# plsk.org documentation

> plsk.org is a disposable Plesk playground for AI agents: MCP and REST access to a small, short-lived hosting subscription. This file holds every page; the account API reference is generated from https://api.plsk.org/openapi.json.

---

Source: https://docs.plsk.org/
Updated: 2026-11-08

# Overview

plsk.org provides short-lived Plesk hosting subscriptions that are operated through MCP and REST interfaces. A subscription is a Plesk customer on a shared server with a site at `https://<id>.lab.plsk.org`, a file system, PHP 8.5, MySQL, and the Plesk REST API scoped to that customer.

| Property | Value |
|---|---|
| Provisioning time | approximately 25 s |
| Lifetime of a subscription | 14 days from the moment it is ready |
| Active subscriptions per account | 5 |

See [Limits](/limits) for resource limits.

## Endpoints

All interfaces are served from `https://api.plsk.org`.

| Base path | Interface | Credential | Reference |
|---|---|---|---|
| `/v1` | Account API: subscriptions, subscription keys, feedback. | Account key `plsa_…` | [Account API](/api/account) |
| `/api/plesk/v2` (alias `/api/v2`) | Plesk REST API of one subscription. | Subscription key `plsk_…` | [Plesk REST API](/api/plesk) |
| `/api/modules/wp-toolkit/v1` | WP Toolkit REST API of one subscription. | Subscription key `plsk_…` | [WP Toolkit REST API](/api/wp-toolkit) |
| `/mcp` | MCP server (Streamable HTTP). | OAuth 2.0 access token `plso_…` | [MCP reference](/mcp) |

Machine-readable descriptions:

| Path | Content |
|---|---|
| `/openapi.json` | OpenAPI document of the account API and the gateway. |
| `/plesk-openapi.json` | OpenAPI document of the Plesk REST API, with the gateway as its server. No credential required. |
| `/.well-known/api-catalog` | API catalog (RFC 9727). |
| `/.well-known/oauth-protected-resource/mcp` | OAuth protected resource metadata of the MCP server. |

## Documentation

- [API reference](/api): authentication, request handling, error format.
- [MCP reference](/mcp): tools, parameters, scopes.
- Examples: [MCP session](/quickstart-agent), [REST session](/quickstart-rest), [static site](/examples/static-site), [PHP and MySQL](/examples/php-mysql), [WordPress](/examples/wordpress), [subdomains and certificates](/examples/subdomains).
- [Troubleshooting](/troubleshooting).
- [Limits](/limits), [Feedback](/feedback).

---

Source: https://docs.plsk.org/api
Updated: 2026-11-08

# API reference

Base URL: `https://api.plsk.org`.

## Interfaces

| Base path | Interface | Credential |
|---|---|---|
| `/v1` | Account API. See [Account API](/api/account). | Account key |
| `/api/plesk/v2` | Plesk REST API of one subscription. See [Plesk REST API](/api/plesk). | Subscription key |
| `/api/modules/wp-toolkit/v1` | WP Toolkit REST API of one subscription. See [WP Toolkit REST API](/api/wp-toolkit). | Subscription key |
| `/mcp` | MCP server. See [MCP reference](/mcp). | OAuth access token |

Aliases: `/api/v2` is equivalent to `/api/plesk/v2`.

## Authentication

A key is sent in one of two headers:

```
X-API-Key: <key>
Authorization: Bearer <key>
```

| Credential | Prefix | Issued by | Valid for | Applies to |
|---|---|---|---|---|
| Account key | `plsa_` | Cabinet, section Agents | 1 day, 7 days or 30 days | `/v1` |
| Subscription key | `plsk_` | `POST /v1/subscriptions/{id}/keys` | 1 day, 7 days or until the subscription expires | `/api/plesk/v2`, `/api/modules/*` |
| Access token | `plso_` | OAuth 2.0 authorization code flow at `https://my.plsk.org` | at most 30 days | `/mcp` |

An account key has a scope. `read` permits listing and reading. `manage` additionally permits creating, retrying and deleting subscriptions and managing keys. `POST /v1/feedback` accepts either scope.

A subscription key is bound to one subscription and expires no later than that subscription. A subscription has at most one active key. The key value is returned once, at creation.

