Every console action has an endpoint.
The API is not a subset bolted on afterwards — it is a second front door onto the same service layer the console calls. If you can do it by clicking, you can do it with a token: deploy, resize, rebuild, snapshot, forward a port, schedule a shutdown, open a ticket against a specific instance. One hundred and twelve endpoints across twenty-one groups, at cmp.api.comsky.ai/v1.
Long operations answer 202 with a task handle you poll, rather than holding a connection open for a minute. The money in the response is the same arithmetic the pricing page publishes — the API does not quote you a different number than the website. See the formula →
The spec cannot drift, because it is not written by hand.
Most published API documents are a second artefact maintained beside the server, and they rot — quietly, in the one field you needed. Ours cannot, because the router and the OpenAPI document are generated from the same route table at build time.
Generated, not maintained
The reference is read straight from the OpenAPI document, and the document is read straight from the route table the server boots with. Nobody remembers to update the docs, because nobody can forget.
Scoped, narrow keys
A key carries only the scopes you grant it, and can be pinned to named instances. A key for your deploy pipeline does not have to be a key that can delete your database box.
Safe retries
Every state-changing call takes an Idempotency-Key. Replay the same key and you get the same result rather than a second instance — which is what makes it safe to retry from a queue.
Published rate limits
Limits are per key and stated up front, so you can size a batch job against them instead of discovering them at three in the morning. Long operations return 202 plus a task handle you poll.
A representative slice, and then all twenty-one groups.
Each row below is something you can also do by clicking. That is the test we hold the API to — not “does it expose the main objects”, but “is there a console action that has no endpoint”.
A key, a header, a call — and a scope you chose.
Create a key under Account → API keys, grant it only the scopes it needs, and optionally pin it to named instances. Then it is one bearer header. There is no signing ceremony and no session to keep alive.
The kill switch is not a revocation
API access can be switched off for the whole account from the portal. Every call on every key is refused while it is off, and nothing is revoked — so turning it back on does not mean reissuing keys to four services at midnight.
You can read your own traffic
Your request history and a usage summary over the last N days are themselves endpoints. When something is calling more than you expected, you can find out which key it was without asking us.
No billing surface at all
The API cannot top up the wallet, cannot change a payment method and cannot spend money you have not already deposited. The worst a leaked key can do is provision against a prepaid balance you control — and you can stop that in one switch.
Signed, logged, retryable — and readable after the fact.
Polling is fine for a task handle and wrong for everything else. Register an endpoint, subscribe to the event types you care about, and check the delivery log when your receiver was down.
Signed, so you can verify it was us
Each delivery carries a signature over the timestamp and the body. Rotate the signing secret from the console when you need to, without tearing down the subscription.
A delivery log you can read
Every attempt is listed with the response your endpoint gave. When a receiver was down for an hour, you can see exactly what it missed rather than guessing.
Retry, by hand or by rule
A failed delivery can be retried from the console or over the API. Threshold alerts on instance metrics fire the same way, with a log of the events each rule has raised.
The parts that never made it onto a marketing page.
Compute
- Deploy, resize, rebuild, reboot, stop and start
- Quote a resize before committing to it
- One-time web console URLs
- Recycle bin: restore, or expunge with the disks
- Scheduled power actions on a cron expression, in your own timezone, returning the next few firings
Storage
- Additional data volumes — create, attach, grow, detach, delete
- A quote endpoint before you create one
- Volume snapshots and whole-instance snapshots, each revertible
- Create a new volume from a snapshot
- S3-compatible buckets with their own access key and secret
Networking
- The isolated network and its virtual router
- Public IPs, static NAT and port forwarding
- Firewall and egress policy
- Load balancers with health-checked targets
- VPCs with tiers and per-tier ACLs — note a routed VPC type has no port forwarding, static NAT, load balancer or VPN
Observability
- Current metrics and 14 days of history
- CPU, memory, disk and network, sampled every 60 seconds
- Power state polled separately every 45 seconds
- Threshold alert rules, and the events they raised
- Email or webhook notification
Automation & account
- Idempotency-Key on every state-changing call
- 202 plus a task handle for long operations
- Signed webhooks with delivery log and retry
- Your own request history and usage summary
- A dependency-free TypeScript SDK, if you would rather not write the curl
Support
- Open a ticket over the API
- Pin a ticket to a specific instance
- So an alert in your monitoring can open a ticket in ours
- Read the thread back the same way
- P1 acknowledged in one hour, 24×7
Object storage, additional volumes and VPCs are reachable over the API and are not yet sold as their own products. We would rather tell you they exist than let you find them in the reference and wonder why nobody mentioned it.
About building against it.
Where is the base URL and how do I authenticate?
Everything lives under https://cmp.api.comsky.ai/v1 and authenticates with a bearer token you create under Account → API keys. One header, no signing ceremony, no session to refresh.
Is the whole console available, or a subset?
The whole surface. One hundred and twelve endpoints across twenty-one groups, covering provisioning, storage, networking, monitoring, automation and support. The API and the console call the same service layer; neither is a wrapper over the other.
How do I know the documentation matches the server?
Because neither is written by hand. The route table declares the path, the method, the scopes and the request and response schemas; the HTTP router and the OpenAPI document are both generated from it. An endpoint that is not in the table is neither served nor documented.
Is it safe to retry a failed call?
Yes, if you send an Idempotency-Key — and every state-changing endpoint accepts one. Replaying the same key returns the original result instead of creating a second resource, which is what makes it safe to drive from a job queue.
Can a leaked key cost me money?
Only up to the prepaid balance already in your wallet. The API has no billing surface: it cannot top up, cannot change a payment method and cannot invoice you. Scope keys narrowly, pin them to named instances, and use the account-wide switch to refuse every call at once while you sort it out.
Can I deploy a GPU instance over the API?
No. POST /v1/instances takes cores, ramGb and ssdGb. There is no accelerator field because there is no GPU product yet — the GPU page says exactly where that stands.
Is there an SDK, or a Terraform provider?
There is a dependency-free TypeScript SDK. A Terraform provider is the kind of thing people build on top of an API this shape, and several have asked — but we do not publish one today and will not imply otherwise.
What are the rate limits?
Published per key, so you can size a batch against them rather than discovering them in production. Long-running operations answer 202 with a task handle you poll, which keeps a big provisioning run from burning limit on held connections.
Can I turn the API off entirely?
Yes, account-wide, from the portal. Every call on every key is refused while it is off and nothing is revoked, so turning it back on does not mean reissuing keys across your estate.
Start with Comsky Cloud.
Grow into the ecosystem.
One account opens every Comsky product — and one invoice covers them, however many you run.