VPS power operation (start/stop/restart/poweroff)
POST/services/:id/power/:action
Changes the power state of the reseller's VPS. The action URL parameter accepts
start, stop, restart or poweroff; any other value returns 404 from the
Slim route regex.
Idempotency-Key REQUIRED. If the header is missing, 400 missing_idempotency_key
is returned. Power actions must be processed idempotently for double-click protection;
the reseller module must generate a NEW UUID v4 ON EVERY CLICK.
The same key + same body replays the cached response for 24 hours
(with the X-Idempotent-Replay: true header).
Rate limit: services_changes bucket (120 req/min).
vps_id null: If the service is not yet linked to Virtualizor (tblcustomfieldsvalues
empty or undefined), 422 service_not_provisioned is returned (409 management_unavailable
for a management=basic service) and NO call is made to Virtualizor.
Request
Responses
- 200
- 400
- 401
- 403
- 422
- 429
- 502
Power action processed
Response Headers
The per-minute limit defined for this key
Number of requests remaining in the current window
Unix epoch of the start of the next window (UTC seconds)
true on a cache-hit replay. Not sent for fresh processing.
Idempotency-Key missing or invalid power action
Authentication failed — missing header, wrong credential, outside the IP whitelist, or a revoked key. No detail is leaked; all cases return a single message.
Response Headers
RFC 7617 Basic Auth challenge
Insufficient authorization — the reseller tried to access another reseller's service_id, or has insufficient scope for an endpoint requiring admin scope. The message is kept generic (ServiceOwnershipMiddleware prevents leakage).
VPS not yet provisioned (vps_id custom field empty)
Per-minute limit exceeded
Response Headers
Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)
The per-minute limit defined for this key
Unix epoch of the start of the next window (UTC seconds)
Virtualizor upstream error