## Request handling

For `/api/plesk/v2` and `/api/modules/*` the gateway performs these steps:

1. Validates the key: it exists, is not revoked and not expired, and the subscription is available.
2. Applies the rate limit of the key.
3. Validates the target against the rules below.
4. Replaces the key with the Plesk credential of the subscription and forwards the request.
5. Returns the status, headers and body of the Plesk response. `Set-Cookie` and hop-by-hop headers are removed.

Path, query, method and body are forwarded unchanged. Request headers are forwarded except credentials, routing headers and hop-by-hop headers.

Targets that are not forwarded:

| Target | Result |
|---|---|
| `/api/plesk/v2/auth/...` (Plesk API keys, panel sessions) | `403 blocked_path` |
| `/api/modules/<extension>/...` for an extension other than `wp-toolkit` | `403 blocked_path` |
| Dot segments, encoded slashes or backslashes, control characters, fragments, targets longer than 8192 characters | `400 bad_path` |

## Limits

| Limit | Value |
|---|---|
| Requests per key | 120 per minute |
| Request body | 10 MiB |
| Upstream timeout | 60 s |

## Errors

Errors produced by the platform use this format:

```
{"error": {"code": "<code>", "message": "<text>"}}
```

| Status | Code | Condition |
|---|---|---|
| 400 | `bad_path` | The target is not acceptable. |
| 400 | `bad_request` | The request is malformed. |
| 401 | `invalid_key` | The key is missing, unknown, revoked or expired. The response carries `WWW-Authenticate: Bearer realm="plsk"`. |
| 403 | `blocked_path` | The target is not offered by the gateway. |
| 413 | `body_too_large` | The body exceeds 10 MiB. |
| 429 | `rate_limited` | The rate limit is exceeded. The response carries `Retry-After` in seconds. |
| 500 | `internal_error` | Internal error. |
| 502 | `upstream_unavailable` | Plesk could not be reached. |
| 504 | `upstream_timeout` | Plesk did not answer within the timeout. |

Status codes and bodies produced by Plesk are returned as received. See [Troubleshooting](/troubleshooting) for their interpretation.

## Account API conventions

- `POST /v1/subscriptions` requires the header `Idempotency-Key` (1 to 64 characters from `A-Z a-z 0-9 _ -`). A repeated request with the same key returns the existing subscription with status 200; the first request returns 201.
- `DELETE /v1/subscriptions/{id}` and `POST /v1/subscriptions/{id}/retry` return 202.
- Account API errors use the format above with the codes listed in [Account API](/api/account).

---

Source: https://docs.plsk.org/api/plesk
Updated: 2026-11-08

# Plesk REST API

Base URL: `https://api.plsk.org/api/plesk/v2`. Credential: subscription key. Authentication, rate limit and error format: [API reference](/api).

The gateway forwards requests to the Plesk REST API of the server that hosts the subscription. Paths, parameters, bodies and responses are those of Plesk. Plesk executes the request as the Plesk customer that owns the subscription; operations that this customer is not permitted to perform are refused by Plesk.

The OpenAPI document is available without a credential at `https://api.plsk.org/plesk-openapi.json`. Its `servers` entry is the gateway. Operations under `/auth` are not served.

## Operations used with subscriptions

| Method | Path | Purpose |
|---|---|---|
| `GET` | `/domains` | List the domains of the subscription. |
| `POST` | `/domains` | Create a subdomain. |
| `GET` | `/domains/{id}/fs` | Metadata of a file or directory (`path`). |
| `GET` | `/domains/{id}/fs/list` | List a directory (`path`). |
| `GET` | `/domains/{id}/fs/content` | Read a file (`path`). |
| `PUT` | `/domains/{id}/fs/content` | Write a file (`path`). |
| `PATCH` | `/domains/{id}/fs/content` | Append a chunk to a file (`path`). |
| `POST` | `/domains/{id}/fs/mkdir` | Create a directory. |
| `POST` | `/domains/{id}/fs/copy` | Copy a file or directory. |
| `POST` | `/domains/{id}/fs/move` | Move or rename a file or directory. |
| `DELETE` | `/domains/{id}/fs` | Delete a file or directory (`path`). |
| `GET` `POST` | `/databases` | List or create databases. |
| `DELETE` | `/databases/{id}` | Delete a database. |
| `GET` `POST` | `/dbusers` | List or create database users. |
| `PUT` `DELETE` | `/dbusers/{id}` | Update or delete a database user. |

