Client accounts · ModKey Docs

List users

POST https://dev.mod.wtf/api/v2/action

methodget-users

Client accounts created by you. status: 1 not blocked, 0 blocked; check expiration_date for expiry.

Body

q string optional

Substring search
level integer optional

Filter by role: 2 Admin, 3 Reseller
status optional

Filter: 1 normal, 0 blocked
limit integer optional

Number of records to return, 1..200, default 50
offset integer optional

Number of records to skip for pagination
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "get-users"
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "get-users"
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "get-users"
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'get-users',
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "get-users",
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "total": 8,
        "limit": 50,
        "offset": 0,
        "items": [
            {
                "id": 50,
                "username": "myreseller1",
                "fullname": "Reseller One",
                "email": "res@example.com",
                "level": 3,
                "level_label": "Reseller",
                "status": 1,
                "saldo": 1000,
                "uplink": "JohnDoe",
                "soft": 123,
                "created_at": "2025-03-01 09:00:00",
                "expiration_date": "2026-03-01 09:00:00",
                "telegram": null,
                "telegram_id": null
            }
        ]
    }
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Create user

POST https://dev.mod.wtf/api/v2/action

methodcreate-user

Create a client account. Software and uplink are assigned automatically.

Body

username string required

4-25 alphanumeric chars
password string required

8-128 chars
level integer optional

2 Admin or 3 Reseller, default 2
email string optional

Up to 40 characters; a placeholder address is generated when omitted
fullname string optional

Up to 155 characters: letters, digits, spaces, periods, apostrophes and hyphens
saldo integer optional

Starting balance, default 0
expiration_date string optional

YYYY-MM-DD HH:MM:SS
expiration_days integer optional

0 to 18250. Admin and Reseller accounts default to 30 days
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

forbidden_field forbidden_soft duplicate validation database_error + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "create-user",
    "username": "newrep1",
    "password": "abcd1234",
    "level": 3
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "create-user",
    "username": "newrep1",
    "password": "abcd1234",
    "level": 3
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "create-user",
      "username": "newrep1",
      "password": "abcd1234",
      "level": 3
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'create-user',
        'username' => 'newrep1',
        'password' => 'abcd1234',
        'level' => 3,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "create-user",
        "username": "newrep1",
        "password": "abcd1234",
        "level": 3,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "username": "newrep1",
        "fullname": "",
        "email": "ub5559fdd95b1@m.dk",
        "level": 3,
        "level_label": "Reseller",
        "status": 1,
        "saldo": 0,
        "uplink": "JohnDoe",
        "soft": 123,
        "created_at": "2025-06-01 12:00:00",
        "expiration_date": "2025-07-01 12:00:00",
        "telegram": null,
        "telegram_id": null
    }
}

{
    "ok": false,
    "error": "duplicate",
    "message": "username already taken"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Get user

POST https://dev.mod.wtf/api/v2/action

methodget-user

Client account details.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "get-user",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "get-user",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "get-user",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'get-user',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "get-user",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "username": "myreseller1",
        "fullname": "Reseller One",
        "email": "res@example.com",
        "level": 3,
        "level_label": "Reseller",
        "status": 1,
        "saldo": 1000,
        "uplink": "JohnDoe",
        "soft": 123,
        "created_at": "2025-03-01 09:00:00",
        "expiration_date": "2026-03-01 09:00:00",
        "telegram": null,
        "telegram_id": null
    }
}

{
    "ok": false,
    "error": "not_found",
    "message": "user not found or not in your downline"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Update user

POST https://dev.mod.wtf/api/v2/action

methodedit-user

Update one of your client accounts.

Body

user_id integer required

Client account ID
fullname string optional

Up to 155 characters: letters, digits, spaces, periods, apostrophes and hyphens
email string optional

Up to 40 characters
telegram string optional

1 to 32 letters, digits or underscores. Leading @ is optional; an empty value clears the field
status optional

