Proxy./ docs

Plans & line generation

GET /plans lists the active plans a key owns. POST /plans/{id}/generate returns host:port:user:pass lines with country, city, ISP and sticky-session targeting.

GEThproxy.com/api/v1/planskey
curl https://hproxy.com/api/v1/plans -H "X-API-Key: hpx_your_key_here"

List plans

Your active plans: residential GB balances and dedicated allocations. The id is what you pass to the endpoints below; label is your own tag (see PATCH), null until you set it. productId is the catalog id you ordered (residential-lite, residential-premium, …) and the field to branch on; product is our internal family name, kept for compatibility, and it can change when we move a product to a new pool. dataGbTotal and dataGbRemaining here are the usage sync's reading, taken about every 30 minutes (a plan bought moments ago shows its full balance until the next pass); GET /plans/{id} refreshes them from the network on the call and carries usageAsOf. The network enforces every plan's cap itself, in real time.

GEThproxy.com/api/v1/plans/{id}key
curl https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr \
  -H "X-API-Key: hpx_your_key_here"

Get one plan

A single active plan you own: the per-customer read for a reseller dashboard. dataGbRemaining is refreshed from the network's own meter on this call (one network read per plan per minute; between reads you get the last reading), and usageAsOf says when that reading was taken. The list endpoint carries the usage sync's reading instead, taken about every 30 minutes, so poll this door when you show a customer what is left. The network enforces the plan's cap itself, in real time: a customer cannot use more than the plan holds, whatever the figure here shows between readings.

PATCHhproxy.com/api/v1/plans/{id}key
curl -X PATCH https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr \
  -H "X-API-Key: hpx_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"label": "customer-1042"}'

Label a plan

PATCH a plan with your own reference, e.g. which of YOUR customers it belongs to. Pure metadata: it changes nothing about pricing, traffic or generation, and it comes back in GET /plans, GET /plans/{id} and in webhook payloads, so every signal is already attributed to your customer. null (or an empty body) clears it.

ParameterTypeRequiredDescription
labelstring | nulloptional1 to 64 characters, no control characters. null/omitted clears.
GEThproxy.com/api/v1/plans/{id}/statskey
curl "https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr/stats?days=7" \
  -H "X-API-Key: hpx_your_key_here"

Traffic statistics

How a Residential Premium plan was used, bucket by bucket: bytes, requests and success rate straight from the network's own metering of that plan. Add /targets to the path (GET /plans/{id}/stats/targets) for the breakdown by target host and country, heaviest first (rows[] with host, country, bandwidthBytes, requests, successRate, avgLatencyMs; limit 1 to 500). Plans on other products answer 400.

ParameterTypeRequiredDescription
daysintegeroptionalWindow ending now, 1 to 30. Default 7.
granularitystringoptional"hour" (windows up to 29 days) or "day". Default: hour up to 2 days, else day.
GEThproxy.com/api/v1/plans/{id}/whitelistkey
curl -X POST https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr/whitelist \
  -H "X-API-Key: hpx_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"ips": [{"ip": "203.0.113.9", "description": "office"}]}'

IP whitelist

The IP addresses that may use a Residential Premium plan WITHOUT the password (IP authentication), up to 150 per plan. GET lists them, POST adds ({"ips": ["203.0.113.9", {"ip": "2001:db8::1", "description": "office"}]}), DELETE removes ({"ips": ["203.0.113.9"]}); each answers the resulting list. Every entry must be a valid IPv4 or IPv6 address. A whitelisted connection carries no username, so it takes no targeting: it rotates through any country on the rotating ports and holds one IP per sticky port. Use the generated lines (password included) whenever you need a country, state, city or ISP. Whitelist only addresses you alone control: everything that connects from a whitelisted IP spends this plan's traffic, and a shared office, VPN or cloud egress address is shared with everyone behind it. Plans on other products answer 400.

