Skip to content

Sites

OAuth scopes: reads require sites:read, writes require sites:write. A dunning-suspended site returns 402 service_suspended on its show/update/destroy and tool endpoints (list endpoints instead surface dunning_suspended: true).

Related site tooling lives on its own pages: CDN, Cache & Logs and Shield.

List Sites

If you omit the account ID header in this api call, it will return all sites available to your user. If you include the account ID header, it will only return sites for this account.

GET /api/sites

Returned Params
  • sites: Array
    • id: String
    • name: String
    • primary_domain: String
    • location: String (Geographic Region)
    • region: String (Availability Zone)
    • account: Object
      • id: String
      • name: String
    • package: String
    • dunning_suspended: Boolean
    • created_at
    • updated_at

View Site

GET /api/sites/:id

Returned Params
  • site: Object
    • id: String
    • name: String
    • primary_domain: String
    • location: String (Geographic Region)
    • region: String (Availability Zone)
    • package: String
    • php_version: String
    • domain_cname: String
    • sftp_base_path: String
    • ssh: Object
      • ipaddr: String
      • username: String
      • password: String
      • port: Integer
    • domains: Array
      • See domains api endpoint
    • subscription: Object
    • id: String
    • status: String
    • created_at: DateTime
    • updated_at: DateTime
    • price: Object
      • amount_cents: Integer
      • term: String
    • product: Object
      • id: String
      • name: String
    • account: Object
      • id: String
      • name: String
    • created_at
    • updated_at

Update Site / Resize

PATCH /api/sites/:id

Handles two intents:

  1. Rename (synchronous) — pass name. Returns 202 with an empty body.
  2. Plan change (cart-mediated, async) — pass plan (a Product short_name). The price difference is invoiced against the account's default payment method off-session, and the response is the shared cart envelope (see Orders / Carts) — poll the cart for completion. It does not return a task_id. Requires a single-site account and a default payment method on file; the billing term is preserved.

When both fields are present, the rename runs first; on rename validation failure the resize is skipped entirely and the response is 422.

Params
  • name: String | site rename
  • plan: String | Product short_name (e.g. "basic")
Returned Params (plan-change path, 202 Accepted)
  • status: String | "accepted"
  • cart: Object | { token, status, rollup_status, poll_url }
  • payment: Object | { status, method_type, hosted_invoice_url }
  • orders: Array | [{ id, status, poll_url }] (empty during the async window)
Errors (plan change)
  • 400 unknown_product | plan doesn't match any Product short_name
  • 400 product_unavailable | Product exists but not offered on the account's billing plan
  • 400 no_default_payment_method | billing account not ready to charge
  • 422 no_price_for_plan | no price matching the account's term
  • 422 multi_site_resize_unsupported | account has more than one active site
  • 422 subscription_not_proratable | subscription is missing Stripe metadata
  • 422 cart_pay_failed | the off-session charge could not be initiated
  • 422 billing_settling | the site's billing is still settling (a freshly created site's initial billing window)

billing_settling is 422, not 402

The billing-settle guard on a plan change (and on site delete) returns 422 billing_settling. This is distinct from dunning suspension, which returns 402 service_suspended (see the page header).

Restart a Site

Restart the WordPress container for a site. Does not affect other containers such as the database or redis. Returns 202.

POST /api/sites/:id/restart

curl -X POST -H "Authorization: Bearer $SUPERSPACE_TOKEN" -H "X-Auth-Account: $ACCOUNT_ID" \
  https://your-instance/api/sites/$SITE_ID/restart

Delete a Site

DELETE /api/sites/:id

Deletes the site asynchronously. Returns 200; blocked with 422 billing_settling while the site's billing is still settling (distinct from the 402 service_suspended dunning guard).

Removing a site may affect volume discounts on existing sites.

Site SSO

This is a hybrid endpoint. It supports logging in for all SSO operations on a site. Currently that is WordPress and phpMyAdmin (database).

Not available via OAuth — SSO requires a session or API-key credential. Without the wp_login role flag, you can only generate URLs for WordPress users the token's user is explicitly linked to; with wp_login, any user.

List All WP Users

This returns raw user details from the WordPress site. The associated ID is WordPress' internal ID, not a SuperSpace user.

GET /api/sites/:id/sso

Returned Params
  • users: Array
    • ID: Integer
    • user_login: String
    • display_name: String
    • user_email: String
    • user_registered: DateTime
    • roles: String
    • url: String

Login as User

POST /api/sites/:id/sso

Success returns 200 { "url": "..." }; failure returns 400.

Params
  • kind: String | wordpress (default) or database
  • username: String | required for wordpress; not used for database
Returned Params
  • url: String

Tasks

List all tasks for a given site.

GET /api/sites/{site-id}/tasks

GET /api/sites/{site-id}/tasks/{filter-name}/filter

Filter is optional, can be one of:

  • OK
  • PENDING
  • RUNNING
  • CANCELLED
  • PAUSED
  • FAILED
  • TODAY <-- Special filter to show all events from today.

All responses will be limited to the 100 most recent tasks.

Returned Params

Returns an array of objects:

  • id: Integer
  • name: String
  • data: String | Raw data from the event
  • labels: Object
  • status: String | OK, PENDING, RUNNING, CANCELLED, PAUSED, FAILED
  • start_on: Timestamp | When the task was started
  • end_on: Timestamp | Not consistently used, but may be when the task was completed.
  • created_at: Timestamp
  • updated_at: Timestamp
  • performed_by: Object
    • id: String | ID of the user who performed this action
    • name: String | Full name of the user
    • email: String

View a single site task

GET /api/sites/{site-id}/tasks/{id}

Returns a single task object (same fields as above). Unknown id returns 404 {"errors":["Unknown task"]}.

