API Reference

Cookie-authenticated JSON API for bots and dashboards.

Bots & integrations: create a long-lived token under Settings → API Tokens with scope full (default, everything) or bot (least-privilege for resellers: GET /api/me, GET /api/stats, GET /api/users, POST /api/users, GET /api/templates) and send it as Authorization: Bearer zfp_… — no CSRF header needed then. Tokens act as the admin that created them (password-gated actions still need the password), are shown once, and can be revoked anytime. Bot tokens can create users including start_on_first_use (bot-safe: expiry is server-computed) but get 403 on deletes, patches, backup/restore, settings, tokens and updates.

Ready-made reseller bots: Python · Node.js — plans keyboard, account creation, subscription link.

Auth & account

Users

Server objects

Public

Example: create a user

curl -c jar.txt -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -d '{"username":"admin","password":"…"}' \
     https://vpn.example.com/api/login

curl -b jar.txt -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -d '{"username":"buyer1","protocols":["vless","reality"],"volume_gb":50,"days":30}' \
     https://vpn.example.com/api/users

# Or create straight from a saved plan: template_id fills protocols, volume,
# days, start_on_first_use and device_limit. Explicit body fields win.
curl -b jar.txt -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -d '{"username":"buyer2","template_id":3,"days":60}' \
     https://vpn.example.com/api/users

# PATCH sets absolute values; add_* are deltas. An unknown-only patch is a
# 422 (never a silent 200), and sending both forms of one field is a 422.
curl -X PATCH -b jar.txt -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -d '{"used_gb": 12.5, "volume_gb": 100, "days": 30, "note": "VIP"}' \
     https://vpn.example.com/api/users/1

curl -X PATCH -b jar.txt -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -d '{"add_volume_gb": 20, "add_used_gb": -2.5}' \
     https://vpn.example.com/api/users/1

Example: bot renewal flow (bot-scoped token)

No cookies, no CSRF header — just Authorization: Bearer zfp_… from a bot-scoped token. Lookup by username, renew usage + link in one call:

# 1) find the buyer by username (bots know tg123, not numeric IDs)
curl -H 'Authorization: Bearer zfp_…' \
     https://vpn.example.com/api/users/by-username/tg123

# 2) renew: zero the meter AND rotate token+secrets (old link dies)
curl -X POST -H 'Authorization: Bearer zfp_…' \
     -H 'Content-Type: application/json' \
     -d '{"reset_usage": true, "reset_token": true}' \
     https://vpn.example.com/api/users/12/reset

# 3) usage-only top-up (link keeps working)
curl -X POST -H 'Authorization: Bearer zfp_…' \
     -H 'Content-Type: application/json' \
     -d '{"reset_usage": true, "reset_token": false}' \
     https://vpn.example.com/api/users/12/reset