Site settings, one document per section: ai, payment, auth, limits, retention,
branding, email and affiliate. Secrets are returned masked and kept when omitted on PUT.
Get affiliate settings
The affiliate program terms.
Get affiliate settings › Responses
Affiliate settings.
enabledcommission_percentShare of each paid top-up of a referred user credited to the referrer.
commission_monthsCommission is paid on top-ups within this many months of the referral.
referee_bonus_percentExtra credit for the referred user on their first paid top-up.
Update affiliate settings
Replaces the program terms. Omitted fields take their defaults (enabled: false, 10 %,
12 months, 10 %), so send all four. Percentages are rounded to two decimals.
Update affiliate settings › Request Body
enabledcommission_percentShare of each paid top-up of a referred user credited to the referrer.
commission_monthsCommission is paid on top-ups within this many months of the referral.
referee_bonus_percentExtra credit for the referred user on their first paid top-up.
Update affiliate settings › Responses
The saved settings.
enabledcommission_percentShare of each paid top-up of a referred user credited to the referrer.
commission_monthsCommission is paid on top-ups within this many months of the referral.
referee_bonus_percentExtra credit for the referred user on their first paid top-up.
Get AI provider settings
The Sumopod AI upstream. The base URL is fixed by the server; the key is shown masked.
Get AI provider settings › Responses
AI settings.
base_urlSumopod AI base URL (fixed by the server configuration).
api_key_hintMasked key, e.g. sk-****-a1b2; null when not set.
Set the Sumopod AI API key
Saves the Sumopod AI API key after checking it against Sumopod's /models endpoint. Unlike other
sections, the key is required here (400 if empty or rejected by Sumopod; 502 if Sumopod
can't be reached).
Set the Sumopod AI API key › Responses
The saved settings (masked).
base_urlSumopod AI base URL (fixed by the server configuration).
api_key_hintMasked key, e.g. sk-****-a1b2; null when not set.
Get payment settings
Sumopod Managed Payment (QRIS) settings for the sandbox and live environments, with masked secrets and webhook URLs.
Get payment settings › Responses
Payment settings.
enabledenvironmentpayment_methodFixed.
idr_per_usdHow many IDR buy 1 USD of credit.
min_topup_idrmax_topup_idrUpdate payment settings
Saves the payment settings. Per environment, api_key, webhook_token and
webhook_signing_secret are kept when omitted, null or empty; send a value to replace one.
Limits: 10,000 ≤ min_topup_idr ≤ 100,000 and min_topup_idr < max_topup_idr ≤ 10,000,000.
Update payment settings › Request Body
enabledOffer top-ups (also needs an API key for the active environment).
environmentidr_per_usdHow many IDR buy 1 USD of credit.
min_topup_idrmax_topup_idrSecrets for one environment. Omitted, null or empty values keep the stored secret.
Secrets for one environment. Omitted, null or empty values keep the stored secret.
Update payment settings › Responses
The saved settings (masked).
enabledenvironmentpayment_methodFixed.
idr_per_usdHow many IDR buy 1 USD of credit.
min_topup_idrmax_topup_idrGet sign-in settings
Sign-in methods, registration, Google OAuth, email verification, sign-up blocking rules and Cloudflare Turnstile.
Get sign-in settings › Responses
Auth settings.
email_password_enabledregistration_enabledWhen off, only existing accounts can sign in.
google_enabledgoogle_client_idgoogle_client_secret_hintMasked; null when not set.
google_redirect_uriRedirect URI to register with Google (read-only).
require_email_verificationNew email/password sign-ups must confirm their address.
email_readySMTP is set up, so verification and reset emails can go out (read-only).
block_disposable_emailsblock_email_aliasesRefuse +tag aliases and Gmail dot variants of an existing account.
blocked_email_domainsExtra domains to refuse (subdomains included).
turnstile_enabledCloudflare Turnstile on sign-in, sign-up and password reset.
turnstile_site_keyturnstile_secret_key_hintMasked; null when not set.
Update sign-in settings
The first four fields are required. Other non-secret fields keep their current value when omitted.
google_client_secret and turnstile_secret_key are kept when omitted, null or empty.
Validation: at least one of email/password or Google sign-in must stay enabled; Google needs a
client id and secret; Turnstile needs a site key and secret key; blocked_email_domains is
normalized (trimmed, leading @ removed, lower-cased, de-duplicated) and limited to 1000 domains.
