API
Hubfly space REST API
Every action in the console, the CLI and both SDKs goes through this API. It is a plain JSON over HTTPS interface with bearer-token authentication and no client library required.
Base URL and versioning
All endpoints live under a single host and are versioned in the path. The current version is v1, and it will not change shape underneath you: additive changes ship as new fields and new endpoints, and anything breaking would land on a new version prefix.
https://api.hubfly.space/api/v1There is no sandbox
Building a multi-tenant product?
X-HubFly-Subaccount.Making a request
Authenticate with a bearer token in the Authorization header. Requests with a body send JSON and set Content-Type: application/json.
curl https://api.hubfly.space/api/v1/projects \
-H "Authorization: Bearer $HUBFLY_TOKEN"curl -X POST https://api.hubfly.space/api/v1/projects/create \
-H "Authorization: Bearer $HUBFLY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "frontend-service", "region": "us-east-1"}'Response envelope
Successful responses wrap the payload in data and carry request metadata inmeta. The resource is never at the top level, so parsing code can be uniform across endpoints.
{
"data": {
"id": "proj_8f3a1d9",
"name": "frontend-service",
"region": "us-east-1",
"createdAt": "2026-07-20T11:04:52.000Z"
},
"meta": {
"requestId": "req_2c91ba4"
}
}Failures use the same envelope with an error object in place of the data:
{
"error": {
"code": "project_not_found",
"message": "Project not found"
},
"meta": {
"requestId": "req_2c91ba4"
}
}Errors and status codes lists what each status means and which failures are worth retrying.
Resource groups
The API exposes 294 endpoints, grouped by the resource they act on. Each group below maps to a section in the endpoint explorer.
| Group | Path prefix | Endpoints | Covers |
|---|---|---|---|
| Projects & Workloads | /api/v1/projects | 185 | Deployments, containers, volumes, load balancers, GPU, hibernation, and environment variables |
| Organizations & Teams | /api/v1/organizations | 37 | Organization management, team members, semesters, budgets, and access groups |
| Authentication | /api/v1/auth | 20 | User login, registration, sessions, API tokens, and password management |
| CLI & Automated Deployments | /api/v1/cli | 15 | CLI authentication, container deployment sessions, and build status |
| Developer Sub-accounts | /api/v1/subaccounts | 11 | Isolated customer tenants, wallets, machine credentials, and lifecycle controls |
| GitHub Integration | /api/v1/github | 5 | Branch listing, repository sync, and GitHub access |
| Domains & DNS | /api/v1/domains | 4 | Custom domain registration, DNS verification, and domain removal |
| GPU Computing | /api/v1/gpu | 4 | GPU instance provisioning, status, and compute resources |
| Platform Credentials | /api/v1/platform | 3 | Parent-scoped service credentials for managing and operating sub-accounts |
| Courses & Assignments | /api/v1/courses | 3 | Course management and assignment administration |
| Billing & Subscriptions | /api/v1/billing | 2 | Checkout sessions and subscription details |
| System Status | /api/v1/system | 2 | System health check and status telemetry |
| Marketplace | /api/v1/marketplace | 1 | One-click app templates and marketplace listings |
| Infrastructure Regions | /api/v1/regions | 1 | Available deployment regions and data centers |
| App Templates | /api/v1/templates | 1 | Pre-configured application templates |
Conventions
Identifiers
IDs are opaque prefixed strings — proj_, cnt_,vol_, lb_, sub_. Treat them as strings: do not parse them, and do not assume a length.
Timestamps
All timestamps are ISO 8601 in UTC, for example2026-07-20T11:04:52.000Z. There is no local-time variant.
Verbs in paths
Mutating endpoints spell the action out in the path — /projects/create,/projects/:projectId/delete — rather than relying on the HTTP method alone. The method still matters, but the path tells you what a request does at a glance in a log.
Partial updates
Update endpoints replace the collection they are given rather than merging into it. Firewall rules and environment variables in particular are set wholesale: read the current value, modify it, and send the complete list back.