## Request bodies

File write (`PUT` and `PATCH` `/domains/{id}/fs/content?path=<path>`):

```
{"encoding": "plain" | "base64", "content": "<text or base64>"}
```

Subdomain (`POST /domains`):

```
{"name": "<label>.<hostname>", "hosting_type": "virtual", "parent_domain": {"id": <domain id>, "name": "<hostname>"}}
```

Database (`POST /databases`):

```
{"name": "<name>", "type": "mysql", "parent_domain": {"id": <domain id>, "name": "<hostname>"}}
```

Database user (`POST /dbusers`):

```
{"login": "<login>", "password": "<password>", "database_id": <database id>}
```

## Behavior of the file API

- A write replaces the file. Files that are removed from a release remain until deleted.
- `copy` does not overwrite an existing target.
- The file API has no atomic multi-file operation.
- Updates with fields that Plesk does not support are accepted with status 200 and have no effect; the resource has to be read back to confirm a change.

## Not available to subscription keys

Choosing the database server (`server_id`), listing extensions, running commands (`exec`), reading DNS records, creating domains other than subdomains. Plesk refuses these; see [Troubleshooting](/troubleshooting).

---

Source: https://docs.plsk.org/api/wp-toolkit
Updated: 2026-11-08

# WP Toolkit REST API

Base URL: `https://api.plsk.org/api/modules/wp-toolkit/v1`. Credential: subscription key. Authentication, rate limit and error format: [API reference](/api).

The gateway forwards requests unchanged to the WP Toolkit REST API of the server. WP Toolkit executes them as the Plesk customer that owns the subscription and returns only the installations of that customer. The same methods are available through the MCP tools `si_plesk_api_method_*` (see [MCP reference](/mcp)), where their names have no prefix, for example `createinstallation`.

Paths contained in WP Toolkit responses (for example the `url` of a background task) are valid on `https://api.plsk.org` as returned.

## Operations

| Method | Path | Purpose |
|---|---|---|
| `GET` | `/installations` | List installations. |
| `POST` | `/installations` | Install WordPress. Returns a background task. |
| `GET` | `/installations/{installationId}` | Read an installation. |
| `GET` | `/installations/{installationId}/plugins` | List plugins. |
| `GET` | `/installations/{installationId}/themes` | List themes. |
| `GET` | `/installations/{installationId}/backups` | List backups. |
| `GET` | `/background-tasks/{taskCode}/{taskId}` | Read a background task. |
| `GET` | `/license-info` | License information. |

The complete list of operations is the WP Toolkit REST API specification; the MCP tool `si_plesk_api_method_list` with the filter `wordpress` lists the corresponding methods.

## Install request

```
POST /installations
{"domain": "<hostname>", "installationPath": "/wp", "title": "<site title>", "protocol": "https"}
```

Response: status 201 with `{"url": "/api/modules/wp-toolkit/v1/background-tasks/task_install/<id>", "task": {...}}`.

## Background tasks

`GET /background-tasks/task_install/<id>` returns `status` (`running` or `done`), `progress` (0 to 100), the list of `steps` and, once available, `publicParams.installationId`. `GET /installations` lists an installation only after the task has finished.

An installation uses one of the databases of the subscription (see [Limits](/limits)).

---

Source: https://docs.plsk.org/mcp
Updated: 2026-11-08

# MCP reference

Endpoint: `https://api.plsk.org/mcp`. Transport: Streamable HTTP. Protected resource metadata: `https://api.plsk.org/.well-known/oauth-protected-resource/mcp`.

## Authentication

OAuth 2.0 authorization code flow with PKCE and dynamic client registration. The authorization server is `https://my.plsk.org` (metadata at `/.well-known/oauth-authorization-server`). The access token (`plso_…`) is sent as `Authorization: Bearer <token>`. A connection is valid for at most 30 days and can be revoked in the cabinet.

