Create a sub-reseller, action=create_user

If you are starting a new integration instead of migrating, prefer the native v1 API with the official SDKs.

Create a new account inside the reseller tree in the classic Xtream Codes envelope. The compat layer translates this call to the native POST /panel-api/v1/resellers and wraps the result in the XC {"status": "STATUS_SUCCESS", "data": {...}} shape.

Behavior depends on the calling key. An admin key can create a top-level reseller in either billing mode with any starting balance. A reseller key can only create a sub-reseller under its own account, in the same billing mode as the parent, with a zero starting balance, and only if the panel admin has enabled create_sub_resellers on the caller's member group and configured a sub-reseller package for that group.

The endpoint runs the check and the insert inside a single transaction with SELECT ... FOR UPDATE on the caller's own row, so two concurrent creates can never over-allocate slots or double-spend credits. Retries covered by the rid idempotency parameter never provision a duplicate account.

Endpoint

POST https://<your-panel-domain>/panel-api/xc/{accesscode}/{admin|reseller}/index.php?action=create_user

The {accesscode} segment is decorative. Any non-empty value works. Both /admin/index.php and /reseller/index.php accept the same key type; the API infers admin-versus-reseller from the key itself. Security is enforced through the API key, not the path.

Authentication

Send the API key either as api_key=<your-api-key> in the query string, as Authorization: Bearer <your-api-key> in the header, or as a form field in the POST body. Both admin and reseller keys can call this action; the field set they may send differs (see Request body). See Xtream Codes compatibility for the full auth contract.

Required scope

subresellers:write. Admin keys carry this scope by default. Reseller-issued keys must have it explicitly.

Idempotency

Every write action in the XC dialect accepts an optional rid parameter (in the query string or the POST body). Repeating the exact same request with the same rid and the same body replays the original response instead of running twice. Reusing the same rid with a different body returns STATUS_FAILURE with error: "idempotency_conflict". Use a stable value such as the invoice ID or CRM record ID that triggered the provision. Values up to 255 characters, scoped per API key, retained for 24 hours. See Idempotency via rid for the full contract.

Request body

XC integrations POST form-encoded (application/x-www-form-urlencoded).

Field	Type	Required	Default	Description
`username`	string	yes		Login name. Minimum 3 characters. Cannot contain `% & ? # / \ = + @ : ;`. Must be unique across the panel.
`password`	string	yes		Login password. Minimum 8 characters, same character restrictions as `username`.
`email`	string	yes		Validated with `FILTER_VALIDATE_EMAIL`.
`member_group_id`	int	admin only		Which member group the new reseller belongs to. Ignored on reseller keys (the target group is fixed by the panel admin's sub-reseller setup for the caller's group).
`credits`	float	admin only	`0`	Starting credit balance. Forced to `0.0` for reseller-key callers; top up later with `action=adjust_credits`.
`billing_mode`	string	admin only	`"credits"`	Either `"credits"` or `"users"`. Any other value falls back to `"credits"`. Reseller-key callers inherit the parent's mode; the field is ignored.
`max_users`	int	conditional	`0`	Required when `billing_mode` is `"users"`, and must be positive.
`billing_expires`	int	conditional		Unix timestamp in seconds. Required when a reseller-key caller in `users` mode creates a sub-reseller. Optional for admin-key calls.
`owner_id`	int	admin only	panel admin	Parent account for the new reseller. Reseller-key callers must either omit this field or send their own reg-user ID; any other value returns `STATUS_NO_PERMISSIONS` with `owner_must_be_self`.
`notes`	string	no	`""`	Free-form label kept alongside the reseller record.
`rid`	string	no		Idempotency token (see above). Optional, but strongly recommended for automated billing.

Response

On success the endpoint returns STATUS_SUCCESS with the new ID, the billing snapshot the account starts with, and credits_charged, which reflects how many credits were deducted from the caller. For admin-key calls that field is always 0. For reseller-key calls in credits mode it matches the per-creation price configured on the caller's group.

{
  "status": "STATUS_SUCCESS",
  "data": {
    "id": 100262261,
    "username": "reseller_new",
    "email": "reseller_new@example.com",
    "member_group_id": 4,
    "owner_id": 100260897,
    "credits_charged": 0,
    "billing": {
      "mode": "credits",
      "credits": 100,
      "max_users": null,
      "active_users": null,
      "billing_expires": null
    }
  }
}

HTTP status is always 200. Your client must branch on body.status, not on the HTTP code.

