Cloud Panel API — networks

7 min

A network is what actually receives DNS traffic. Creating it is not enough: it must be bound to a policy and a DNS resolver.

Network types

Type	Endpoint	Body	Notes
Static single IP	POST /network/v1/static/single	name, note, organizationId, ip	Public WAN IP (v4 or v6). LAN IPs rejected
Static CIDR	POST /network/v1/static/cidr	name, note, organizationId, cidr	e.g. 19.16.31.0/24
Static range	POST /network/v1/static/range	name, note, organizationId, range Ip: {start, end}	IPv4 only
Dynamic (DDNS)	POST /network/v1/dynamic/internal	name, note, organizationId, ddns: {username, password}	For changing public IPs
Encrypted (DoH/DoT)	POST /network/v1/encrypted	name, note, organizationId, policyId, tag	Policy bound at creation; returns DoH/DoT URLs

# Static single IP
curl -X POST 'https://core.fsflt.net/network/v1/static/single' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Headquarter",
    "note": "Main office WAN",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "ip": "203.0.113.24"
  }'

{
  "id": "0199e74b-70d9-7b80-b138-36ae8c1ca3b3",
  "name": "Headquarter",
  "note": "Main office WAN",
  "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
  "type": "STATIC_SINGLE",
  "ip": "203.0.113.24",
  "createdAt": "2026-10-27T09:55:05.049Z",
  "updatedAt": "2026-10-27T09:55:05.049Z"
}

Other bodies:

# Static CIDR
curl -X POST 'https://core.fsflt.net/network/v1/static/cidr' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Branch CIDR",
    "note": "Branch offices",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "cidr": "198.51.100.0/24"
  }'

# Static range
curl -X POST 'https://core.fsflt.net/network/v1/static/range' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "ISP pool",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "rangeIp": { "start": "151.24.10.1", "end": "151.24.19.254" }
  }'

# Dynamic internal (DDNS)
curl -X POST 'https://core.fsflt.net/network/v1/dynamic/internal' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Home office",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "ddns": { "username": "customer09122", "password": "a-strong-password" }
  }'

# Encrypted (DoH / DoT)
curl -X POST 'https://core.fsflt.net/network/v1/encrypted' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Roaming laptops",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "policyId": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
    "tag": "abcdef123"
  }'

Encrypted networks return the tag used to build the endpoints (https://doh.flashstart.com/<tag>, https://<tag>.dot.flashstart.com).

Bind policy and DNS to the network

This is the step that actually activates filtering. Pick a free resolver, then bind.

# 1. Resolvers available for this network
curl 'https://core.fsflt.net/network/v1/0199e74b-70d9-7b80-b138-36ae8c1ca3b3/dns/available' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# 2. Bind policy + DNS
curl -X POST 'https://core.fsflt.net/network/v1/0199e74b-70d9-7b80-b138-36ae8c1ca3b3/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "policyId": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
    "dnsId": "0182e9f8-9bdf-47ea-99e1-632498e17169"
  }'

{
  "networkId": "0199e74b-70d9-7b80-b138-36ae8c1ca3b3",
  "note": null,
  "policy": {
    "id": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
    "name": "Default Policy",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "isShared": false,
    "isLimited": false
  },
  "dns": {
    "id": "0182e9f8-9bdf-47ea-99e1-632498e17169",
    "port": 5404,
    "primaryDNSv4": "185.236.104.154",
    "secondaryDNSv4": "185.236.105.155",
    "primaryDNSv6": "2a12:7bc0:104:154::",
    "secondaryDNSv6": "2a12:7bc0:105:155::"
  }
}

The dnsblock is what you hand to the customer's router/firewall: primaryDNSv4/ secondaryDNSv4(and the IPv6 equivalents).

A network can be bound to multiple policies through different DNS resolvers — useful for "multi-profile" setups where different subnets resolve through different DNS pairs. Bind again with the same networkId and a different policyId + dnsId. To detach: DELETE /network/v1/{networkId}/policies/{policyId}.

Verify

# All networks of the tenant, with their bindings
curl 'https://core.fsflt.net/network/v1?organizationId=019f88ef-7fb5-725c-88e8-0d7028d1b392&includePolicies=true' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Single network
curl 'https://core.fsflt.net/network/v1/0199e74b-70d9-7b80-b138-36ae8c1ca3b3?includePolicies=true' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Bindings of a network
curl 'https://core.fsflt.net/network/v1/0199e74b-70d9-7b80-b138-36ae8c1ca3b3/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

A network without any entry in /policies receives no filtering, even though it exists and is visible in the panel. Always verify the binding.

Updating and deleting

Operation	Endpoint
Edit static single	PATCH /network/v1/static/single/{networkId}
Edit static CIDR	PATCH /network/v1/static/cidr/{networkId}
Edit static range	PATCH /network/v1/static/range/{networkId}
Edit dynamic internal	PATCH /network/v1/dynamic/internal/{networkId}
Edit encrypted	PATCH /network/v1/encrypted/{networkId}
Delete any network	DELETE /network/v1/{networkId}