NSIN Support
Overview
Public REST API for NSIN CDN, DNS and edge-security management.
NSIN API 1.0.0
Section titled “NSIN API 1.0.0”The NSIN API lets you manage everything you can manage from the panel: domains, DNS records, edge rules (cache, WAF, redirects, rate limiting, …), TLS certificates, analytics, uptime and domain sharing.
Authentication
Every endpoint in this reference is authenticated with an API key.
Create one in the panel under Settings → API keys. Keys are shown once at
creation time and are prefixed nsin_.
Send the key either way — both are equivalent:
Authorization: Bearer nsin_xxxxxxxxxxxxxxxxxxxxX-Api-Key: nsin_xxxxxxxxxxxxxxxxxxxxRead-only keys
A key marked read-only may only issue GET, HEAD and OPTIONS requests.
Any other method returns 403 with {"error": "read-only API key"},
regardless of the endpoint.
What API keys cannot do
Some parts of the product are deliberately unreachable with a key, so that a
leaked key can never take over the account or spend money. These return
403 for every key, including full-access ones:
| Surface | Reason |
|---|---|
/users/** | Profile, password, sessions and API-key management. A key cannot mint or revoke keys. |
/auth/** | Login, registration, OTP. |
/billing/** | Plan catalogue and billing settings. |
/admin/** | Administrative surface. |
POST /wallet/topup | Moves money. |
POST /subscriptions/purchase, /switch, /auto-renew | Moves money. |
POST /domains/{domain}/subscriptions/purchase, /switch, /auto-renew | Moves money. |
Reading subscription, feature, traffic-usage, invoice and wallet state is allowed — only the money-moving writes are blocked.
Rate limiting
Requests are limited per key, by default to 300 requests per minute.
Exceeding it returns 429 with {"error": "rate limit exceeded"}.
Panel (browser) traffic is limited separately and does not consume your key’s
budget.
Conventions
{domain}path parameter — every path segment written as{domain}is the domain name (example.com), not a numeric id. Percent-encode it if it contains characters that are unsafe in a path segment.- Errors — all errors share one shape:
{"error": "human readable message"}. See theErrorschema. - Timestamps — RFC 3339 / ISO 8601 strings in UTC unless stated otherwise.
- Byte counts — always bytes; traffic and quota values are documented per field.
- Access control — a key inherits the permissions of the user who owns it.
For a shared domain that is the role granted to that user (
viewer,editor,admin); for your own domains it isowner. Endpoints document the permission they require, and return403when the role lacks it and404when the domain is not visible to you at all.
Plan features
Several endpoints are gated on the domain’s active plan (analytics, logs,
WAF, custom certificates, …). When the plan does not include the feature the
response is 403 with an error explaining which feature is missing.
Authentication
Section titled “ Authentication ”bearerAuth
Section titled “bearerAuth ”Authorization: Bearer nsin_…. The token is an NSIN API key, not a JWT.
Security scheme type: http
apiKeyAuth
Section titled “apiKeyAuth ”X-Api-Key: nsin_…. Equivalent to the bearer form — use whichever suits
your client.
Security scheme type: apiKey
Header parameter name: X-Api-Key