Module and release scope
This guide covers CWP Pro Hosting Control Panel 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
server_url — Panel HTTPS address |
url | Yes | Origin only, including its HTTPS API port. A valid trusted TLS certificate is required. |
default_package — Default hosting package |
text | No | Exact package name or ID from this panel. Product settings can override it. |
default_nameservers — Default nameservers |
text | No | Use the account-specific value described below. |
allow_writes — Allow account provisioning and changes |
boolean | No | Default: false |
allow_automated_suspend — Allow automated suspension |
boolean | No | Default: false |
allow_automated_unsuspend — Allow automated unsuspension |
boolean | No | Default: false |
allow_automated_terminate — Allow lifecycle termination |
boolean | No | Default: false |
api_key — API Manager key |
secret | Yes | Use the account-specific value described below. |
account_ip — Shared account IP address |
text | Yes | Use the account-specific value described below. |
inode_limit — Account inode limit |
integer | No | Default: 0 |
process_limit — Account process limit |
integer | No | Default: 40 |
open_file_limit — Account open file limit |
integer | No | Default: 100 |
This module installs disabled. It uses CWP's external HTTPS API, normally on port 2304. Credentials, server addresses and business-specific packages are configured by the installation operator, never supplied in the product.
Configure
- Enable the module and create a server connection using an origin such as
https://panel.example.net:2304. Configure a trusted certificate matching that hostname. The module verifies TLS and appends its fixed/v1/paths; do not paste a user-panel URL or API path. - In CWP Settings → API Manager, create and enable a key. Allow the application server's outbound IP in API Manager and the server firewall. Choose JSON responses. Grant Account LIST, ADD, SUSP, UNSP and DEL; Packages LIST; and Account pack change UDP. Keep unneeded functions disabled. Paste the key in the encrypted API key field.
- Create the desired packages in CWP. This module uses the exact numeric package ID, including for
changepack; a display name is insufficient. Choose an ID returned by the connection Test in product provisioning settings or the connection default. - Enter the shared account IP and appropriate inode, process and open-file limits. A process limit of zero is refused because it prevents account processes. These limits are sent during creation only.
- Test the connection before allowing writes. Test reads packages and accounts only. Add optional default nameservers as a comma/space-separated list. Account writes and all automated lifecycle actions default off; deletion requires a verified suspended account and the explicit lifecycle policy.
Operations and confirmation
The fixed endpoints are /v1/account (list, add, susp, unsp, del), /v1/packages (list) and /v1/changepack (udp). Creation includes the reserved username, primary domain, password, email, package ID, limits and assigned IP.
A fresh account list must prove username, primary domain, numeric package ID and an explicit suspension state. CWP versions expose account inventory differently; versions that omit package or state cannot be treated as verified. Test reports incomplete evidence instead of assuming accounts are active. The adapter understands explicit suspended 0/1 or yes/no and explicit active/suspended/inactive account states. Unrecognized or malformed results fail safely.
Success acknowledgements alone do not activate a service. An incomplete post-write read remains pending for reconciliation, and timed-out creation is never retried automatically. Existing usernames/domains block new submission. Errors are sanitized, responses are bounded and redirects/compressed bodies are refused.
Only shared/hosting accounts are advertised. Reseller/VPS creation, password changes, automatic login, custom API commands and resource-limit changes on existing accounts are not exposed. There is no webhook to enter and no provider-independent sandbox; use a dedicated test CWP server before enabling writes. If CWP restarts its web/PHP service during account creation, synchronize the reserved username and domain before retrying.