Update sign-in settings › Request Body
email_password_enabledregistration_enabledWhen off, only existing accounts can sign in.
google_enabledgoogle_client_idgoogle_client_secretOmitted, null or empty keeps the stored secret.
require_email_verificationblock_disposable_emailsblock_email_aliasesblocked_email_domainsturnstile_enabledturnstile_site_keyturnstile_secret_keyOmitted, null or empty keeps the stored secret.
Update sign-in settings › Responses
The saved settings (masked).
email_password_enabledregistration_enabledWhen off, only existing accounts can sign in.
google_enabledgoogle_client_idgoogle_client_secret_hintMasked; null when not set.
google_redirect_uriRedirect URI to register with Google (read-only).
require_email_verificationNew email/password sign-ups must confirm their address.
email_readySMTP is set up, so verification and reset emails can go out (read-only).
block_disposable_emailsblock_email_aliasesRefuse +tag aliases and Gmail dot variants of an existing account.
blocked_email_domainsExtra domains to refuse (subdomains included).
turnstile_enabledCloudflare Turnstile on sign-in, sign-up and password reset.
turnstile_site_keyturnstile_secret_key_hintMasked; null when not set.
Get request limits
Rate and concurrency limits for the AI endpoints.
Get request limits › Responses
Limits.
key_rpmRequests per minute per API key without its own limit; also the playground's.
user_rpmRequests per minute per user across all their keys; also the highest per-key limit a user can set.
user_max_parallelAI requests in progress at once per user.
Update request limits
Replaces the limits. Omitted fields take their defaults (60 / 300 / 20), so send all three.
Each must be 1..1,000,000 and key_rpm can't exceed user_rpm.
Update request limits › Request Body
key_rpmRequests per minute per API key without its own limit; also the playground's.
user_rpmRequests per minute per user across all their keys; also the highest per-key limit a user can set.
user_max_parallelAI requests in progress at once per user.
Update request limits › Responses
The saved limits.
key_rpmRequests per minute per API key without its own limit; also the playground's.
user_rpmRequests per minute per user across all their keys; also the highest per-key limit a user can set.
user_max_parallelAI requests in progress at once per user.
Get log retention
Retention periods in days (0 keeps forever), current row counts and the last cleanup run.
Get log retention › Responses
Retention settings with stats.
request_logs_daysDeletes request log rows (usage history, analytics and reports go with them; balances are unaffected).
request_details_daysClears client IP, user agent, request parameters and error messages, keeping tokens and cost.
audit_logs_daysDeletes audit entries, except admin credit and starting balance entries (balance history).
payment_payloads_daysClears raw gateway responses and webhook payloads stored on top-ups.
The last cleanup run, if any.
Update log retention
Replaces the retention periods (0-3650 days; 0 keeps forever). Omitted fields become 0
(keep forever). Applied by a scheduled cleanup job, or now with POST /settings/retention/run.
Update log retention › Request Body
request_logs_daysDeletes request log rows (usage history, analytics and reports go with them; balances are unaffected).
request_details_daysClears client IP, user agent, request parameters and error messages, keeping tokens and cost.
audit_logs_daysDeletes audit entries, except admin credit and starting balance entries (balance history).
payment_payloads_daysClears raw gateway responses and webhook payloads stored on top-ups.
Update log retention › Responses
The saved settings with stats.
request_logs_daysDeletes request log rows (usage history, analytics and reports go with them; balances are unaffected).
request_details_daysClears client IP, user agent, request parameters and error messages, keeping tokens and cost.
audit_logs_daysDeletes audit entries, except admin credit and starting balance entries (balance history).
payment_payloads_daysClears raw gateway responses and webhook payloads stored on top-ups.
The last cleanup run, if any.
Run log cleanup now
Applies the saved retention settings now instead of waiting for the next scheduled run.
Run log cleanup now › Responses
What the run did.
started_atfinished_atskippedAnother instance was already running the cleanup.
request_logs_deletedrequest_details_clearedaudit_logs_deletedpayment_payloads_clearedemail_tokens_deletedExpired email verification / reset tokens removed.
Get branding
Site name, public URL, icon and time zone.
Get branding › Responses
Branding.
site_namesite_urlStored value; empty means the server's PUBLIC_URL is used.
default_urlPUBLIC_URL from the server environment (read-only).
icon_urlVersioned public icon URL (/api/branding/icon?v=N); null uses the built-in logo.
timezoneIANA time zone for usage dates and charts.