ParameterTypeRequiredDescription
ipsarrayrequiredPOST / DELETE body: IP strings, or {ip, description} objects (description up to 80 characters).
GEThproxy.com/api/v1/plans/{id}/sessionskey
curl "https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr/sessions" \
  -H "X-API-Key: hpx_your_key_here"

Sticky sessions

The sticky sessions a Residential Premium plan holds right now, up to 250 per page: the port and its protocol, the session label the line carried, the exit country, the session's full length, the seconds it has run and the seconds it has left. A session whose line was generated here also carries targeting (what the line aimed at: country, state or city, asn, os, exclusions, strict, udp), line (the exact line, with the plan's password) and generatedAt; a session opened with a session id of your own carries null in all three. A port holds any number of sessions, one per session id, so total can be far larger than the number of ports; read further pages with page. A sticky line opens its session on the first request. POST /plans/{id}/release-sessions ends sessions and takes exactly one of three bodies: {"sessions": [{"port": 10000, "sessionId": "a41f9c02"}]} ends exactly those (up to 1,000 per call), {"ports": [10000]} ends every session on those ports (up to 200 ports), {"all": true} ends every open session. The next request on a released line draws a fresh IP. The answer carries releasedSessions (how many ended), released (their ports), notOpen (named ports that held none) and remaining: a ports or all release ends at most 5,000 sessions per call, so call again until remaining is 0. Plans on other products answer 400.

ParameterTypeRequiredDescription
pageintegeroptionalList only: the page to read, from 1. Default 1.
pageSizeintegeroptionalList only: sessions per page, 1 to 250. Default 250.
sessionsobject[]optionalRelease only: 1 to 1,000 {port, sessionId} pairs, as the list shows them. Exactly those sessions end.
portsinteger[]optionalRelease only: 1 to 200 sticky ports. Every open session on them ends.
allbooleanoptionalRelease only: true ends every open session on the plan.
POSThproxy.com/api/v1/plans/{id}/passwordkey
curl -X POST https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr/password \
  -H "X-API-Key: hpx_your_key_here"

Rotate the proxy password

Replace the password behind a residential plan's lines with a fresh one, confirmed by the network before it is stored, and answer the new username and password once. Every line generated before the call stops working within seconds; generate again afterwards. Use it when a line has leaked. Throttled to three rotations per account every ten minutes, because each call cuts every line that account is running. No body. Residential Plus plans answer 400.

POSThproxy.com/api/v1/plans/{id}/generatekey
curl -X POST https://hproxy.com/api/v1/plans/cmjfmhhpd004c4i4hqsk3mzrr/generate \
  -H "X-API-Key: hpx_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"count": 3, "country": "US", "stickyMinutes": 30}'

Generate proxy lines

Turn a gateway plan you own into ready-to-use proxy lines, fully programmatic, using the same hardened generator the dashboard uses. Every product whose delivery is lines on products generates (residential, mobile, ISP rotating, IPv4 and IPv6 per GB); the product's generate block, and each plan's, says which targeting fields its network takes. Lines come back as host:port:username:password with the targeting baked into the username, so any HTTP or SOCKS5 client uses them as-is. Every field is optional; an empty body returns one rotating line with the plan's defaults. Generating lines is free and repeatable: traffic is only consumed when the lines are used. All generated lines draw from the SAME plan balance. Dedicated per-IP products don't generate; fetch them from GET /proxies instead.

