Home/For developers

Terrakom One API

Manage hosting, domains, DNS, mail and invoices from your own scripts, applications and AI assistants, with the same rules as in Terrakom One.

https://www.terrakom.hr/one/api/v1OpenAPI description (JSON)

First request

The account owner opens Users and access → API keys → New key in Terrakom One, chooses a role and an expiry, and copies the key. The key is shown only once.

# list the company's servicescurl https://www.terrakom.hr/one/api/v1/hosting \  -H "Authorization: Bearer tko_9fQ2…"# new mailbox; the system generates the password and returns it only this oncecurl -X POST https://www.terrakom.hr/one/api/v1/hosting/services/281475/mail/mailboxes \  -H "Authorization: Bearer tko_9fQ2…" -H "Content-Type: application/json" \  -d '{"local_part": "ana", "domain": "firma.hr", "quota_mb": 2048}'

# Pythonimport requestsapi = requests.Session()api.headers["Authorization"] = "Bearer tko_9fQ2…"for s in api.get("https://www.terrakom.hr/one/api/v1/hosting").json()["data"]["services"]:    print(s["domain"], s["name"], "paid until", s["paid_until"])

Keys and roles

A key can do exactly what its role allows, using the same roles as people in Terrakom One. A key has no access to user and profile management: it cannot create other keys or logins, and it cannot change passwords or consents.

Role	What the key can do
Account owner	All services, orders, pro forma invoices, invoices and support requests.
Hosting – selected services	Only the assigned hosting services (mail, DNS, web, databases, files) and support requests about them, without invoices or orders. For agencies, contractors and scripts that work on a single website.
Accounting	Pro forma invoices and invoices, PDFs.

Expiry: 30 days, 90 days, 1 year or no expiry. Revocation takes effect immediately.
The account owner can see when a key was last used.
Store the key as a secret (for example in an environment variable); never put it in code that goes into a repository or a browser.

Rules

Rate limits

300 requests per hour per key, of which at most 60 changes (anything other than GET). Exceeding the limit returns 429; try again later.

Deletion is immediate

Deleting a mailbox, database, FTP user or DNS record, and stopping a VPS, take effect immediately, with no further confirmation. An AI assistant must ask the user for confirmation before the call.

Passwords

Passwords are generated by the system and returned only in the response to the create or change request. They are not stored anywhere else.

Orders

An order always creates a pro forma invoice. The service is activated after payment, and a person pays.

Activity log

Every change to a service is logged and visible in the service's actions field (GET /hosting/services/{obligation_id}) and in Terrakom One.

Versions

Within v1 things are only added (new fields and endpoints). Anything that would break existing integrations comes in v2, with advance notice.

Responses and errors

The response is JSON with the fields success, message and data; the payload is in data (an object or a list). The exceptions are PDFs, file downloads and /user/getBills. If the action was not carried out, success is false and the reason for the customer is in message. The HTTP code is then usually still 200, so always check success.

{"success": false, "message": "Upišite ispravnu adresu i kvotu (50 MB – 50 GB).", "data": {}}

Code	Meaning
`200`	Response with the fields success, message and data; check `success`.
`400`	Invalid address, path or an action that is not possible (with a message).
`401`	The key was not sent, is invalid, has expired or has been revoked.
`403`	The key's role does not allow this.
`404`	No such record, the service does not have this feature, or the key is not allowed to see it (with a message).
`429`	Too many requests for this key.