Module and release scope
This guide covers VestaCP Hosting 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
server_url — HTTPS control-panel origin |
url | Yes | Include the panel port; do not include an API path. A trusted TLS certificate is required. |
default_nameservers — Default hosting nameservers |
text | No | Comma or space separated authoritative nameservers. |
allow_writes — Allow account creation and changes |
boolean | No | Default: false |
allow_automated_create — Allow automated creation |
boolean | No | Default: false |
allow_automated_suspend — Allow automated suspension |
boolean | No | Default: false |
allow_automated_unsuspend — Allow automated restoration |
boolean | No | Default: false |
allow_automated_change_package — Allow automated package changes |
boolean | No | Default: false |
allow_automated_terminate — Allow automated termination |
boolean | No | Default: false |
username — API administrator login |
text | Yes | Use the account-specific value described below. |
password — API administrator password |
secret | Yes | Use the account-specific value described below. |
Dedicated customer-account integration for existing VestaCP installations. Supports package inventory, exact account synchronization, creation of a dedicated customer user with one web domain, suspension, restoration, package changes and explicit lifecycle termination. Use the administrator's documented remote API; a current supported control-panel release with a trusted TLS certificate is required. Install remains disabled and makes no server changes.
Configuration
Enter the HTTPS panel origin, normally https://panel.example.test:8083, and its dedicated administrator API login and password. Do not put /api/ in the origin: the module appends that fixed path. Restrict access at the firewall to the billing host. Never disable TLS verification to work around a certificate problem. Configure the actual hosting nameservers and map each product to the exact remote package name.
The API account needs v-list-user-packages, v-list-users, v-list-user, v-list-web-domains and v-search-domain-owner for read-only testing, duplicate prevention and identity confirmation; account lifecycle additionally uses v-add-user, v-add-web-domain, v-suspend-user, v-unsuspend-user, v-change-user-package, v-delete-user. Test reads package and user inventories only. Vesta uses POST for read commands too. Enable the module and tested connection explicitly; allow writes and every automated action separately, all default false.
Each billing service must map to a dedicated non-administrator login owning exactly one web domain. The module confirms login, domain, package, and both account/domain suspension states through fresh reads. It refuses shared multi-domain logins and administrator logins. The login and encrypted password are reserved by the billing core before provisioning. If the two-step user/domain creation fails, it remains unconfirmed without retries or automatic deletion: resolve the reserved account in Vesta, then synchronize. Termination requires a suspended account and explicitly enabled lifecycle automation; deleting a dedicated user also deletes its associated resources.
The integration does not provision resellers, virtual machines, mail domains, DNS zones, automatic sign-in or SSL certificates. Redirects, compressed replies, untrusted certificates and responses over two MiB are refused. HTTP timeouts do not trigger a second write. Test diagnostics omit credentials and contact data.
Official references: Vesta API and authentication, command reference, official implementation.