Short-lived (60s) NoVNC connection info
POST/services/:id/vnc-token
Used to connect directly from the browser to the wss://{host}:{port}/{websockify_path} URL
(port = Virtualizor enduser novnc proxy port, e.g. 4083; NOT the RAW VNC/RFB port).
The API NEVER PROXIES this websocket stream — it only returns connection details
(host/port/password/expires_at).
Idempotency-Key NOT ACCEPTED. Even if the header is sent it is IGNORED (IdempotencyMiddleware is not attached to the route). Reason: every call generates a NEW password in Virtualizor; a cached old password expires after 60s and the reseller would get an "invalid password" error.
Rate limit: Default bucket (60 req/min) — not high-frequency.
vps_id null: 422 service_not_provisioned.
management=basic: 409 management_unavailable.
Response:
expires_at: UTC ISO8601 computed by the server (now + 60s)ttl_seconds: 60 (fixed, easy for the client to parse)password: short-lived NoVNC password (LogMasker masks thevnc_passwordfield)host/port/websockify_path: node details the reseller's browser connects to
Request
Responses
- 200
- 401
- 403
- 422
- 429
- 502
VNC connection info (valid for 60s)
Response Headers
The per-minute limit defined for this key
Number of requests remaining in the current window
Unix epoch of the start of the next window (UTC seconds)
Authentication failed — missing header, wrong credential, outside the IP whitelist, or a revoked key. No detail is leaked; all cases return a single message.
Response Headers
RFC 7617 Basic Auth challenge
Insufficient authorization — the reseller tried to access another reseller's service_id, or has insufficient scope for an endpoint requiring admin scope. The message is kept generic (ServiceOwnershipMiddleware prevents leakage).
VPS not yet provisioned
Per-minute limit exceeded
Response Headers
Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)
The per-minute limit defined for this key
Unix epoch of the start of the next window (UTC seconds)
Virtualizor upstream error