A connection has one of two scopes, chosen at consent:

| Scope | Permits |
|---|---|
| `read` | Listing and reading. `site_api` with `GET` and `HEAD`. |
| `manage` | Everything in `read`, and creating, changing and deleting. |

## Account tools

| Tool | Parameters | Scope | Description |
|---|---|---|---|
| `list_subscriptions` | none | read | Lists the subscriptions of the account. |
| `get_subscription` | `id` | read | Returns one subscription. |
| `create_subscription` | `name` (1 to 40 characters), `idempotency_key` (1 to 64 characters from `A-Z a-z 0-9 _ -`) | manage | Creates a subscription. A repeated `idempotency_key` returns the existing subscription. |
| `delete_subscription` | `id` | manage | Deletes a ready subscription or removes a failed one. |
| `retry_subscription` | `id` | manage | Retries a failed subscription. |
| `list_subscription_keys` | `id` | read | Lists the keys of a subscription without secrets. |
| `create_subscription_key` | `id`, `lifetime` (`1d`, `7d`, `subscription`) | manage | Issues the subscription key. The secret is returned once. |
| `revoke_subscription_key` | `id`, `key_id` | manage | Revokes a key. |
| `submit_feedback` | `kind` (`bug`, `feedback`), `title` (5 to 120 characters), `message` (20 to 8000 characters), `include_recent_calls` (boolean, optional) | read | Submits a report. With `include_recent_calls`, the tool name, Plesk method name, status and duration of the account's calls of the past hour are appended; arguments and results are never attached. |

## Plesk tools

| Tool | Parameters | Scope | Description |
|---|---|---|---|
| `site_api` | `subscription_id`, `method`, `path`, `query` (object of strings, optional), `body` (JSON, optional) | read for `GET` and `HEAD`, manage otherwise | One request to the Plesk REST API of the subscription. `path` is relative to `/api/plesk/v2`. A path beginning with `/modules/<extension>/` addresses an extension API, for example `/modules/wp-toolkit/v1/installations`. |
| `plesk_api_reference` | `text` (optional), `limit` (1 to 500, optional) | read | Lists operations of the core Plesk REST API (method, path, summary). Requires no subscription. Extension APIs are not listed. |

The result of `site_api` is `{"status": <number>, "content_type": "<type>", "body": <value>}`. `body` is parsed JSON, text, or `{"encoding": "base64", "data": "<base64>"}` for binary content. It is truncated at 256 KiB, indicated by `"truncated": true`. Statuses 4xx and 5xx from Plesk are returned as results.

## Plesk MCP tools

The following tools pass requests to the MCP server of the WebPros Dashboard. Each subscription has its own token there, limited to one server and one Plesk customer; the requests run as that customer. All tools take `subscription_id`. The rate limit is 120 requests per minute per subscription.

| Tool | Parameters | Scope | Description |
|---|---|---|---|
| `si_plesk_api_method_list` | `subscription_id`, `filter` | read | Searches Plesk API methods by words in the name, summary or path. At most 50 methods are returned. |
| `si_plesk_api_method_usage` | `subscription_id`, `methodName`, `includeOutputSchema` (optional) | read | Returns the arguments of a method and the tool that executes it. |
| `si_plesk_api_method_execute_read` | `subscription_id`, `methodName`, `arguments` (object, optional) | read | Executes a method that only reads. |
| `si_plesk_api_method_execute_write` | `subscription_id`, `methodName`, `arguments` (object, optional) | manage | Executes a method that changes data. |
| `si_plesk_api_method_upload` | `subscription_id`, `methodName`, `arguments` (object, optional) | manage | For methods that take a file. Returns an upload URL and the request that sends the file. |

Method names correspond to Plesk REST operations (`get_domains`, `post_databases`). The methods of WP Toolkit have no prefix (`createinstallation`, `getinstallations`) and are found with the filter `wordpress`. Methods that create or delete Plesk API keys or panel sessions (`post_auth_keys`, `delete_auth_keys_by_key`, `post_server_session`) are neither listed nor executed.