Update branding
Sets the site name (1-40 characters) and public URL (http(s)://host[:port] without a path;
a trailing / is removed; empty uses the server's PUBLIC_URL). timezone is an IANA name;
omitted or empty keeps the current zone. The icon is managed with /settings/branding/icon.
Update branding › Request Body
site_namesite_urlEmpty string uses PUBLIC_URL.
timezoneIANA time zone, e.g. Asia/Jakarta.
Update branding › Responses
The saved branding.
site_namesite_urlStored value; empty means the server's PUBLIC_URL is used.
default_urlPUBLIC_URL from the server environment (read-only).
icon_urlVersioned public icon URL (/api/branding/icon?v=N); null uses the built-in logo.
timezoneIANA time zone for usage dates and charts.
Upload the site icon
Uploads the site icon as a base64 data URL (as produced by FileReader.readAsDataURL). PNG, SVG,
ICO, JPEG or WebP, at most 256 KB. The public icon URL is versioned so browsers pick up the change.
Upload the site icon › Request Body
data_url^data:image/(png|svg… · requireddata:<mime>;base64,<data>.
Upload the site icon › Responses
The branding with the new icon_url.
site_namesite_urlStored value; empty means the server's PUBLIC_URL is used.
default_urlPUBLIC_URL from the server environment (read-only).
icon_urlVersioned public icon URL (/api/branding/icon?v=N); null uses the built-in logo.
timezoneIANA time zone for usage dates and charts.
Remove the site icon
Removes the uploaded icon; the built-in logo is used again.
Remove the site icon › Responses
The branding with icon_url set to null.
site_namesite_urlStored value; empty means the server's PUBLIC_URL is used.
default_urlPUBLIC_URL from the server environment (read-only).
icon_urlVersioned public icon URL (/api/branding/icon?v=N); null uses the built-in logo.
timezoneIANA time zone for usage dates and charts.
Get email settings
The SMTP provider (password never returned) and every email template with its current subject and body.
Get email settings › Responses
Email settings.
providerenabledsender_emailsender_namesmtp_hostDefaults to smtp.sumopod.com.
smtp_portDefaults to 465.
smtp_usernamesmtp_password_hint•••••••• when a password is stored, else null.
smtp_securitystarttls (usually port 587), tls (usually 465) or none (local test servers only).
Update the SMTP provider
Saves the SMTP settings. smtp_password is kept when omitted or empty. Turning email on needs an
SMTP host and a sender (the sender email, or an email address as the SMTP username). Templates are
edited with /settings/email/templates/{key}.
Update the SMTP provider › Request Body
enabledsender_emailFrom address; may be empty when the username is an email address.
sender_namesmtp_hostsmtp_portsmtp_usernamesmtp_securitystarttls (usually port 587), tls (usually 465) or none (local test servers only).
smtp_passwordEmpty keeps the stored password.
Update the SMTP provider › Responses
The saved settings.
providerenabledsender_emailsender_namesmtp_hostDefaults to smtp.sumopod.com.
smtp_portDefaults to 465.
smtp_usernamesmtp_password_hint•••••••• when a password is stored, else null.
smtp_securitystarttls (usually port 587), tls (usually 465) or none (local test servers only).
Send a test email
Sends one template filled with example values to to, using the saved SMTP settings; the subject
is prefixed with [Test]. Limited to 5 test emails per minute per admin. 502 if the SMTP server
rejects the email.
Send a test email › Request Body
totemplateDefaults to confirm_signup.
Send a test email › Responses
Sent.
sentEdit an email template
Saves a custom subject (1-200 characters) and HTML body (up to 100 KB) for a template. Placeholders
such as {{SiteName}} are listed in the template's variables. enabled only applies to optional
(notification) templates; account emails always stay on.
path Parameters
keyEdit an email template › Request Body
subjectbodyHTML, up to 100 KB.
enabledEdit an email template › Responses
The full email settings.
providerenabledsender_emailsender_namesmtp_hostDefaults to smtp.sumopod.com.
smtp_portDefaults to 465.
smtp_usernamesmtp_password_hint•••••••• when a password is stored, else null.
smtp_securitystarttls (usually port 587), tls (usually 465) or none (local test servers only).
Reset an email template
Restores the built-in subject and body (and re-enables it).
path Parameters
keyReset an email template › Responses
The full email settings.
providerenabledsender_emailsender_namesmtp_hostDefaults to smtp.sumopod.com.
smtp_portDefaults to 465.
smtp_usernamesmtp_password_hint•••••••• when a password is stored, else null.
smtp_securitystarttls (usually port 587), tls (usually 465) or none (local test servers only).