DirectAdmin Hosting Control Panel — setup and reference

Module and release scope

This guide covers DirectAdmin Hosting Control Panel 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.

Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.

Exact connection fields

These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.

Key / label	Type	Required	Default / guidance
server_url — Panel HTTPS address	url	Yes	Origin only, including its HTTPS API port. A valid trusted TLS certificate is required.
default_package — Default hosting package	text	No	Exact package name or ID from this panel. Product settings can override it.
default_nameservers — Default nameservers	text	No	Use the account-specific value described below.
allow_writes — Allow account provisioning and changes	boolean	No	Default: false
allow_automated_suspend — Allow automated suspension	boolean	No	Default: false
allow_automated_unsuspend — Allow automated unsuspension	boolean	No	Default: false
allow_automated_terminate — Allow lifecycle termination	boolean	No	Default: false
username — Administrator or reseller login	text	Yes	Use the account-specific value described below.
login_key — Restricted API login key	secret	Yes	Use a login key restricted to the documented account and package commands and this application server IP.
account_ip — Shared account IP address	text	Yes	Use the account-specific value described below.
inventory_scope — Account inventory scope	select	Yes	Default: "reseller" Choices: reseller = This reseller, admin = All server users (administrator)

This module installs disabled. It uses DirectAdmin's documented legacy account/package API with JSON responses and a restricted login key. It ships no server configuration or credentials.

Configure

1. Enable the module, create a server connection and enter the panel origin, normally https://panel.example.net:2222. Use a trusted TLS certificate; the API paths are appended automatically. Credentials in URLs, paths, query strings, redirects and insecure HTTP are refused.
2. In DirectAdmin, create a login key for the administrator or reseller that owns these hosting accounts. Restrict the key to the application server's outbound IP and the required commands: CMD_API_PACKAGES_USER, CMD_API_SHOW_USERS (reseller inventory) or CMD_API_SHOW_ALL_USERS (administrator inventory), CMD_API_SHOW_USER_CONFIG, CMD_API_ACCOUNT_USER, CMD_API_SELECT_USERS, and CMD_API_MODIFY_USER. Enter the login and encrypted login key separately. A user-level account is insufficient.
3. Choose the inventory scope matching that credential. Enter a shared/free account IP available to the credential. Create the required User packages in DirectAdmin and use an exact package name returned by Test. The connection default can be overridden by product provisioning settings.
4. Run Test: it reads the available packages, account inventory and account configuration without creating or changing anything. Inventory is bounded to 500 users per connection; split large reseller scopes rather than raising response limits.
5. Enter optional default nameservers as a comma/space-separated list. Enable writes only when ready. Automated suspension, unsuspension and termination each require their own permission; all default off. Deletion requires a verified suspended account and the explicit lifecycle policy.

Operations and confirmation

Create uses CMD_API_ACCOUNT_USER with a fixed reserved username, exact domain/package, matching password confirmation, customer email and configured IP. DirectAdmin notifications are disabled for this request so the billing application's credential delivery can remain authoritative. New usernames are 4–8 characters and begin with a lowercase letter; no random alternative is chosen after a collision.

Sync reads CMD_API_SHOW_USER_CONFIG. Suspend/unsuspend use dosuspend/dounsuspend, never the legacy toggle. Package changes use CMD_API_MODIFY_USER with action=package; termination uses CMD_API_SELECT_USERS with explicit deletion confirmation.

Every mutation is followed by a fresh inventory/configuration read. Exact username, primary domain, package and suspension status must match before confirmation. An unconfirmed create remains pending and is never automatically repeated. Existing usernames/domains block creation; errors are sanitized before display. A restricted key must be able to see all accounts in its creation scope to support duplicate detection and verification.

Shared/hosting products are supported. Reseller/VPS account creation, password changes, single sign-on and arbitrary API commands are not exposed. The panel has no webhook for these operations and no module-provided sandbox; use a dedicated test server before enabling production writes. Login-key expiry, source-IP restrictions, missing command grants and inaccessible TLS ports appear in connection diagnostics.

Provider documentation

• Legacy API account, package and configuration commands
• API request examples and JSON responses
• Explicit suspension and activation commands
• API authentication and login keys