Automate your VPS with the Virtualizor end-user API

Everything you click in the Virtualizor end-user panel can also be done through its API. That makes it possible to restart a frozen VPS automatically from a monitoring system, list your servers in your own dashboard, or power off test servers at night. This guide shows the basics.

Before you start

• Your provider must have enabled API access for end users. If you do not see an API section, ask support.
• A system to run scripts from, with a fixed public IP if you want to restrict access.
• Basic knowledge of curl and JSON.

Create API credentials

1. Log in to the Virtualizor end-user panel (port 4083).
2. Open your account menu and choose API Credentials (or API).
3. Click Create. Virtualizor shows an API key and API password.
4. If available, restrict the key to the IP address of your script server. Find it with the IP checker.
5. Store the credentials in a password manager or environment variables, never in a public repository.

Make a first call

The end-user API is served over HTTPS on the panel address. A request to list your VPS looks like this (parameter names follow Virtualizor's end-user API documentation for your version):

curl -s "https://panel.example.com:4083/index.php?act=listvs&api=json&apikey=KEY&apipass=PASS"

The JSON response contains each VPS with its ID, hostname, IPs and status. Note the VPS ID (vpsid) for later calls.

Power actions

Common actions use the VPS ID and an action name, for example act=start, act=stop, act=restart or act=poweroff with svs=VPSID. Check the response for a success flag before assuming the action worked, and see the panel's Tasks list to confirm.

Example: auto-restart when a site is down

1. A monitoring script checks your website every minute.
2. After several consecutive failures, it calls the API to restart the VPS.
3. It waits a few minutes and checks again; if still down, it alerts you instead of looping.

Add a cooldown so the script never restarts repeatedly – a restart loop can hide the real problem and corrupt data. See power controls for when a restart is appropriate.

Security tips

• Restrict keys by IP and keep one key per script, so you can revoke one without breaking others.
• Use HTTPS only and validate the certificate (avoid curl -k).
• Avoid API actions that destroy data (reinstall) in automation.
• Enable two-factor authentication on the panel account; see account security.

Troubleshooting

• Invalid API credentials: wrong key or password, or the key is restricted to another IP.
• Connection refused: port 4083 blocked from your script server.
• Action not allowed: your provider disabled that feature for end users.

Next steps

• Resource monitoring.
• Monitoring with Grafana.
• Panel overview.