## Errors

A failed call returns a tool error whose text is `{"error": {"code": "<code>", "message": "<text>"}}`.

| Code | Condition |
|---|---|
| `invalid_input` | A parameter is missing or malformed. |
| `insufficient_scope` | The connection has the scope `read` and the call requires `manage`. |
| `not_found` | The subscription does not exist in the account. |
| `not_available` | The subscription is not ready, has expired, or its Plesk access is not available yet. |
| `not_ready`, `not_failed` | The state of the subscription does not permit the operation. |
| `quota_exceeded` | The account has 5 active subscriptions. |
| `idempotency_key_spent` | The key belongs to a subscription that was deleted; a new key is required. |
| `key_exists` | The subscription already has an active key. |
| `disclosure_required` | The research disclosure has not been acknowledged in the cabinet. |
| `bad_path`, `blocked_path` | The `site_api` path is malformed or not offered. |
| `blocked_method` | The method creates credentials or sessions. |
| `rate_limited` | The rate limit is exceeded. |
| `upstream_error` | Plesk or the WebPros Dashboard did not answer or refused the request. |
| `spec_unavailable` | The Plesk specification could not be obtained. |
| `internal_error` | Internal error. |

Interpretation of Plesk refusals: [Troubleshooting](/troubleshooting).

---

Source: https://docs.plsk.org/quickstart-agent
Updated: 2026-11-08

# Example - MCP session

## Connect a client

Claude Code:

```
claude mcp add --transport http plsk https://api.plsk.org/mcp
```

Authorization is completed in the browser with `/mcp` in the client.

Codex, in the configuration file:

```
[mcp_servers.plsk]
url = "https://api.plsk.org/mcp"
```

```
codex mcp login plsk
```

## Create a subscription and publish a page

| Step | Tool | Parameters |
|---|---|---|
| 1 | `create_subscription` | `name`: `demo`, `idempotency_key`: `demo-1` |
| 2 | `get_subscription` | `id` from step 1; repeat until `status` is `ready` |
| 3 | `site_api` | `method`: `GET`, `path`: `/domains`; the response lists the domain `id` |
| 4 | `site_api` | `method`: `PUT`, `path`: `/domains/<id>/fs/content`, `query`: `{"path": "index.html"}`, `body`: `{"encoding": "plain", "content": "<h1>Hello</h1>"}` |
| 5 | HTTP client | `GET https://<hostname>/` |
| 6 | `delete_subscription` | `id` |

Deletion completes in approximately 2 minutes.

---

Source: https://docs.plsk.org/quickstart-rest
Updated: 2026-11-08

# Example - REST session

Prerequisite: an account key with scope `manage`, created in the cabinet under Agents.

## Create a subscription

```
curl -sS -X POST https://api.plsk.org/v1/subscriptions \
  -H "X-API-Key: $PLSA" \
  -H "Idempotency-Key: demo-1" \
  -H "content-type: application/json" \
  -d '{"name": "demo"}'
```

Status 201. The response contains `id`, `hostname` and `status`. Poll `GET /v1/subscriptions/{id}` until `status` is `ready`.

## Issue a subscription key

```
curl -sS -X POST https://api.plsk.org/v1/subscriptions/{id}/keys \
  -H "X-API-Key: $PLSA" \
  -H "content-type: application/json" \
  -d '{"lifetime": "1d"}'
```

Status 201. The response contains `token` (`plsk_…`), returned once.

## Call the Plesk REST API

```
curl -sS https://api.plsk.org/api/plesk/v2/domains -H "X-API-Key: $KEY"

curl -sS -X PUT "https://api.plsk.org/api/plesk/v2/domains/{domainId}/fs/content?path=index.html" \
  -H "X-API-Key: $KEY" \
  -H "content-type: application/json" \
  -d '{"encoding": "plain", "content": "<h1>Hello</h1>"}'
```

## Delete

```
curl -sS -X DELETE https://api.plsk.org/v1/subscriptions/{id} -H "X-API-Key: $PLSA"
```

Status 202.

---

Source: https://docs.plsk.org/examples/static-site
Updated: 2026-11-08

# Example - static site

All requests use the base URL `https://api.plsk.org/api/plesk/v2` and a subscription key. `{id}` is the `id` returned by `GET /domains` for the main domain of the subscription.

| Operation | Request |
|---|---|
| Write a text file | `PUT /domains/{id}/fs/content?path=index.html` with `{"encoding": "plain", "content": "<h1>Hello</h1>"}` |
| Write a binary file | `PUT /domains/{id}/fs/content?path=logo.png` with `{"encoding": "base64", "content": "<base64>"}` |
| Append a chunk to a large file | `PATCH /domains/{id}/fs/content?path=<path>` with the next chunk in the same format |
| List a directory | `GET /domains/{id}/fs/list?path=/httpdocs` |
| Read a file | `GET /domains/{id}/fs/content?path=index.html` |
| Create a directory | `POST /domains/{id}/fs/mkdir` |
| Delete a file or directory | `DELETE /domains/{id}/fs?path=old.html` |

Rewrite rules are supported through `.htaccess`, for example for single-page applications:

```
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ /index.html [L]
```

Via MCP, the same requests are issued with `site_api` (`path`: `/domains/{id}/fs/content`, `query`: `{"path": "index.html"}`).

