Change VPS firmware mode

PUT /api/v2/vps/{id}/firmware

Change firmware mode to incus or legacy. Use incus for UEFI with Secure Boot and TPM 2.0; use legacy for BIOS without TPM. Optional storage is an advanced placement hint matching [A-Za-z0-9_-]{1,64}.

VPS Services VM

Authentication

Required API scopes: write:vmwrite:storage

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID. Get it from GET /api/v2/vps data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Authorization Bearer <token>
Accept application/json
Content-Type application/json

Body

required
application/json
mode string · enum required · Example: incus
incus
legacy
storage string · Example: local-lvm

Responses

200 Firmware mode changed.
mode string · enum required · Example: incus
incus
legacy
summary string required · Example: Firmware mode was changed to UEFI with Secure Boot and TPM 2.0.
firmware object | null required · Example: null
firmware.status string · nullable required · Example: stopped

Nullable: may be null when not applicable.

firmware.bios string · nullable required · Example: ovmf

Nullable: may be null when not applicable.

firmware.machine string · nullable required · Example: q35

Nullable: may be null when not applicable.

firmware.mode string · nullable required · Example: incus

Nullable: may be null when not applicable.

firmware.efi object | null required · Example: null
firmware.efi.volume string · nullable required · Example: local-lvm:vm-100-disk-0

Nullable: may be null when not applicable.

firmware.efi.type string · nullable required · Example: 4m

Nullable: may be null when not applicable.

firmware.efi.size string · nullable required · Example: 4M

Nullable: may be null when not applicable.

firmware.efi.preEnrolledKeys boolean required · Example: true
firmware.tpm object | null required · Example: null
firmware.tpm.volume string · nullable required · Example: local-lvm:vm-100-disk-1

Nullable: may be null when not applicable.

firmware.tpm.size string · nullable required · Example: 4M

Nullable: may be null when not applicable.

firmware.tpm.version string · nullable required · Example: 2.0

Nullable: may be null when not applicable.

firmware.secureBootReady boolean required · Example: true
firmware.tpmReady boolean required · Example: true
firmware.actions object required
firmware.actions.canChangeMode object required
firmware.actions.canChangeMode.allowed boolean required · Example: true
firmware.actions.canChangeMode.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
409 The VPS is still provisioning or cannot change firmware in its current state.

No response body

429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
PUT https://cloud.hostup.se/api/v2/vps/{id}/firmware
For AI assistants
View as Markdown
cURL 
curl -X PUT "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/firmware" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "incus"
  }'
Response 
{
  "mode": "incus",
  "summary": "Firmware mode was changed to UEFI with Secure Boot and TPM 2.0.",
  "firmware": {
    "status": "stopped",
    "bios": "ovmf",
    "machine": "q35",
    "mode": "incus",
    "efi": {
      "volume": "local-lvm:vm-100-disk-0",
      "type": "4m",
      "size": "4M",
      "preEnrolledKeys": true
    },
    "tpm": {
      "volume": "local-lvm:vm-100-disk-1",
      "size": "4M",
      "version": "2.0"
    },
    "secureBootReady": true,
    "tpmReady": true,
    "actions": {
      "canChangeMode": {
        "allowed": true,
        "reason": null
      }
    }
  }
}
Request Body Enable UEFI Secure Boot and TPM 
{
  "mode": "incus"
}