For resellers

Reseller API documentation

A REST API for adding and managing your customers' domains from your own systems (WHMCS, your own control panel). Everything you can do in the reseller panel can also be done through the API. Not a reseller yet? See the reseller program.

Authentication

Create a key in the reseller panel under Settings → API access. The key is shown only once, at the moment it's created. If you lose it, you'll need to create a new one (the old one stops working). Add this header to every request:

Authorization: Bearer sb_live_<your-key>

Base URL: https://spambil.com — all paths below are relative to this address.

Account

GET/api/reseller/me

Your company details, signup fee status and a list of all your domains.

curl https://spambil.com/api/reseller/me \
  -H "Authorization: Bearer sb_live_..."

Domain management

POST/api/reseller/domains

Adds a new customer domain. It stays in pending_payment status until payment is completed.

curl -X POST https://spambil.com/api/reseller/domains \
  -H "Authorization: Bearer sb_live_..." \
  -H "Content-Type: application/json" \
  -d '{"domain":"musteriniz.com","mailHost":"mail.musteriniz.com"}'

→ { "resellerDomainId": "...", "priceKurus": 300, "currency": "USD" }

mailHost is your customer's existing mail server (hostname or IP) that clean mail is delivered to. priceKurus is the domain's yearly price in the minor unit of currency: US cents for international resellers (300 = $3.00), kuruş for resellers billed in Turkish lira.

POST/api/reseller/domains/bulk

Adds up to 200 domains in a single request. Each row is processed on its own: if one fails, the others are still added. Payment is still made separately for each domain.

curl -X POST https://spambil.com/api/reseller/domains/bulk \
  -H "Authorization: Bearer sb_live_..." \
  -H "Content-Type: application/json" \
  -d '{"rows":[{"domain":"musteriniz1.com","mailHost":"mail.musteriniz1.com"},{"domain":"musteriniz2.com","mailHost":"185.10.20.30"}]}'

→ { "added": 2, "failed": 0, "results": [{"domain":"musteriniz1.com","ok":true,"resellerDomainId":"..."}, ...] }

POST/api/reseller/domains/:id/cancel

Cancels the domain. Protection is removed from the gateway (PMG) immediately.

GET/api/reseller/domains/:id/mx-check

Checks whether the domain's MX records point to Spambil.

→ { "verified": true, "records": ["spam1.jusbil.com", "mx1.spambil.com"], "expected": "spam1.jusbil.com" }

GET/api/reseller/domains/:id/host-check

Verifies that the registered mail server (mailHost) still resolves to an IP address.

GET/api/reseller/domains/:id/stats?days=30

Scanned/spam/virus counts for the last days days (default 30, maximum 90).

Quarantine

GET/api/reseller/domains/:id/quarantine?days=7

Messages quarantined in the last days days (default 7, maximum 30).

GET/api/reseller/domains/:id/quarantine/:itemId

A full preview of a single message (headers, spam score breakdown, content).

POST/api/reseller/domains/:id/quarantine/action

curl -X POST https://spambil.com/api/reseller/domains/:id/quarantine/action \
  -H "Authorization: Bearer sb_live_..." \
  -H "Content-Type: application/json" \
  -d '{"itemId":"C1R2T3","action":"welcomelist"}'

action	Meaning
`welcomelist`	Delivers the message and adds the sender to the allow list (welcomelist)
`deliver`	Delivers the message only; does not add the sender to the allow list
`delete`	Deletes the message permanently

Allow / block lists

GET/api/reseller/domains/:id/lists?pmail=kutu@domain.com&type=welcomelist

pmail is a mailbox on the domain. type: welcomelist (allow list) or blocklist.

POST / DELETE/api/reseller/domains/:id/lists

Adds (POST) or removes (DELETE) a sender address on a mailbox's list.

-d '{"pmail":"kutu@domain.com","type":"welcomelist","address":"gonderen@disaridan.com"}'

Team access

Only the account owner (the email for which /api/reseller/me returns isOwner: true) can manage the team and create API keys. Team members can access the same domains and quarantine, but can't do those two things.

GET/api/reseller/team

POST/api/reseller/team

-d '{"email":"ekip@sirketiniz.com"}'

DELETE/api/reseller/team/:id

Pricing

The priceTiers and nextDomainPriceKurus fields in the /api/reseller/me response show the tiered price based on your number of active (paid) domains. Prices are yearly and per domain, and the per-domain price drops as your active domain count grows. A newly added domain is priced at the tier in effect when it's added, and that price stays the same on renewal. Your current price list is shared when your application is approved and is always visible in your reseller panel.

Reporting

GET/api/reseller/export

Returns all your domains with their scanned/spam/virus counts for the last 30 days as text/csv (for importing into your own billing or internal reporting systems). When opened in a browser, it downloads directly.

Payment

POST/api/reseller/checkout/start

Starts a one-off payment for a domain (new or renewal, 1 year). International resellers are charged in US dollars through Paddle.com, our Merchant of Record; payment details are entered only in Paddle's checkout, and this API never sees card data. Open checkoutUrl in a browser (or send it to whoever pays) to complete the payment.

-d '{"kind":"domain","resellerDomainId":"..."}'
→ { "provider": "paddle", "transactionId": "txn_...", "checkoutUrl": "https://spambil.com/en/checkout?_ptxn=txn_...", "amountKurus": 300, "currency": "USD" }

For the signup fee, send {"kind":"signup_fee"}. Taxes are calculated by Paddle for your country and added at checkout. The domain is activated automatically once the payment completes.

Error format

Failed requests return a body of {"error": "code"}. Common codes: unauthenticated (401, missing or invalid key), forbidden (403), not_found (404, the domain doesn't belong to you), domain_taken (409).

Questions about the API? Contact us or email info@spambil.com.