Admin

Server-to-server admin channel (X-Admin-Token, NOT BasicAuth). When a customer clicks "Become a reseller", the Rabisu WHMCS master module uses these endpoints to generate/list API keys for that customer. Cannot be accessed with reseller API keys.

📄️Generate a new API key for a reseller (secret returned ONCE)

When a customer clicks 'Become a Reseller', the Rabisu WHMCS master module calls this

📄️List a reseller's active API keys (NO secret)

Returns the active (is_active=1) API keys for the specified `reseller_id`. The secret hash or plaintext is NEVER returned — only metadata.

📄️Issue a webhook secret to a legacy key (if missing, one time)

For a key created before Become a Reseller, if `webhook_secret_encrypted` is empty, generates

📄️Rotate the reseller API key secret (secret returned ONCE)

The public part of `api_key` DOES NOT CHANGE; only the secret is rotated. The old secret becomes invalid IMMEDIATELY (immediate rotate — 24h grace / dual-secret v2 backlog). The APCu auth cache is invalidated. The `reseller_id` in the body is an ownership guard — another reseller's key returns 404 `key_not_found` (isolation, no leak).

📄️Revoke the reseller API key (soft delete)

Immediately deactivates the key (`revoked_at` set) + invalidates the APCu auth cache. The record is preserved for audit. The `reseller_id` in the body is an ownership guard — another reseller's key returns 404 `key_not_found`.