Generate a new import-ready configuration in one request

Send configuration, server, and tweak values from your backend and receive encrypted configuration text ready to import. You can optionally apply Cloud Protect, export the result to the cloud, or use both together.

POSThttps://httptweak.com/api/business/v1/config/generate

Manage Business API View Client API documentation

API guide

Choose the right API

Use Client API for configurations in your Panel account. Use Business API to generate new configurations from request data.

Client API

Work with existing Panel configurations.

List configurations in your account and keep their servers, tweaks, cloud device IDs, and cloud passwords in sync.

Example: Create "Premium Config" in Panel, then keep its resources updated from your backend.

Read Client API documentation

Business API

You are here

Generate a new configuration from request data.

Send configuration, server, and tweak values and receive an import-ready encrypted configuration. The result is not saved in Panel.

Example: A customer chooses options in your app, then your backend generates the configuration.

Continue with Business API

Quick rule: Existing Panel configuration: Client API. New configuration from request data: Business API.

The credentials are separate: manage the Client API credential in Panel > API > Client API and the Business API credential in Panel > API > Business API.

Overview

The endpoint validates the complete payload, builds the configuration and resources in memory, and encrypts the export. By default it returns that importable text directly. Optional delivery fields can wrap it with Cloud Protect and/or store it as a cloud share. It never reads or modifies configurations already saved in Panel; use Client API for that workflow.

Authentication

Send the credential using X-API-Key or Authorization Bearer. If both are present, X-API-Key takes precedence.

Transport	Example	Notes
`X-API-Key`	`X-API-Key: YOUR_BUSINESS_API_KEY`	Recommended explicit header for server-to-server requests.
`Authorization`	`Authorization: Bearer YOUR_BUSINESS_API_KEY`	Standard Bearer authentication alternative.

Get your Business API key: Generate a Business API credential to receive it once, or rotate an existing credential if you no longer have it. Open Business API account management.

Keep credentials server-side. Never embed the Business API credential in a mobile app, browser bundle, public repository, or client-visible log.

Complete request

This example includes configuration fields, one server, and one tweak. Omit optional fields that your generated configuration does not need.

curl --request POST "https://httptweak.com/api/business/v1/config/generate" \
  --header "Accept: text/plain" \
  --header "Content-Type: application/json" \
  --header "X-API-Key: YOUR_BUSINESS_API_KEY" \
  --data '{
    "name": "Partner Starter Config",
    "message": "Generated [config_name] with [server_count] servers: [server_list]",
    "block_application": "WhatsApp\ncom.example.blocked",
    "unlock_server": true,
    "servers": [
      {
        "name": "Primary SSH",
        "category": "Premium",
        "tunnel_type": "ssh",
        "ip_port_user_pass": "203.0.113.10:22@demo:secret",
        "note": "Singapore"
      }
    ],
    "tweaks": [
      {
        "name": "WebSocket Payload",
        "category": "Premium",
        "tunnel_type": "ssh",
        "payload": "GET / HTTP/1.1[crlf]Host: example.com[crlf][crlf]",
        "sni": "example.com",
        "tls_version": "TLSv1.3"
      }
    ]
  }'

Smallest valid request

Only name is required. Omitting servers and tweaks produces a valid generated configuration with empty resource lists.

{
  "name": "Minimal Partner Config"
}

Cloud Protect and cloud export

cloud_protected and export_to_cloud are independent. Enable either one or combine them. expiry and is_one_time_import are valid only when export_to_cloud is true.

{
  "name": "Protected Cloud Partner Config",
  "cloud_protected": true,
  "export_to_cloud": true,
  "is_one_time_import": true,
  "expiry": 60
}

Bearer alternative

Authorization: Bearer YOUR_BUSINESS_API_KEY

Request text/plain for the successful generated body. Authentication, validation, quota, and service errors remain JSON.

