API docs by Redocly

AWH WHMCS REST API v2 (2.0.0)

Download OpenAPI specification:

A modern PHP RESTful API for WHMCS. JSON-only request and response format with Bearer token authentication.

This API provides a clean, well-structured set of REST endpoints for client-facing operations: account management, contacts, TLD pricing, orders, domains (including .hu-specific hureg actions), WHOIS lookups, and emails.

Every request and response is JSON. Successful responses are always shaped as {"status": "success", "data": {...}}; errors are always {"status": "error", "error": {"code": "...", "message": "..."}}.

Many endpoints pass a WHMCS API result through directly as data; where noted, only the documented fields are guaranteed and additional passthrough fields may be present.

Health

Service health check (public)

Health check

Public — no auth token required. Confirms the API process is up and can reach its database (a trivial SELECT 1 round-trip), for use by load balancers and uptime monitors.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Account

Authenticated client's own account details

Get account details

Retrieve the authenticated client's account details.

Authorizations:
bearerAuth
query Parameters
stats
boolean

Include additional client statistics

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Update account details

Update the authenticated client's billing details. All fields are optional — only provided fields are updated. The login email and password cannot be changed here.

Authorizations:
bearerAuth
Request Body schema: application/json
optional
firstname
string
lastname
string
companyname
string
address1
string
address2
string
city
string
state
string
postcode
string
country
string

2-letter ISO country code

phonenumber
string

Responses

Request samples

Content type
application/json
{
  • "firstname": "string",
  • "lastname": "string",
  • "companyname": "string",
  • "address1": "string",
  • "address2": "string",
  • "city": "string",
  • "state": "string",
  • "postcode": "string",
  • "country": "string",
  • "phonenumber": "string"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Contacts

Sub-account / additional contacts on the client's account

List contacts

Retrieve contacts belonging to the authenticated client. All filters are optional.

Authorizations:
bearerAuth
query Parameters
firstname
string
lastname
string
companyname
string
email
string
address1
string
address2
string
city
string
state
string
postcode
string
country
string
phonenumber
string
subaccount
boolean

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Create contact

Add a new contact to the authenticated client's account. All fields are optional.

Authorizations:
bearerAuth
Request Body schema: application/json
optional
firstname
string
lastname
string
companyname
string
email
string
address1
string
address2
string
city
string
state
string
postcode
string
country
string

2-letter ISO country code

phonenumber
string
generalemails
boolean
productemails
boolean
domainemails
boolean
invoiceemails
boolean
supportemails
boolean

Responses

Request samples

Content type
application/json
{
  • "firstname": "string",
  • "lastname": "string",
  • "companyname": "string",
  • "email": "string",
  • "address1": "string",
  • "address2": "string",
  • "city": "string",
  • "state": "string",
  • "postcode": "string",
  • "country": "string",
  • "phonenumber": "string",
  • "generalemails": true,
  • "productemails": true,
  • "domainemails": true,
  • "invoiceemails": true,
  • "supportemails": true
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get contact details

Retrieve a single contact's details. The contact must belong to the authenticated client.

Authorizations:
bearerAuth
path Parameters
id
required
integer >= 1

The contact ID

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Update contact

Update an existing contact. The contact must belong to the authenticated client.

Authorizations:
bearerAuth
path Parameters
id
required
integer >= 1

The contact ID

Request Body schema: application/json
optional
firstname
string
lastname
string
companyname
string
email
string
address1
string
address2
string
city
string
state
string
postcode
string
country
string

2-letter ISO country code

phonenumber
string
generalemails
boolean
productemails
boolean
domainemails
boolean
invoiceemails
boolean
supportemails
boolean

Responses

Request samples

Content type
application/json
{
  • "firstname": "string",
  • "lastname": "string",
  • "companyname": "string",
  • "email": "string",
  • "address1": "string",
  • "address2": "string",
  • "city": "string",
  • "state": "string",
  • "postcode": "string",
  • "country": "string",
  • "phonenumber": "string",
  • "generalemails": true,
  • "productemails": true,
  • "domainemails": true,
  • "invoiceemails": true,
  • "supportemails": true
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Delete contact

Delete a contact. The contact must belong to the authenticated client.

Authorizations:
bearerAuth
path Parameters
id
required
integer >= 1

The contact ID

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

TLDs

TLD pricing

Get TLD pricing

Retrieve pricing for all configured TLDs. No filtering — always returns the full list.

Authorizations:
bearerAuth

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Orders

Order placement, listing, and cancellation

List orders

Retrieve orders belonging to the authenticated client.

Authorizations:
bearerAuth
query Parameters
id
integer

Filter by specific order ID

status
string

Filter by order status

limitstart
integer >= 0
Default: 0

Pagination offset (default 0)

limitnum
integer [ 1 .. 250 ]
Default: 25

Records per page (default 25, capped at 250)

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Create order

Place a new order. Payment method is always set to bank transfer. All fields are optional.

Auto-accept logic: if the client has monthly payment, the order is automatically accepted after creation — each domain is registered or transferred (depending on its domaintype), donotrenew is set, and the order is accepted via acceptorder. Any step of that process that fails is reported back as a warnings entry on the response rather than failing the request, since the order itself has already been created by that point. If the client does not have monthly payment, the stored credit card is charged automatically instead.