Metrics

Realtime Resources

This endpoint will return the realtime status for a site.

GET /api/sites/{site-id}/metrics/resources

Returned Params
  • total_storage: Decimal
  • {Image Name}: Object | i.e. "WordPress"
    • cpu: Decimal | Percentage of total plan
    • storage: Decimal | GB
    • memory: Decimal | MB

Raw Metrics

This is an advanced endpoint that shows raw container metrics for a given site. Due to the nature of the SuperSpace platform, new sites may return metric data created prior to the creation of your site. This is expected behavior, as the site may already exist waiting for a customer order.

Furthermore, it may return additional containers that the customer may not directly be able to interface with. For example, 'SuperSpace Lite' may not include redis, but you may still see a redis container in these results. This is also an expected behavior of our platform.

POST /api/sites/{site-id}/metrics/resources

kind can be one or more of:

  • cpu
  • cpu_throttled
  • memory
  • memory_throttled
  • storage
Params
  • kind: Array | ['storage', 'memory'] (example)
  • period_start: Integer | unix timestamp (must be within the last month)
  • period_end: Integer | unix timestamp (after period_start, within the last month)
  • step: String | defaults to '1m'.

Period and Step parameters have no affect on storage metric. That will always return the current value.

Returned Params
  • service_name: Object
    • id: Integer
    • name: String
    • image: String
    • resources: Object | Dependent on which values selected
      • cpu: Array<time, value>
      • cpu_throttled: Array<time, value>
      • memory: Array<time, value>
      • memory_throttled: Array<time, value>
      • storage: Decimal
Errors

All error bodies use the {"errors": [...]} array shape.

  • 422 | empty or invalid kind, or period_start/period_end outside the last month / out of order
  • 502 | upstream metric service unavailable
  • 400 | unexpected failure

CDN Metrics

Retrieve RAW cdn metrics. Full description of the returned data can be found on Bunny's API Documentation Site. Note: Click the 200 under Responses to see field explanation.

POST /api/sites/{site-id}/metrics/cdn

Params
  • period_start: Integer | Unix timestamp. Takes precedence over period. (>3 months old → 422)
  • step: String | hourly or monthly. Only consulted with period_start.
  • period: String | preset window — one of 12h, 24h, 7d, 30d. Used only when period_start is absent. Unknown values → 422.
Returned Params
  • TotalBandwidthUsed: Integer | For the given period
  • TotalOriginTraffic: Integer | For the given period
  • AverageOriginResponseTime: Integer | For the given period
  • TotalRequestsServed: Integer | For the given period
  • CacheHitRatio: Integer
  • OriginResponseTimeChart: Object | "2025-11-20T00:00:00Z": 0 (ISO8601 timestamp → Integer)
  • BandwidthUsedChart: Object
  • BandwidthCachedChart: Object
  • CacheHitRateChart: Object
  • RequestsServedChart: Object
  • PullRequestsPulledChart: Object
  • OriginShieldBandwidthUsedChart: Object
  • OriginShieldInternalBandwidthUsedChart: Object
  • OriginTrafficChart: Object
  • GeoTrafficDistribution: Object | e.g. "EU: Stockholm, SE": 0
  • Error3xxChart: Object
  • Error4xxChart: Object
  • Error5xxChart: Object
Errors
  • 409 | CDN not active for this site
  • 422 | missing/zero/too-old period_start, or unknown period
  • 502 | upstream statistics fetch failed
Example: Show Monthly Bandwidth 
curl -X POST -d '{"period_start": 1760983782, "step": "monthly"}'

This will return data for the past month, in daily increments, but more importantly, the TotalBandwidthUsed value will be for the entire 30 day period.

See also Shield metrics.

Backups

Please use the Tasks endpoint to monitor the status of these actions.

List All Backups

Return a list of backups for a given site, grouped by volume. Returns [] when there are no volumes; a volume with no archives renders as {}.

GET /api/sites/{site-id}/backups

Returned Params
  • {label}: Object | i.e. wordpress, or mysql
    • id: Integer | ID of the volume (required for backup operations)
    • size: Decimal | GB - volume capacity
    • usage: Decimal | GB - compressed and deduplicated backup size (actual usage on disk)
    • archives: Array
      • id: String
      • name: String
      • created: String | in iso8601 format

Create a backup

PATCH /api/sites/{site-id}/backups/{volume-id}

Returns 202. An unknown volume returns 404 {"errors":["Volume not found"]}.

Params
  • name: String | Backup Name

Delete a backup

DELETE /api/sites/{site-id}/backups/{volume-id}

Returns 202.

Params
  • backup_id: String | Backup ID

Restore a backup

PATCH /api/sites/{site-id}/restores/{volume-id}

Returns 202.

Params
  • backup_id: String | Backup ID

Change PHP Version

List Available

GET /api/sites/{site-id}/variants

Returned Params
  • php: Array<Object> | Currently only php is returned.
    • id: Integer | variant_id needed for changing the version
    • label: String
    • is_default: Boolean | When deploying a new site, this will be used.
    • active: Boolean | Current version the site is using

Change

When changing a site's php version, the site will be restarted with a different container image. Please allow time for the site to restart. Returns 202. The URL segment must be php — any other variant returns 422 {"errors":["only php version changes are allowed"]}.

PATCH /api/sites/{site-id}/variants/php

Params
  • variant_id: Integer
Returned Params (202 Accepted)
  • task_id: Integer | The ID of the task so you can follow along.