Parameters

Configuration fields

Field	Rule	Description
`name`	`required\|string\|max:255`	The configuration label displayed to recipients in HTTP Tweak.
`unique_key`	Response-only; do not send this field.	Always generated by the service as a lowercase 32-character UUID hex value, matching configurations created in Panel. It is returned in X-Configuration-Key and in the generated root object.
`update_url`	`nullable\|url\|max:255`	A direct URL the client can use as the configuration update source. Use HTTPS and return importable configuration content from that URL; omit it when the file should not update from a remote source.
`message`	`nullable\|string\|max:100000`	A message displayed with the generated configuration. HTML and configuration message placeholders are supported; line breaks and surrounding whitespace are preserved.
`expire_date`	`YYYY-MM-DD HH:mm` or `YYYY-MM-DD`	The local date and optional time after which the client must no longer use the configuration. Use YYYY-MM-DD HH:mm, or legacy YYYY-MM-DD for end-of-day expiry. Omit or send null for no expiry.
`password`	`nullable\|string\|max:100`	The access password recipients must supply when opening the configuration. Send plaintext over HTTPS; the service hashes it before export and never returns or stores the plaintext.
`hwid_lock`	`nullable\|string\|max:1000`	A local allowlist of app Device IDs, separated by semicolons, such as ID1;ID2;ID3. Omit it to allow any device. Cloud HWID lookup is not available for generated files.
`device_hwid`	`nullable\|string\|max:32`	An App Device ID, up to 32 characters, permitted to edit this configuration on-device. This is distinct from hwid_lock, which controls who may use it.
`block_application`	`nullable\|string\|max:1000`	App display names or Android package names to block while the configuration is used. Matching is case-insensitive. Separate multiple entries with new lines or semicolons; for example WhatsApp;com.example.two.
`is_mobile_locked`	`nullable\|boolean`	When true, enables the client mobile-lock restriction for this configuration. Defaults to false when omitted and is disabled by unlock_all.
`is_block_root`	`nullable\|boolean`	When true, prevents use on rooted devices. Defaults to false when omitted and is disabled by unlock_all.
`is_ps_install`	`nullable\|boolean`	When true, requires an installation recognized as coming from Google Play. Defaults to false when omitted and is disabled by unlock_all.
`unlock_all`	`nullable\|boolean`	When true, produces an unrestricted file and takes precedence over individual lock and unlock fields. See the normalization note below.
`unlock_server`	`nullable\|boolean`	When true, permits recipients to view or reuse server connection details. unlock_user_pass automatically enables it. Defaults to false and is superseded by unlock_all.
`unlock_user_pass`	`nullable\|boolean`	When true, permits recipients to view server usernames and passwords and automatically enables unlock_server. Defaults to false and is superseded by unlock_all.
`unlock_proxy`	`nullable\|boolean`	When true, permits recipients to view proxy values stored in tweaks. Defaults to false and is superseded by unlock_all.
`unlock_payload`	`nullable\|boolean`	When true, permits recipients to view payload text stored in tweaks. Defaults to false and is superseded by unlock_all.
`is_hide_banner`	`nullable\|boolean`	When true, hides the SSH banner in the client. It has no effect on non-SSH tunnels. Defaults to false.
`is_shared_resources`	`nullable\|boolean`	When true, allows the servers and tweaks in this configuration to be offered as shared resources to other configurations in the app. Defaults to false.
`is_show_shared_resources`	`nullable\|boolean`	When true, allows this configuration to display compatible resources shared by other configurations in the app. Defaults to false.
`is_custom_resources`	`nullable\|boolean`	When true, permits recipients to add local custom servers and tweaks for this configuration. Defaults to false and is disabled by unlock_all.
`allow_reshare`	`nullable\|boolean`	When true, the recipient can export and reshare the generated configuration from the app. Defaults to false when omitted, keeping the file locked to its recipient.
`cloud_protected`	`nullable\|boolean`	When true, marks the generated payload for Cloud Protect, wraps it in a protected envelope, and registers the key material needed by the app. Defaults to false.
`export_to_cloud`	`nullable\|boolean`	When true, uploads the generated result to the configured cloud-share disk and returns the short app import link as the response body. Defaults to false.
`is_one_time_import`	`nullable\|boolean`; requires `export_to_cloud: true`	Cloud-export option. When true, the cloud share can be imported only once. Defaults to false.
`expiry`	`nullable\|integer\|min:1`; requires `export_to_cloud: true`	Cloud-export option. Positive lifetime in minutes; omit it for no time-based share expiry. This is separate from the configuration expire_date.
`servers`	`nullable\|array\|max:100`	An optional array of server objects. Omit it or send an empty array for no servers. Items are generated only for this response and are not saved in Panel.
`tweaks`	`nullable\|array\|max:100`	An optional array of tweak objects. Omit it or send an empty array for no tweaks. Items are generated only for this response and are not saved in Panel.

