API

Run the whole fleet from code.

List devices, sell and revoke proxy connections, rotate addresses, block websites per connection, pull IP history and logs, and pair new phones. One key runs the whole account, or scope a key to a single device for a customer of yours.

Endpoints

Live at https://luxur-hosting.com. JSON in, JSON out. Errors are { ok: false, error }.

Authentication

Send your key as a bearer token. Keys are made in the console once you’re signed in.

Authorization: Bearer lx_live_…

Examples

Authentication & proxies

Send the key as a bearer token on every request. Keys never expire; revoke them in the console.

curl https://luxur-hosting.com/api/v1/devices \
  -H "Authorization: Bearer lx_live_…"

curl -X POST https://luxur-hosting.com/api/v1/devices/<id>/rotate \
  -H "Authorization: Bearer lx_live_…"

# Sell a 30-day proxy, then revoke it when it ends
curl -X POST https://luxur-hosting.com/api/v1/devices/<id>/access-points \
  -H "Authorization: Bearer lx_live_…" \
  -H "Content-Type: application/json" \
  -d '{"type":"SOCKS5","days":30}'

curl -X DELETE https://luxur-hosting.com/api/v1/devices/<id>/access-points/<apId> \
  -H "Authorization: Bearer lx_live_…"

Website blacklist

Block websites on one connection — every port on it refuses them. A domain covers its subdomains; IPv4 addresses and ranges work too.

# Add
curl -X POST https://luxur-hosting.com/api/v1/devices/<id>/blacklist \
  -H "Authorization: Bearer lx_live_…" \
  -H "Content-Type: application/json" \
  -d '{"sites":["example.com","203.0.113.0/24"]}'

# List
curl https://luxur-hosting.com/api/v1/devices/<id>/blacklist \
  -H "Authorization: Bearer lx_live_…"

# Remove one, or clear them all
curl -X DELETE https://luxur-hosting.com/api/v1/devices/<id>/blacklist/example.com \
  -H "Authorization: Bearer lx_live_…"
curl -X DELETE https://luxur-hosting.com/api/v1/devices/<id>/blacklist \
  -H "Authorization: Bearer lx_live_…"

Rotation links

Every device has rotation links on its Change IP tab — a plain GET that starts a rotation and answers at once. Add ?command=<command_id> to read how it went and the new IP. Treat a link like a password.

curl https://lxh-idr.com/api/rotate/<token>
{"command_id":"cmd_3f9a…","device_id":"8f3a21c0","message":"IP rotation triggered","ok":true}

curl "https://lxh-idr.com/api/rotate/<token>?command=cmd_3f9a…"
{"command_id":"cmd_3f9a…","device_id":"8f3a21c0","status":"completed","ip":"166.205.14.92","message":"IP rotated","ok":true}

IP history & logs

Every address a connection used (the last 5,000, IPv4 / IPv6) and its 12-week log, as JSON or a text file.

curl https://luxur-hosting.com/api/v1/devices/<id>/ip-history?limit=100 \
  -H "Authorization: Bearer lx_live_…"

curl -o ip-history.txt "https://luxur-hosting.com/api/v1/devices/<id>/ip-history?format=txt" \
  -H "Authorization: Bearer lx_live_…"
curl -o logs.txt "https://luxur-hosting.com/api/v1/devices/<id>/logs?format=txt" \
  -H "Authorization: Bearer lx_live_…"

Every endpoint

Devices

GET/api/v1/devicesEvery device on the account — online, battery, signal, carrier, public IP, last sync.
GET/api/v1/devices/:idOne device with its latest heartbeat, recent commands, address history and traffic per day (usageMb, 14 days).
GET/api/v1/devices/:id/ip-historyEvery address the connection exited on — the last 5,000, newest first, each with its time and IPv4 / IPv6. ?format=txt downloads it.
GET/api/v1/devices/:id/logsThe connection's log for the last 12 weeks: status, rotations, IP changes, port and plan events. ?format=txt downloads it.
GET/api/v1/devices/:id/uptime?d=<ms>&tz=<iana>One day of the uptime timeline in 5-minute cells (on, off, rotated), in your own timezone. Omit d for today.
GET/api/v1/devices/:id/vpn/:cfgDownload a VPN profile (.conf for WireGuard, .ovpn for OpenVPN); ?format=qr gives a WireGuard QR code. Fleet plan.

