hosting
POST /v1/sites/{siteId}/migrations/discover
Work out which control panel a host runs, from the hostname alone.
Authentication
Send an API key as a bearer token. The key must carry the hosting.import.manage permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/migrations/discover \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "host": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Takes a hostname and **no credential**, and answers which control panel the host is running, on which port, and what we would expect to be able to take off it. It exists because the step before it used to be a dropdown asking a prospect to choose "cPanel / WHM" or "DirectAdmin" and to know their own control-panel port — which the customer who is leaving a host they are unhappy with frequently cannot answer, and a form that cannot be filled in is a migration that is postponed for ever. It runs unauthenticated TCP connects and reads public sign-in pages. Five protocol fingerprints decide first (`cpsrvd` in a `Server:` header, `PLESKSESSID`, and so on — facts about software, not a list of hosting brands that would rot); a language model is asked to read the page **only** when that table is not confident, and its answer is weighted evidence that cannot outrank a protocol banner. `agent_used` says whether it was asked. `outcome` is three-valued and never a boolean: `identified`, `unidentified` (something answered and we cannot place it — a candidate for the managed migration) and `unreachable` (nothing answered at all — usually a typo or a firewall). Those have opposite remedies, so folding them would hand both populations the same wrong advice. `routes` lists every way in that was tried and whether it answered, with `checked` distinguishing "closed" from "we never got to try". Read it when a panel is firewalled: a host with 2083 closed and 22 open can still have its files, databases and mail moved. **Nothing we do installs anything on the source** — no migration plugin, no backup plugin, no agent — so a host that forbids those blocks none of it. ⛔ `POST` although it creates nothing and carries no secret: it knocks on a third party's administrative ports, which is an act rather than a lookup, and must not be repeated by a prefetch or a back button. A bad hostname or a dead host is an `outcome`, not an error. Requires `hosting.import.manage`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
host | string | Yes | The server address the current host gave them, e.g. `server123.theirhost.com`. A hostname, not a web address — no scheme and no path. The customer's own domain works too when it… |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
outcome | string<pending, identified, unidentified, unreachable> | Yes | `pending` while the discovery workflow is still probing — poll `getMigrationDiscovery` until it is one of the other three (D19865). ⛔ Three answers and never a boolean. `unident… |
host | string | Yes | The hostname as it was normalised, which may differ from what was typed. |
source | string | Yes | The best candidate's `MigrationSource`, or `""` when there is none. |
port | integer | Yes | The **login** port for that source, which is not necessarily the port the evidence came from: a banner read from cPanel's plaintext 2082 reports 2083, because that is where the… |
confidence | integer | Yes | — |
confident | boolean | Yes | May the credential form be pre-filled from this? |
candidates | MigrationDiscoveryCandidate[] | Yes | — |
expectations | string[] | Yes | Machine codes for what to expect from the winning source — e.g. `ftp_files_only`. ⛔ Expectations, not a capability claim: the authoritative answer comes from the credentialed pr… |
routes | MigrationDiscoveryRoute[] | Yes | Every way in that was tried. Read it when a panel is firewalled — a host with 2083 closed and 22 open can still have everything moved. |
proxy_fronted | boolean | Yes | This address is a CDN in front of a website, not a hosting account — several different panels' login ports accepted a connection at once and none of them answered with its own n… |
refused | string | Yes | A customer-readable reason the hostname was rejected before any packet went out — a private address, an unresolvable name. `""` otherwise. |
agent_used | boolean | Yes | Whether a language model was asked to read the sign-in page. It is asked only when the deterministic table produced no confident panel. |
agent_unavailable | string | Yes | Machine code when the model was asked and could not answer (`ai_unavailable`, `ai_timeout`, …). `""` when it was not asked or it answered. ⛔ The deterministic answer stands eith… |
discovery_id | string | Yes | The recorded run, for support. `""` when the row could not be written — which never costs the customer their answer. |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 503