VPS Reseller API Documentation

Getting Started

API base:

`https://billing.svr4u.com/reseller-api/v1`

Create an API key in the authenticated VPS Reseller panel.

Authenticate with:

`Authorization: Bearer YOUR_API_KEY`

Store API keys server-side. Use an IP/CIDR allowlist whenever practical.

Authentication and Security

API keys are scoped credentials.

New full-access reseller keys can include catalogue, billing, instance lifecycle, firewall, rescue, ISO/media, snapshot, backup and webhook scopes.

Existing keys retain the scopes they already had.

Never expose a token in browser JavaScript, a public source repository, screenshots, tickets or downstream customer systems.

Capabilities

`GET /capabilities`

Returns a machine-readable list of currently exposed feature families.

The capability endpoint distinguishes supported features from features that are not yet exposed.

Catalogue: Account

`GET /account`

Returns WHMCS credit balance, currency, current reseller tier, rolling spend, active VPS count, active-service limit and API request-per-minute limit.

Your normal SVR4U WHMCS credit balance is the prepaid reseller purchasing balance.

Catalogue: Plans

`GET /plans`

Lists enabled reseller plans and your current private price.

`GET /plans/PLAN_CODE`

Returns one enabled reseller plan.

Plan responses can include vCPU, memory, disk, transfer quota, effective normal port rate and current reseller price.

Catalogue: OS Templates

`GET /images?plan=PLAN_CODE`

Alternative resource-style route:

`GET /plans/PLAN_CODE/images`

Always discover valid templates instead of hard-coding template IDs.

Idempotency

Mutating API operations use an `Idempotency-Key` where required by the endpoint.

One logical order should use one stable key.

Example:

`Idempotency-Key: customer-order-12345`

If a request times out, inspect the current transaction or VPS state before creating another logical order.

VPS Instances: List

`GET /instances`

Lists VPS instances owned by the authenticated reseller.

A downstream external reference can be used to correlate reseller orders with your own billing system.

VPS Instances: Create

`POST /instances`

Example:

`curl -X POST https://billing.svr4u.com/reseller-api/v1/instances -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" -H "Idempotency-Key: customer-order-12345" -d '{"plan_code":"MY-RS-8G","template_vmid":9107,"hostname":"server1.example.com","reference":"customer-order-12345"}'`

Creation is asynchronous.

A successful purchase normally returns HTTP `202` with state `provisioning`.

Do not treat an accepted WHMCS order as proof that the guest is ready.

VPS Instances: Details and Effective State

`GET /instances/INSTANCE_UUID`

Returns reseller-facing instance information.

`GET /instances/INSTANCE_UUID/status`

Returns the live backend status/configuration response when available.

Typical effective states:

• `provisioning`
• `active`
• `suspended`
• `terminating`
• `terminated`

VPS Instances: Live Statistics

`GET /instances/INSTANCE_UUID/stats`

Returns live VPS statistics from the existing PVEWHMCS bridge where supported by the guest/backend.

Monthly accounting remains available separately through the usage endpoint.

VPS Instances: Monthly Usage

`GET /instances/INSTANCE_UUID/usage`

Returns monthly inbound, outbound and total byte counters when accounting data is available.

Transfer quota and normal network-port rate are separate policies.

VPS Instances: Task History

`GET /instances/INSTANCE_UUID/tasks`

Returns reseller provisioning queue tasks.

The public `attempts` field maps from the PVEWHMCS queue field `tries`.

`GET /instances/INSTANCE_UUID/backend-tasks`

Returns the richer PVEWHMCS task-history bridge response where available.

VPS Instances: Power

Supported power actions:

`reset` is a hard reset and should be used carefully.

• `POST /instances/INSTANCE_UUID/start`
• `POST /instances/INSTANCE_UUID/shutdown`
• `POST /instances/INSTANCE_UUID/reboot`
• `POST /instances/INSTANCE_UUID/stop`
• `POST /instances/INSTANCE_UUID/reset`

VPS Instances: Hostname

`POST /instances/INSTANCE_UUID/hostname`

Body:

`{"hostname":"server1.example.com"}`

The existing backend can update WHMCS/Proxmox naming and can attempt guest-OS synchronization when supported.

VPS Instances: Suspend and Unsuspend

Suspend:

`POST /instances/INSTANCE_UUID/suspend`

Unsuspend:

`POST /instances/INSTANCE_UUID/unsuspend`

Insufficient reseller credit can also trigger balance-related suspension at renewal.

VPS Instances: Reinstall

`POST /instances/INSTANCE_UUID/reinstall`

Supply a valid template ID returned for the plan.

Reinstall is destructive to the VPS system disk and can return the instance to `provisioning` while work continues.

VPS Instances: Password Reset

`POST /instances/INSTANCE_UUID/password/reset`

A password can be supplied or generated.

Treat a returned password as a one-time secret.

VPS Instances: Console

`POST /instances/INSTANCE_UUID/console`

Creates a short-lived console session through the authorised backend bridge.

Console tickets and URLs are sensitive.

Networking: Reverse DNS

Read PTR state:

`GET /instances/INSTANCE_UUID/rdns`

Request PTR:

`POST /instances/INSTANCE_UUID/rdns`

PTR requests remain subject to current SVR4U rDNS policy and backend processing.