1 active, 0 blocked
saldo integer optional

New balance
expiration_date string optional

YYYY-MM-DD HH:MM:SS
level integer optional

2 Admin or 3 Reseller
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

forbidden_field forbidden_soft not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "edit-user",
    "user_id": 50,
    "fullname": "Updated Name",
    "saldo": 1000
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "edit-user",
    "user_id": 50,
    "fullname": "Updated Name",
    "saldo": 1000
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "edit-user",
      "user_id": 50,
      "fullname": "Updated Name",
      "saldo": 1000
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'edit-user',
        'user_id' => 50,
        'fullname' => 'Updated Name',
        'saldo' => 1000,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "edit-user",
        "user_id": 50,
        "fullname": "Updated Name",
        "saldo": 1000,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "username": "myreseller1",
        "fullname": "Updated Name",
        "email": "res@example.com",
        "level": 3,
        "level_label": "Reseller",
        "status": 1,
        "saldo": 1000,
        "uplink": "JohnDoe",
        "soft": 123,
        "created_at": "2025-03-01 09:00:00",
        "expiration_date": "2026-03-01 09:00:00",
        "telegram": null,
        "telegram_id": null
    }
}

{
    "ok": false,
    "error": "forbidden_soft",
    "message": "Soft Owner may only assign users to their own soft"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Delete user

POST https://dev.mod.wtf/api/v2/action

methoddelete-user

Delete a client account.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

self_destroy not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "delete-user",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "delete-user",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "delete-user",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'delete-user',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "delete-user",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "deleted": true,
        "id": 50
    }
}

{
    "ok": false,
    "error": "self_destroy",
    "message": "cannot delete yourself"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Block user

POST https://dev.mod.wtf/api/v2/action

methodblock-user

Block: status=0, the user can no longer sign in.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

self_block not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "block-user",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "block-user",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "block-user",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'block-user',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "block-user",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "status": 0
    }
}

{
    "ok": false,
    "error": "self_block",
    "message": "cannot change your own status"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Unblock user

POST https://dev.mod.wtf/api/v2/action

methodunblock-user

Unblock: status=1.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

self_block not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "unblock-user",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "unblock-user",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "unblock-user",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'unblock-user',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "unblock-user",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "status": 1
    }
}

{
    "ok": false,
    "error": "not_found",
    "message": "user not found or not in your downline"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Kick user sessions

POST https://dev.mod.wtf/api/v2/action

methodkick-user-sessions

Reset quick-login tokens and require the user to sign in again.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; your main software when omitted

Errors it can return

not_found validation session_storage_unavailable + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "kick-user-sessions",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "kick-user-sessions",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "kick-user-sessions",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'kick-user-sessions',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "kick-user-sessions",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "sessions_kicked": 3
    }
}

{
    "ok": false,
    "error": "not_found",
    "message": "user not found or not in your downline"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

Reset user password

POST https://dev.mod.wtf/api/v2/action

methodreset-user-password

Create a one-hour password reset link for an Admin or Reseller you created.

Body

user_id integer required

Client account ID
soft_id integer optional

ID of a software you own; default is your main software

Errors it can return

not_found validation + shared codes

POST /api/v2/action HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/json
Accept: application/json

{
    "api_key": "YOUR_API_KEY",
    "method": "reset-user-password",
    "user_id": 50
}

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "reset-user-password",
    "user_id": 50
}'

const response = await fetch("https://dev.mod.wtf/api/v2/action", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
      "api_key": "YOUR_API_KEY",
      "method": "reset-user-password",
      "user_id": 50
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/api/v2/action');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'api_key' => 'YOUR_API_KEY',
        'method' => 'reset-user-password',
        'user_id' => 50,
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/api/v2/action",
    json={
        "api_key": "YOUR_API_KEY",
        "method": "reset-user-password",
        "user_id": 50,
    },
    timeout=10,
)

result = response.json()

{
    "ok": true,
    "data": {
        "id": 50,
        "reset_url": "https://mod.wtf/auth/reset-password?uid=50#token=<TOKEN>",
        "expires_in_seconds": 3600
    }
}

{
    "ok": false,
    "error": "not_found",
    "message": "user not found or not in your downline"
}

{
    "ok": false,
    "error": "unauthorized",
    "message": "Invalid or missing api_key"
}

#Keep in mind

#List users

Body

Errors it can return

#Create user

Body

Errors it can return

#Get user

Body

Errors it can return

#Update user

Body

Errors it can return

#Delete user

Body

Errors it can return

#Block user

Body

Errors it can return

#Unblock user

Body

Errors it can return

#Kick user sessions

Body

Errors it can return

#Reset user password

Body

Errors it can return

Keep in mind

List users

Create user

Get user

Update user

Delete user

Block user

Unblock user

Kick user sessions

Reset user password