Rabisu Reseller API
The Rabisu Virtual Server Reseller API — a REST interface for resellers to programmatically order virtual servers, manage existing services and query their account balance.
Authentication: HTTP Basic Auth (RFC 7617).
Username = API Key (rsk_live_*), Password = API Secret (rsks_live_*).
Rate Limit: Default 60 req/min per key. Can be overridden per key via the mod_reseller_api_keys.rate_limit_rpm column. All responses return X-RateLimit-* headers, and a Retry-After header when the limit is exceeded.
Idempotency: POST/PUT/PATCH endpoints support the Idempotency-Key header (RFC draft-irsdl-httpbis-idempotency-header). The same key + same body sent again within 24 hours returns the cached response. Same key + different body → 422 idempotency_key_reuse.
Authentication
- HTTP: Basic Auth
- API Key: AdminToken
HTTP Basic Authentication (RFC 7617).
- Username: API Key (
rsk_live_*orrsk_test_*in the test environment) - Password: API Secret (
rsks_live_*/rsks_test_*) - A bcrypt hash is kept in the DB, the plaintext secret is shown only AT creation time
- Wrong credentials return 401 +
WWW-Authenticate: Basic realm="Rabisu Reseller API"
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | basic |
Server-to-server admin token (no RFC — custom header). The Rabisu WHMCS master module calls the /admin/* endpoints with this header. The value is compared in constant time (hash_equals) with ADMIN_API_TOKEN in .env.
- If the token is not configured (empty), ALL
/admin/*return 403admin_disabled. - A missing/wrong token returns 401
unauthorized. - This channel is not BasicAuth; it is not used with reseller API keys.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Admin-Token |
Contact Rabisu API Support: api@rabisu.com
License Proprietary