RH Reseller Parent — WHMCS Integration Documentation

1. Authentication & Security Flow

• Child Authentication: Sent on every request via the header X-RH-API-Key (or parameter api_key).
• User Authentication: User sessions are stateless, managed via a generated JWT-style HMAC-SHA256 token. Child panels must authenticate users via the auth action first to retrieve the user token, then pass it via X-RH-USER_TOKEN (or parameter token) for subsequent user-bound actions.
• IP Whitelisting: If a child panel defines an IP whitelist in the parent admin dashboard, incoming requests from non-whitelisted IPs are automatically dropped with a 403 Forbidden response.

2. REST API Reference

A. Public / Child-Only Actions

1. Ping / Health Check

• Action: ping
• Method: GET / POST
• Headers: X-RH-API-Key: <key>
• Response:
  
  
  JSON

   

  {
      "status": "success",
      "message": "RH Reseller Parent API is online",
      "version": "1.1.0",
      "timestamp": 1718000000,
      "child": "Acme Reseller Panel",
      "module_configured": true
  }
  

2. User Authentication (Login)

• Action: auth
• Method: POST
• Headers: X-RH-API-Key: <key>
• Payload: email, password
• Response:
  
  
  JSON

   

  {
      "status": "success",
      "client_id": 1445,
      "user_id": 1444,
      "token": "<jwt_string>",
      "expires_in": 1800
  }
  

B. Authenticated Actions (Requires Child Key + User Token)

3. Get Client Summary & Credit

• Action: getClientSummary or getClientCredit
• Response: Returns client profile metadata, active status, and available credit balance mapped to the appropriate parent currency ID.

4. Fetch Products Catalogue (Hosting & VPS)

• Action: getProducts
• Optional Payload: serviceid (or service_id) to fetch a specific product.
• Response: Returns an array of available web hosting or VPS product packages and pricing configurations.

5. Provision Service (Web Hosting & VPS)

• Action: createService
• Payload:
  
  
  • serviceid (Product PID)
  • domain (Required for web hosting; optional/supplemented by hostname for VPS)
  • hostname (Optional, for VPS setups)
  • rootpw (Optional root password for VPS)
  • billingcycle (e.g., monthly, annually)
  • qty (Integer, default 1)
  • paymentmethod (Default banktransfer)
• Behavior: Checks child client credit balance against the required line total, places the order via WHMCS AddOrder, automatically creates an invoice if missing, applies available credit via ApplyCredit, and accepts the order.

6. Domain Management & Registration

• Search Domain: searchDomain (checks availability via DomainWhois)
• Get TLD Pricing: domainPricing
• Register Domain: createDomain (Payload: domain, years, nameservers)
• Manage Nameservers: changeNSDomain (Payload: domainid, ns1, ns2, etc.)
• DNS Records: getDNSRecords, saveDNSRecords

7. Single Sign-On (SSO) Client Area Login

• Action: loginRealhost
• Response: Returns a secure one-time WHMCS SSO redirect URL (url) to seamlessly log the user into the parent client portal interface.