API reference

Proxies, from code.

JSON over HTTPS. Everything the dashboard does with proxies, the API does too, paid from your balance. It knows you by a key, exactly like the website, and by nothing else.

Base URLhttps://ghostconnect.io/api/v1/

Authentication

Create a key in Settings. It is shown once; we keep only a SHA-256 hash of it. An account can hold 5 keys, each with a label and each revocable on its own, so the key in one script can be killed without touching the others.

Send it on every request as a bearer token. X-Api-Key is accepted as well. Cookies are ignored: being signed in on the website does not authenticate an API call.

curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account

Replacing your access key in Settings revokes every API key on the account, because anyone who saw the old access key could have created one.

Requests and responses

  • Send bodies as JSON with Content-Type: application/json. Form-encoded bodies also work.
  • Every response is a JSON object. Success is {"ok": true, "data": ...}; failure is {"ok": false, "error": {"code", "message"}} with a matching HTTP status.
  • Money is a string of US dollars, like "14.95", so it never loses a cent to floating point. A few per-unit prices carry a third decimal.
  • Times are Unix seconds. expires_at is null for residential bandwidth, which never expires.
  • Paying requests take the money from your balance at the moment of the call. Add funds on the website with crypto or a card.

Retrying safely

A network can fail after an order went through. To make retries safe, send an Idempotency-Key header on orders, renew and topup: any unique string of 8 to 64 letters, digits, dashes, underscores, colons or dots, one per purchase.

  • The first response to a key is kept for 24 hours. Repeating the same request with the same key returns that response, with Idempotent-Replayed: true, and charges nothing.
  • The same key with a different request is refused with 422 idempotency_key_reused.
  • A retry that arrives while the first request is still running gets 409 idempotency_in_progress.
  • If a request is refused before any money moves (bad input, short balance), its key is released and can be used again for the corrected request.
curl -X POST -H "Authorization: Bearer $GT_KEY" \
  -H "Idempotency-Key: order-2026-09-14-0001" \
  -H "Content-Type: application/json" \
  -d '{"type":"residential","gb":5}' \
  https://ghostconnect.io/api/v1/orders

Rate limits

120 requests a minute per key, of which 30 may be paying requests. Unauthenticated catalog calls get 120 a minute per connection. Past a limit the response is 429 rate_limited with a Retry-After header in seconds.

Errors

StatusCodeMeaning
400invalid_orderA field is missing or not allowed. The message names it.
400invalid_json, invalid_type, invalid_kind, invalid_countryThe request itself is malformed.
400not_renewable, not_toppable, not_supportedThat action does not exist for this proxy type.
400allowlist_failed, auto_renew_failed, reset_failedThe change was refused; the message says why.
401unauthenticated, invalid_keyNo key, or a key that does not exist or was revoked.
402insufficient_balanceThe balance does not cover it. Includes amount_usd and balance_usd. Nothing was charged.
403account_suspendedThe account is suspended.
404not_foundNo such endpoint, or no such proxy or invoice on this account.
405method_not_allowedThe path exists with another method.
409idempotency_in_progressThe first request with this key has not finished.
413body_too_largeBodies are limited to 64 KB.
422idempotency_key_reusedThis key was used for a different request.
429rate_limitedSlow down; see Retry-After.
500internal_errorOur fault. After a paying request, check invoices before retrying without an idempotency key.
502fulfilment_failedPaid, but it could not be set up. The full amount is already back on the balance; the invoice is included with status credited.
503unavailableA dependency did not answer. Try again shortly.

What is recorded

The same as the website, which is almost nothing. There is no access log. Keys have no last-used time and no record of where they were used from. Rate-limit counters are named with a keyed hash that changes daily and are deleted within hours. The only API-specific record is the idempotency response described above, deleted after 24 hours. The rest is what any order leaves: the invoice and the proxy.

Endpoints

GET/catalog

Prices, allowed values and current datacenter stock. No key needed.

curl https://ghostconnect.io/api/v1/catalog
{
  "ok": true,
  "data": {
    "currency": "USD",
    "pays_from": "balance",
    "products": {
      "datacenter": { "price_per_ip_per_31_days_usd": "1.79", "days": [7, 14, 31, ...], "stock": { "ipv4": { "us": 120, ... } } },
      "residential": { "price_per_gb_usd": "2.99", ... },
      "rotating": { ... },
      "isp": { "use_cases": { "us": ["pkc", "ticket", ...] }, ... }
    }
  }
}

GET/account

The account this key belongs to and its balance.

curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account
{
  "ok": true,
  "data": { "id": 48, "balance_usd": "133.68", "created_at": 1789350000, "api_keys": 1 }
}

POST/quote

The exact price of an order, renewal or top-up, without buying it. Takes kind plus the same fields as the matching purchase; renewals and top-ups also take the proxy id.

