NSIN Support
Overview
Public REST API for NSIN CDN, DNS and edge-security management.
NSIN API 1.0.0
Section titled “NSIN API 1.0.0”The NSIN API lets you manage everything you can manage from the panel: domains, DNS records, edge rules (cache, WAF, redirects, rate limiting, …), TLS certificates, analytics, uptime and domain sharing.
Authentication
Every endpoint in this reference is authenticated with an API key.
Create one in the panel under Settings → API keys. Keys are shown once at
creation time and are prefixed nsin_.
Send the key either way — both are equivalent:
Authorization: Bearer nsin_xxxxxxxxxxxxxxxxxxxxX-Api-Key: nsin_xxxxxxxxxxxxxxxxxxxxRead-only keys
A key marked read-only may only issue GET, HEAD and OPTIONS requests.
Any other method returns 403 with {"error": "read-only API key"},
regardless of the endpoint.
Inactive accounts
If the account that owns the key is deactivated, every request made with
that key is refused with 403 and
{"error": "account is inactive", "code": "account_suspended"} — on any
endpoint, reads included. It is deliberately 403 and not 401: the
credential is still valid, the account behind it is not, so rotating the key
fixes nothing. Individual operations do not list this code.
What API keys cannot do
Some parts of the product are deliberately unreachable with a key, so that a
leaked key can never take over the account or spend money. These return
403 for every key, including full-access ones:
| Surface | Reason |
|---|---|
/users/** | Profile, password, sessions and API-key management. A key cannot mint or revoke keys. |
/auth/** | Login, registration, OTP. |
/billing/** | Plan catalogue and billing settings. |
/admin/** | Administrative surface. |
POST /wallet/topup | Moves money. |
POST /subscriptions/purchase, /switch, /auto-renew | Removed for everyone. Subscriptions are per domain, so these three now answer 410 whatever the credential — a key just never gets that far, because the denylist answers 403 first. Use the /domains/{domain}/subscriptions/... routes from the panel. |
POST /domains/{domain}/subscriptions/purchase, /switch, /auto-renew | Moves money. |
Reading subscription, feature, traffic-usage, invoice and wallet state is allowed — only the money-moving writes are blocked.
If your account is managed by a reseller
A second gate, entirely separate from the denylist above, sits in front of the
routes in this section. It keys on the account, not on the credential: it
runs after both authentication paths have resolved the user, so a managed
client gets the identical 403 from a panel session and from an API key —
there is no way around it by switching credential. The single predicate is
whether the account has a provider at all. If you signed up with NSIN directly,
nothing here applies to you; it also never fires for a reseller himself.
A reseller’s client owns his sites; his provider owns the money, the support
relationship and the sharing graph. So for a managed client these return 403
with code: "managed_by_reseller":
| Surface | Why |
|---|---|
/wallet and /wallet/** | The wallet is funded and owned by your provider. |
/invoices, /invoices/{id}, /domains/{domain}/invoices/** | Invoices are raised against your provider, who bills you out of band. |
POST /domains/{domain}/subscriptions/purchase, /switch, /auto-renew | Your provider buys and switches plans on your behalf. |
/tickets and /tickets/** | Support goes to your provider, not to NSIN. |
POST /domains/ | Your provider provisions domains, because their traffic burns his wallet. Managing a domain you already have is untouched. |
/domains/{domain}/invites/**, /invites/{token}, /invites/{token}/accept | You cannot sub-grant access to a domain your provider funds, or accept an invitation into one. |
/domains/{domain}/members/{userId} — every method except GET | Reading the member list is allowed on purpose; changing it is not. |
Two traps in that table. GET /domains/{domain}/members stays open — your
provider appears in it as an admin and you are entitled to see who holds
rights on your domain — but the member PATCH is blocked wholesale, so a
managed client cannot change even his own notification preferences through
it. And key management is blocked for him too, so a managed client cannot mint
an API key in the first place: the keys that hit these 403s are ones minted
before the account moved under a provider.
Everything else is untouched — domains, DNS, rules, SSL, cache, analytics,
uptime. Plan and subscription reads stay open so you can see which plan a
domain is on and what it includes, but every price field is stripped from those
responses on the way out. NSIN does not know what your provider charges you,
and NSIN’s own retail price is not the number you pay. Read a missing price
as not disclosed, never as free.
Rate limiting
Requests are limited per key, by default to 300 requests per minute.
Exceeding it returns 429 with {"error": "rate limit exceeded"}.
Panel (browser) traffic is limited separately and does not consume your key’s
budget.
Conventions
{domain}path parameter — every path segment written as{domain}is the domain name (example.com), not a numeric id. Percent-encode it if it contains characters that are unsafe in a path segment.- Errors — every error body carries
error, a human-readable message. Some of them also carrycode, a stable machine-readable reason, when the distinction matters more than the sentence:account_suspended,domain_disabled,managed_by_resellerandinvite_email_mismatch(which addsinvited_emailas well). Branch oncodewhere it exists and never on the wording oferror. See theErrorschema for what each one means. One endpoint breaks even that shape: the removedGET /subscriptions/currentputs a machine string inerrorand the prose inmessage. - Timestamps — RFC 3339 / ISO 8601 strings in UTC unless stated otherwise.
- Byte counts — always bytes; traffic and quota values are documented per field.
- Access control — a key inherits the permissions of the user who owns it.
For a shared domain that is the role granted to that user (
viewer,editor,admin); for your own domains it isowner. Endpoints document the permission they require, and return403when the role lacks it and404when the domain is not visible to you at all.
Plan features
Several endpoints are gated on the domain’s active plan (analytics, logs,
WAF, custom certificates, …). When the plan does not include the feature the
response is 403 with an error explaining which feature is missing.
Authentication
Section titled “ Authentication ”bearerAuth
Section titled “bearerAuth ”Authorization: Bearer nsin_…. The token is an NSIN API key, not a JWT.
Security scheme type: http
apiKeyAuth
Section titled “apiKeyAuth ”X-Api-Key: nsin_…. Equivalent to the bearer form — use whichever suits
your client.
Security scheme type: apiKey
Header parameter name: X-Api-Key