Network Security: Firewall

Read firewall options and rules:

`GET /instances/INSTANCE_UUID/firewall`

Update firewall options:

`POST /instances/INSTANCE_UUID/firewall/options`

Example body:

`{"enabled":true,"policy_in":"DROP","policy_out":"ACCEPT"}`

Add rule:

`POST /instances/INSTANCE_UUID/firewall/rules`

Example body:

`{"type":"in","action":"ACCEPT","proto":"tcp","source":"0.0.0.0/0","dport":"443","comment":"Allow HTTPS"}`

Toggle rule:

`POST /instances/INSTANCE_UUID/firewall/rules/RULE_POSITION/toggle`

Delete rule:

`DELETE /instances/INSTANCE_UUID/firewall/rules/RULE_POSITION`

Firewall rules are applied through the existing per-guest PVEWHMCS firewall authority.

Recovery: Rescue Mode

Read rescue state:

`GET /instances/INSTANCE_UUID/rescue`

Start rescue mode:

`POST /instances/INSTANCE_UUID/rescue/start`

Exit rescue mode:

`POST /instances/INSTANCE_UUID/rescue/stop`

Changing rescue mode can restart the VPS.

Use the console for recovery access.

Recovery: ISO and Media

List available media:

`GET /instances/INSTANCE_UUID/iso`

Mount media:

`POST /instances/INSTANCE_UUID/iso/mount`

Example body:

`{"iso":"MEDIA_VOLUME_ID","boot_cdrom_first":true}`

Eject:

`POST /instances/INSTANCE_UUID/iso/eject`

Set HDD-first boot:

`POST /instances/INSTANCE_UUID/iso/boot/hdd`

Set CD/DVD-first boot:

`POST /instances/INSTANCE_UUID/iso/boot/cdrom`

The API exposes media already authorised by the current backend library. Arbitrary custom ISO upload is not exposed by the reseller API at this time.

Snapshots

List:

`GET /instances/INSTANCE_UUID/snapshots`

Create:

`POST /instances/INSTANCE_UUID/snapshots`

Rollback:

`POST /instances/INSTANCE_UUID/snapshots/SNAPSHOT_NAME/rollback`

Delete:

`DELETE /instances/INSTANCE_UUID/snapshots/SNAPSHOT_NAME`

Snapshot availability depends on current backend/storage capability.

Backups

List:

`GET /instances/INSTANCE_UUID/backups`

Create:

`POST /instances/INSTANCE_UUID/backups`

Restore:

`POST /instances/INSTANCE_UUID/backups/restore`

Example restore body:

`{"backup_id":"BACKUP_VOLUME_ID"}`

Delete:

`DELETE /instances/INSTANCE_UUID/backups`

Example delete body:

`{"backup_id":"BACKUP_VOLUME_ID"}`

Backups remain subject to backend retention, storage and service state.

Termination

`DELETE /instances/INSTANCE_UUID`

Termination can be asynchronous.

Poll until the effective state is `terminated`.

Repeating DELETE after the VPS is already terminated is safe and returns a successful no-op rather than starting another termination action.

Webhooks

List:

`GET /webhooks`

Create:

`POST /webhooks`

Delete:

`DELETE /webhooks/WEBHOOK_ID`

Webhook signing secrets are displayed only at creation.

SVR4U signs webhook deliveries with HMAC-SHA256 over:

`timestamp + "." + raw_json_body`

Verify signatures with the exact raw body and a constant-time comparison.

HTTP Status Codes

`200` — successful read, synchronous action or safe no-op.

`201` — resource/rule created.

`202` — asynchronous work accepted.

`400` — malformed request.

`401` — invalid or missing token.

`402` — insufficient WHMCS credit.

`403` — reseller status, scope or source-IP restriction.

`404` — resource not found.

`409` — conflict, service limit or reconciliation state.

`422` — validation failure.

`429` — API rate limit exceeded.

`500` or `502` — internal/backend operation failed. Inspect current state before retrying a mutation.

Rate Limits

Request-per-minute limits depend on reseller tier.

Use reasonable polling intervals and retry backoff.

Do not poll lifecycle endpoints continuously at high frequency.

Integrations

Authenticated reseller panel:

`/index.php?m=svr4u_reseller_api`

WHMCS integration:

`/downloads/svr4u-reseller-whmcs-module.zip`

Paymenter reference:

`/downloads/svr4u-reseller-paymenter-reference.zip`

OpenAPI specification:

`/reseller-api/openapi.yaml`

Feature Matrix

Currently exposed:

Not yet exposed as reseller API objects:

These are not advertised as available until SVR4U has an accepted backend and reseller-policy authority for them.

• private reseller plan/pricing catalogue;
• OS templates;
• prepaid credit purchasing;
• VPS lifecycle;
• live status and statistics;
• monthly usage;
• task history;
• hostname changes;
• power/reset;
• reinstall/password;
• console;
• reverse DNS;
• per-VPS firewall;
• rescue mode;
• authorised ISO/media library;
• snapshots;
• backups;
• webhooks.
• saved SSH-key library;
• IP-list objects;
• VPC/private-network objects;
• reserved/floating IP objects;
• startup-script library;
• arbitrary custom ISO upload;
• BGP enable/disable controls;
• object storage.

Commercial Model

VPS reseller and SVR4U affiliate earnings are separate.

While VPS reseller status is active or suspended, no new SVR4U affiliate commission is earned.

Your reseller profit is the difference between your private reseller purchase rate and the downstream price you independently charge.

Support

When opening an integration support ticket, include:

Never send the full API token, webhook secret or root password in a support ticket.

• endpoint;
• HTTP method/status;
• timestamp;
• external reference;
• instance UUID where applicable;
• task/event identifier where applicable.