API-1 foundation
A module returns an object from bootstrap.php, implements its declared category contract, reports that same category() and returns apiVersion() === 1. Use the installed App\Contracts and App\Data types. A package's numeric core range is necessary but cannot add a missing newer interface to an older licensed distribution.
| Contract | Capability |
|---|---|
Module |
Category and API version. |
IntegrationModule |
Declarative connection schema and safe Test. |
PaymentModule |
Currency support, checkout creation and verified notification. |
ConnectionCurrencySupport |
Account/connection-specific currency eligibility. |
CheckoutRequirements |
Real required payer billing fields before attempt reservation. |
PaymentReturnModule |
Authenticated settlement verification from a signed return context. |
PaymentReturnParameters |
Permitted untrusted provider locator query fields. |
HostedCheckoutBridge |
Browser-safe data for an existing authenticated attempt. |
HostedPaymentForm |
Provider-hosted POST handoff without local card collection. |
PaymentMethodDiscovery |
Read-only available-method labels, networks and conditional flags. |
BatchPaymentWebhook |
Fully verified batch of up to 250 distinct payments. |
PaymentWebhookAcknowledgement |
Bounded provider-specific receipt after verified handling. |
WebhookEndpointVerification |
Provider GET challenge without settlement. |
CheckoutReconciliation |
Protected authoritative query of an existing checkout. |
RegistrarModule |
Availability and explicit domain operations. |
RegistrarTermSupport |
Exact operation/whole-year capability before priced checkout. |
RegistrarCustomerContact |
Canonical owning-customer contact input. |
RegistrarTransferNameservers |
Explicit preservation of observed transfer delegation. |
ServerModule |
Typed hosting execute actions. |
HostingControlPanel |
Current creatable packages and stable candidate username. |
ServiceAccess |
Short-lived HTTPS sign-in for the exact mapped account. |
ServicePassword |
Explicit supported remote password change. |
DnsModule |
Publication of one exact complete zone snapshot. |
AutoConfigurableIntegration |
Restricted declared internal configuration after provider setup. |
AddonModule |
Declared staff actions and the five queued lifecycle events. |
Themes and public APIs
Themes are signed view/assets packages, not executable integration-category objects. The reviewed source contains customer/staff web routes and explicit callback contracts; it does not expose a generic documented bearer-token REST API, arbitrary remote-shell route or WHMCS API compatibility layer. Browser routes require their normal sessions, CSRF, permissions and confirmations. Do not scrape them with a master staff session as a substitute for an accepted service API.
Choose the detailed guide
Use payment implementation, registrar implementation, server implementation, DNS, addon actions/hooks, themes and packaging. Optional contracts must be reviewed and tested on the exact released core before being advertised.