---

Source: https://docs.plsk.org/examples/php-mysql
Updated: 2026-11-08

# Example - PHP and MySQL

Base URL: `https://api.plsk.org/api/plesk/v2`. `{domainId}` is the id of the main domain.

1. Create the database:

```
POST /databases
{"name": "app", "type": "mysql", "parent_domain": {"id": {domainId}, "name": "<hostname>"}}
```

2. Create the database user with the returned database id:

```
POST /dbusers
{"login": "app_user", "password": "<password>", "database_id": <databaseId>}
```

3. Write a PHP file with `PUT /domains/{domainId}/fs/content?path=index.php`.

```
<?php
$db = new mysqli("localhost", "app_user", "<password>", "app");
echo $db->server_info;
```

PHP 8.5 provides `curl`, `mysqli` and `ZipArchive`. Outbound HTTPS requests from PHP are permitted. The `server_id` field of `POST /databases` is not accepted.

---

Source: https://docs.plsk.org/examples/wordpress
Updated: 2026-11-08

# Example - WordPress

## REST

Install:

```
curl -sS -X POST https://api.plsk.org/api/modules/wp-toolkit/v1/installations \
  -H "X-API-Key: $KEY" -H "content-type: application/json" \
  -d '{"domain": "<hostname>", "installationPath": "/wp", "title": "Example", "protocol": "https"}'
```

Status 201 with the task path in `url`. Poll the task until `status` is `done` (approximately 20 s):

```
curl -sS https://api.plsk.org/api/modules/wp-toolkit/v1/background-tasks/task_install/<id> -H "X-API-Key: $KEY"
```

List installations:

```
curl -sS https://api.plsk.org/api/modules/wp-toolkit/v1/installations -H "X-API-Key: $KEY"
```

The site is served at `https://<hostname>/wp/`.

## MCP

With `site_api`: `method` `POST`, `path` `/modules/wp-toolkit/v1/installations`, `body` as above.

With the Plesk MCP tools: `si_plesk_api_method_execute_write` with `methodName` `createinstallation` and `arguments` `{"domain": "<hostname>", "installationPath": "/wp", "title": "Example", "protocol": "https"}`, then `si_plesk_api_method_execute_read` with `methodName` `getbackgroundtask` and `arguments` `{"taskCode": "task_install", "taskId": <id>}`.

---

Source: https://docs.plsk.org/examples/subdomains
Updated: 2026-11-08

# Example - subdomains and certificates

Create a subdomain of the site:

```
POST https://api.plsk.org/api/plesk/v2/domains
{"name": "blog.<hostname>", "hosting_type": "virtual", "parent_domain": {"id": <domainId>, "name": "<hostname>"}}
```

Status 201 with the id of the new domain. A subscription may have 5 subdomains. The file API addresses the subdomain by its own domain id.

## Certificates

The certificate `*.lab.plsk.org` covers the hostname of the subscription and does not cover `blog.<hostname>`. Until a certificate for the subdomain exists, the subdomain answers over HTTP only.

The platform requests a Let's Encrypt certificate for each subdomain. The certificate is usually installed within 1 to 2 minutes after the subdomain is created; a failed attempt is repeated after 30 s, then at doubling intervals up to 1 h. After installation, HTTP requests are redirected to HTTPS.

Verification:

```
curl -I https://blog.<hostname>
```

The number of certificates the platform requests is limited per week. When the limit is reached, requests resume when the limit frees. Certificates are not renewed; they are valid for 90 days and a subscription for 14.

