Plesk Hosting Control Panel — setup and reference

Module and release scope

This guide covers Plesk Hosting Control Panel 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.

Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.

Exact connection fields

These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.

Key / label	Type	Required	Default / guidance
server_url — Panel HTTPS address	url	Yes	Origin only, including its HTTPS API port. A valid trusted TLS certificate is required.
default_package — Default hosting package	text	No	Exact package name or ID from this panel. Product settings can override it.
default_nameservers — Default nameservers	text	No	Use the account-specific value described below.
allow_writes — Allow account provisioning and changes	boolean	No	Default: false
allow_automated_suspend — Allow automated suspension	boolean	No	Default: false
allow_automated_unsuspend — Allow automated unsuspension	boolean	No	Default: false
allow_automated_terminate — Allow lifecycle termination	boolean	No	Default: false
api_role — API credential role	select	Yes	Default: "administrator" Choices: administrator = Administrator, reseller = Reseller
api_key — Plesk XML API secret key	secret	Yes	Generate an XML API secret key for the administrator or a reseller with remote API permission.
owner_login — Existing subscription owner login	text	Yes	Subscriptions are created under this existing Plesk administrator, reseller or customer owner.
account_ip — Shared hosting IP address	text	Yes	Use the account-specific value described below.

This module installs disabled. It supports Plesk Obsidian XML API 1.6.9.1 hosting subscriptions. No server, account, secret key, subscription or business setting is supplied with the product.

Configure

1. Enable this module under Server modules, then create a connection. Enter the panel origin, normally https://panel.example.net:8443. Install a trusted certificate matching the hostname; TLS verification cannot be disabled. Do not paste /enterprise/control/agent.php, credentials or a query into this field.
2. Generate a Plesk XML API secret key for an administrator or reseller with remote API access, then select that credential role in the connection. Restrict access to the application server's outbound IP in Plesk and its firewall. Paste the key in the encrypted secret field. REST API tokens alone are not assumed to be XML API keys.
3. Enter an existing subscription owner login and the IP assigned to hosting subscriptions. This integration creates virtual-hosting subscriptions under that existing owner. It does not create Plesk customer/reseller identities or change the owner's password; the reserved service username is the subscription's FTP/system login.
4. Run Test. It reads service plans and subscriptions only. Select an exact returned service plan name in product provisioning settings or the connection default. Plans must belong to the configured owner. Use an administrator/reseller owner who has service plans; a customer account alone cannot own a service-plan catalogue.
5. Enter default nameservers separated by spaces or commas if required. This is hosting metadata, not a registrar nameserver change.
6. Enable account writes only when provisioning is intended. Automated suspension, unsuspension and lifecycle termination are separately disabled by default. Deletion requires a verified suspended account and the explicit lifecycle policy.

Operations and confirmation

Create uses webspace/add with the primary domain, configured owner/IP, explicit FTP login/password and exact plan name. Synchronization uses webspace/get with general, hosting and subscription information. Suspend/unsuspend use webspace/set; package changes use webspace/switch-subscription with the verified plan GUID; termination uses webspace/del for one verified subscription ID.

An acknowledgement does not activate a service. A fresh read must prove the exact primary domain, FTP login, base service plan GUID and account status. An uncertain response, mismatched plan or incomplete evidence leaves provisioning pending for synchronization. Creation submits once; a timeout never triggers another automatic create. Existing usernames/domains are rejected before submission. API error text is sanitized before display.

Only shared/hosting products are advertised. Reseller creation, VPS provisioning, single sign-on, password changes, DNS management, add-on plan changes and arbitrary CLI commands are not exposed. Customized subscriptions without one identifiable base plan need operator reconciliation. XML API must be reachable on the configured TLS port; there is no webhook to configure and no public sandbox supplied by Plesk. Validate with a dedicated test server and test domains before enabling production writes.

Provider documentation

• XML API secret keys
• Creating subscriptions
• Subscription information and filtering
• Setting subscription status
• Switching service plans