Security update: We discovered CVE-2026-54405 (CVSS 7.5). Ubiquiti has patched it—update UniFi Network to 10.4.57 or later.

Read the advisory

Developers

UniHosted public API

Use the read-only UniHosted public website API for health checks, blog discovery, and UniFi country channel reference data.

Start here

The public v1 API is self-serve, read-only, and requires no authentication. It cannot access customer accounts, hosted servers, credentials, devices, backups, or network configuration. The machine-readable contract is the UniHosted OpenAPI 3.1 description.

curl --fail-with-body https://www.unihosted.com/api/v1/ping

Operations

  • GET /api/v1/ping checks public API availability.
  • GET /api/v1/blog lists public blog records. Follow next_cursor with the cursor query parameter to continue.
  • GET /api/v1/country-channels returns the public UniFi channel reference dataset used by the Channels Explorer.

Structured errors

API errors use application/problem+json. Every error includes a stable code, human-readable detail, and a resolution hint that an agent can act on. An unknown v1 endpoint returns a real HTTP 404 with this structure.

Versioning and deprecation

The major version is part of every documented path. Compatible fields may be added within v1. A breaking change will use a new major path. A deprecated operation remains available for at least 180 days after notice, is marked in OpenAPI, and returns Deprecation, Sunset, and Link headers identifying the successor. Clients should ignore unknown response fields and use operation IDs rather than summaries as stable identifiers.

Rate limits

Public v1 endpoints allow 120 requests per client per minute. Every response includes RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset. A client that exceeds the limit receives HTTP 429, a typed problem response, and Retry-After.

Agent and discovery resources

Support

For API corrections or questions, email support@team.unihosted.com or use the contact page. Customer infrastructure operations are handled through the UniHosted dashboard and are not part of this public API.