FieldTypeValues
kindstringdatacenter, residential, rotating, isp, renew_datacenter, renew_rotating, renew_isp, topup_residential
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
  -d '{"kind":"isp","country":"us","use_case":"social","months":1,"quantity":2}' \
  https://ghostconnect.io/api/v1/quote
{
  "ok": true,
  "data": {
    "kind": "isp",
    "description": "ISP x2, US, 1 month",
    "amount_usd": "10.00",
    "lines": { "Country": "United States", "Use case": "Social media", "Term": "1 month", "IPs": 2 },
    "balance_usd": "133.68",
    "balance_covers": true
  }
}

POST/orders

Buy proxies. Pays from the balance and returns 201 with the invoice and the new proxies, credentials included, in the same response. Send an Idempotency-Key.

typeFieldValues
datacentercountryus, ca, uk, fr, nl, de
ip_type optionalipv4, ipv6, default ipv4
days7, 14, 31, 62, 93, 186, 365
quantity optional1 to 100, default 1. Limited by stock in GET /catalog.
residentialgb1 to 1000. Never expires.
rotatingcountryca
threads100 to 5000, in steps of 100
days7, 14, 30, 60, 90
ispcountryus, uk, de, hk, jp, ca, it, fr, pl, es
use_caseDepends on the country; see use_cases in GET /catalog. One of pkc, ticket, sneaker, retail, social, ipqs, aio.
months1 to 24
quantity optional1 to 1000, or up to 249 for 12 months or more. Default 1.
curl -X POST -H "Authorization: Bearer $GT_KEY" \
  -H "Idempotency-Key: order-dc-0001" \
  -H "Content-Type: application/json" \
  -d '{"type":"datacenter","country":"us","ip_type":"ipv4","days":31,"quantity":2}' \
  https://ghostconnect.io/api/v1/orders
{
  "ok": true,
  "data": {
    "invoice": {
      "id": "d3z0sya3", "type": "proxy_datacenter_create",
      "description": "Datacenter IPv4 x2, US, 31 days", "amount_usd": "3.58",
      "payment_method": "balance", "status": "completed",
      "proxy_type": "datacenter", "proxy_id": "k2m9x4qa",
      "created_at": 1789350000, "paid_at": 1789350000, "completed_at": 1789350003
    },
    "proxies": [
      {
        "id": "k2m9x4qa", "type": "datacenter", "created_at": 1789350003,
        "country": "us", "ip_type": "ipv4", "ip": "203.0.113.121",
        "port_http": 10242, "port_socks5": 10243,
        "username": "dxq8m2p", "password": "Zk4pQ9wLr2mT7c",
        "allowlist": [], "expires_at": 1792028403,
        "auto_renew": { "enabled": false, "days": 31 }
      },
      { "id": "p7c1v0ne", ... }
    ],
    "balance_usd": "130.10"
  }
}

Residential proxies come back with a host, credentials and bandwidth in GB. Rotating proxies come back with host, port and threads, and authorise by the allowlist. ISP orders come back as one object with an ips array.

GET/proxies

Every proxy on the account, oldest first, in the same shape as orders returns. Filter with ?type=. GET /proxies/{type}/{id} returns one as {"proxy": ...}; for ISP, the id of any IP in an order returns the whole order.

FieldTypeValues
type optionalquerydatacenter, residential, rotating, isp
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies?type=residential"

POST/proxies/{type}/{id}/renew

Add time to a datacenter, rotating or ISP proxy. An ISP renewal covers every IP in the order. Returns the invoice and the updated proxy. Send an Idempotency-Key: a renewal is not undone by retrying, it is repeated.

FieldTypeValues
daysintdatacenter: 7, 14, 31, 62, 93, 186, 365. rotating: 7, 14, 30, 60, 90.
monthsintisp only: 1 to 24
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: renew-k2m9x4qa-2026-10" \
  -H "Content-Type: application/json" -d '{"days":31}' \
  https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/renew

POST/proxies/residential/{id}/topup

Add bandwidth to a residential proxy. Returns the invoice and the updated proxy.

FieldTypeValues
gbint1 to 1000
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: topup-0001" \
  -H "Content-Type: application/json" -d '{"gb":10}' \
  https://ghostconnect.io/api/v1/proxies/residential/obcl4126/topup

POST/proxies/{type}/{id}/allowlist

Allow a source address to use a datacenter, residential or rotating proxy without the password. POST /proxies/{type}/{id}/allowlist/remove with the same body removes one. ISP proxies authenticate by username and password only.

FieldTypeValues
ipstringA public IPv4 or IPv6 address. Up to 10 per proxy.
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
  -d '{"ip":"198.51.100.7"}' https://ghostconnect.io/api/v1/proxies/rotating/r4t8b2kd/allowlist

POST/proxies/{type}/{id}/auto-renew

Renew automatically from the balance about a day before expiry. For ISP the setting applies to the whole order.

FieldTypeValues
enabledbooltrue, false
periodintWhat each renewal adds. datacenter: 7, 14, 31, 62, 93, 186, 365 days. rotating: 7, 14, 30, 60, 90 days. isp: 1 to 24 months.
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
  -d '{"enabled":true,"period":31}' https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/auto-renew

POST/proxies/{type}/{id}/reset-credentials

Issue a new username and password for a datacenter, residential or rotating proxy. The old ones stop working at once. No body.

curl -X POST -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/reset-credentials

GET/proxies/residential/{id}/connection-string

A ready host:port:username:password line with targeting and session built in.

FieldTypeValues
session optionalqueryrotating, sticky, default rotating
minutes optionalquerySticky session length, 1 to 1440, default 30
country optionalqueryTwo-letter code from targeting_countries in GET /catalog
protocol optionalqueryhttp, socks5, default http
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies/residential/obcl4126/connection-string?session=sticky&minutes=10&country=de"

GET/invoices

The latest 100 invoices, newest first. GET /invoices/{id} returns one, with the proxies it created. Status is one of completed, credited (paid, not deliverable, refunded to the balance), or a payment state for website payments still in progress.

curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/invoices