Website blacklist — per connection

GET/api/v1/devices/:id/blacklistThe websites this connection refuses: { count, sites, enforced }.
POST/api/v1/devices/:id/blacklistAdd to it: { sites: ["example.com", "203.0.113.0/24"] }. A domain also blocks its subdomains; duplicates are skipped.
DELETE/api/v1/devices/:id/blacklist/:siteRemove one website (URL-encoded, e.g. /blacklist/example.com).
DELETE/api/v1/devices/:id/blacklistClear the whole list.

Proxy connections (access points) — sell, renew and revoke from your bot

GET/api/v1/devices/:id/access-pointsEvery connection on the device: host, port, username, password, proxy URL, rotation link, expiry, usage.
POST/api/v1/devices/:id/access-pointsOpen one. { type?, username?, password?, days? | expires?, note?, rotationLink?, whitelist? } → IP, port, login, proxy URL and its own rotation link. Ready in ~20 s.
GET/api/v1/devices/:id/access-points/:apIdOne connection.
PATCH/api/v1/devices/:id/access-points/:apIdRenew or change it: { days } or { expires }, username, password, type, note, whitelist (IPv4 / CIDR list; [] = any IP).
DELETE/api/v1/devices/:id/access-points/:apIdRevoke it: the login stops working, the port closes and its rotation link is deleted.

Rotation links — no key needed

GET/api/rotate/:tokenStart a rotation and answer at once: { command_id, device_id, message: "IP rotation triggered", ok }. Links come from a device's Change IP tab or an access point's rotationLink.
GET/api/rotate/:token?command=:command_idHow that rotation went — status, and the new ip once it's done — without starting another.
GET/api/v1/devices/:id/rotation-linksThe device's rotation links, each as { token, url }.
POST/api/v1/devices/:id/rotation-linksMake a new rotation link (up to 20 per device) → { link: { token, url } }.
DELETE/api/v1/devices/:id/rotation-links/:tokenKill a rotation link; it stops working at once.

Commands — delivered to the phone instantly

POST/api/v1/devices/:id/rotateRotate and wait for the new address. Returns { ok, ip }.
POST/api/v1/devices/:id/commands{ type, wait } — ROTATE_IP, FIND_DEVICE, REFRESH_STATUS, REFRESH_CONNECTIONS, RESTART_VPN, REBOOT.
GET/api/v1/devices/:id/commandsThe last 50 commands and where each one got to.
GET/api/v1/devices/:id/commands/:commandId?wait=30One command; optionally wait for the phone's result.

Adding phones

POST/api/v1/pairing-pins{ name? } — a 6-digit PIN, valid 5 minutes and once, to enter in the Luxur app; the phone pairs under name.
GET/api/v1/pairing-pins/:pinwaiting, paired (with the new device id) or expired.

Account

GET/api/v1/balanceBalance and the last 50 ledger rows.

Phone side (the Luxur app uses these — device token)

POST/api/v1/device/pairPIN + phone identity → device token.
POST/api/v1/device/heartbeatEvery 10 s: network, battery, signal, proxy state. Reply carries policy.
GET/api/v1/device/commands?wait=25Long-poll: held open, answered the moment a command is queued.
POST/api/v1/device/commands/:id/result{ ok, detail } — e.g. the new IP after a rotation.
GET/api/v1/device/policyThe rules the platform holds for the phone.

Ready to build?

Create an account, confirm your email, and make an API key under Console → API.

Start Here Sign in