Skip to main content
The Orbitel Shield REST API provides your scripts and dashboards with the same account-scoped data as the panel. Send requests over HTTPS to read services, invoices, protection, analytics, and tickets, or use write scopes to change protection and support tickets.

​
Base URL

Paths in this reference are relative to this base URL. Request examples use the complete URL.

​
Authentication

Create a key under API keys in the panel. Send it as a bearer token on every request.
Replace the placeholder with your key privately. Do not commit keys to source control or include them in logs, support tickets, screenshots, or documentation.
Keys work only under /api/v1/public. Panel pages, account pages, billing actions, and the admin area do not accept them. Conversely, the public API never accepts a signed-in browser session in place of a key. Public invoice read endpoints remain available with the appropriate scope.

​
Key controls

  • Limit a key to a list of allowed IP addresses if needed.
  • Set an expiry to restrict its lifetime.
  • Revoke a key to invalidate it on the next request.
  • Grant only the scopes needed by the integration.

​
Scopes

Do not assume a write scope also grants the corresponding read scope. Include the scopes needed for each endpoint your integration calls.

​
Check a key

​
GET /key

Works with any scope. Use this endpoint to check that a key is valid and inspect its name, prefix, scopes, and expiry.
This returns information about the key that authenticated the request, not another key identified by an ID. The supplied specification does not define its exact JSON field names or response envelope.

​
Rate limits

Each key allows 120 requests per minute, of which 30 may change something. The write allowance is part of the total, not an additional 30 requests. Repeated bad keys from one IP address are blocked for 10 minutes. Correct authentication problems rather than repeatedly submitting an invalid key. When a request returns 429 rate_limited, wait for the number of seconds specified in the Retry-After response header before trying again. See errors.

​
Resource reference

Services and invoices

Read service plans and status, then inspect invoice totals, lines, tax, and payments.

Protection reads

Inspect prefixes and tunnels, query live traffic windows, and retrieve attack history.

Protection changes

Add or remove prefixes, create GRE tunnels, update delivery, and re-sync the network.

Support tickets

Read messages and attachments, open requests, reply, and close tickets.

Errors

Handle authentication, scope, IP allowlist, validation, and rate-limit failures.

Webhook signatures

Verify signed attack alerts using the raw body, timestamp, and channel signing secret.