Authorizations:
bearerAuth
Request Body schema: application/json
optional
pid
Array of integers

Product IDs to order

domain
Array of strings

Domain names associated with products/domains

billingcycle
Array of strings

Billing cycles for the products

domaintype
Array of strings
Items Enum: "register" "transfer"

register or transfer, per domain

customfields
Array of strings <byte> [ items <byte > ]

Base64-encoded serialized custom field values

configoptions
Array of strings <byte> [ items <byte > ]

Base64-encoded serialized configurable option values

promocode
string

Promotion code to apply

regperiod
Array of integers

Registration periods for domains

idnlanguage
Array of strings

IDN language codes

eppcode
Array of strings

EPP codes for domain transfers

nameserver1
string
nameserver2
string
nameserver3
string
nameserver4
string
nameserver5
string
domainfields
Array of strings <byte> [ items <byte > ]

Base64-encoded serialized additional domain fields — see the project README's "Additional Domain Fields" section for the field sets accepted per TLD.

contactid
integer

Contact ID to apply to all domains

idprotection
Array of booleans

Enable ID Protection per domain

object

domainName -> renewalPeriod map for domain renewals

hostname
string

VPS/dedicated server hostname

ns1prefix
string
ns2prefix
string
rootpw
string

VPS/dedicated root password

Responses

Request samples

Content type
application/json
{
  • "pid": [
    ],
  • "domain": [
    ],
  • "billingcycle": [
    ],
  • "domaintype": [
    ],
  • "customfields": [
    ],
  • "configoptions": [
    ],
  • "promocode": "string",
  • "regperiod": [
    ],
  • "idnlanguage": [
    ],
  • "eppcode": [
    ],
  • "nameserver1": "string",
  • "nameserver2": "string",
  • "nameserver3": "string",
  • "nameserver4": "string",
  • "nameserver5": "string",
  • "domainfields": [
    ],
  • "contactid": 0,
  • "idprotection": [
    ],
  • "domainrenewals": {
    },
  • "hostname": "string",
  • "ns1prefix": "string",
  • "ns2prefix": "string",
  • "rootpw": "string"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Cancel order

Cancel a pending order. Only works for orders in Pending status.

Authorizations:
bearerAuth
path Parameters
id
required
integer >= 1

The order ID to cancel

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Domains

Domain listing

List domains

Retrieve domains belonging to the authenticated client.

Authorizations:
bearerAuth
query Parameters
domainid
integer

Filter by domain ID

domain
string

Filter by domain name

limitstart
integer >= 0
Default: 0

Pagination offset (default 0)

limitnum
integer [ 1 .. 250 ]
Default: 25

Records per page (default 25, capped at 250)

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Domain Management

Per-domain WHOIS, nameservers, EPP, lock, and release

Get WHOIS info

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Update WHOIS info

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Request Body schema: application/json
required
contacts_xml
required
string <byte>

Base64-encoded WHOIS contact XML

Responses

Request samples

Content type
application/json
{
  • "contacts_xml": "string"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Get nameservers

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Update nameservers

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Request Body schema: application/json
optional
ns1
string
ns2
string
ns3
string
ns4
string
ns5
string

Responses

Request samples

Content type
application/json
{
  • "ns1": "string",
  • "ns2": "string",
  • "ns3": "string",
  • "ns4": "string",
  • "ns5": "string"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Request EPP / transfer code

No body parameters. Returns the EPP code for the domain.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get lock status

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Update lock status

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Request Body schema: application/json
required
lockstatus
required
boolean

true to lock, false to unlock. Required — there is no implicit default.

Responses

Request samples

Content type
application/json
{
  • "lockstatus": true
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Release domain

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Request Body schema: application/json
required
newtag
required
string

New registrar tag

Responses

Request samples

Content type
application/json
{
  • "newtag": "string"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Get domain info

Detailed domain information from the domain's registrar module, via WHMCS's standard GetDomainInformation dispatch. Registrar-agnostic — works for any registrar module that implements it.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Hureg

.hu (ISZT) registrar-specific domain actions

Get hureg notifications

Domain must belong to the authenticated client and use the hureg registrar, or this returns 400 INVALID_REGISTRAR.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Get full hureg info

Extended information from the hureg registrar module. Domain must belong to the authenticated client and use the hureg registrar, or this returns 400 INVALID_REGISTRAR.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Cancel EPP request

Cancel a pending EPP/auth code request for the domain. No body parameters. Domain must belong to the authenticated client and use the hureg registrar, or this returns 400 INVALID_REGISTRAR.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name (e.g. example.com). Must belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Check domain status before transfer

Pre-transfer registry check for a .hu domain. Because it is called before the transfer order exists, the domain does not have to be on the authenticated client's account — the only requirement is a well-formed .hu name.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Any .hu domain name (including second-level names such as example.co.hu), ASCII/punycode or UTF-8. Unlike the other per-domain endpoints, it does NOT need to belong to the authenticated client.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

WHOIS

Public WHOIS lookup (no auth required)

WHOIS lookup

Perform a WHOIS lookup on any domain. Not scoped to the authenticated client's own domains, but authentication is required like on every endpoint except /health.

Authorizations:
bearerAuth
path Parameters
domain
required
string

Domain name to look up (e.g. example.com)

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}

Emails

Emails sent to the authenticated client

List emails

Retrieve emails sent to the authenticated client.

Authorizations:
bearerAuth
query Parameters
date
string

Filter by date

subject
string

Filter by subject

limitstart
integer >= 0
Default: 0

Pagination offset (default 0)

limitnum
integer [ 1 .. 250 ]

Records per page (capped at 250)

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": { }
}