The X4B APIv2 provides programmatic access to manage your X4B services, DNS records, firewall rules, SSL certificates, tunnels, and more. It is a JSON-based REST-style API available at the following base URL:
https://www.x4b.net/apiv2/{Module}/{Method}
All requests and responses use JSON. Successful responses return the requested data directly. Errors return a JSON object with an error key:
{ "error": "Error Message" }
Authentication failures return HTTP 403.
For interactive exploration of all available endpoints, request/response schemas, and the ability to try calls directly from your browser, use the API Explorer at:
https://x4b.net/api-explorer/
Getting an API Key
API keys are managed from your X4B dashboard:
- Navigate to Dashboard → Account Settings.
- Click the API Keys tab.
- Enter a descriptive Name for your key (e.g. "Monitoring Script" or "Terraform") and click Create Key.
- The generated key is displayed once — copy and store it securely immediately. You will not be able to view it again.
- To revoke a key, use the Action → Delete dropdown next to the key in the list.
You can create multiple API keys for different purposes and revoke them individually without affecting others.
Authentication
APIv2 supports three authentication methods, checked in the following order:
1. Bearer Token (Recommended)
Include an Authorization header with your API key:
Authorization: Bearer api {your_api_key}
This is the preferred method for programmatic access. Example using curl:
curl -H "Authorization: Bearer api YOUR_API_KEY" \
https://www.x4b.net/apiv2/Service/all
2. API_KEY Parameter
Pass your key as a POST or GET parameter named API_KEY:
curl -X POST -d "API_KEY=YOUR_API_KEY" \
https://www.x4b.net/apiv2/Service/all
3. Session Cookie
When making requests from a browser where you are already logged into the X4B dashboard, your existing session cookie is used automatically. This is useful for testing in the API Explorer.
You may also login using the User::login api which attaches a Session cookie to the response.
Two-Factor Authentication (2FA)
If your account has 2FA enabled, you cannot authenticate with a username and password via the API. You must use an API key. Attempting password-based login will return:
{ "status": "fail", "code": 4, "message": "2FA required. To authenticate with the API you must use an API key or disable 2FA." }
Common Patterns
Querying
Most modules support querying by field using the query[fieldname] parameter:
GET /apiv2/Port/get?query[id]=1234
Pagination
List endpoints (all) support pagination via page[start] and page[limit]:
GET /apiv2/DnsRecord/all?page[start]=0&page[limit]=50
The default limit is 200 records. The maximum limit is also 200.
CRUD Operations
Modules that support write operations expose a standard set of methods:
| Method | HTTP | Description |
|---|---|---|
get |
GET | Fetch a single object by query |
all |
GET | List objects matching a query |
create |
POST | Create a new object |
update |
POST | Update an existing object |
delete |
POST | Delete an object |
bulk |
POST | Create and/or update multiple objects |
Create and update operations accept a value[fieldname] parameter for each field. Update and delete operations require a query[id] to identify the target object.
Self-Documentation
Every module exposes a describe method that returns available methods and their parameters:
GET /apiv2/Port/describe
Available Modules
Below is a summary of the customer-facing API modules. For complete field-level detail, request/response schemas, and required parameters, use the API Explorer at https://x4b.net/api-explorer/.
Services & Infrastructure
| Module | Description |
|---|---|
| Service | Your X4B services (DDoS protection, reverse proxy, etc.) |
| Lease | IP address leases assigned to your services |
| LeaseIP | Individual IP addresses within a lease |
| Port | Port forwarding rules on your services |
| PortBackend | Backend server targets for port forwarding |
| Server | Available proxy server locations (PoPs) |
| Plan | Available service plans and pricing tiers |
| Tier | Service tier definitions |
| Region | Geographic regions for routing and filtering |
| Protection | DDoS protection status and configuration |
DNS
| Module | Description |
|---|---|
| DnsZone | DNS zones (domains) managed through X4B |
| DnsRecord | Individual DNS records within a zone |
Firewall & Security
| Module | Description |
|---|---|
| FirewallProfile | Firewall rule profiles attached to ports |
| Layer4Rule | Layer 4 (TCP/UDP) firewall rules |
| Layer7Rule | Layer 7 (HTTP/HTTPS) firewall rules |
| L7List | Managed lists for Layer 7 rules (IP lists, etc.) |
| Zone | Firewall zones grouping rules by priority |
SSL / TLS
| Module | Description |
|---|---|
| SSLOptions | SSL/TLS configuration for a port |
| SSLUser | Custom SSL certificates and private keys |
HTTP
| Module | Description |
|---|---|
| HttpOption | HTTP-level options for a port (headers, caching, etc.) |
| ErrorPage | Custom error pages served by the proxy |
Tunnels
| Module | Description |
|---|---|
| Tunnel | GRE/IP-in-IP tunnel configuration and management |
User Authentication Module
The User module provides session-based authentication endpoints.
| Method | Description |
|---|---|
login |
Authenticate with email and password (requires no 2FA) |
isLoggedIn |
Check current session status |
Note: For automated API access, use API keys rather than the User/login method. The login endpoint is primarily intended for interactive sessions and does not work with 2FA-enabled accounts.
Rate Limits
API requests are subject to rate limiting. If you exceed the limit, you will receive an HTTP 429 response. Contact support if you need higher limits for your use case.
Support
For questions about the API, open a support ticket via the dashboard or email support@x4b.net. When reporting API issues, include the full request URL, request body, and response you received including Request ID.
