVE	List active sessions for the current account.
DELETE	/v1/auth/sessions/{token_id} LIVE	Revoke a session by token ID (logout-everywhere).
POST	/v1/auth/totp/setup LIVE	Begin TOTP enrollment — returns the provisioning URI.
POST	/v1/auth/totp/enable LIVE	Confirm a TOTP code and enable 2FA.
POST	/v1/auth/totp/disable LIVE	Disable 2FA with a current TOTP code.
POST	/v1/auth/password LIVE	Change the account password.
POST	/v1/auth/api-keys LIVE	Create a scoped, long-lived API key (read · billing · servers · full).
GET	/v1/auth/api-keys LIVE	List API keys for the current account (last-used + scopes).
DELETE	/v1/auth/api-keys/{key_id} LIVE	Revoke an API key immediately.

Account · 5 endpoints

GET	/v1/account LIVE	Get the authenticated account (email, status, locale, 2FA state).
PATCH	/v1/account LIVE	Update email, password, locale, default bastion preference.
GET	/v1/account/balance LIVE	Current prepaid balance in USD.
GET	/v1/account/usage LIVE	Trailing-30-day API usage totals.
GET	/v1/account/audit-log LIVE	Recent authenticated requests for this account.

Billing & crypto top-ups · 8 endpoints

POST	/v1/billing/topups LIVE	Create a top-up intent. Returns a per-coin address + QR + expiry.
GET	/v1/billing/topups LIVE	List pending and confirmed crypto top-ups.
GET	/v1/billing/topups/{order_number} LIVE	Status of a single top-up (confirmations, settle status).
POST	/v1/billing/topups/{order_number}/cancel LIVE	Cancel a still-open top-up.
GET	/v1/billing/bonus-tiers LIVE	Public top-up bonus tier ladder.
GET	/v1/billing/coins LIVE	12 supported cryptocurrencies + current settle threshold per coin.
GET	/v1/billing/invoices PLANNED	List invoices (monthly statements).	roadmap
GET	/v1/billing/invoices/{id} PLANNED	Single invoice. Format: JSON · PDF · PGP-signed PDF.	roadmap

Catalogue · 7 endpoints

GET	/v1/catalog LIVE	Bundle of all catalog resources in one call.
GET	/v1/catalog/vps LIVE	Five VPS tiers — Sentinel · Garrison · Ravelin · Bulwark · Citadel.
GET	/v1/catalog/dedicated LIVE	Five dedicated tiers — Bastion-Lite to Bastion-Hyperion.
GET	/v1/catalog/bastions LIVE	Four Nordic bastions — STO · HEL · OSL · RKV with live status.
GET	/v1/catalog/images LIVE	Default OS images — Debian · Ubuntu · Alpine · Arch · FreeBSD · Win.
GET	/v1/catalog/{code} LIVE	Lookup a single tier by service_code.
GET	/v1/catalog/iso PLANNED	Library of bootable ISO images for custom installs.	roadmap

Servers · 14 endpoints

POST	/v1/servers LIVE	Provision a new VPS or dedicated server. Returns 202 + order_number.
GET	/v1/servers LIVE	List servers — supports filter, sort, paginate, field selection.
GET	/v1/servers/{order_number} LIVE	Single server with full configuration + current status.
PATCH	/v1/servers/{order_number} LIVE	Mutate a server (hostname only in v1.0).
DELETE	/v1/servers/{order_number} LIVE	Cancel / decommission a server. Pro-rated credit returned.
POST	/v1/servers/{id}/power PLANNED	Start · stop · restart · poweroff · acpi-shutdown.	roadmap
POST	/v1/servers/{id}/reinstall PLANNED	Reinstall OS from any catalogue image or custom template.	roadmap
POST	/v1/servers/{id}/rescue PLANNED	Reboot into rescue mode (Alpine ramdisk · 1 hour timeout).	roadmap
POST	/v1/servers/{id}/resize PLANNED	Move a VPS up or down between tiers. Applies on next reboot.	roadmap
POST	/v1/servers/{id}/migrate PLANNED	Redeploy a snapshot to another bastion. Pin to STO · HEL · OSL · RKV.	roadmap
POST	/v1/servers/{id}/password-reset PLANNED	Reset root password. Returned once, never stored.	roadmap
GET	/v1/servers/{id}/metrics PLANNED	Per-minute CPU · RAM · disk · network for the last 90 days.	roadmap
GET	/v1/servers/{id}/console PLANNED	One-time URL to the web VNC/SPICE console (expires 5 min).	roadmap
GET	/v1/servers/{id}/serial PLANNED	One-time URL to the web serial console (expires 5 min).	roadmap

