> ## Documentation Index > Fetch the complete documentation index at: https://kb.hosting.com/llms.txt > Use this file to discover all available pages before exploring further. # The hosting.com API and MCP server > What the hosting.com account API and MCP server can do, how to connect to them, and how requests and errors work. The hosting.com account API lets you read and manage your account from a script, from a terminal, or from an AI assistant. Everything you can see in the Hosting Panel is reachable through it: your services and invoices, your domains and their nameservers, the websites on your hosting, your mailboxes and forwarders, and your support tickets. The full reference, with every endpoint, parameter and response, lives at [api.hosting.com](https://api.hosting.com). This article explains what the API is for and how to get connected. It does not repeat the reference. **Every request acts on one account: yours.** The token you sign in with is tied to a single account, and no request can reach another one. There is no administrative or cross-account mode. ## Two ways to connect Which one you want depends on what is doing the calling. | You are | Use | Start here | | -------------------------------------------------------- | ------------------------------------------------ | ---------------------------------------------------------------------------------- | | **Connecting an AI assistant** such as Claude or ChatGPT | The MCP server, over OAuth | [Connecting AI assistants](/docs/connecting-ai-assistants-to-your-hosting-account) | | **Writing a script, or using a terminal** | The REST API, with an email address and password | [Signing in to the API](/docs/signing-in-to-the-api) | Both reach the same operations. An MCP client sees every endpoint below as a tool it can call; a script calls them as ordinary HTTP requests. ## What you can do with it | Area | What is available | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Account** | Who you are signed in as, the full account holder profile, and every service on the account with its status, renewal date and price | | **Billing** | Invoices and what is outstanding, orders, saved payment methods, your credit balance, and **paying an invoice** | | **Domains** | Your registrations, availability search with prices, nameservers, the registrar lock, and glue records | | **Websites** | Create and delete sites, SSH keys, preview hostnames, one-click app installs, WordPress management including a login link and core updates, PHP version and error log, Node.js versions, persistent apps, databases and database users, mapped domains, and SSL certificates | | **Email** | Mailboxes including passwords, suspension and aliases, forwarders, the catch-all address, DKIM signing, and the DNS records your mail needs | | **Support** | Your tickets and their conversations, read only | | **Sessions** | The sessions currently signed in to your account, and revoking one | ## How requests work **Reads are `GET`. Every change is a `POST`** with its arguments in a JSON body. That is true even for deletions, because each change runs something real at a registrar, on your hosting or on your email service. **Deletions ask you to repeat what you are removing.** A call that deletes something takes a confirmation field, such as `confirm_domain` or `confirm_address`, and the value has to match the thing being deleted. This is deliberate. It means an automated caller, including an AI assistant, cannot delete the wrong website or mailbox through a mistyped parameter. **Lists take `limit` and `offset`** and return a `total` alongside the rows, so you can page through them. ## When something goes wrong Every failure returns the same shape, a stable code and a readable sentence: ```json theme={null} { "error": "unauthorized", "error_description": "No bearer token was sent" } ``` | Code | What it means | | ------------------ | --------------------------------------------------------------------------------------------------------------------- | | **401** | A problem with your bearer token. It is missing, expired or revoked | | **403** | Your connection does not have the scope, client permission or consent for this call | | **404** | The thing you asked for is not on this account | | **409** | A change is already in progress on the same target. Wait for it to finish | | **422** | A field did not validate, or the upstream refused the change. Look for `rejected`, `not_confirmed` or `not_supported` | | **429** | You have hit a rate limit. The `Retry-After` header tells you how long to wait | | **502** or **503** | An upstream service is faulting or down. Not your request | ## Versioning The API is versioned by prefix. Everything currently sits under `/v1`, and within a version **fields are only ever added, never removed or renamed**, so a script written against it today keeps working. Responses are shaped by hosting.com rather than relayed from whatever system sits behind them. No response names an upstream vendor or hands you an upstream credential, so you are not building against something that changes when we change a supplier. ## The specification The API is described in OpenAPI 3.1, and the document is the same one the reference is built from: * [openapi.json](https://api.hosting.com/openapi.json) * [openapi.yaml](https://api.hosting.com/openapi.yaml) You can generate a client from either, or point a tool at the reference directly. ## Related articles * [Connecting AI assistants to your account](/docs/connecting-ai-assistants-to-your-hosting-account) * [Signing in to the API](/docs/signing-in-to-the-api) * [Accessing your hosting control panel](/docs/accessing-your-hosting-control-panel)