Message placeholders

The message field can contain these placeholders. They are resolved while the generated configuration is built, before the encrypted text response is returned.

[config_name] — Configuration name.
[created_at] — Creation date and time in YYYY-MM-DD HH:mm:ss format.
[created_date] — Creation date in YYYY-MM-DD format.
[updated_at] — Last-updated date and time in YYYY-MM-DD HH:mm:ss format.
[updated_date] — Last-updated date in YYYY-MM-DD format.
[server_count] — Number of servers included in the generated configuration.
[tweak_count] — Number of tweaks included in the generated configuration.
[server_list] — Server names in alphabetical order, separated by commas.
[tweak_list] — Tweak names in alphabetical order, separated by commas.

Placeholders are case-sensitive. Unknown placeholders remain unchanged. Empty server or tweak lists resolve to an empty string.

The top-level version is always 5 and matches the real data cipher. version_code and version_name come from Business API administration. Callers do not send version fields.

When unlock_all is true, device and app restrictions, expiry, password, HWID lock, individual unlock flags, and custom-resource mode are normalized off in the generated export. Cloud Protect and cloud export remain independent delivery choices.

Server and tweak fields are tunnel-specific, matching the Configuration form. Sending a field that is hidden for the selected tunnel returns HTTP 422. Server and tweak names and categories are limited to 100 characters.

Server object fields

Field	Rule	Description
`name`	`required\|string\|max:100`	The server label displayed in HTTP Tweak. It must be non-empty.
`category`	`nullable\|string\|max:100`	Groups the server with tweaks. When set, the server appears when a selected tweak uses the same category. Examples: WS, CF, Free, or Paid.
`note`	`nullable\|string\|max:255`	Optional display note for the server. It does not affect the connection.
`unique_key`	Response-only; do not send this field.	Always generated independently for every server or tweak as a lowercase 32-character UUID hex value, matching resources created in Panel.
`tunnel_type`	Required; one exact supported tunnel value.	`ovpn_tcp`, `ovpn_udp`, `ssh`, `dnstt`, `hysteria`, `v2ray_default`, `v2ray_vless`, `v2ray_vmess`, `v2ray_hysteria2`, `v2ray_socks`, `v2ray_http`, `v2ray_ss`, `v2ray_trojan`, `v2ray_wireguard`.
`ip_port_user_pass`	Required for OVPN, SSH, DNSTT, and UDP Hysteria tunnel types.	Connection hosts and credentials in the tunnel-specific format shown below. Separators such as semicolons, colons, and @ are part of the value and must not be URL-encoded.
`ssl_port`	`nullable\|integer\|between:1,65535`	Optional SSL/TLS port for ovpn_tcp and SSH connections, commonly 443. It must be from 1 through 65535 and is not accepted for other tunnel types.
`ovpn_config`	Required for ovpn_tcp and ovpn_udp; at least 5 characters and up to max_payload_length.	The complete OpenVPN profile text, including remote directives. Line breaks and surrounding whitespace are preserved exactly.
`ovpn_pk`	`nullable\|string\|max_payload_length`	Optional OpenVPN private-key text. Line breaks and surrounding whitespace are preserved exactly.
`ssh_pk`	Optional string up to max_payload_length; for SSH it must contain a BEGIN ... KEY PEM header.	Optional SSH private key in PEM form. Preserve its header, footer, and line breaks exactly.
`hysteria_bandwidth`	`nullable\|regex:digits:digits\|max:21`	Optional upload:download bandwidth pair for UDP Hysteria, for example 100:100.
`hysteria_alpn`	`nullable\|string\|max:255`	Optional UDP Hysteria ALPN. It is blank by default; set a protocol such as h3 only when the server requires it.
`hysteria_hop_interval`	`nullable\|string\|max:10\|digits`	Optional port-hopping interval stored as a digit string. The form defaults to 10; null or blank lets the app use its fallback of 10.
`hysteria_allow_insecure`	`nullable\|boolean`	Controls UDP Hysteria certificate verification. It defaults to true, and an explicit false is preserved in generated configurations.
`v2ray_config`	Required for every v2ray_* tunnel type; valid JSON, a protocol URI, or INI text up to max_payload_length.	Complete V2Ray connection input. It may be JSON, a supported protocol URI, or WireGuard INI text, depending on tunnel_type. Whitespace is preserved.
`dnstt_pubkey`	Required when tunnel_type is dnstt; string, maximum 255 characters.	The DNSTT server public key paired with the nameserver credentials.

