Module and release scope
This guide covers ISPConfig Hosting 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
server_url — HTTPS control-panel origin |
url | Yes | Include the panel port; do not include an API path. A trusted TLS certificate is required. |
default_nameservers — Default hosting nameservers |
text | No | Comma or space separated authoritative nameservers. |
allow_writes — Allow account creation and changes |
boolean | No | Default: false |
allow_automated_create — Allow automated creation |
boolean | No | Default: false |
allow_automated_suspend — Allow automated suspension |
boolean | No | Default: false |
allow_automated_unsuspend — Allow automated restoration |
boolean | No | Default: false |
allow_automated_change_package — Allow automated package changes |
boolean | No | Default: false |
allow_automated_terminate — Allow automated termination |
boolean | No | Default: false |
username — Remote API user |
text | Yes | Use the account-specific value described below. |
password — Remote API password |
secret | Yes | Use the account-specific value described below. |
server_id — Web-server ID |
integer | Yes | Use the account-specific value described below. |
php_mode — Website PHP mode |
select | Yes | Default: "php-fpm" Choices: php-fpm = PHP-FPM, no = Disabled |
web_ip — Web IP address or * |
text | Yes | Use the IP configured on the selected ISPConfig web server, or * for its wildcard vhost. |
ISPConfig remote JSON API integration for a dedicated non-reseller customer account and one primary website per service. Supports main client-template inventory, account synchronization, creation, suspension, restoration, package changes and explicit lifecycle termination. Packages are exact numeric main client template IDs; reseller/additional templates and templates without website capacity are excluded.
Set up
- Use a current supported ISPConfig installation with remote API enabled in its security configuration. Create a dedicated Remote User, restrict its source IP, and permit
server_get,client_templates_get_all,client_get_by_username,client_get,sites_web_domain_get; write operations additionally requireclient_add,client_update,sites_web_domain_add,sites_web_domain_update,sites_web_domain_set_statusandclient_delete_everything. - Enter only the HTTPS panel origin (usually
https://panel.example.test:8080), remote username/password, selected ISPConfig web-server ID, that server's web IP or*, and the actual hosting nameservers. The module uses the fixed/remote/json.php?methodendpoint and session authentication. TLS verification is always enabled. - Select PHP-FPM or disabled PHP. The main client template must permit the selected PHP mode. Configure normal website/server defaults in ISPConfig; the module creates a primary vhost with template disk/traffic quotas. It does not create FTP users, mail domains, DNS zones or databases. Product packages must contain the numeric main template ID.
- Run Test to authenticate, locate the configured server, and read its website inventory and template catalogue. Enable the installed module and tested connection explicitly. All write and automated lifecycle controls default false.
The module reserves no random identities: the billing core supplies the stable reserved login and encrypted password. Before a create, the API must explicitly confirm no existing login and no matching domain. Client creation and website creation are separate writes. A partial failure stays unconfirmed and is never automatically rolled back or retried. Review the reserved account, complete its website in ISPConfig if needed, and synchronize it.
Confirmation verifies fresh customer login, ordinary user role, client/group IDs, primary domain, configured web server, exact main template and its declared limits, website quotas, and agreement between customer resource lock and website active flags. Additional templates and multiple websites under the account are refused. Suspension changes the customer resource lock and website active flags; ISPConfig retains customer panel access. Existing passwords are preserved during updates. Termination requires a suspended account and explicit lifecycle authorization; client_delete_everything removes this dedicated customer's associated resources.
Account records versus server runtime: ISPConfig applies server configuration through its background server process. Confirmed results describe matching control-panel customer/website records and expose runtime_status: not_exposed; they do not certify that cron has finished, DNS resolves or HTTP/PHP responds. Check ISPConfig's server job queue when runtime configuration lags. Explicitly incomplete API records remain pending.
Redirects, compressed replies and responses over two MiB are refused. Writes are never retried automatically. API sessions are not returned to the billing UI, and diagnostics redact credentials/contact values.
Official references: ISPConfig downloads and current release, official remote API source and examples, official JSON handler, official client operations.