ParameterTypeRequiredDescription
protocolstringoptional"http" (default) or "socks5".
countintegeroptionalLines to return, 1 to 5000, and at most the plan's own generate.maxCount (5,000 on Residential Premium, 1,000 on Residential Lite); a count past it answers 400 invalid_count naming the ceiling. Default 1. Sticky and rotating batches share this limit: on Residential Premium sticky lines take the sticky ports in turn and every line holds its own session, so the number of ports never limits a batch. Each plan's generate.sticky block carries the sticky port range (port, ports).
countrystringoptionalCountry targeting, e.g. "US" (letters only, 2 to 40 chars). This is where a residential order gets its country: the order carries none, so one plan serves every country and each call can target a different one.
statestringoptionalState / region targeting, where the pool supports it.
citystringoptionalCity targeting, where the pool supports it.
ispstringoptionalISP targeting by name. Residential Plus plans only (400 on other products).
asnintegeroptionalISP targeting by AS number, e.g. 7018 for AT&T or 7922 for Comcast, together with country. Residential Premium plans only; the list per country is GET /v1/products/residential-premium/geo/asns?country=US. 400 on other products.
osstringoptional"windows", "android", "ios" or "mac": the device the exit IP belongs to. Residential Premium only.
strictbooleanoptionalDefault true: a target with no IP free fails the request. false: the gateway hands out another IP from the same country instead. Residential Premium only.
excludeAsninteger[]optionalUp to 20 AS numbers to avoid. Not together with excludeCountries. Residential Premium only.
excludeCountriesstring[]optionalUp to 20 two-letter country codes to avoid; only without country. Residential Premium only. One exclusion kind per call: countries, states, cities or networks, never two.
excludeStatesstring[]optionalUp to 20 state / region names to avoid inside country (e.g. ["California", "Texas"]); not together with a state target. Residential Premium only.
excludeCitiesstring[]optionalUp to 20 city names to avoid inside country (e.g. ["New York", "Houston"]); not together with a city target. Residential Premium only.
udpbooleanoptionaltrue lets a socks5 line open UDP relays (SOCKS5 UDP ASSOCIATE). Refused on http. Residential Premium only.
stickyMinutesintegeroptionalTurns sticky on. Omit for rotating IPs. On Residential Premium the number is the session length in minutes, 3 to 1440 (24 hours), and each sticky line holds its own session with no limit on how many; on Plus it is the session length up to 24 hours. On Residential Lite the pool takes no duration, so any value above 0 simply turns sticky on and the session lasts as long as you keep reusing the line. Each plan's generate block reports its own minStickyMinutes / maxStickyMinutes.

Ownership is strict: the plan must be yours and active, anything else is a plain 404 (an id never confirms another account's plan exists). Free-text targeting is validated before it touches the network (letters, digits, spaces and simple punctuation only), so a bad value is a clean 400 naming the rule. The exact host, port and username grammar in the response varies by pool; treat lines as opaque and use them verbatim.

Rotating vs sticky sessions

This is the one choice that shapes how a line behaves, and it is just whether you send stickyMinutes:

ModeHow to askDescription
Rotating (default)omit stickyMinutesEvery request through the line can exit from a different residential IP. Best for scraping, wide coverage, and spreading load. Ask for count: N and you get N interchangeable rotating lines.
StickystickyMinutes: NThe line holds the SAME exit IP instead of rotating per request. Best for anything that needs a stable identity across several requests: a login, a cart, a session. Each line you generate gets its OWN sticky session, so count: 10 with stickyMinutes gives ten simultaneous stable identities. How long it holds depends on the product: Residential Premium and Plus take the duration you ask for, while Residential Lite holds the address for as long as you keep using the line and takes no duration. The address can still change early on any product if that particular device leaves the network, so write a retry either way.

Generation is free, instant and repeatable, and it reveals nothing new. A plan has ONE credential pair; every line is that same pair with the country and session written into the username, so calling generate again just hands back more lines against the same balance. Nothing is 'used up' until traffic actually flows. So a storefront can safely let a customer regenerate lines whenever they want (roll a fresh IP, retarget a country) without spending anything. Data is metered only by bytes through the proxy, drawn from the plan's GB, and you can read what is left any time from GET /plans/{id} or be pushed plan.low_traffic at 10%. Generate when you need lines rather than storing them: the pair inside a line can rotate when we move a pool, while the plan id and its balance stay the same.

Building a reseller integration? The reselling guide walks the whole loop, and the Reseller API does the same generation as each of your customers so every line is billed and isolated per customer.

Need a hand wiring this up? Email support@hproxy.com. A real person reads every message.

Proxy.· developer documentation