TurtleGuard
Get protected
// docs · rest api

REST API

updated · 28 May 2026

English translation for convenience. The Russian text is the binding one.

The TurtleGuard API lives at https://turtleguard.cloud/api/v1. Requests and responses are JSON. Authentication is a bearer JWT in the Authorization header.

Authentication

Get a token with an email and password:

curl -X POST https://turtleguard.cloud/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@example.com","password":"…","captcha_token":"…"}'

The response carries access_token and refresh_token. Use the first one for further calls:

curl https://turtleguard.cloud/api/v1/auth/me \
  -H 'Authorization: Bearer <access_token>'

When the access token expires (about an hour by default), renew it with POST /auth/refresh and the refresh token.

Public endpoints

  • GET /api/v1/plans — the list of plans.
  • GET /api/v1/addons — the add-on catalogue (DNS proxy, CDN).
  • GET /api/v1/status — system state and recent incidents. This is what the status page reads.
  • POST /api/v1/auth/register, /auth/login, /auth/forgot-password, /auth/reset-password — sign-up and sign-in.
  • POST /api/v1/contact — the contact form on the site.

Customer endpoints (authentication required)

Account

  • GET /auth/me — the current user and the active subscription.
  • POST /auth/2fa/setup → /auth/2fa/enable → /auth/2fa/disable — one-time codes.
  • POST /auth/change-password.

Subscriptions and billing

  • GET /subscriptions — every subscription of the current user, with its domain.
  • POST /billing/order — order a service. With trial: true it creates a trial subscription without a charge (once per account).
  • POST /billing/top-up — top up the balance.

Add-ons

  • GET /subscriptions/{subId}/addons — purchased add-ons and entitlements.
  • POST /subscriptions/{subId}/addons {key, auto_renew} — switch one on. It charges monthly_price to the balance and answers HTTP 402 when there is not enough money.
  • DELETE /subscriptions/{subId}/addons/{key} — switch it off.

Domains

  • GET /domains — your domains with the inspection / CDN / DNS flags.
  • GET /domains/{id}/service — the domain, its subscription, entitlements and add-ons.
  • PATCH /domains/{id}/settings — settings. Answers HTTP 402 if you switch on something the plan does not include.
  • POST /domains/{id}/verify-dns — check whether the A record points at us.
  • GET /domains/{id}/dns-instructions — the setup instructions for this domain.

DNS manager

  • GET /domains/{id}/dns — the zone: name servers, mode, records.
  • POST /domains/{id}/dns/records {type, name, content, ttl, priority?, proxied?}
  • PATCH /domains/{id}/dns/records/{recordId} — update.
  • DELETE /domains/{id}/dns/records/{recordId} — delete.

The proxy flag: proxied: true works only for A / AAAA / CNAME and needs an entitlement (Standart and above, or the dns_proxy add-on). Without it the server answers HTTP 402.

Rules, subdomains, origins, redirects

  • GET/POST/DELETE /domains/{id}/rules — inspection rules.
  • GET/POST/DELETE /domains/{id}/subdomains
  • GET/POST/DELETE /domains/{id}/origins
  • GET/POST/DELETE /domains/{id}/redirects

Response codes

  • 200 — success with a body
  • 201 — created
  • 204 — success with no body (a delete, for example)
  • 400 — the body is not valid
  • 401 — not signed in, or the token has expired
  • 402 — the plan does not include this, or the balance is too low
  • 403 — not allowed for this role
  • 404 — not found
  • 429 — too many requests
  • 5xx — our fault

Rate limits

Anonymous calls: 60 per second per address. Authenticated: 600 per second per token. Going over answers 429 with a Retry-After header.

A machine-readable OpenAPI schema will be published at /api/v1/openapi.json once the endpoints settle.