توثيق واجهة API للموزعين

Quick start

Your first request

curl https://www.datassl.com/api/reseller/products \
  -H "X-API-Key: YOUR_API_KEY"

Base URL: https://www.datassl.com/api/reseller. All requests and responses are JSON. Successful responses contain "success": true; errors contain "success": false and an "error" message.

Authentication

Send your API key with every request in one of two ways:

X-API-Key: YOUR_API_KEY
Authorization: Bearer YOUR_API_KEY

• Use the key on the server side only; never put it in a browser or mobile app.
• To test connectivity without authentication, use GET /ping. If you send a key, the response also includes api_key_valid.
• Limit: 600 requests per minute. When exceeded you get 429 with a Retry-After header; wait one minute.

Sell on your site

To sell on your own site you only need three things: pull the product list, add your margin on top of your reseller price, and place the order through the API when your customer pays.

Example: pull products and price them with a 30% margin (PHP)

<?php
$apiBase = 'https://www.datassl.com/api/reseller';
$apiKey  = 'YOUR_API_KEY';
$margin  = 30; // your margin, %

function datassl($method, $path, $body = null) {
    global $apiBase, $apiKey;
    $ch = curl_init($apiBase . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_HTTPHEADER     => ['X-API-Key: ' . $apiKey, 'Content-Type: application/json'],
        CURLOPT_POSTFIELDS     => $body ? json_encode($body) : null,
        CURLOPT_TIMEOUT        => 60,
    ]);
    $res = json_decode(curl_exec($ch), true);
    curl_close($ch);
    return $res;
}

// 1) Pull products (caching a few times a day is enough)
$list = datassl('GET', '/products');
foreach ($list['products'] as $p) {
    foreach ($p['pricing'] as $years => $cost) {      // year => your reseller price (USD)
        $sell = round($cost * (1 + $margin / 100), 2); // your selling price
        printf("%s | %d %s | %s %.2f → %s %.2f\n", $p['name'], $years,
            'yr', 'cost', $cost, 'sell', $sell);
    }
}

// 2) When your customer pays, place the order
$order = datassl('POST', '/orders', [
    'product_id' => 12,
    'domain'     => 'example.com',
    'period'     => 12,            // months: 12, 24 or 36
]);
echo $order['success'] ? 'Order #' . $order['order_id'] : $order['error'];

• Do not fetch prices on every page view; refresh them periodically and store them in your own database.
• The order is charged at the reseller price at order time; to re-check the price before taking payment, call GET /products/{id}.
• If you prefer not to write code, the ready-made modules do the same job.

Products and prices

Example response (shortened)

{
  "success": true,
  "count": 1,
  "products": [{
    "id": 12,
    "name": "Sectigo PositiveSSL",
    "brand": "Sectigo",
    "validation_type": "DV",
    "base_currency": "USD",
    "tax_rate": 20,
    "pricing":      { "1": 7.20, "2": 13.10, "3": 18.90 },
    "list_pricing": { "1": 9.99, "2": 17.99, "3": 25.99 },
    "max_years": 3,
    "san_enabled": false
  }]
}

• Keys in pricing are years. Send period in months when ordering: 1 year = 12.
• For SAN products, san.reseller_prices in /products/{id} is the price per extra domain.
• Only products assigned to your reseller group are listed.

Placing orders

At order time the amount (including VAT) is charged to your balance and a paid invoice is created. You do not need a separate payment call.

curl -X POST https://www.datassl.com/api/reseller/orders \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"product_id": 12, "domain": "example.com", "period": 12}'

Response (shortened)

{
  "success": true,
  "order_id": 1534,
  "order_number": "ORD-2026-1534",
  "subtotal": 7.20, "tax_amount": 1.44, "total": 8.64,
  "status": "pending_configuration",
  "payment_status": "paid",
  "new_balance": 191.36,
  "invoice_number": "INV-2026-2011"
}

Order statuses

List orders with GET /orders (filters: Status, domain, limit, offset); a single order with GET /orders/{id}.

