Create a read-only WHMCS API role

The ten actions, and nothing else

The list is closed in 0seat’s code: an action outside this list is never called, whatever the role allows. The role you create should therefore contain exactly these actions.

1. GetClients and GetClientsDetails: find the customer by e-mail address.
2. GetClientsProducts and GetClientsDomains: their services and domains, with status and dates.
3. GetInvoices and GetInvoice: their invoices, with due date, amount, currency and status.
4. GetOrders: their orders and payment status.
5. GetTickets: the subject and status of their tickets, never the body.
6. GetProducts and GetTLDPricing: your catalogue and per-extension prices, re-read every twelve hours.

Create the role in WHMCS

In the WHMCS admin area, API credentials and their roles are managed under system settings, in the “API Credentials” section. Menu details vary by version; the steps do not.

1. Open the API roles tab and create a role named, for example, “0seat read-only”.
2. Tick the ten actions above, and no other. In particular, untick any action starting with Add, Update, Delete, Send or Accept.
3. Open the credentials tab and generate a new API credential attached to an administrator user, assigning it this role only.
4. Note the identifier and the secret: WHMCS shows the secret only once, and 0seat will never show it again either.
5. If your WHMCS restricts the API by IP address, add 0seat’s address: ask us for it through the contact form.

Configure the connection in the console

On the space page, the “WHMCS (optional)” section takes the API address, that is your WHMCS address followed by “/includes/api.php”, the identifier and the secret.

1. Fill in the API address, the identifier and the secret.
2. List the products whose price the assistant may quote, by their exact names in WHMCS, comma-separated; then the domain extensions, and the currency of your prices.
3. Click “Test and save”. The console confirms the connection with the number of products and extensions found, and lists the ones it recognised.
4. Credentials are encrypted on save and never shown again. To replace them, enter new ones; to remove WHMCS, the dedicated button erases the secrets.

What 0seat does with this access

At drafting time, 0seat finds the customer by the contact’s e-mail address, keeps no account when several match, then reads their services, domains, invoices and orders. Password, postal address and phone fields are stripped in code before any model call. Ticket bodies are not read.

Calls carry an identifiable user agent and are spaced out: an application firewall will see no burst from a generic HTTP client. On an agent’s command, an account summary built by code, with no model text, can be sent to the customer’s address.