Reseller API guide

1. Enable access & add funds

API access is enabled per customer: it opens automatically once your account balance reaches the minimum balance set by our team, and our team can also enable it for you regardless of balance (open a support ticket and ask for it). Every API order is paid only from your available balance — your balance minus your minimum balance, which must still remain after the order — so add funds first (client area → Add funds). Use GET /account any time to see your balance, your minimum balance and how much you can spend.

2. Create a key

In your client area open API access and create a key. Give it a name (you can have up to 5 active keys). The key is shown once and stored only as a hash, so save it in your server's environment (never in website JavaScript or a mobile app). Optionally restrict the key to your server's IP addresses; requests from other IPs get 403 ip_not_allowed. Our team can also generate a key for you.

Base URL for every call below:

https://syllhost.com/api/v1

3. First call: check your account

Send the key as a Bearer token (or X-API-Key header). Always use HTTPS.

curl -H "Authorization: Bearer sh_live_xxxxxxxxxxxxxxxx" https://syllhost.com/api/v1/account

A healthy response looks like this. If you get 401 invalid_api_key, the key is missing, wrong or revoked. 403 api_not_enabled means access is not enabled on your account yet.

{ "data": { "name": "Reseller Co", "email": "you@example.com", "currency": "USD",
  "balance": "92.00", "minimum_balance": "5.00", "available_to_spend": "87.00",
  "discount_percent": "20.00", "discount_scope": "all", "rate_limit_per_minute": 60 } }

4. List plans

List everything you can sell. Filter by group when you only want one kind of plan: shared-hosting, wordpress-hosting, reseller-hosting, business-email. The prices returned already include your reseller discount and are exactly what you will be charged. If your discount applies only to selected products, only those products show discounted prices (GET /account shows your discount_scope).

curl -H "Authorization: Bearer sh_live_xxx" "https://syllhost.com/api/v1/products?group=wordpress-hosting"
curl -H "Authorization: Bearer sh_live_xxx" "https://syllhost.com/api/v1/products?group=business-email"

Each plan carries its resources (disk_mb, bandwidth_gb, email_accounts, databases) and its prices per billing cycle (monthly, annual, and more where offered). Only offer your customers cycles the plan actually lists.

5. Check a domain

Before selling a domain, check it. The response tells you whether it is available and what registration costs at your price.

curl -H "Authorization: Bearer sh_live_xxx" "https://syllhost.com/api/v1/domains/check?domain=acme-traders.com"

{ "data": { "domain": "acme-traders.com", "status": "available", "available": true,
  "message": "Great news - this domain is available!", "register_price": "11.40" } }

6. Order hosting

Every call that spends money must send an Idempotency-Key header (8–100 characters, unique per order — an order id from your own system is perfect). If a request times out, send it again with the same key: you get the original order back and are not charged twice. Reusing a key for a different order returns 409.

You can also send a billing object with your end customer's details; that invoice then prints their details instead of yours, and renewal invoices keep them. For a domain registration the same details become the domain owner.

curl -X POST https://syllhost.com/api/v1/orders/hosting \
  -H "Authorization: Bearer sh_live_xxx" -H "Idempotency-Key: my-order-1001" -H "Content-Type: application/json" \
  -d '{"product_id":5,"cycle":"monthly","domain":"acme-traders.com","reference":"CUST-77",
       "billing":{"name":"Acme Traders","email":"accounts@acme.example","country":"PK"}}'

The account is usually created right away (service.status: active, provision_status: done). If the server is busy it may be pending with provision_status queued or failed: payment is kept and we retry automatically, so poll GET /services/{id} until it is active. The first cPanel login details are emailed to your account email; use POST /services/{id}/password to set a new password programmatically.

7. Order a domain

No hosting plan is needed. Availability is checked before you are charged; if the registry needs extra time the domain stays pending and our team is notified — poll GET /domains/{name}.

curl -X POST https://syllhost.com/api/v1/orders/domain \
  -H "Authorization: Bearer sh_live_xxx" -H "Idempotency-Key: my-domain-1001" -H "Content-Type: application/json" \
  -d '{"domain":"acme-traders.com","years":1,
       "billing":{"name":"Acme Traders","email":"accounts@acme.example","phone":"+92.3001234567","address1":"1 Main Street","city":"Lahore","postcode":"54000","country":"PK"}}'

8. Mailboxes on a hosting service

Every hosting plan includes mailboxes, and email plans add more. List, create, change the password of and delete mailboxes on any active hosting service you own. Each mailbox's storage limit follows its email plan — 5 GB (Starter), 20 GB (Standard) or 50 GB (Premium); a hosting plan's own included mailboxes are 1 GB — and it can send up to 100 messages every 24 hours. Your customers sign in to webmail at https://mail.syllhost.com with the full mailbox address and its password. For mail apps: IMAP mail.<domain> port 993 SSL/TLS, POP3 port 995 SSL/TLS, SMTP port 465 SSL/TLS (or 587 STARTTLS); if mail.<domain> does not connect, use server.syllhost.com.

curl -H "Authorization: Bearer sh_live_xxx" https://syllhost.com/api/v1/services/812/mailboxes
curl -X POST https://syllhost.com/api/v1/services/812/mailboxes \
  -H "Authorization: Bearer sh_live_xxx" -H "Content-Type: application/json" \
  -d '{"local":"info","password":"CorrectHorse9Battery"}'
curl -X POST https://syllhost.com/api/v1/services/812/mailboxes/password \
  -H "Authorization: Bearer sh_live_xxx" -H "Content-Type: application/json" \
  -d '{"local":"info","password":"NewPassword9Here"}'
curl -X DELETE https://syllhost.com/api/v1/services/812/mailboxes \
  -H "Authorization: Bearer sh_live_xxx" -H "Content-Type: application/json" \
  -d '{"local":"info"}'

Mailbox passwords need at least 10 characters with letters and numbers. Creating beyond the included count returns 409 — buy an email add-on or an email plan for more.

9. Renewals

Renewal invoices are created before the due date and, with auto-renew on, are paid from your balance automatically. Keep the balance funded, or pay an unpaid invoice yourself:

curl -H "Authorization: Bearer sh_live_xxx" "https://syllhost.com/api/v1/invoices?status=unpaid"
curl -X POST https://syllhost.com/api/v1/invoices/123/pay -H "Authorization: Bearer sh_live_xxx"

Paying twice is safe. If a service already expired and you pay late, the new period starts on the payment day — the lapsed days are not counted. Paying early extends from the existing expiry date.

10. Errors & safety

• Successful responses look like {"data": ...}; lists add "meta": {"page","per_page","total","last_page"} (use ?page= and ?per_page=, max 100).
• All money is a string in USD with two decimals; dates are ISO 8601.
• Errors always use {"error": {"code","message"}} with a meaningful HTTP status (402 insufficient balance, 404 not found, 409 conflict, 422 validation failed, 429 rate limited). Validation errors also list fields.
• Rate limit: 60 requests per minute per key by default (your GET /account shows your limit). Over it you get 429 and a Retry-After header. Repeated invalid keys from one IP are blocked for a while.
• We log each request (method, path, status, IP, time) — never request bodies or keys. Keep keys on your server, restrict them by IP, rotate them if anyone who knew them leaves, and keep the balance only as high as you need.
• Still not available through the API (open a ticket): cancelling or terminating a service, changing a plan, nameserver and DNS changes for domains, domain transfer-out and webhooks.

Full endpoint reference, field tables and code examples: Reseller API documentation.