# Exoscale API

Infrastructure automation API, allowing programmatic access to all Exoscale products and services.

[OpenAPI Specification (YAML)](exoscale-openapi-spec.yaml) | [JSON](exoscale-openapi-spec.json)

**Last updated:** July 20, 2026

{{< cards cols="2" >}}

  {{< card
  link="compute/"
  icon="exo-vm"
  title="Compute"
  subtitle="Host anything from simple applications to complex architectures. Start a compute instance in seconds and scale as your infrastructure grows." >}}

  {{< card
  link="sks/"
  icon="exo-sks"
  title="SKS"
  subtitle="SKS is Exoscale's scalable Kubernetes service which provides managed Kubernetes control planes with integrated support for Exoscale instance pools ands network load balancers." >}}

  {{< card
  link="dbaas/"
  icon="exo-dbaas"
  title="DBaaS"
  subtitle="Databases as a Service (DBaaS) provides scalable and fully-managed database solutions with high availability and performance backed by Exoscale's Compute and Storage services." >}}

  {{< card
  link="object-storage/"
  icon="exo-object-storage"
  title="Object Storage"
  subtitle="Exoscale Simple Object Storage (SOS) is an S3-compatible object storage service." >}}

  {{< card
  link="block-storage/"
  icon="exo-block-storage"
  title="Block Storage"
  subtitle="Exoscale's Block Storage offers persistent externally attached volumes for your Compute instances." >}}

  {{< card
  link="dns/"
  icon="exo-dns"
  title="DNS"
  subtitle="DNS zone hosting and records management." >}}

  {{< card
  link="iam/"
  icon="exo-iam"
  title="IAM"
  subtitle="Identity and Access Management: roles, users, policies and credentials for accessing the Exoscale API." >}}

  {{< card
  link="ai/"
  icon="exo-ai-prod"
  title="AI"
  subtitle="Exoscale AI services provide GPU-powered infrastructure for running machine learning workloads and large language models." >}}

  {{< card
  link="audit-trail/"
  icon="exo-license"
  title="Audit Trail"
  subtitle="The Exoscale audit-trail provides a mechanism to query past events performing mutations on resources which happened on an organization." >}}

  {{< card
  link="kms/"
  icon="exo-secgrp"
  title="KMS"
  subtitle="Exoscale Key Management Service is a managed security service that lets you create, control and manage the lifecycle of cryptographic keys." >}}

  {{< card
  link="general/"
  icon="exo-logo"
  title="General"
  subtitle="8 API operations" >}}

{{< /cards >}}

## API Request Signature


In order to authenticate legitimate users, the Exoscale API requires incoming requests to be signed using valid Exoscale API account credentials with the following mechanism.

## Signature Mechanism

The *message* (i.e. content) to sign contains several segments concatenated using a line return character (`\n`).

All segments must be included and in the described order. For cases where a segment doesn't fit the context of the request (e.g. no request body) **an empty line must be used instead**.

* Request method and request URL (path only), separated by a space character
* Request body
* Request URL parameters (Query String) values, concatenated without separator. The matching parameter names have to be specified in the resulting signature header `signed-query-args=` pragma, separated by semicolons (e.g. `p1;p2;pN`).
* Request header values, concatenated without separator (none at the moment, leave empty)
* Request expiration date in UNIX timestamp format

Example *message* to sign for `GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2`:

```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0

v1v2

1599140767
```

The two blank lines above are due to the absence of a request body and signed headers.

Example *message* to [create a security group](https://community.exoscale.com/reference/api/compute/security-group/#create-security-group)

```
POST /v2/security-group
{"name": "my-security-group"}


1599140767
```

The two blank lines above are due to the absence of query parameters and signed headers.

The request signature consists of the base64-encoded [HMAC](https://en.wikipedia.org/wiki/HMAC) hash of the UTF-8 encoded *message* and the Exoscale API secret using the SHA265 function:

```
signature = BASE64_ENCODE(HMAC_SHA256(Exoscale API secret, message))
```

Finally, the computed signature must be added to the API request in a `Authorization` header such as:

```
Authorization: EXO2-HMAC-SHA256 credential=<Exoscale API key>,expires=<expiration date UNIX timestamp>,signature=<signature>
```

Example API query:

```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2 HTTP/1.1
Host: api-ch-gva-2.exoscale.com
Authorization: EXO2-HMAC-SHA256 credential=EXO29147e9f89102b7ac1e88514,signed-query-args=p1;p2,expires=1599140767,signature=2AOBQsbElQb4FpKT/FM/9T4NobjlmZkSGvvdUth/xlY=
```

## Reference Implementations

You can look up the following existing reference implementations:

* Go: [github.com/exoscale/egoscale/api/v2 > `SecurityProviderExoscale.signRequest`](https://github.com/exoscale/egoscale/blob/master/v2/api/security.go)
* Python: [requests-exoscale-auth > `ExoscaleV2Auth`](https://github.com/exoscale/requests-exoscale-auth/blob/master/exoscale_auth.py)



## Zone local resources


The API is deployed across all Exoscale zones. When performing a compute call, you should use the relevant zone for your resource.
For example: https://api-de-fra-1.exoscale.com/v2/instance would return only the instances from `de-fra-1`, https://api-ch-gva-2.exoscale.com/v2/instance from `ch-gva-2`.
To obtain a list of all instances across all zones, you would need to do the corresponding request for each zone.