Tunnel-specific server formats

Conditional fields are selected by tunnel_type. The following examples show the expected separators and minimum companion fields.

Tunnel	Required fields	Format example
OVPN types	`ip_port_user_pass`, `ovpn_config`	`user:pass` `remote vpn.example.com 1194`
`ssh`	`ip_port_user_pass`	`host1;host2:22@user:pass`
`dnstt`	`ip_port_user_pass`, `dnstt_pubkey`	`ns1.example.com;ns2.example.com@user:pass`
`hysteria`	`ip_port_user_pass`	`hy.example.com:443@my-auth` or `hy.example.com:443@my-auth:my-obfs` Multiple hosts: `hy1.example.com;hy2.example.com:443@my-auth:my-obfs` `hysteria_bandwidth: "100:100"`, `hysteria_allow_insecure: true`, `hysteria_hop_interval: "10"`
`v2ray_*`	`v2ray_config`	JSON, protocol URI, or WireGuard INI text.

IPv6 value formats: Keep host-only addresses unbracketed, for example 2001:db8::10. When a port follows, wrap each IPv6 address in brackets, for example [2001:db8::10]:22@user:pass. Multiple candidates may share one port and credentials, for example [2001:db8::10];[2001:db8::11]:22@user:pass. Tweak examples include an IPv6 proxy or UDP DNSTT resolver: [2001:db8::10]:8080 or [2001:db8::53]:53.

Tweak object fields

Field	Rule	Description
`name`	`required\|string\|max:100`	The tweak label displayed in HTTP Tweak. It must be non-empty.
`category`	`nullable\|string\|max:100`	Groups the tweak with servers. When set, only servers using the same category are shown after this tweak is selected. Examples: WS, CF, Free, or Paid.
`note`	`nullable\|string\|max:255`	Optional display note for the tweak. It does not change tunnel behavior.
`unique_key`	Response-only; do not send this field.	Always generated independently for every server or tweak as a lowercase 32-character UUID hex value, matching resources created in Panel.
`tunnel_type`	Required; one exact supported tunnel value.	Uses the server tunnel_type values and additionally accepts ovpn_tcp_ssh for tweaks.
`payload`	`nullable\|string\|max_payload_length`	Optional HTTP payload for OVPN/SSH-style tunnels. Use app tokens such as [crlf] for line boundaries; line breaks and surrounding whitespace are preserved exactly.
`sni`	`nullable\|string\|max_payload_length`	Optional TLS Server Name Indication host. Multiple candidates may be separated with semicolons, for example sni1.example;sni2.example.
`proxy`	`nullable\|string\|max_payload_length`	Optional proxy value. Use host:port or host:port@user:pass; multiple hosts may be separated with semicolons.
`dnstt_payload`	`nullable\|string\|max_payload_length`	Optional payload used with a DNSTT tweak. It supports the same payload tokens and whitespace-preservation behavior as payload.
`hysteria_sni`	`nullable\|string\|max:253`	Optional UDP Hysteria SNI value. [host], [ip], [ssh_host], [rlb], [bughost], [cf], their uppercase forms, and the existing extended host aliases resolve to the selected Hysteria endpoint host; [proxy] is not supported. This belongs to the tweak and follows the app's unlock_payload protection.
`bug_host`	`nullable\|string\|max:255`	Optional host for V2Ray-style tweaks. Place [bughost] in v2ray_config where this value should be substituted by the app.
`tls_version`	`nullable\|in:default,TLSv1.1,TLSv1.2,TLSv1.3`	Optional exact TLS mode for compatible OVPN/SSH tweaks. Use default to let the client choose, or select TLSv1.1, TLSv1.2, or TLSv1.3.
`dnstt_resolver`	Required when tunnel_type is dnstt; string, maximum 255 characters.	DNSTT resolver address. Examples: https://resolver.example/dns-query for DoH, resolver.example:853 for DoT, or 1.1.1.1:53 for UDP.

A request may contain up to 100 servers and 100 tweaks. Heavy text fields are limited to 100000 characters unless a smaller field limit is shown.

Examples by tunnel type

Expand a tunnel to copy a complete generation request using valid server and tweak fields. Replace the sample connection values before sending it.

ovpn_tcp_ssh OpenVPN TCP & SSH Tweak only

Generation request

ovpn_tcp_ssh is supported for tweaks only. Use ovpn_tcp or ssh when a matching server is required.

