content.html 8.47 KB
Newer Older
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "">
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159

    <title>ISPCOnfig 3 remote API documentation</title>

    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

    <style type="text/css">
        .command {
            padding: 1em;
            border: 1px dashed #2f6fab;
            color: black;
            background-color: #f9f9f9;
            line-height: 1.1em;
            font-family: Courier New, Courier, mono;
            font-size: 12px;
            font-style: italic;

        .notes {
            color: #17075c;
            font-family: Georgia, "Times New Roman", Times, serif;
            font-size: 14px;


        .preface {
            color: black;
            font-family: Georgia, "Times New Roman", Times, serif;
            font-size: 14px;

        a:visited {
            text-decoration: none;

        a:active {
            text-decoration: underline;

        .question {
            font-size: 14px;
            padding: 0em 0em 0em 1em;

        .answer {
            padding: 0em 0em 0em 2em;

    <div style="padding:40px">
        <h2>ISPConfig 3 Remote API Documentation</h2>
        <div class="notes">

            <p class="preface">These notes are new for v3.2 and the content will change.<br />
                This is currently in FAQ format, because the topics seem to be Frequently Asked Questions.<br />
                Over time, notes will also be added to individual function pages.<br />
                If you would like to help with this process, please visit the forum, and add your comments to <a
                    href="">this thread</a>
                which has been created for this purpose.<br />
                Thank you for your patience and collaboration.

            <h4 class="question">What do we do to get started with API calls?</h4>
            <div class="answer">
                <p>Create a "Remote" User in the ISPConfig UI. Check boxes there to assign permissions for
                    the kinds of queries that can be processed by that user.</p>
                <p>Almost all API queries require a session_id. To get that, call the login function, sending the remote
                    username and password. The response will be a single value which will be used as your session ID for
                    a limited time period for all other requests.</p>
                <p>Finishing with a logout request is recommended, but optional since the session IDs expire.</p>

            <h4 class="question">How do I get all records with a _get request?</h4>
            <div class="answer">Rather than using a single integer ID as a primary key selector (domain_id, group_id,
                etc), use -1. Where the primary key for a _get request is a string, use an empty array ' [] '. Do not
                use an empty string ' "" ', which is itself a valid string and will/should return an empty array result.

            <h4 class="question">Are defaults used if we only send some of the defined parameters?</h4>
            <div class="answer">No, there are no default values except where explicitly noted. For example, in the
                system_config_get function, the key element is optional because it is documented as defaulting to an
                empty string. For all requests, except where documented otherwise, send all documented parameters.</div>

            <h4 class="question">Examples are provided for SOAP, why not for REST?</h4>
            <div class="answer">The REST API supports all functions and can be exactly substituted for SOAP examples.
                For all functions, the request and response parameters are the same for SOAP and REST.</div>

            <h4 class="question">Are there examples for cURL? Python? C#? JavaScript? (anything else...)</h4>
            <div class="answer">The documentation details request and response parameters which can be passed using any
                language or toolchain. The URL always includes the function name. Queries are always sent via POST. The
                result is always in the same JSON format. Use Postman or another tool to generate code in your preferred

            <h4 class="question">I created a new record (domain, mail user, etc). Why isn't it showing in the UI?</h4>
            <div class="answer">If a parent ID is invalid, a transaction may be accepted, with a record created under a
                different parent entity.

            <h4 class="question">Why does a response show a successful result when there is no data?</h4>
            <div class="answer">Carefully check the names and values being sent. Invalid name/value pairs are ignored. A
                request that does not include a valid request paramenter is requesting nothing, so the return value is
                nothing. The query was successful, and returned no data.</div>

            <h4 class="question">Why are parameters $session_id and others being ignored?</h4>
            <div class="answer">The documentation shows PHP function syntax. SOAP and REST parameters do not include the
                leading $dollar-sign</div>

            <h4 class="question">Key Concept:</h4>
            <div class="answer">Based on the above you may be thinking there is very little error checking with this
                API. That is correct. As noted by Jesse Norell: <blockquote>"The api is largely just an interface to the
                    database tables, and will usually accept what you send, whether that's consistent/correct or not. It
                    can be a feature, eg. you can create a mail alias first before creating the mailbox to which it
                    forwards, but it does mean you have a lot more testing to do on your side because you can't just
                    rely on an error to be thrown if you send inconsistent data."</blockquote>

            <h4 class="question">What is sys_userid and sys_groupid?</h4>
            <div class="answer">
                <p>These fields are referenced often in the developer forum and in code, usually with some confusion.
                    These internal database fields are used in SQL queries to determine parent/child client
                    relationships. The fields are not passed to API calls, with the exception of one function,
                    client_get_id which is a convenience function to return the client_id for a sys_userid. In the past
                    other functions included these keys in the request. Now, when a function request includes a
                    client_id, at query time a lookup is done to get the internal sys_userid for that client.</p>
                <p>The sys_userid can identify the creator of a record. This may be the ID of the local/UI user or the
                    remote/API user that is logging in to create records. If a client record is created without a
                    reseller, both the sys_userid and the sys_groupid are the same user ID.</p>
                <p>If a client record is created with a reseller, the meaning of the fields is completely different. The
                    sys_userid is not a logged-in user ID. It is a new ID that represents the client under the reseller.
                    The sys_groupid for a client under a reseller is (a foreign-key to) the sys_userid of the client
                    record for the reseller. In this scenario, the sys_groupid establishes a child-to-parent

            <h4 class="question">What domains are the 'domains_' functions operating on?</h4>
            <div class="answer">The 'domains_' functions update the 'domains' table, which is used by the domain limit
                module. Clients and resellers are restricted to the domains in this table. To activate domain limits, go
                to System > Interface > Main Config, then to the Domains tab. Logout/in. Then go to Sites, Add or Edit a
                site, the "Domain" dropdown list uses this table.</div>

            <h4 class="question">What will be here next?</h4>
            <div class="answer">Maybe something you write... </div>