Every request acts on one account: yours. The token you sign in with is tied to a single account, and no request can reach another one. There is no administrative or cross-account mode.
Two ways to connect
Which one you want depends on what is doing the calling.
Both reach the same operations. An MCP client sees every endpoint below as a tool it can call; a script calls them as ordinary HTTP requests.
What you can do with it
How requests work
Reads areGET. Every change is a POST with its arguments in a JSON body. That is true even for deletions, because each change runs something real at a registrar, on your hosting or on your email service.
Deletions ask you to repeat what you are removing. A call that deletes something takes a confirmation field, such as confirm_domain or confirm_address, and the value has to match the thing being deleted. This is deliberate. It means an automated caller, including an AI assistant, cannot delete the wrong website or mailbox through a mistyped parameter.
Lists take limit and offset and return a total alongside the rows, so you can page through them.
When something goes wrong
Every failure returns the same shape, a stable code and a readable sentence:Versioning
The API is versioned by prefix. Everything currently sits under/v1, and within a version fields are only ever added, never removed or renamed, so a script written against it today keeps working.
Responses are shaped by hosting.com rather than relayed from whatever system sits behind them. No response names an upstream vendor or hands you an upstream credential, so you are not building against something that changes when we change a supplier.
.jpg?fit=max&auto=format&n=E2LlsT5gBITvo732&q=85&s=ec11e1673894bdf46663a5d73602eb87)