Access details (username/password/ip/hostname/panel_url)

GET 
/services/:id/credentials

Returns the root access details of the reseller's VPS. password is decrypted via the WHMCS DecryptPassword API action (tblhosting.password is stored encrypted). If it cannot be decrypted (empty in DB, no WHMCS API permission, transport error), password_available=false + an empty password is returned — in that case the reseller module MUST NOT overwrite the existing password.

Usage: After the service.created webhook, the reseller module calls this endpoint and writes the result to its own WHMCS tblhosting record (password + dedicatedip); this way it appears in the admin/client area + the {$service_password} mail merge field.

management=basic: For a service whose panel the API cannot manage, the customer connects directly with these details; panel_url = the WHMCS server's hostname (cPanel :2083, Plesk :8443). For a fully managed service panel_url is null.

SECURITY: The returned password is the plaintext root password; ownership (api_key → reseller → service) is verified, and it is masked in logs.

Rate limit: Default bucket (60 req/min). Idempotency: none (read).

Request

Responses

200

VPS access details

403

Insufficient authorization — the reseller tried to access another reseller's service_id, or has insufficient scope for an endpoint requiring admin scope. The message is kept generic (ServiceOwnershipMiddleware prevents leakage).

404

Resource not found (or hidden from the reseller). To prevent inventory/resource leakage between resellers, "not found" and "not accessible" return a single response.