Snapshots · 5 endpoints

POST	/v1/servers/{id}/snapshots PLANNED	Create a live or quiesced snapshot (off-host, encrypted).	roadmap
GET	/v1/servers/{id}/snapshots PLANNED	List snapshots for a server (size, age, source).	roadmap
POST	/v1/servers/{id}/snapshots/{snapId}/restore PLANNED	Restore in place — server reboots into the snapshot.	roadmap
DELETE	/v1/servers/{id}/snapshots/{snapId} PLANNED	Delete a snapshot.	roadmap
POST	/v1/servers/{id}/snapshots/{snapId}/export PLANNED	Export a snapshot as a .qcow2 download. PGP-signed manifest.	roadmap

SSH keys · 4 endpoints

POST	/v1/ssh-keys LIVE	Register a new SSH public key. SHA-256 fingerprint indexed.
GET	/v1/ssh-keys LIVE	List SSH keys on the account.
GET	/v1/ssh-keys/{id} LIVE	A single SSH public key.
DELETE	/v1/ssh-keys/{id} LIVE	Remove a key (does not change any existing server's installed keys).

Networking · 8 endpoints

GET	/v1/networking/ips PLANNED	List IPv4 + IPv6 addresses assigned to your servers.	roadmap
POST	/v1/networking/ips/floating PLANNED	Request additional IPv4 or a /64 IPv6 block. Bastion-scoped.	roadmap
POST	/v1/networking/rdns PLANNED	Set reverse-DNS PTR. IPv4 + IPv6 supported.	roadmap
POST	/v1/networking/firewall PLANNED	Create or replace a firewall ruleset for one or more servers.	roadmap
GET	/v1/networking/firewall PLANNED	List firewall rulesets and their bindings.	roadmap
POST	/v1/networking/private-network PLANNED	Create a VPC-style private network between your own servers.	roadmap
POST	/v1/networking/byoip PLANNED	Announce your own /24 (IPv4) or /48 (IPv6). RPKI-verified.	roadmap
POST	/v1/networking/lookingglass PLANNED	Run ping · traceroute · MTR from any of the four bastions.	roadmap

Storage · 5 endpoints

POST	/v1/storage/volumes PLANNED	Provision an additional NVMe volume — 10 GB to 16 TB, bastion-scoped.	roadmap
GET	/v1/storage/volumes PLANNED	List volumes on the account.	roadmap
POST	/v1/storage/volumes/{id}/attach PLANNED	Attach a volume to a running or stopped server.	roadmap
POST	/v1/storage/volumes/{id}/detach PLANNED	Detach a volume (requires the server to be stopped).	roadmap
POST	/v1/storage/volumes/{id}/resize PLANNED	Grow a volume. Shrink not supported.	roadmap

Images & templates · 3 endpoints

POST	/v1/images/iso/upload PLANNED	Upload a custom .iso (≤ 4 GB) bootable from any server's rescue path.	roadmap
POST	/v1/images/templates PLANNED	Register a custom OS template from an existing snapshot.	roadmap
GET	/v1/images/templates PLANNED	List your custom templates.	roadmap

Webhooks · 4 endpoints

POST	/v1/webhooks LIVE	Subscribe a URL to one or more event types. HMAC-signed payloads.
GET	/v1/webhooks LIVE	List webhook subscriptions on the account.
DELETE	/v1/webhooks/{id} LIVE	Remove a webhook subscription.
POST	/v1/webhooks/{id}/test LIVE	Send a synthetic test event to a webhook URL.

