Skip to content

The API

The panel has an API: your programs can create customers and subscriptions, suspend and reactivate them, change plan, read the usage, manage the devices and the logs of CSP (Central Syslog) and much more, without going through the pages. It is mostly for a billing system, such as WHMCS, which activates and suspends the services with the payments, or for your automation scripts.

People do not use the API: the API accounts do, in Organization › API accounts. An API account cannot sign in to the panel.

Creating an API account

  1. New API account: a Name, for example "WHMCS", and a Role.
  2. Create the account.
  3. Create a key: a Name of the key, for example "Production server", and an optional expiry (Expires).

The key is shown only once, right after it is created: copy it at once and keep it in a safe place. The panel never shows it again.

The role

The Role decides what the account can do, as for a user. The roles are the same as for the users: make one with only the functions the program needs. A billing system, for example, must manage customers and subscriptions, but not the backups.

An API account acts as a user of your organization: it sees your customers and their subscriptions, not those of others.

Keys

An account can have several keys. Give each program or server its own key, so you can revoke one without stopping the others.

For each key the page shows when it was Created, when it Expires and when it was Last used. Leave the expiry empty for a key without expiry, and revoke it when it is no longer needed.

  • Revoke stops a key at once: the programs that use it stop working.
  • Setting the Status of the account to disabled stops all its keys until you enable it again.
  • Delete the account deletes the account and its keys.

If a key ended up where it should not, revoke it and create a new one.

The documentation of the calls

Documentation of the API, on the API accounts page, opens the description of all the calls, with their parameters and answers. It is generated by the panel itself, so it always matches the version installed.

Some things to know before writing an integration:

  • each call carries the key in the header Authorization: Bearer <key>;
  • the answers are in JSON, the dates in UTC;
  • there is a rate limit per key: beyond it, the panel asks you to wait;
  • a request that creates something can carry the Idempotency-Key header, so repeating it after a network error does not make a duplicate;
  • customers and subscriptions can have an external reference, the code of the customer or of the service in your billing system, to look them up by.

The details are in the documentation of the API.

What stays in the panel only

Your own account, users and roles, the brand and the notifications are managed only from the pages of the panel.