VPS root access details (username/password/ip/hostname)
GET/services/:id/credentials
Returns the root access details of the reseller's VPS. password is decrypted via the WHMCS DecryptPassword API action (tblhosting.password is stored encrypted). If it cannot be decrypted (empty in DB, no WHMCS API permission, transport error), password_available=false + an empty password is returned — in that case the reseller module MUST NOT overwrite the existing password.
Usage: After the service.created webhook the reseller module calls this endpoint and writes it (password + dedicatedip) into its own WHMCS tblhosting record; so it appears in the admin/customer panel + the {$service_password} mail merge field.
SECURITY: The returned password is the plaintext root password; ownership (api_key → reseller → service) is verified, and it is masked in logs.
Rate limit: Default bucket (60 req/min). Idempotency: none (read).
Request
Responses
- 200
- 403
- 404
VPS access details
Insufficient authorization — the reseller tried to access another reseller's service_id, or has insufficient scope for an endpoint requiring admin scope. The message is kept generic (ServiceOwnershipMiddleware prevents leakage).
Resource not found (or hidden from the reseller). To prevent inventory/resource leakage between resellers, "not found" and "not accessible" return a single response.