User (Admin/Staff) API

Base URL: https://your-domain.com
Authentication: Bearer Token (Admin/Staff)

All endpoints in this section require admin/staff authentication. Include the Bearer token in your request headers.

---

API Modules

Core Management

Module	Description	Endpoints
📁 Subscribers	Subscriber CRUD, activation, suspension, import/export	9
📁 Users	User management, resellers, staff	7
📁 Packages	Package CRUD, assignment, pricing	7

Accounting

Module	Description	Endpoints
📁 Invoices	Invoice CRUD, generate, pay, reverse	8
📁 Payments	Payment CRUD, payment methods	6
📁 Ledgers	Ledger history and transactions	3
📁 Balance	Subscriber/user balance management	4
📁 Expenses	Expense tracking and categories	6

Network

Module	Description	Endpoints
📁 NAS	Network Access Server management	6
📁 IP Pools	IP pool management and generation	6
📁 OLT/ONU	Fiber network device management	8
📁 Policies	RADIUS policy management	5
📁 Bandwidth	Bandwidth allocation management	6
📁 MAC Binding	MAC address binding	4
📁 RADIUS	RADIUS sessions and management	7

Organization

Module	Description	Endpoints
📁 ISPs	ISP management	5
📁 Branches	Branch management	5
📁 Areas	Area hierarchy management	6
📁 Inventory	Inventory tracking and assignment	7

Support & Communication

Module	Description	Endpoints
📁 Tickets	Support ticket management	7
📁 Notes	Note management	5
📁 Notices	Notice management	5
📁 SMS	SMS messaging	3
📁 SMS Templates	SMS template management	5
📁 Email Templates	Email template management	5

System

Module	Description	Endpoints
📁 Dashboard	Subscriber, accounting and user counters	3
📁 Settings	System settings management	6
📁 Roles	Role management	6
📁 Permissions	Permission management	2
📁 Activity Logs	Activity log viewing	4
📁 Reports	Reporting endpoints	6
📁 Extra Fees	Extra fee management	6

---

Common Request Headers

Header	Value	Required
Authorization	Bearer your-auth-token	Yes
Accept	application/json	Yes
Content-Type	application/json	Yes (POST/PUT)

Common Query Parameters

Parameter	Type	Required	Description
isp_id	integer	Yes	ISP identifier
branch_id	integer	Yes	Branch identifier
user_id	integer	Yes	User identifier

isp_id and branch_id must be the caller's own (the values returned by Login); a Super admin (profile_type 100) may name any existing ISP/branch pair, and must then send both. user_id, when sent, must be the caller or a user the caller may act for. Anything else answers 403 Oops! Insufficient Permission. Records are always created and changed as the token's user, whatever user_id says.

---

What each user sees (scoping)

The API shows each user the same records the web panel shows them. Inside the caller's ISP and branch, what is visible depends on the token user's profile_type:

Profile type	Who	What the API shows
1, 100	Admin, Super admin	The whole ISP and branch
2	Admin staff	Subscribers (the list and details, MAC binding list, RADIUS sessions, and every subscriber action): only those of the resellers the staff's role manages, plus the admin's own subscribers. Everything else (invoices, payments, ledgers, reports, users, tickets, dashboard): the whole ISP and branch, except that admin staff never see an admin's profile or balance
3, 4, 5	Reseller, Sub-reseller, Retailer	Only their own tree: the records of the user itself and of the sub-resellers / retailers below it
6, 7, 8	Staff of a reseller, sub-reseller, retailer	The same as their parent (the user who created them): the parent's tree

For the reseller family (3 to 8) the tree applies to every module:

Module	What a reseller-family user sees
Subscribers, MAC binding	Subscribers whose salesperson is in the tree. Every subscriber action (activation, migration, update, balance) works only on these
Invoices	Invoices of the tree's subscribers, or sold by a user of the tree
Payments, receipts	Payments made by the tree's subscribers or the tree's users
Ledgers, balances	Ledger rows and balances of the tree's subscribers and users
Users	A reseller: the sub-resellers, retailers and staff it or its sub-resellers created. A sub-reseller: its retailers and staff. A retailer: its staff. Reseller staff: none
Packages	Only the packages assigned to the reseller (the parent, for staff). Creating, changing and assigning packages is admin side only
Reports	All six reports count only the tree's subscribers, invoices and payments
Notes	Notes on the tree's subscribers and users. A note can be created only on one of them
Activity logs	Only the user's own actions
Expenses	Only the expenses the user created
Tickets	Tickets of the user's own subscribers and tickets assigned to the user or its staff (staff: also those assigned to the parent and to sibling staff). See Tickets
RADIUS	Online sessions, session history, RADIUS attributes, usage and disconnect for the tree's subscribers only
Dashboard	Counters of the tree. Reseller staff see their parent's numbers

A record outside what you may see answers as if it did not exist: 404 with the endpoint's usual "not found" message (for example Oops! Subscriber Not Found., Invoice Not Found, Ticket not found.). Lists simply leave such records out. When you send an ID you may not use (a foreign subscriber_id on a write, a ticket assign_to_id outside your reach, a note to_id outside your tree), the answer is 403, for example:

{
    "status": "error",
    "message": "The selected subscriber_id does not belong to your ISP and branch."
}

---

Access and errors

api_access is checked on every request. Every profile except Admin (1) and Super admin (100) needs the api_access permission (Super admin is exempt from v2.30.8). Profiles other than Admin and Super admin also need the web permission of the module they call, where the web panel has one (for example subscriber_module, ticket_module; disconnecting a RADIUS session needs subscriber_disconnect). When the permission is removed, the next request with the same token answers:

{
    "status": "error",
    "message": "Oops! Insufficient Permission"
}

The token is kept, so granting the permission again makes it work at once. A disabled user's token answers 401 instead (see Auth - User).

Server errors carry no internals. A server error answers 500 with a short generic message only (in every staff module from v2.30.8; before that, only in the scoped modules, RADIUS, Tickets and Dashboard), for example:

{
    "status": "error",
    "message": "Failed to fetch tickets."
}

No SQL, exception text, file or line is returned; the details are written to the server log. A message the server gives on purpose (for example Insufficient Balance!) is still returned as it is.

Wrong token, route or method answers JSON, never an HTML page or a redirect to the login page:

Status	When	Body
401	Missing, invalid, expired or revoked token	{"message": "Unauthenticated."}
404	No route has this path	{"status": "error", "message": "Route not found: GET /api/v1/tikets"}
404	A record looked up by ID does not exist	{"status": "error", "message": "Record not found."} (or the endpoint's own message)
405	The path exists but not for this method	{"status": "error", "message": "The DELETE method is not supported for this route. Use: GET, POST."} (here for DELETE /api/v1/tickets), with an Allow header

Send Accept: application/json on every request.

---

Method Reference

• GET - Retrieve data
• POST - Create new resource or perform action
• PUT - Update existing resource
• DELETE - Delete resource

Fields marked in red are required.