Corenzy API

Introduction

Every request is authenticated with an API key that you create in your dashboard. A key belongs to a single account and can only ever read or act on that account's own resources. All responses are JSON with a consistent envelope:

{
  "success": true,
  "status": 200,
  "data": { ... }
}

Authentication

Pass your key as a Bearer token. Never expose it in browser code - the API is meant for server-to-server use.

curl https://api.corenzy.com/api/v1/account \
  -H "Authorization: Bearer core_live_xxxxxxxxxxxxxxxx"

Keys are shown in full only once, at creation. Store the secret securely; if lost, revoke and create a new one. Optionally pin a key to specific source IPs for defense in depth.

Scopes

Each key is granted one or more scopes. A request to an endpoint whose scope your key lacks returns 403 insufficient_scope. Grant the minimum a given integration needs.

Rate limits

Each key is limited to 120 requests per minute. Every response includes:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118

Exceeding the limit returns 429 rate_limited. Order creation is additionally capped to protect against runaway provisioning.

Errors

Errors use standard HTTP status codes and a machine-readable error field.

{
  "success": false,
  "status": 403,
  "error": "insufficient_scope",
  "message": "This key is missing required scope(s): invoices:read"
}

Your account profile and balance.

curl https://api.corenzy.com/api/v1/account \
  -H "Authorization: Bearer core_live_..."

{
  "success": true,
  "data": {
    "id": "1234",
    "fullname": "Acme Hosting",
    "email": "[email protected]",
    "country": "TR",
    "currency": "TRY",
    "balance": { "credit": 240.00, "currency": "TRY" }
  }
}

All services on your account. Cached ~30s.

{
  "success": true,
  "data": [
    {
      "id": "912",
      "name": "VSR - 4 vCPU / 8 GB",
      "domain": "vps-912.host",
      "status": "Active",
      "billingcycle": "monthly",
      "recurringamount": "5600.00",
      "nextduedate": "2026-08-12",
      "dedicatedip": "45.10.x.x"
    }
  ]
}

One service, enriched with live VM power state and metrics when attached.

{
  "success": true,
  "data": {
    "id": "912",
    "status": "Active",
    "vm": { "id": "vm_abc", "powerState": "running", "node": "node-3" },
    "stats": { "cpu": "3%", "memory": "2.1/8 GB", "uptime": "6d" }
  }
}

Power action on the attached VM. action ∈ start · stop · reboot · restart · shutdown.

curl -X POST https://api.corenzy.com/api/v1/services/912/power \
  -H "Authorization: Bearer core_live_..." \
  -H "Content-Type: application/json" \
  -d '{"action":"reboot"}'

{ "success": true, "status": 202, "message": "Power action 'reboot' accepted." }

Issues a one-time URL that opens a live noVNC console for the attached VM in a browser tab or an <iframe>. The URL carries a signed token and expires 60 seconds after issue - request a fresh one each time you want to open a console, don't cache it.

curl -X POST https://api.corenzy.com/api/v1/services/912/console \
  -H "Authorization: Bearer core_live_..."

{
  "success": true,
  "status": 200,
  "data": {
    "serviceId": "912",
    "vmId": "vm_abc",
    "url": "https://api.corenzy.com/api/v1/vms/vm_abc/novnc?token=...",
    "expiresIn": 60
  }
}

Returns 409 vm_not_attached if the service has no VM provisioned yet, and 502 automation_error if the VM can't accept a console session right now (for example while it's powered off).

Your invoices. Optional ?status=Unpaid and ?limit=.

{
  "success": true,
  "data": [
    { "id": "168", "status": "Unpaid", "total": "5694.50", "currency": "TRY", "duedate": "2026-07-19" }
  ]
}

Full invoice with line items. Returns 404 if the invoice is not on your account.

{
  "success": true,
  "data": {
    "id": "168",
    "status": "Unpaid",
    "total": "5694.50",
    "items": [
      { "description": "VSR #9", "amount": "5600.00" },
      { "description": "cPanel #1", "amount": "135.00" }
    ]
  }
}

The orderable catalog with pricing - the pid values you pass to /orders.

{
  "success": true,
  "data": [
    { "pid": 33, "name": "VSR Spider", "type": "server", "pricing": { "TRY": { "monthly": "5600.00" } } }
  ]
}

Provision a new service under your account. Produces an unpaid invoice you settle from your balance - the API never auto-charges.

curl -X POST https://api.corenzy.com/api/v1/orders \
  -H "Authorization: Bearer core_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "productId": 33,
    "billingCycle": "monthly",
    "configOptions": { "12": 3 },
    "promoCode": "PARTNER10"
  }'

{
  "success": true,
  "status": 201,
  "data": { "orderId": 5521, "invoiceId": 169, "serviceIds": ["913"] }
}

MCP server (AI assistants)

Connect your own AI assistant to your own Corenzy account with the Model Context Protocol. The assistant can list your services, check status, read invoices and, when you allow it, start, stop or reboot a server. It uses your API key, so it can never see or touch anything outside your account.

URL        https://api.corenzy.com/mcp
Transport  Streamable HTTP (stateless)
Auth       Authorization: Bearer core_live_...

Claude Code:

claude mcp add --transport http corenzy https://api.corenzy.com/mcp \
  --header "Authorization: Bearer core_live_xxxxxxxxxxxxxxxx"

Cursor, VS Code and other clients that read an mcp.json file:

{
  "mcpServers": {
    "corenzy": {
      "url": "https://api.corenzy.com/mcp",
      "headers": { "Authorization": "Bearer core_live_xxxxxxxxxxxxxxxx" }
    }
  }
}

Claude Desktop connects through the mcp-remote bridge: npx mcp-remote https://api.corenzy.com/mcp --header "Authorization: Bearer core_live_...".

• Least privilege - create a dedicated key for your assistant. A read-only key (account:read, services:read, invoices:read) is enough for status and billing questions.
• Confirmation - every power action except start needs an explicit confirm flag, so a good assistant asks you before it interrupts a running server.
• No ordering - placing orders and spending money stays in the dashboard and the REST API. The MCP server cannot create orders.
• Limits - 60 tool calls per minute per key. If your key is pinned to source IPs, the connecting address must be on the list.
• Revoking - revoke the key in the dashboard and the assistant loses access immediately. Nothing is stored on the MCP server.

Authentication uses your API key in a request header. Connectors that only offer a sign-in button (OAuth) are not supported yet.

Reseller modules (WHMCS & WiseCP)

Ready-made provisioning modules let you resell Corenzy from your own billing panel. When your end-customer orders, the module calls this API with your reseller key and provisions a real upstream service automatically.

• WHMCS - drop-in server module. Maps CreateAccount → POST /orders, Suspend/Unsuspend → power stop/start, a client-area panel with power controls, and a "Console" client-area button that opens a live noVNC session via POST /services/:id/console.
• WiseCP - server module with the same lifecycle mapping, live status sync, and the same one-click console access.

Required key scopes for reseller modules: orders:create, services:read, services:manage. Contact support to request the module package for your panel.