---

Source: https://docs.plsk.org/troubleshooting
Updated: 2026-11-08

# Troubleshooting

## Responses of the Plesk REST API

| Response | Cause | Action |
|---|---|---|
| `403`, body `{"code": 1024, "message": "There are no available resources of this type (...)"}` | A quota of the subscription is exhausted, for example the number of databases. | Delete a resource of that type. See [Limits](/limits). |
| `403`, body `{"code": 0, "message": "Permission denied"}` | The subscription key is not permitted to perform the operation. Refused operations include choosing the database server, listing extensions, running commands and reading DNS records. | None. The operation is not available. |
| `400` about an FTP login, or `403` with code `1024` for "sites", when creating a domain | Domains other than subdomains are not part of the plan. | Create a subdomain. See [subdomains](/examples/subdomains). |
| `200` for an update, resource unchanged | Plesk ignores fields it does not support in updates (for example `aliases`). | Read the resource back to confirm the change. |
| `404` with an HTML body from the platform | The path is not served by the gateway. | Use the base paths in the [API reference](/api). |

## Responses of the platform

| Response | Cause | Action |
|---|---|---|
| `401 invalid_key` | The key is missing, revoked, expired, or its subscription is not available. | Issue a new key. |
| `403 blocked_path` | The target is `/auth` or an extension that is not offered. | None. The target is not available. |
| `400 bad_path` | The target contains dot segments, encoded slashes or other unsafe characters. | Correct the path. |
| `429 rate_limited` | 120 requests per minute per key exceeded. | Wait for the number of seconds in `Retry-After`. |
| `409 key_exists` | The subscription already has an active key. | Revoke the key with `DELETE /v1/subscriptions/{id}/keys/{keyId}`, then issue a new one. |
| `409 idempotency_key_spent` | The `Idempotency-Key` belongs to a deleted subscription. | Use a new key. |
| `409 quota_exceeded` | The account has 5 active subscriptions. | Delete a subscription. |
| `403 disclosure_required` | The research disclosure has not been acknowledged. | Acknowledge it in the cabinet. |
| `502 upstream_unavailable`, `504 upstream_timeout` | Plesk did not answer. | Repeat the request. |

## Timing

| Observation | Cause |
|---|---|
| A request to a new subscription or subdomain fails for a few seconds. | The web server has not yet applied the configuration of the new site. Repeat the request. |
| A new subdomain answers over HTTP only. | The certificate is issued after the subdomain exists. See [subdomains](/examples/subdomains). |
| `GET /installations` of WP Toolkit returns `[]` after an install request. | The installation appears after the background task is `done`. |
| `delete_subscription` is accepted and the subscription is still listed. | Deletion takes approximately 2 minutes. |

## MCP clients

| Observation | Cause | Action |
|---|---|---|
| A client lists fewer tools than the [MCP reference](/mcp). | The client uses a tool list fetched earlier. | Reconnect the server. |
| A client reports that sign-in is required. | The access token expired or was revoked. | Authorize again (`/mcp` in Claude Code, `codex mcp login plsk`). |
| `blocked_method` | The method creates credentials or sessions. | None. The method is not available. |

Reports about behavior that is not described here: [Feedback](/feedback).

---

Source: https://docs.plsk.org/limits
Updated: 2026-11-08

# Limits

| Resource | Limit |
|---|---|
| Lifetime of a subscription | 14 days |
| Active subscriptions per account | 5 |
| Time until a new subscription is ready | approximately 25 seconds |
| Disk | 1000 MB |
| Databases | 3 |
| Subdomains | 5 |
| PHP | 8.5 |
| Subscription keys | one active key per subscription; 1 day, 7 days or until the subscription expires |
| Gateway rate | 120 requests per minute per key |
| Plesk MCP calls | 120 per minute per subscription |
| Request body | 10 MiB |
| Gateway timeout | 60 seconds |

Not provided: shell access, Node.js, Git, archive upload, mail hosting, backups, access to the Plesk panel, DNS records. A subscription and its data are deleted when it expires.

---

Source: https://docs.plsk.org/feedback
Updated: 2026-11-08

# Feedback

| Interface | Request |
|---|---|
| Cabinet | `https://my.plsk.org/account/feedback` |
| REST | `POST /v1/feedback` with an account key of either scope |
| MCP | tool `submit_feedback` |

A report has a `kind` (`bug` or `feedback`), a `title` of 5 to 120 characters and a `message` of 20 to 8000 characters in plain text. Credentials and private content must not be included. With `include_recent_calls` (MCP), the tool name, Plesk method name, status and duration of the account's calls of the past hour are appended; arguments and results are not.

Reports are read by the operators. A reply is not guaranteed.