Admin API
Manage manual services, payments, users and tickets from your own software; v1 (PerfectPanel-compatible) and v2 (REST).
Keys
Only the panel owner can create keys, on Admin → Admin API.
- Creating one asks for your 2FA code (or admin password). The key (
nxa_+ 48 characters) is shown once. - Up to 20 active keys; each has a name and at least one permission.
- A deleted key stops working immediately. Last use and request count are listed.
- Child panels don't have an Admin API.
| Permission | Allows |
|---|---|
orders.view, orders.manage | View / update orders, pull manual orders, refill and cancel tasks |
users.view, users.manage, users.balance | View / edit users / change balances |
payments.view, payments.manage | View payments / add payments |
services.view, services.manage, providers.manage | Services and providers |
tickets.view, tickets.reply | Support tickets |
dashboard.view, reports.view, content.manage, coupons.manage, settings.manage, audit.view | Other areas |
Rate limit: 600 requests per minute per IP and per key.
v1 — PerfectPanel-compatible
POST https://yourpanel.com/adminapi/v1, key in the key field or the X-Api-Key header. Success: {"status":"success", ...}; failure: {"status":"fail","error":"<code>"}. A bad key or missing permission returns bad_auth, an unknown action bad_action.
Processing manual orders
| Action | Parameters | Description |
|---|---|---|
getorder | type (manual service ID) | Claims the oldest pending order and marks it processing: {id, link, quantity, charge, user_id, comments} |
getorders | type | Same, up to 100 orders: {orders:[…]} |
updateorders | orders = JSON array [{id, status, start_count, remains}] (max 100) | Bulk update |
setinprogress | id, optional start_count | |
setprocessing, setcompleted | id | |
setstartcount | id, start_count | |
setpartial, setremains | id, remains | |
setcanceled | id | Cancels and refunds |
updateorders statuses: pending, in progress, processing, completed, partial, canceled.
curl -X POST https://yourpanel.com/adminapi/v1 -d key=nxa_xxx -d action=getorder -d type=42
curl -X POST https://yourpanel.com/adminapi/v1 -d key=nxa_xxx -d action=setcompleted -d id=1001Refill and cancel tasks
| Action | Parameters | Response |
|---|---|---|
getrefill | optional service_id | {id, refill, order_id, service_id, link, start_count, current_count, quantity} |
setrefillcompleted, setrefillrejected, setrefillinprogress | refill | |
getcancel | optional service_id | {cancel, order_id, service_id, link} |
setcancelrejected | cancel |
Payments and support
| Action | Parameters | Description |
|---|---|---|
addpayment | username (email) or id, amount (0–1,000,000), details | Creates a paid deposit and credits the balance (users.balance) |
addticket | username, subject (≤200), message (≤5000) | Opens a ticket to the customer (tickets.reply) |
v2 — REST / JSON
Base URL https://yourpanel.com/adminapi/v2, key only in the X-Api-Key header. Success {"data": …}, error {"error":{"code","message"}}. Lists accept ?limit= (1–500, default 50) and ?offset=.
| Method and path | Permission | Description |
|---|---|---|
GET /orders | orders.view | ?status=in_progress, ?service_id= |
GET /orders/:id | orders.view | One order |
POST /orders/pull | orders.manage | {service_id, limit} → pulls manual orders |
PATCH /orders/:id | orders.manage | {status?, start_count?, remains?} |
POST /orders/:id/cancel | orders.manage | Cancel and refund |
GET /refills, POST /refills/pull, PATCH /refills/:id | orders.* | Refill tasks; PATCH {status: completed|rejected|in_progress} |
GET /cancels, POST /cancels/pull, POST /cancels/:id/reject | orders.* | Cancel tasks |
GET /users | users.view | ?email= contains search |
GET /users/:id | users.view | ID or email |
POST /users/:id/balance | users.balance | {amount}; negative debits |
GET /payments | payments.view | ?status= |
POST /payments | payments.manage + users.balance | {user, amount, details} |
GET /tickets | tickets.view | ?status= |
POST /tickets | tickets.reply | {user, subject, message} |
POST /tickets/:id/reply | tickets.reply | {message} |
GET /services | services.view | {id, name, type, cost, min, max, active, manual, provider} |
Order object: {id, status, service:{id,name}, user:{id,email}, link, quantity, charge, cost, refunded, start_count, remains, provider_order_id, source, created_at, completed_at}.
curl https://yourpanel.com/adminapi/v2/orders?status=pending -H "X-Api-Key: nxa_xxx"
curl -X PATCH https://yourpanel.com/adminapi/v2/orders/1001 \
-H "X-Api-Key: nxa_xxx" -H "Content-Type: application/json" \
-d '{"status":"completed","start_count":1200}'Error codes: 401 unauthorized, 403 forbidden ("This key needs the … permission"), 404 not_found, 400 (e.g. bad_json), 429 rate_limited, 500 internal_error.