ISPConfig Hosting — setup and reference

Module and release scope

This guide covers ISPConfig Hosting 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.

Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.

Exact connection fields

These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.

Key / label	Type	Required	Default / guidance
server_url — HTTPS control-panel origin	url	Yes	Include the panel port; do not include an API path. A trusted TLS certificate is required.
default_nameservers — Default hosting nameservers	text	No	Comma or space separated authoritative nameservers.
allow_writes — Allow account creation and changes	boolean	No	Default: false
allow_automated_create — Allow automated creation	boolean	No	Default: false
allow_automated_suspend — Allow automated suspension	boolean	No	Default: false
allow_automated_unsuspend — Allow automated restoration	boolean	No	Default: false
allow_automated_change_package — Allow automated package changes	boolean	No	Default: false
allow_automated_terminate — Allow automated termination	boolean	No	Default: false
username — Remote API user	text	Yes	Use the account-specific value described below.
password — Remote API password	secret	Yes	Use the account-specific value described below.
server_id — Web-server ID	integer	Yes	Use the account-specific value described below.
php_mode — Website PHP mode	select	Yes	Default: "php-fpm" Choices: php-fpm = PHP-FPM, no = Disabled
web_ip — Web IP address or *	text	Yes	Use the IP configured on the selected ISPConfig web server, or * for its wildcard vhost.

ISPConfig remote JSON API integration for a dedicated non-reseller customer account and one primary website per service. Supports main client-template inventory, account synchronization, creation, suspension, restoration, package changes and explicit lifecycle termination. Packages are exact numeric main client template IDs; reseller/additional templates and templates without website capacity are excluded.

Set up

1. Use a current supported ISPConfig installation with remote API enabled in its security configuration. Create a dedicated Remote User, restrict its source IP, and permit server_get, client_templates_get_all, client_get_by_username, client_get, sites_web_domain_get; write operations additionally require client_add, client_update, sites_web_domain_add, sites_web_domain_update, sites_web_domain_set_status and client_delete_everything.
2. Enter only the HTTPS panel origin (usually https://panel.example.test:8080), remote username/password, selected ISPConfig web-server ID, that server's web IP or *, and the actual hosting nameservers. The module uses the fixed /remote/json.php?method endpoint and session authentication. TLS verification is always enabled.
3. Select PHP-FPM or disabled PHP. The main client template must permit the selected PHP mode. Configure normal website/server defaults in ISPConfig; the module creates a primary vhost with template disk/traffic quotas. It does not create FTP users, mail domains, DNS zones or databases. Product packages must contain the numeric main template ID.
4. Run Test to authenticate, locate the configured server, and read its website inventory and template catalogue. Enable the installed module and tested connection explicitly. All write and automated lifecycle controls default false.

The module reserves no random identities: the billing core supplies the stable reserved login and encrypted password. Before a create, the API must explicitly confirm no existing login and no matching domain. Client creation and website creation are separate writes. A partial failure stays unconfirmed and is never automatically rolled back or retried. Review the reserved account, complete its website in ISPConfig if needed, and synchronize it.

Confirmation verifies fresh customer login, ordinary user role, client/group IDs, primary domain, configured web server, exact main template and its declared limits, website quotas, and agreement between customer resource lock and website active flags. Additional templates and multiple websites under the account are refused. Suspension changes the customer resource lock and website active flags; ISPConfig retains customer panel access. Existing passwords are preserved during updates. Termination requires a suspended account and explicit lifecycle authorization; client_delete_everything removes this dedicated customer's associated resources.

Account records versus server runtime: ISPConfig applies server configuration through its background server process. Confirmed results describe matching control-panel customer/website records and expose runtime_status: not_exposed; they do not certify that cron has finished, DNS resolves or HTTP/PHP responds. Check ISPConfig's server job queue when runtime configuration lags. Explicitly incomplete API records remain pending.

Redirects, compressed replies and responses over two MiB are refused. Writes are never retried automatically. API sessions are not returned to the billing UI, and diagnostics redact credentials/contact values.

Official references: ISPConfig downloads and current release, official remote API source and examples, official JSON handler, official client operations.