{
    "name": "OpenVPN TCP & SSH Generated Configuration",
    "tweaks": [
        {
            "name": "OpenVPN TCP & SSH WebSocket",
            "tunnel_type": "ovpn_tcp_ssh",
            "payload": "GET / HTTP/1.1[crlf]Host: edge.example.com[crlf][crlf]",
            "sni": "edge.example.com",
            "proxy": "proxy.example.com:8080",
            "tls_version": "TLSv1.3"
        }
    ]
}

ovpn_tcp OpenVPN TCP Server + tweak

Generation request

{
    "name": "OpenVPN TCP Generated Configuration",
    "servers": [
        {
            "name": "OpenVPN TCP Server",
            "tunnel_type": "ovpn_tcp",
            "ip_port_user_pass": "vpn.example.com:443@demo:secret",
            "ssl_port": 443,
            "ovpn_config": "client\nproto tcp\nremote vpn.example.com 443"
        }
    ],
    "tweaks": [
        {
            "name": "OpenVPN TCP SNI",
            "tunnel_type": "ovpn_tcp",
            "sni": "edge.example.com",
            "tls_version": "TLSv1.3"
        }
    ]
}

ovpn_udp OpenVPN UDP Server + tweak

Generation request

{
    "name": "OpenVPN UDP Generated Configuration",
    "servers": [
        {
            "name": "OpenVPN UDP Server",
            "tunnel_type": "ovpn_udp",
            "ip_port_user_pass": "vpn.example.com:1194@demo:secret",
            "ovpn_config": "client\nproto udp\nremote vpn.example.com 1194"
        }
    ],
    "tweaks": [
        {
            "name": "OpenVPN UDP Default",
            "tunnel_type": "ovpn_udp",
            "note": "UDP mode has no advanced tweak fields."
        }
    ]
}

ssh SSH Server + tweak

Generation request

{
    "name": "SSH Generated Configuration",
    "servers": [
        {
            "name": "SSH Server",
            "tunnel_type": "ssh",
            "ip_port_user_pass": "ssh.example.com:22@demo:secret",
            "ssl_port": 443
        }
    ],
    "tweaks": [
        {
            "name": "SSH WebSocket",
            "tunnel_type": "ssh",
            "payload": "GET / HTTP/1.1[crlf]Host: edge.example.com[crlf][crlf]",
            "sni": "edge.example.com",
            "proxy": "proxy.example.com:8080",
            "tls_version": "TLSv1.3"
        }
    ]
}

dnstt SlowDNS (DNSTT) Server + tweak

Generation request

{
    "name": "SlowDNS (DNSTT) Generated Configuration",
    "servers": [
        {
            "name": "DNSTT Server",
            "tunnel_type": "dnstt",
            "ip_port_user_pass": "ns.example.com@demo:secret",
            "dnstt_pubkey": "DNSTT_SERVER_PUBLIC_KEY"
        }
    ],
    "tweaks": [
        {
            "name": "DNSTT UDP Resolver",
            "tunnel_type": "dnstt",
            "dnstt_resolver": "1.1.1.1:53",
            "dnstt_payload": "dns.example.com"
        }
    ]
}

hysteria UDP Hysteria Server + tweak

Generation request

{
    "name": "UDP Hysteria Generated Configuration",
    "servers": [
        {
            "name": "Hysteria Server",
            "tunnel_type": "hysteria",
            "ip_port_user_pass": "hy.example.com:443@auth-token:obfs-password",
            "hysteria_bandwidth": "20:50",
            "hysteria_alpn": "h3",
            "hysteria_allow_insecure": false,
            "hysteria_hop_interval": "10"
        }
    ],
    "tweaks": [
        {
            "name": "Hysteria SNI",
            "tunnel_type": "hysteria",
            "hysteria_sni": "hy.example.com"
        }
    ]
}

v2ray_default V2Ray Default Server + tweak

Generation request

{
    "name": "V2Ray Default Generated Configuration",
    "servers": [
        {
            "name": "V2Ray Default Server",
            "tunnel_type": "v2ray_default",
            "v2ray_config": "{\"outbounds\":[{\"protocol\":\"freedom\"}]}"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray Default Bug Host",
            "tunnel_type": "v2ray_default",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_vless V2Ray VLESS Server + tweak

