Zal Pro API v1

Base URL: https://your-domain.com/api/v1

🧪 Beta

The v1 API is newly released. Endpoints are provided as-is — please verify each on your own instance before relying on it in production, especially the money/router endpoints (subscriber activation and disconnect), which move balances and reprovision the router.

Overview

The v1 API greatly expands what you can automate in Zal Pro — subscribers, activation & billing, packages, tickets, network, resellers/staff/admins, and roles & permissions.

It runs alongside the original legacy API (/api/user, /api/ticket), which stays unchanged — existing integrations keep working. All new endpoints live under the versioned prefix /api/v1/.

Authentication

Same as the rest of Zal Pro — HTTP Basic Authentication using the API username/password from Settings → Others API & Server Settings. See the Authentication guide.

curl -u "your_api_username:your_api_password" \
  "https://your-domain.com/api/v1/subscriber/list"

URL format

Multi-word endpoints use underscores (a CodeIgniter routing requirement) — e.g. /api/v1/dashboard/online_count, /api/v1/subscriber/reset_password. If clean URLs are off on your server, prefix paths with index.php/.

Modules

Module	What it covers
Auth & Dashboard	Credential check, self-info, headline stats & charts
Subscribers	Subscriber CRUD, usage, notes, password & MAC binding
Activation & Disconnect	Activate / renew / change package, and disconnect a session
Packages & Policies	Package reads + safe edits, RADIUS policy reads
Tickets	Full ticket CRUD, comments, assign, categories
Billing	Payments, invoices, subscriber balance/due
Areas	Cities / areas / sub-areas + hierarchy
Notices	Notice CRUD
Network	NAS reads, RADIUS online sessions & history
Resellers	Franchise / dealer / subdealer CRUD
Staff & Admins	Staff and primary-admin CRUD
Roles & Permissions	Roles CRUD + per-role permissions

Conventions

• Requests: GET uses query params; POST/DELETE bodies use form fields (application/x-www-form-urlencoded), not raw JSON.
• Responses: always JSON. Lists return an array; actions return { "success": "..." } (or { "error": "..." }).
• List filters: most list endpoints accept limit and offset for paging.

HTTP status codes

Code	Meaning
200	Success (some business errors also return 200 with an error field)
400	Validation error
401	Bad Basic Auth credentials
403	API disabled or IP not whitelisted
404	Resource not found
422	Not allowed in this state (e.g. insufficient balance, unsupported connection type)
429	Too frequent (e.g. re-activation within 2 minutes)