Short-lived (60s) NoVNC connection info
POST/services/:id/vnc-token
Used to connect directly on the browser side to the wss://{host}:{port}/{websockify_path} URL (port = the Virtualizor enduser novnc proxy port, e.g. 4083; NOT the RAW VNC/RFB port). The API does NOT PROXY this websocket stream at all — it only returns connection info (host/port/password/expires_at).
Idempotency-Key NOT ACCEPTED. Even if the header is sent it is IGNORED (IdempotencyMiddleware is not bound to the route). Reason: every call generates a NEW password on Virtualizor; a cached old password expires after 60s and the reseller would get a "password invalid" error.
Rate limit: Default bucket (60 req/min) — not high-frequency.
vps_id null: 422 service_not_provisioned.
Response:
expires_at: the UTC ISO8601 computed by the server (now + 60s)ttl_seconds: 60 (fixed, so the client parses it easily)password: the short-lived NoVNC password (LogMasker masks thevnc_passwordfield)host/port/websockify_path: the node info the reseller browser will connect to
Request
Responses
- 200
- 401
- 403
- 422
- 429
- 502
VNC connection info (valid for 60s)
Response Headers
The per-minute limit defined for this key
Number of requests remaining in the current window
Unix epoch of the start of the next window (UTC seconds)
Authentication failed — missing header, wrong credential, outside the IP whitelist, or a revoked key. No detail is leaked; all cases return a single message.
Response Headers
RFC 7617 Basic Auth challenge
Insufficient authorization — the reseller tried to access another reseller's service_id, or has insufficient scope for an endpoint requiring admin scope. The message is kept generic (ServiceOwnershipMiddleware prevents leakage).
VPS not yet provisioned
Per-minute limit exceeded
Response Headers
Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)
The per-minute limit defined for this key
Unix epoch of the start of the next window (UTC seconds)
Virtualizor upstream error