Generation request

{
    "name": "V2Ray VLESS Generated Configuration",
    "servers": [
        {
            "name": "V2Ray VLESS Server",
            "tunnel_type": "v2ray_vless",
            "v2ray_config": "vless://[email protected]:443?security=tls"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray VLESS Bug Host",
            "tunnel_type": "v2ray_vless",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_vmess V2Ray VMess Server + tweak

Generation request

{
    "name": "V2Ray VMess Generated Configuration",
    "servers": [
        {
            "name": "V2Ray VMess Server",
            "tunnel_type": "v2ray_vmess",
            "v2ray_config": "vmess://BASE64_ENCODED_VMESS_PROFILE"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray VMess Bug Host",
            "tunnel_type": "v2ray_vmess",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_hysteria2 V2Ray Hysteria2 Server + tweak

Generation request

{
    "name": "V2Ray Hysteria2 Generated Configuration",
    "servers": [
        {
            "name": "V2Ray Hysteria2 Server",
            "tunnel_type": "v2ray_hysteria2",
            "v2ray_config": "hysteria2://[email protected]:443"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray Hysteria2 Bug Host",
            "tunnel_type": "v2ray_hysteria2",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_socks V2Ray SOCKS Server + tweak

Generation request

{
    "name": "V2Ray SOCKS Generated Configuration",
    "servers": [
        {
            "name": "V2Ray SOCKS Server",
            "tunnel_type": "v2ray_socks",
            "v2ray_config": "socks://demo:[email protected]:1080"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray SOCKS Bug Host",
            "tunnel_type": "v2ray_socks",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_http V2Ray HTTP Server + tweak

Generation request

{
    "name": "V2Ray HTTP Generated Configuration",
    "servers": [
        {
            "name": "V2Ray HTTP Server",
            "tunnel_type": "v2ray_http",
            "v2ray_config": "http://demo:[email protected]:8080"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray HTTP Bug Host",
            "tunnel_type": "v2ray_http",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_ss V2Ray Shadowsocks Server + tweak

Generation request

{
    "name": "V2Ray Shadowsocks Generated Configuration",
    "servers": [
        {
            "name": "V2Ray Shadowsocks Server",
            "tunnel_type": "v2ray_ss",
            "v2ray_config": "ss://[email protected]:8388"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray Shadowsocks Bug Host",
            "tunnel_type": "v2ray_ss",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_trojan V2Ray Trojan Server + tweak

Generation request

{
    "name": "V2Ray Trojan Generated Configuration",
    "servers": [
        {
            "name": "V2Ray Trojan Server",
            "tunnel_type": "v2ray_trojan",
            "v2ray_config": "trojan://[email protected]:443?security=tls"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray Trojan Bug Host",
            "tunnel_type": "v2ray_trojan",
            "bug_host": "edge.example.com"
        }
    ]
}

v2ray_wireguard V2Ray WireGuard Server + tweak

Generation request

{
    "name": "V2Ray WireGuard Generated Configuration",
    "servers": [
        {
            "name": "V2Ray WireGuard Server",
            "tunnel_type": "v2ray_wireguard",
            "v2ray_config": "[Interface]\nPrivateKey = CLIENT_PRIVATE_KEY\nAddress = 10.0.0.2/32\n\n[Peer]\nPublicKey = SERVER_PUBLIC_KEY\nEndpoint = wg.example.com:51820"
        }
    ],
    "tweaks": [
        {
            "name": "V2Ray WireGuard Bug Host",
            "tunnel_type": "v2ray_wireguard",
            "bug_host": "edge.example.com"
        }
    ]
}

Success response

A successful request returns plain text, not a JSON wrapper. Direct mode returns the generated import content; cloud mode returns the short cloud import link.

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Cache-Control: no-store, private
X-Configuration-Key: 9d7d6d874a9c4b2ea70c409d70bcb410
X-Cloud-Protected: false
X-Export-Mode: direct
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1783737660
X-DailyQuota-Limit: 2000
X-DailyQuota-Used: 18
X-DailyQuota-Remaining: 1982
X-DailyQuota-Reset: 1783814400

<generated encrypted configuration text>

Read the response body as text. X-Configuration-Key identifies the generated configuration. X-Cloud-Protected reports whether Cloud Protect was applied, and X-Export-Mode is direct or cloud. Cache-Control: no-store tells intermediaries and clients not to retain the sensitive response.

