Overview

The endpoint validates the complete payload, builds the configuration and resources in memory, encrypts the export, and returns it as plain text. It is intended for server-to-server partner automation.

Authentication

Send the credential using one of the supported transports. If both are present, X-Business-API-Key takes precedence.

Complete request

This example includes configuration fields, one server, and one tweak. Omit optional fields that your generated configuration does not need.

curl --request POST "https://httptweak.com/api/business/v1/config/generate" \
  --header "Accept: text/plain" \
  --header "Content-Type: application/json" \
  --header "X-Business-API-Key: YOUR_BUSINESS_API_KEY" \
  --data '{
    "name": "Partner Starter Config",
    "message": "Generated for a partner subscriber",
    "unlock_server": true,
    "servers": [
      {
        "name": "Primary SSH",
        "category": "Premium",
        "tunnel_type": "ssh",
        "ip_port_user_pass": "203.0.113.10:22@demo:secret",
        "note": "Singapore"
      }
    ],
    "tweaks": [
      {
        "name": "WebSocket Payload",
        "category": "Premium",
        "tunnel_type": "ssh",
        "payload": "GET / HTTP/1.1[crlf]Host: example.com[crlf][crlf]",
        "sni": "example.com",
        "tls_version": "TLSv1.3"
      }
    ]
  }'

Smallest valid request

Only name is required. Omitting servers and tweaks produces a valid generated configuration with empty resource lists.

{
  "name": "Minimal Partner Config"
}

Bearer alternative

Authorization: Bearer YOUR_BUSINESS_API_KEY

Request text/plain for the successful generated body. Authentication, validation, quota, and service errors remain JSON.

Parameters

Configuration fields

Server object fields

Tunnel-specific server formats

Conditional fields are selected by tunnel_type. The following examples show the expected separators and minimum companion fields.

Tweak object fields

A request may contain up to 100 servers and 100 tweaks. Heavy text fields are limited to 100000 characters unless a smaller field limit is shown.

Success response

A successful request returns the generated encrypted configuration directly, not a JSON wrapper.

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Cache-Control: no-store, private
X-Configuration-Key: 9d7d6d874a9c4b2ea70c409d70bcb410
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1783737660
X-DailyQuota-Limit: 1000
X-DailyQuota-Used: 18
X-DailyQuota-Remaining: 982
X-DailyQuota-Reset: 1783814400

<generated encrypted configuration text>

Quotas and rate limits

Every account inherits administrator defaults unless it has an override. Read the response headers instead of hard-coding those limits.

• A valid authenticated request consumes the per-minute limit, including a request that later fails payload validation.
• Daily quota is consumed only after the payload passes validation and generation is about to run.
• A generation that fails after validation (HTTP 500) does not refund its consumed daily quota unit.
• Reset header values are Unix timestamps. Daily windows reset at 00:00 UTC; minute windows are aligned to UTC epoch minutes.
• Credential rotation does not reset usage because counters belong to the Business API account, not its credential.

JSON errors

Validation error example

{
  "success": false,
  "message": "The given data was invalid.",
  "errors": {
    "name": ["The name field is required."]
  }
}

Daily quota error example

{
  "success": false,
  "message": "The Business API daily quota has been exceeded.",
  "error": "daily_quota_exceeded",
  "scope": "daily",
  "daily_quota": {
    "limit": 1000,
    "used": 1000,
    "remaining": 0,
    "reset_at": 1783814400,
    "reset_at_iso8601": "2026-07-12T00:00:00+00:00",
    "retry_after": 22500
  }
}

A per-minute 429 has error rate_limit_exceeded and places the same metadata shape under rate_limit.

A quota-enforcement 503 has error quota_service_unavailable and a Retry-After header; retry only after that interval. A maintenance 503 from the global API status carries a status field instead, has no Retry-After header, and clears when the API status returns to available.

Behavior and security

• Generated configurations, servers, and tweaks are built in memory and are not saved to the panel database.
• unique_key is system-owned for the configuration and every server and tweak. Callers must not send it. Each successful generation, including a retry, receives fresh values; no stored record is created or updated.
• Cloud update, cloud password, and cloud HWID are disabled for generated output. Generated configurations are locked to their recipient by default; send allow_reshare: true to permit re-export.
• Each panel user has one Business API account and one current credential.
• Send requests only over HTTPS and apply strict outbound timeout and retry limits.
• Do not log credentials, configuration passwords, private keys, or full generated response bodies.
• Rotate the credential immediately after suspected exposure. The previous credential stops authenticating, while daily usage remains unchanged.