Examples

cURL

curl -X POST "https://<your-panel-domain>/panel-api/xc/panel_api/admin/index.php?api_key=<your-api-key>&action=create_user" \
  -d "username=reseller_new" \
  -d "password=SuperSecret123" \
  -d "email=reseller_new@example.com" \
  -d "member_group_id=4" \
  -d "billing_mode=credits" \
  -d "credits=100" \
  -d "notes=CRM signup 90142" \
  -d "rid=crm-signup-90142"

PHP raw

$url = 'https://<your-panel-domain>/panel-api/xc/panel_api/admin/index.php'
     . '?' . http_build_query([
         'api_key' => '<your-api-key>',
         'action'  => 'create_user',
       ]);
$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'username'        => 'reseller_new',
        'password'        => 'SuperSecret123',
        'email'           => 'reseller_new@example.com',
        'member_group_id' => 4,
        'billing_mode'    => 'credits',
        'credits'         => 100,
        'notes'           => 'CRM signup 90142',
        'rid'             => 'crm-signup-90142',
    ]),
]);
$body = json_decode(curl_exec($ch), true);
curl_close($ch);
if ($body['status'] !== 'STATUS_SUCCESS') {
    throw new RuntimeException($body['data']['message'] ?? 'create_user failed');
}
$resellerId = $body['data']['id'];

Python raw

import requests

r = requests.post(
    "https://<your-panel-domain>/panel-api/xc/panel_api/admin/index.php",
    params={"api_key": "<your-api-key>", "action": "create_user"},
    data={
        "username":        "reseller_new",
        "password":        "SuperSecret123",
        "email":           "reseller_new@example.com",
        "member_group_id": 4,
        "billing_mode":    "credits",
        "credits":         100,
        "notes":           "CRM signup 90142",
        "rid":             "crm-signup-90142",
    },
    timeout=30,
)
r.raise_for_status()
body = r.json()
if body["status"] != "STATUS_SUCCESS":
    raise RuntimeError(body["data"].get("message", "create_user failed"))
reseller_id = body["data"]["id"]

Errors

HTTP is always 200 for this dialect. The status field is the branch signal, and data.error carries the exact slug.

status	Error slug	When it happens	How to fix
`STATUS_INVALID_DATA`	`validation_error`	Username, password, or email fails the validators (length, forbidden characters, invalid email, duplicate username, unknown `member_group_id`). The `message` carries the reason.	Fix the offending field and resend.
`STATUS_INVALID_DATA`	`validation_error`	A reseller-key caller in `users` mode sent `billing_expires_required` or a non-positive `max_users`.	Add a positive Unix timestamp for `billing_expires` and a positive `max_users`.
`STATUS_FAILURE`	`invalid_key`	The `api_key` (or `Authorization: Bearer`) is missing, malformed, or unknown.	Send a live key.
`STATUS_NO_PERMISSIONS`	`insufficient_scope`	The key does not carry `subresellers:write`.	Rotate the key with the correct scopes.
`STATUS_NO_PERMISSIONS`	`owner_must_be_self`	A reseller-key caller passed an `owner_id` other than their own.	Omit `owner_id`, or set it to the caller's own reg-user ID.
`STATUS_NO_PERMISSIONS`	`sub_reseller_creation_not_allowed`	The reseller-key caller's group does not have `create_sub_resellers = 1`.	The panel admin turns this on per group in the CMS.
`STATUS_INVALID_DATA`	`no_sub_reseller_setup`	The panel admin has not configured a sub-reseller package for the reseller-key caller's group, or the configured package is not usable.	The admin configures it in the CMS.
`STATUS_INSUFFICIENT_CREDITS`	`insufficient_credits`	A reseller-key caller in `credits` mode does not have enough balance to pay the per-creation price.	Top up the caller with `action=adjust_credits`, then retry.
`STATUS_INSUFFICIENT_CREDITS`	`insufficient_slots`	A reseller-key caller in `users` mode asked for more `max_users` than they have available. XC has no slot-specific status value, so the slot error surfaces under `STATUS_INSUFFICIENT_CREDITS`.	Free slots on the caller, or lower `max_users`.
`STATUS_FAILURE`	`idempotency_conflict`	The `rid` was reused with a different body.	Generate a new `rid` or resend the original body.
`STATUS_FAILURE`	`rate_limited`	The per-key request budget for the current minute is spent.	Back off and retry after the minute rolls over.

Create a sub-reseller, action=create_user

Endpoint

Authentication

Required scope

Idempotency

Request body

Response

Examples

cURL

PHP raw

Python raw

Errors

See also