Hostingsurge Policies API

openapi: 3.2.0
info:
  title: Hostingsurge Platform Policies API
  version: 1.0.0
  description: 'Deploy and operate projects on Hostingsurge: Git/upload/Docker/WordPress projects, deployments, logs, environment variables, domains and databases. Errors are {"error":{"code","message","details?"}}.'
servers:
- url: /api/v1
  description: Same origin as the dashboard, e.g. https://hostingsurge.com/api/v1
security:
- bearerAuth: []
- sessionCookie: []
tags:
- name: Policies
paths:
  /policies/generate:
    post:
      tags:
      - Policies
      summary: 'Generate the legal texts a website needs from its own facts: privacy policy…'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                language:
                  type: string
                  enum:
                  - da
                  - de
                  - en
                  - es
                  - fr
                  - id
                  - nb
                  - pt
                  - sv
                facts:
                  type: object
                  properties:
                    name:
                      type: string
                      minLength: 1
                      maxLength: 120
                      description: 'who runs the site: the company or person that is responsible for the personal data'
                    orgNumber:
                      type: string
                      maxLength: 40
                      description: company registration number, left out of the texts when missing
                    address:
                      type: string
                      maxLength: 240
                      description: postal address, left out of the texts when missing
                    email:
                      type: string
                      minLength: 3
                      maxLength: 160
                      pattern: ^[^\s<>@,;"]+@[^\s<>@,;"]+\.[^\s<>@,;"]+$
                      description: where visitors reach the controller about their data
                    website:
                      type: string
                      maxLength: 200
                      description: the site's address, e.g. example.com
                    country:
                      type: string
                      pattern: ^[A-Z]{2}$
                      description: 'ISO country of the controller (SE, DK, NO, FR, ES, PT, DE ...): picks the supervisory authority and the governing law'
                  required:
                  - name
                  - email
                features:
                  type: object
                  properties:
                    contactForm:
                      type: boolean
                      default: false
                      description: visitors send a message through a form
                    newsletter:
                      type: boolean
                      default: false
                      description: visitors sign up for a mailing list
                    accounts:
                      type: boolean
                      default: false
                      description: visitors can create an account and sign in
                    shop:
                      type: boolean
                      default: false
                      description: the site sells goods or services; adds terms of sale and returns
                    analytics:
                      type: boolean
                      default: false
                      description: visits are measured with an analytics tool
                    embeddedMedia:
                      type: boolean
                      default: false
                      description: videos, maps or other content from other services is embedded
                    payments:
                      type: boolean
                      default: false
                      description: visitors pay on the site
                  default:
                    contactForm: false
                    newsletter: false
                    accounts: false
                    shop: false
                    analytics: false
                    embeddedMedia: false
                    payments: false
                recipients:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                        minLength: 1
                        maxLength: 80
                        description: the service, e.g. "Stripe" or "Mailchimp"
                      purpose:
                        type: string
                        maxLength: 160
                        description: what it is used for, e.g. "card payments"
                      outsideEu:
                        type: boolean
                        default: false
                        description: true when the service is based or processes data outside the EU/EEA; it is then named under transfers
                    required:
                    - name
                  maxItems: 20
                  default: []
                  description: other services the site uses that receive personal data
                analyticsTool:
                  type: string
                  maxLength: 80
                  description: name of the analytics tool, used when features.analytics is on
              required:
              - language
              - facts
      responses:
        '200':
          description: The documents, each as plain text, an HTML fragment and Markdown
          content:
            application/json:
              schema:
                type: object
                properties:
                  documents:
                    type: array
                    items:
                      type: object
                      properties:
                        kind:
                          type: string
                          enum:
                          - privacy
                          - cookies
                          - terms
                          - sale
                          - returns
                        title:
                          type: string
                        text:
                          type: string
                          description: plain text, paragraphs separated by a blank line
                        html:
                          type: string
                          description: an HTML fragment (h1, h2, h3, p, ul); every value is escaped
                        markdown:
                          type: string
                      required:
                      - kind
                      - title
                      - text
                      - html
                      - markdown
                required:
                - documents
        '400':
          description: Invalid request (code invalid_request)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                        - unauthorized
                        - forbidden
                        - not_found
                        - invalid_request
                        - conflict
                        - limit_reached
                        - rate_limited
                        - provider_unavailable
                        - not_configured
                        - internal
                        - ip_not_allowed
                        - upgrade_required
                        - view_only
                      message:
                        type: string
                      details:
                        type: object
                        additionalProperties: {}
                    required:
                    - code
                    - message
                required:
                - error
        '401':
          description: Missing or invalid session/token (code unauthorized)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                        - unauthorized
                        - forbidden
                        - not_found
                        - invalid_request
                        - conflict
                        - limit_reached
                        - rate_limited
                        - provider_unavailable
                        - not_configured
                        - internal
                        - ip_not_allowed
                        - upgrade_required
                        - view_only
                      message:
                        type: string
                      details:
                        type: object
                        additionalProperties: {}
                    required:
                    - code
                    - message
                required:
                - error
        '403':
          description: Authenticated but not permitted (code forbidden; needs projects:read)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                        - unauthorized
                        - forbidden
                        - not_found
                        - invalid_request
                        - conflict
                        - limit_reached
                        - rate_limited
                        - provider_unavailable
                        - not_configured
                        - internal
                        - ip_not_allowed
                        - upgrade_required
                        - view_only
                      message:
                        type: string
                      details:
                        type: object
                        additionalProperties: {}
                    required:
                    - code
                    - message
                required:
                - error
        '429':
          description: Too many requests (code rate_limited); see Retry-After
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                        - unauthorized
                        - forbidden
                        - not_found
                        - invalid_request
                        - conflict
                        - limit_reached
                        - rate_limited
                        - provider_unavailable
                        - not_configured
                        - internal
                        - ip_not_allowed
                        - upgrade_required
                        - view_only
                      message:
                        type: string
                      details:
                        type: object
                        additionalProperties: {}
                    required:
                    - code
                    - message
                required:
                - error
      operationId: postPoliciesGenerate
      x-operation-id-source: derived
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API or MCP key created in the dashboard (Account → API & MCP keys). Keys carry scopes and project grants.
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Host-hs_session
      description: Dashboard session (same origin only; changes require a matching Origin header)