Cloud export response body

When export_to_cloud is true, the body is the app import link. The cloud share stores the generated content; if cloud_protected is also true, the stored content is the Cloud Protect envelope.

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Cache-Control: no-store, private
X-Configuration-Key: 9d7d6d874a9c4b2ea70c409d70bcb410
X-Cloud-Protected: true
X-Export-Mode: cloud

httptweak://HTa1b2c3

Quotas and rate limits

Every account inherits administrator defaults unless it has an override. Read the response headers instead of hard-coding those limits.

Header	Meaning
`X-RateLimit-Limit` `X-RateLimit-Remaining` `X-RateLimit-Reset`	Per-account aligned-minute limit, remaining requests, and reset time.
`X-DailyQuota-Limit` `X-DailyQuota-Used` `X-DailyQuota-Remaining` `X-DailyQuota-Reset`	UTC calendar-day limit, consumed requests, remaining requests, and reset time.
`Retry-After`	Seconds until retry, included on a 429 response.

A valid authenticated request consumes the per-minute limit, including a request that later fails payload validation.
Daily quota is consumed only after the payload passes validation and generation is about to run.
A generation that fails after validation (HTTP 500) does not refund its consumed daily quota unit.
Reset header values are Unix timestamps. Daily windows reset at 00:00 UTC; minute windows are aligned to UTC epoch minutes.
Credential rotation does not reset usage because counters belong to the Business API account, not its credential.

JSON errors

HTTP status	Meaning
`401`	The credential is missing, malformed, or invalid.
`403`	The Business API account, its owner, or access status is inactive.
`413`	The generated result exceeds the configured maximum size for cloud export.
`422`	One or more configuration, server, or tweak parameters failed validation.
`429`	The per-minute limit, daily quota, or invalid-authentication limit was exceeded.
`500`	An unexpected generation, Cloud Protect, cloud upload, or server failure occurred. The consumed daily quota unit is not refunded. Do not retry indefinitely.
`503`	Quota enforcement is temporarily unavailable, or the API is in maintenance mode.

Validation error example

{
  "success": false,
  "message": "The given data was invalid.",
  "errors": {
    "name": ["The name field is required."]
  }
}

Daily quota error example

{
  "success": false,
  "message": "The Business API daily quota has been exceeded.",
  "error": "daily_quota_exceeded",
  "scope": "daily",
  "daily_quota": {
    "limit": 2000,
    "used": 2000,
    "remaining": 0,
    "reset_at": 1783814400,
    "reset_at_iso8601": "2026-07-12T00:00:00+00:00",
    "retry_after": 22500
  }
}

A per-minute 429 has error rate_limit_exceeded and places the same metadata shape under rate_limit.

A quota-enforcement 503 has error quota_service_unavailable and a Retry-After header; retry only after that interval. A maintenance 503 from the global API status carries a status field instead, has no Retry-After header, and clears when the API status returns to available.

Behavior and security

Generated configuration, server, and tweak entities are built in memory and are not saved to Panel. Cloud Protect stores its key material, and export_to_cloud stores share metadata plus the generated content so the import link can work.
unique_key is system-owned for the configuration and every server and tweak. Callers must not send it. Each successful generation, including a retry, receives fresh values; no stored record is created or updated.
Cloud Protect and cloud export are optional delivery features. Cloud update, cloud password, and cloud HWID remain disabled because the generated configuration itself is not saved. Generated configurations are locked to their recipient by default; send allow_reshare: true to permit re-export.
Each panel user has one Business API account and one current credential.
Send requests only over HTTPS and apply strict outbound timeout and retry limits.
Do not log credentials, configuration passwords, private keys, or full generated response bodies.
Rotate the credential immediately after suspected exposure. The previous credential stops authenticating, while daily usage remains unchanged.

Credential display is one-time only. The panel stores a hash and a short preview, not a recoverable copy. Losing the secret requires credential rotation.

Manage Business API View Client API documentation

Business API Documentation

Choose the right API

Client API

Business API

Overview

Authentication

Complete request

Smallest valid request

Cloud Protect and cloud export

Bearer alternative

Parameters

Configuration fields

Message placeholders

Server object fields

Tunnel-specific server formats

Tweak object fields

Examples by tunnel type

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Generation request

Success response

Cloud export response body

Quotas and rate limits

JSON errors

Validation error example

Daily quota error example

Behavior and security