Transparency · 4 endpoints

GET	/v1/transparency/canary LIVE	Current warrant canary, PGP-signed payload. Same content as /warrant-canary/.
GET	/v1/transparency/peering LIVE	AS213232 peering announcements + current prefix list.
GET	/v1/transparency/status LIVE	Live operational status of every bastion + shared services.
GET	/v1/transparency/incidents PLANNED	Operational incidents (last 12 months, rolling).	roadmap

Agents directory · 2 endpoints

GET	/v1/agents/directory LIVE	Public listing of agents using NordBastion.
POST	/v1/agents/directory LIVE	Submit this account's agent for the public directory.

OAuth 2.1 / DCR · 4 endpoints

POST	/v1/oauth/register LIVE	RFC 7591 Dynamic Client Registration.
POST	/v1/oauth/token LIVE	Token endpoint — client_credentials, password, refresh_token.
POST	/v1/oauth/revoke LIVE	Revoke an access or refresh token.
GET	/v1/oauth/introspect LIVE	Introspect a token (RFC 7662, basic info only).

Semua endpoint mengikuti JSON masuk / JSON keluar, paginasi dengan ?page= & ?per_page=, penyaringan dengan ?filter[field]= dan pemilihan kolom dengan ?fields=. Setiap permintaan dapat membawa header Idempotency-Key.

Autentikasi

Tiga jenis kredensial, dua mode privasi.

Token Bearer LIVE

Email + kata sandi · JWT · kedaluwarsa 24 jam

JWT berumur pendek yang diterbitkan oleh POST /v1/auth/login. Membawa klaim cakupan dan ID pencabutan sesi. Dapat diperbarui selama 30 hari melalui /v1/auth/token/refresh.

Authorization: Bearer eyJhbGciOi••••

Kunci API bercakupan LIVE

Berumur panjang · bercakupan · dapat dicabut

Cakupan: read-only, billing-read, billing-write, servers-read, servers-write, full. Daftar izin IP opsional (CIDR), kedaluwarsa opsional. Direkomendasikan untuk skrip CI dan infrastruktur.

Authorization: Bearer nb_live_3f9c2a••••

TLS Mutual Planned v1.1

Sertifikat klien · enterprise / kepatuhan

Sematkan sertifikat klien mTLS ke kunci API. Permintaan yang menyajikan sertifikat klien yang salah ditolak di lapisan TLS sebelum logika aplikasi mana pun berjalan. Tersedia berdasarkan permintaan melalui panel.

curl --cert client.pem --key client.key https://nordbastion.com/v1/servers

Respons yang ditandatangani PGP Planned v1.1

Tanda tangan terpisah opt-in · dapat diverifikasi secara offline

Atur X-NB-Sign: 1 pada permintaan apa pun. Isi respons dibungkus dalam tanda tangan PGP cleartext terpisah menggunakan kunci NordBastion (sidik jari di /pgp/). Digunakan oleh pipeline kepatuhan yang tidak hanya mengandalkan rantai TLS.

curl -H "X-NB-Sign: 1" -H "Authorization: Bearer ..." https://nordbastion.com/v1/transparency/canary

NordBastion tidak mengumpulkan identitas saat mendaftar, dan API tidak mengubah lantai itu. Tidak ada webhook verifikasi SMS, tidak ada alur konfirmasi email, tidak ada endpoint unggah dokumen identitas. API mengekspos uang, mesin, dan metadata — itulah seluruh luas permukaannya.

Batas-batas laju

Per kunci, diterbitkan per menit

Endpoint baca: 1000 / min
Endpoint tulis: 100 / min
Sensitif autentikasi: 10 / min
Percobaan ulang 429: Retry-After

Setiap respons membawa X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Tingkat lebih tinggi tersedia berdasarkan permintaan dari panel.

Penerapan versi

Batas bawah depresiasi dua belas bulan

Endpoint diberi versi URL di bawah /v1/. Perubahan yang merusak hanya dikirimkan dalam versi mayor baru. Versi mayor sebelumnya tetap didukung setidaknya dua belas bulan. Endpoint yang sudah usang membawa header respons Sunset dan Deprecation.

