Reference

Base URL: https://api.hypercall.dev

Authenticate /api/* calls with your API key:

curl -H "Authorization: Bearer $HYPERCALL_KEY" https://api.hypercall.dev/api/me

/stats/{token} and /locations/* need no authentication.

Prefer a machine-readable spec? Download openapi.yaml and import it into Postman, Insomnia, or your client generator.

Your account

GET /api/me

Your account summary. Returns every account field:

{
  "id": "6f1c1f8e-6f0a-4b8f-9a5e-2f9d1c3b7a10",
  "parent_id": null,
  "can_resell": true,
  "name": "acme",
  "status": "active",
  "proxy_username": "acme",
  "proxy_password": "<your proxy password>",
  "stats_token": "<opaque token>",
  "max_bytes": 500000000000,
  "allocated_bytes": 0,
  "bytes_used": 2885007,
  "remaining_bytes": 499997114993,
  "thread_cap": null,
  "speed_limit_mbps": null,
  "expires_at": null,
  "ip_auths": [],
  "ip_restrictions": [],
  "created_at": "2026-01-12T09:30:00Z"
}

status is one of active, suspended, depleted, expired. max_bytes: null means unlimited. See Usage & limits for what the byte fields mean.

GET /api/me/proxies

Generate ready-to-use proxy strings.

curl -H "Authorization: Bearer $HYPERCALL_KEY" \
  'https://api.hypercall.dev/api/me/proxies?country=us&count=5&format=txt'

JSON responses are an array of:

{
  "server": "us-east",
  "host": "us.proxy.hypercall.dev",
  "username": "acme-country-us-sid-48291057",
  "password": "<proxy password>",
  "http_port": 4444,
  "socks5_port": 1080,
  "http_url": "http://acme-country-us-sid-48291057:<password>@us.proxy.hypercall.dev:4444",
  "socks5_url": "socks5://acme-country-us-sid-48291057:<password>@us.proxy.hypercall.dev:1080"
}

POST /api/me/rotate-password

Returns {"proxy_password": "..."} exactly once. See Credentials.

POST /api/me/rotate-key

Returns {"api_key": "uk_..."} and revokes every other key on the account, including the one used for this request.

GET /api/nodes

Entry nodes you can connect to:

[{ "id": "...", "name": "us-east", "host": "us.proxy.hypercall.dev", "region": "us", "http_port": 4444, "socks5_port": 1080 }]

Sub-users

All sub-user routes require can_resell on your account and only ever see your own sub-users; anyone else’s return 404.

POST /api/users

Create a sub-user and fund it from your balance. Accepts an Idempotency-Key header.

curl -H "Authorization: Bearer $HYPERCALL_KEY" -X POST \
  -H 'Content-Type: application/json' \
  -d '{"name": "customer-a", "gb": 50}' \
  https://api.hypercall.dev/api/users

Returns {"user": {...}, "api_key": "uk_..."}. The key is shown once.

GET /api/users and GET /api/users/{id}

List your sub-users, or fetch one. Same shape as GET /api/me.

PATCH /api/users/{id}

Update name, status (active or suspended only), can_resell, thread_cap, or speed_limit_mbps. depleted and expired are computed states and cannot be set.

DELETE /api/users/{id}

Returns {"deleted": true}. The sub-user’s unused balance returns to you.

POST /api/users/{id}/allocate

Body {"gb": 25}. Moves GB from your balance into theirs. Accepts an Idempotency-Key header. Insufficient balance returns a billing 422.

POST /api/users/{id}/refund

Body {"gb": 10}, or an empty body to reclaim everything they haven’t spent.

POST /api/users/{id}/rotate-password

Returns {"proxy_password": "..."} once. You never need the old one.

PUT /api/users/{id}/allowed-ips

Body {"cidrs": ["203.0.113.0/24"]}. Restricts where the sub-user’s credentials work. Empty list = unrestricted. Returns {"allowed_ips": [...]}.

PUT /api/users/{id}/ip-auths

Body {"ips": ["203.0.113.7"]}. Source IPs that authenticate as this account with no password (see IP authentication). Returns {"ip_auths": [...]}.

GET /api/users/{id}/proxies

Same parameters and response as /api/me/proxies, for a sub-user.

Public (no auth)

GET /stats/{token}

Usage by the account’s opaque stats_token. Add ?format=txt for used=... total=... remaining=... (with unlimited on unlimited accounts). See Usage & limits.

GET /locations/...

What the network can currently serve, as flat JSON arrays of strings:

curl 'https://api.hypercall.dev/locations/cities?country=us&region=texas'

Errors

See API overview for status codes and the two 422 shapes.