Code signing orders

Code signing certificates are configured differently from SSL: there is no domain, CSR or domain validation (DCV). The certificate is issued to a company and the certificate authority validates the company.

curl -X POST https://www.datassl.com/api/reseller/orders \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"product_id": 343, "period": 12,
       "organization": "Example Software Ltd.", "org_address": "...", "org_city": "Istanbul", "org_country": "TR", "org_phone": "+90 ...",
       "admin_firstname": "Ada", "admin_lastname": "Yilmaz", "admin_email": "ada@example.com", "admin_phone": "+90 ..."}'

• domain وكذلك csr are not sent. Organization (organization, org_*) and contact (admin_*) details must be complete.
• With cloud code signing, the key is kept in the certificate authority's cloud HSM; no USB token is shipped. Company validation and signing account activation depend on the certificate authority; track the status with GET /orders/{id}.
• USB token (optional, paid): for code signing products delivered on a physical token (e.g. Sectigo, DigiCert), add "usb_token": true to the order; the token fee is added to the order total and we ship the token. The usb_token_price field in the product response shows the token price; if it is null, no token is offered for that product and sending usb_token returns 400. If you have your own token or HSM, do not send usb_token.
• Certum products are sold for 1 year only (period: 12).
• The 200-day rule does not apply to code signing; the certificate is valid for the purchased term.

Documents and validation status

The certificate authority may ask for documents for company validation. Upload them through the API; documents are stored securely on our side and forwarded to the certificate authority.

curl -X POST https://www.datassl.com/api/reseller/orders/1534/documents   -H "X-API-Key: YOUR_API_KEY"   -F "type=company" -F "file=@trade-register.pdf"

curl https://www.datassl.com/api/reseller/orders/1534/documents -H "X-API-Key: YOUR_API_KEY"

• Type: Company (company document), identity (authorised person ID), authority (authorisation letter / signature circular), other. PDF, JPG or PNG; max 10 MB per file.
• To send as JSON, use {"type":"company","file_name":"x.pdf","content_base64":"..."}.
• The GET response returns documents (send status of each document) and verifications (validation steps and states at the certificate authority).

Configuration and validation

If you did not send a CSR with the order, send the CSR and validation method in this step. Then poll the status and download the certificate once issued.

curl -X POST https://www.datassl.com/api/reseller/ssl/configure \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"order_id": 1534, "csr": "-----BEGIN CERTIFICATE REQUEST-----...", "dcv_method": "dns"}'

Certificate actions

Balance, invoices, account

Balance top-ups are done in the panel. If the balance is insufficient, the order is rejected with error 402 and nothing is charged.

Errors and limits

Every error response has a fixed error_code, a suggested fix (hint) and a request_id. Base your logic on error_code, not the message text: messages may change, codes do not. Include the request_id in support tickets (it is also returned in the X-Request-Id header). hint is in Turkish or English according to Accept-Language; you can also pass ?lang=tr.

{
  "success": false,
  "error": "Yetersiz bakiye. Sipariş tutarı: USD 49.00. Mevcut bakiye: USD 12.50. Lütfen kredi yükleyin.",
  "error_code": "INSUFFICIENT_BALANCE",
  "http_status": 402,
  "hint": "Top up your balance in the reseller panel (Account → Add funds), then retry.",
  "request_id": "3f9a1c07b2de",
  "docs": "https://www.datassl.com/en/api-docs#err-insufficient-balance"
}

$r = json_decode($body, true);
if (empty($r['success'])) {
    switch ($r['error_code'] ?? '') {
        case 'INSUFFICIENT_BALANCE': /* show a top-up warning */ break;
        case 'CSR_INVALID':          /* ask the customer for a new CSR */ break;
        case 'INTERNAL_ERROR':       /* retry later */ break;
    }
    error_log('DATASSL ' . $r['error_code'] . ' ' . $r['error'] . ' ref=' . $r['request_id']);
}

Error codes

Authentication and access

Request

Products and orders

الدفع

SSL, code signing and validation

Server

HTTP statuses

Ready-made modules

Modules are downloaded from the reseller panel with your API key embedded; you do not need to enter the key again after installing.

To download, sign in with your reseller account and create an API key first.

All endpoints

Changelog

API changes are published here. Changes that may affect your integration are called out.