Sunset: Wed, 01 Jul 2027 00:00:00 GMT
Deprecation: true

Format kesalahan

Amplop stabil, kode yang dapat dibaca mesin

{
  "error": {
    "type":    "invalid_request",
    "code":    "invalid_bastion",
    "message": "Unknown bastion 'mxp'.",
    "request_id": "req_2VqK8e...",
    "doc_url": "https://nordbastion.com/api/#errors"
  }
}

Webhook

Event bertanda tangan, dicoba ulang dengan backoff.

Setiap muatan peristiwa ditandatangani HMAC dengan rahasia webhook Anda. Tiga percobaan ulang dengan backoff eksponensial selama satu jam, kemudian diabaikan. Pengiriman uji tersedia dari POST /v1/webhooks/{id}/test.

account.balance.low

Balance dropped below the configured threshold.

topup.created

Crypto top-up address generated, waiting for first confirmation.

topup.confirmed

Top-up settled on-chain. Balance credited.

topup.failed

Top-up address expired without confirmation.

invoice.issued

Monthly invoice issued. PDF + PGP-signed PDF available.

server.provisioning

Provisioning started — image being written.

server.provisioned

Server is booted and reachable on SSH.

server.power.on

Server powered on (manual or scheduled).

server.power.off

Server powered off (manual or scheduled).

server.reinstalled

OS reinstalled. Root password rotated.

server.resized

VPS tier changed. Applied on the next reboot.

server.migrated

Server moved to another bastion via snapshot redeploy.

server.deleted

Server terminated. Pro-rated credit returned.

snapshot.created

Snapshot completed and is downloadable.

snapshot.restored

Snapshot restored in place.

snapshot.deleted

Snapshot removed.

volume.attached

Block volume attached to a server.

volume.detached

Block volume detached.

firewall.changed

Firewall ruleset applied to one or more servers.

canary.updated

Warrant canary reaffirmed (first of every month).

incident.opened

Operational incident opened on a bastion or shared service.

incident.resolved

Operational incident closed.

peering.changed

AS213232 peering or prefix announcement updated.

Endpoint transparansi

Akses terprogram ke canary, log insiden, rekaman peering.

Sebagian besar API cloud mengekspos produk dan penagihan. NordBastion juga mengekspos permukaan transparansinya sendiri — secara terprogram. Canary warrant yang sama yang diterbitkan di /warrant-canary/ tersedia sebagai muatan JSON yang ditandatangani di /v1/transparency/canary. Riwayat insiden yang sama yang mendorong /status/ ada di /v1/transparency/incidents. Rekaman peering yang sama yang ada di /peering/ ada di /v1/transparency/peering. Pengumuman awalan AS213232 yang sama dapat dikueri secara real time.

Berlangganan webhook canary.updated dan Anda mendapatkan notifikasi push pada hari pertama setiap bulan — jika berhenti berjalan, kanari rusak, dan Anda tahu tanpa harus polling. Bangun peringatan sendiri, di infrastruktur Anda sendiri, dengan tanda tangan kriptografis yang dapat Anda verifikasi secara offline terhadap kunci PGP yang dipublikasikan.

Inilah bagian API yang tidak dimiliki cloud komersial mana pun, karena tidak ada cloud komersial yang memiliki doktrin untuk mendukungnya.

Contoh · GET /v1/transparency/canary

{
  "as_of": "2026-05-01T00:00:00Z",
  "statement": "NordBastion has received no...",
  "signature": "-----BEGIN PGP SIGNATURE-----...",
  "key_fingerprint": "B9BB 3413 6FDC C3DA 8356 50C8 1A32 1442 3855 B282",
  "next_reaffirmation": "2026-06-01T00:00:00Z"
}

Baca halaman kanari Baca laporan transparansi Kunci PGP

FAQ · API

Pertanyaan pengembang, dijawab.

Pertanyaan yang diajukan pengembang sebelum mempercayakan infrastruktur ke API host.

Apakah benar-benar ada API dan apakah itu bebas KYC?

Ya — setiap tindakan yang dapat Anda lakukan di panel kontrol memiliki padanan API saat ini atau di peta jalan yang dipublikasikan, dan API itu sendiri dibatasi oleh akun panel terautentikasi yang sama: email dan kata sandi. Tidak diperlukan verifikasi identitas untuk mendapatkan atau menggunakan kredensial API.

