compute
POST /v1/compute/servers/{serverId}/administrator-password
Show a Windows server's Administrator password.
Authentication
Send an API key as a bearer token. The key must carry the sites.delete permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/compute/servers/{serverId}/administrator-password \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
A Windows Server machine is reached over Remote Desktop with the Administrator password minted when it was built (SSH keys do not apply). We keep that password in our secret store until you delete it, and this call shows it. It is a POST so nothing caches or prefetches it, and the response is Cache-Control: no-store. ⛔ Requires sites.delete, like the root-password reset: the password is total control of the machine. Each read is audit-logged as a fact (who, which machine), never with the value. 422 when no password is held: a Linux machine never has one, and a Windows one loses it once deleted. 503 when the secret store cannot be read.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
serverId (path) | Uuid | Yes | The server's id, as listComputeServers reports it. Ours (UUIDv7), minted when the order row was written — never the provider's own identifier for the machine. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
username | string | Yes | Always Administrator. |
password | string | Yes | The password. Shown, never logged or audited. |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 503