{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"06e8fba0-d243-43a3-a742-0926097d2ade","name":"CreateYourVPN Partner API v1","description":"# CreateYourVPN Partner API v1\n\nA server-to-server API for managing end users: create a customer, grant them a plan,\nhand them a subscription link, read their consumption.\n\n**Base URL:** `https://api.createyourvpn.com/api/v1/partner-api`\n\nThe version is part of the URL. Breaking changes ship under a new prefix\n(`/api/v2/...`); the `v1` contract does not change. Ignore unknown fields in JSON\nresponses so that backwards-compatible additions do not break you.\n\n## Getting started\n\n1. Issue a key in the partner panel and save it — the full string is shown **once**,\n   we only store a hash.\n2. Duplicate the `CYV Partner API - template` environment, put your key in the\n   `apiKey` variable, and select the environment in the top right corner.\n3. Send **Key and configuration -> Who am I**. A `200` means you are ready, and\n   `key.scopes` shows your permissions straight away.\n\nFrom there you can run the whole collection through the Collection Runner: the\nrequests are ordered as an end-to-end scenario — create a customer, grant a plan,\ncheck the subscription and usage, rotate the link, delete.\n\n## Authentication\n\n```http\nAuthorization: Bearer {{apiKey}}\n```\n\nAlternatively, send the same value in an `X-API-Key` header.\n\nThe key is for **server-to-server integrations only**. Requests carrying browser\nheaders such as `Origin` or `Sec-Fetch-Site` are rejected with `403\nbrowser_forbidden`. Never put the key in frontend code.\n\n**Key scopes**\n\n| Scope | Grants access to |\n|---|---|\n| `config:read` | Storefront config, locations, information about the key |\n| `users:read` | Reading users, subscriptions and traffic |\n| `users:write` | Creating, updating, deleting, granting plans, rotating links |\n\n## Units and formats\n\n| Field | Format |\n|---|---|\n| `expire`, `expiresAt` | Unix time, seconds |\n| `createdAt`, `onlineAt`, `from`, `to` | RFC 3339 |\n| `dataLimit`, `usedTraffic`, `lifetimeUsedTraffic`, `remaining` | bytes |\n| `dataLimit` absent or `0` | unlimited traffic |\n| `expire` absent or `0` | no expiry |\n| `id` | opaque identifier; store it from the response, never derive it from the email |\n\n## Rate limits\n\n* Shared: **120 requests per minute** per key.\n* `GET /users`: a separate budget of **10 requests per minute** per key.\n\nExceeding either returns `429 rate_limited` with a `Retry-After` header in seconds.\nLimits are a service setting and may differ per environment; read the actual value\nfrom `key.rateLimitPerMinute` in `GET /me`.\n\n## Idempotency\n\nThe `Idempotency-Key` header is required on three operations:\n\n* `DELETE /users/{id}`\n* `POST /users/{id}/grant`\n* `POST /users/{id}/subscription/rotate`\n\nOne key = one business event; every retry of that event sends the same key. Results\nare kept for 24 hours and the key may be at most 128 characters long.\n\nRetrying a completed operation returns the same JSON plus an `Idempotent-Replay:\ntrue` header. If a request with that key is still running you get `409 conflict` and\n`Retry-After: 2`.\n\nIn this collection the header is filled with the dynamic `{{$guid}}` so the requests\ncan be tried by hand. **In production, send an identifier of your own event** (order\nnumber, payment id) — otherwise idempotency buys you nothing.\n\n## Error format\n\n```json\n{\n  \"error\": {\n    \"code\": \"validation_failed\",\n    \"message\": \"Validation failed\",\n    \"detail\": \"optional lower-level detail\"\n  }\n}\n```\n\nBranch on the HTTP status and the stable `error.code`; keep `message` and `detail`\nfor your logs. `detail` is not always present.\n\n| HTTP | `error.code` | Meaning |\n|---|---|---|\n| `400` | `validation_failed` | Malformed JSON, parameter or required header |\n| `401` | `unauthorized` | Key missing, invalid, revoked or expired |\n| `402` | `partner_suspended` | Partner service is suspended |\n| `403` | `browser_forbidden` | Key was used from a browser |\n| `403` | `forbidden_scope` | Key lacks the required scope |\n| `404` | `not_found` | User or other requested object not found |\n| `409` | `conflict` | State conflict, external id taken, or operation still running |\n| `429` | `rate_limited` | Rate limit exceeded; honour `Retry-After` |\n| `500` | `internal` | Internal error |\n| `503` | `cluster_not_ready` | Storefront cluster is not ready yet |\n| `503` | `unavailable` | Transient dependency failure; safe to retry |\n\nUse exponential backoff with jitter for `429` and retryable `503`. When retrying an\nidempotent write, always reuse the original `Idempotency-Key`.\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":true,"owner":"57492368","team":34067208,"collectionId":"06e8fba0-d243-43a3-a742-0926097d2ade","publishedId":"2sBYAq1Dvf","public":true,"publicUrl":"https://documenter-api.postman.tech/view/57492368/2sBYAq1Dvf","privateUrl":"https://go.postman.co/documentation/57492368-06e8fba0-d243-43a3-a742-0926097d2ade","customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"documentationLayout":"classic-double-column","customisation":{"metaTags":[{"name":"description","value":"Server-to-server REST API for managing end users: create a customer, grant a plan, issue a subscription link and read traffic usage. Includes request examples, error codes and idempotency rules."},{"name":"title","value":"CreateYourVPN Partner API v1 - REST API reference"}],"appearance":{"default":"light","themes":[{"name":"dark","logo":null,"colors":{"top-bar":"212121","right-sidebar":"303030","highlight":"FF6C37"}},{"name":"light","logo":null,"colors":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"}}]}},"version":"8.12.3","publishDate":"2026-08-17T20:54:57.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"CreateYourVPN Partner API v1 - REST API reference","description":"Server-to-server REST API for managing end users: create a customer, grant a plan, issue a subscription link and read traffic usage. Includes request examples, error codes and idempotency rules."},"logos":{"logoLight":null,"logoDark":null}},"statusCode":200},"environments":[{"name":"CYV Partner API - template","id":"3cef292f-45fa-40c5-a56b-1d037480879f","owner":"57492368","values":[{"key":"baseUrl","value":"https://api.createyourvpn.com/api/v1/partner-api","type":"default","enabled":true},{"key":"apiKey","value":"","type":"secret","enabled":true},{"key":"userId","value":"","type":"default","enabled":true}],"published":true}],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/3f4c921ce37126e9e71cf67d56b7127aeac874a275d8f77339ca98bf64174915","favicon":""},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"},{"label":"CYV Partner API - template","value":"57492368-3cef292f-45fa-40c5-a56b-1d037480879f"}],"canonicalUrl":"https://documenter.gw.postman.com/view/metadata/2sBYAq1Dvf"}