Bahasa pemrograman mana yang memiliki SDK resmi?

Empat SDK resmi dan satu CLI. Python (pip install nordbastion), TypeScript / Node (npm install @nordbastion/api), Go (go install go.nordbastion.com/cli/nb@latest), Rust (cargo add nordbastion) dan CLI lintas platform satu biner (nb) yang dapat dipasang melalui curl. Semua SDK berlisensi MIT dan tersedia sumbernya.

Bisakah saya mengisi saldo dari kode, dalam cryptocurrency?

Ya. POST /v1/billing/topups membuat niat isi ulang dan mengembalikan alamat tujuan per koin, kode QR, dan stempel waktu kedaluwarsa. Ketika jaringan mengkonfirmasi pembayaran, saldo prabayar Anda dikreditkan secara otomatis dan webhook topup.confirmed dinyalakan. Dua belas mata uang kripto didukung, terdaftar di /v1/billing/coins.

Apakah endpoint API dapat dijangkau melalui Tor?

Endpoint clearnet api.nordbastion.com ramah Tor saat ini tanpa batas laju kasus khusus atau pemblokiran anti-Tor. Cermin onion v3 dari permukaan API ada di peta jalan panel dan akan berbagi materi bersertifikat TLS yang sama melalui header respons Onion-Location saat diluncurkan.

Apa yang dimaksud dengan "respons bertanda tangan PGP"?

Anda dapat mengaktifkan kunci API Anda untuk isi respons bertanda tangan PGP. Setiap respons JSON dibungkus dalam tanda tangan PGP cleartext terpisah menggunakan kunci NordBastion (sidik jari di /pgp/). Pembungkus dapat diverifikasi secara offline dan berguna untuk kepatuhan dan attestasi sumber di lingkungan yang tidak hanya mengandalkan rantai TLS.

Bagaimana batas laju ditegakkan?

Per kunci API. Garis dasar yang diterbitkan adalah 1000 permintaan baca per menit dan 100 permintaan tulis per menit, ditambah 10 permintaan per menit pada endpoint yang sensitif terhadap autentikasi (login, reset kata sandi, pembuatan kunci). Setiap respons membawa header X-RateLimit-Limit, X-RateLimit-Remaining, dan X-RateLimit-Reset; respons 429 menyertakan header Retry-After. Akun pengembang yang terverifikasi dapat meminta tingkat lebih tinggi dari panel.

Bagaimana cara kerja versioning?

Endpoint diberi versi URL di bawah /v1/. Perubahan yang merusak hanya dikirimkan dalam versi mayor baru (/v2/, /v3/) dan versi mayor sebelumnya tetap didukung selama setidaknya dua belas bulan setelah yang berikutnya dirilis. Endpoint yang sudah usang membawa header Sunset dengan tanggal batas dan header Deprecation: true pada setiap respons.

Mengapa log audit bersifat opt-in?

Karena doktrin NordBastion menyatakan bahwa kami hanya mencatat apa yang diperlukan. Metrik permintaan operasional hidup selama jendela bergulir yang dibutuhkan pembatas laju kemudian kedaluwarsa; log audit per pelanggan dari tindakan API adalah data lebih banyak dari yang kami butuhkan untuk menjalankan platform, sehingga dinonaktifkan secara default. Pelanggan yang menginginkannya dapat mengaktifkan /v1/account/audit-log; setelah diaktifkan, ini mencakup panel + API secara setara dan dapat diekspor.

Siap untuk di-skrip

Dapatkan kunci API dari panel.

Persyaratan masuk yang sama: email dan kata sandi seperti panel. Tanpa pemeriksaan identitas. Bayar dengan kripto. Hidupkan server Stockholm, Helsinki, Oslo, atau Reykjavík dalam sekitar sembilan puluh detik.

Dapatkan kunci API Lihat katalog VPS Baca doktrin

URL dasar · https://nordbastion.com/v1/ · Status · status operasional langsung · Looking glass · jalankan ping/MTR langsung