API Documentation

Integrate Gsm Player as a supplier. The Latest API is a modern JSON/REST interface; the Legacy API is DHRU-Fusion-compatible for existing integrations. Create an access token under Profile → API Settings.

Latest API (REST v1)

Base URL: https://your-store.example/api/reseller/v1 — if you are connecting a Dhru Fusion Pro panel, give it https://your-store.example instead; it appends /api/reseller/v1/… itself.

Authentication: send your access token as a bearer header — Authorization: Bearer <access-token>. Every response is a JSON object { status, message, code, data } (status is "success" or "error").

GET/account

Account info

Returns the key's currency, wallet balance and account holder.

curl https://your-store.example/api/reseller/v1/account \
  -H "Authorization: Bearer <token>"

{
  "status": "success",
  "message": "Your account details have been retrieved successfully.",
  "code": 200,
  "data": { "currency": "USD", "balance": "99.10", "name": "QA Tester", "email": "reseller@example.com" }
}

GET/products

Product / service list

Lists categories and orderable products priced in the key's currency. Each product's fields[] are the custom inputs required at order time.

{
  "status": "success",
  "code": 200,
  "data": {
    "currency": "USD",
    "categories": { "<catId>": { "name": "Samsung" } },
    "products": {
      "1001": {
        "name": "EME Mobile Tool - Credits",
        "type": "server", "cids": ["<catId>"], "price": 1.15,
        "fields": [ { "type": "imei", "name": "IMEI", "min": 0, "max": 0, "required": true } ]
      }
    }
  }
}

POST/order

Place order

Body is a JSON array of product blocks; each fields[] element is one order line.

Parameter	Required	Description
product_uuid	yes	The product id (from /products).
fields[].reference_id	yes	Your unique id for tracking; echoed back.
fields[].Quantity	yes	Order quantity (integer).
fields[].feedback_url	no	We POST the order's outcome here when it settles — see Order callback.
fields[].<name>	as required	Each of the product's custom fields, by name (e.g. IMEI).

curl -X POST https://your-store.example/api/reseller/v1/order \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '[{ "product_uuid": "1001", "fields": [
        { "reference_id": "ref-001", "feedback_url": "https://your-site.com/callback",
          "Quantity": 1, "IMEI": "356789104567890" } ] }]'

{
  "status": "success", "message": "1 Orders submitted", "code": 200,
  "data": [ { "order_uuid": "ORD-100002", "amount": 1, "currency_code": "USD", "reference_id": "ref-001" } ]
}

GET/order?order_uuid=

Order status

Poll an order by the order_uuid returned from placement.

curl "https://your-store.example/api/reseller/v1/order?order_uuid=ORD-100002" -H "Authorization: Bearer <token>"

{
  "status": "success", "message": "Order Details", "code": 200,
  "data": { "quantity": 1, "status": "success", "date": "2026-07-14 19:32:20" }
}

This returns the order's state only. The delivered result comes back through the callback below, or from the legacy getorder action.

POST→ your feedback_url

Order callback

When an order settles we POST once to the feedback_url you sent with it. replay is the delivered result, base64-encoded — for a rejected or cancelled order it carries the reason instead. Respond 2xx to acknowledge; anything else is retried with backoff for about an hour.

Parameter	Required	Description
reference_id		The reference_id you sent with the order line.
order_id		Our order id — the same value returned as order_uuid.
status		success \| rejected \| cancelled.
replay		Base64 of the result (or of the reason, when not success).

POST https://your-site.com/callback

{
  "reference_id": "ref-001",
  "order_id": "ORD-100002",
  "status": "success",
  "replay": "VU5MT0NLRUQ="
}

Legacy API (DHRU Fusion)

Endpoint: https://your-store.example/api/index.php

Connecting a Dhru Fusion site? Put https://your-store.example in its API url field, not the full endpoint — the DHRU client appends /api/index.php on its own, and giving it the full path makes it request that twice.

Authentication: form fields username (your account username) + apiaccesskey (your access token), plus an action. Both multipart/form-data (what the official DHRU client kit sends) and application/x-www-form-urlencoded are accepted.

POST/api/index.php

Action-based requests

Supported actions: accountinfo, imeiservicelist, serverservicelist, placeimeiorder / placeorder, getimeiorder / getorder, and the V6.1 bulk pair placeimeiorderbulk / getimeiorderbulk. Returns the classic DHRU SUCCESS / ERROR envelope (XML by default; add requestformat=JSON for JSON).

REFERENCEID is numeric (e.g. 100010), matching the standard. When polling with getimeiorder you may pass either that number or the ORD-100010 form.

For the bulk actions, parameters is a map of your own request ids to order blocks, and each id gets its own SUCCESS or ERROR back, so one bad item never fails the batch.

curl -X POST https://your-store.example/api/index.php \
  -d "username=<username>&apiaccesskey=<token>&action=accountinfo&requestformat=JSON"

{ "SUCCESS": [ { "AccoutInfo": { "credit": "99.10", "currency": "USD" } } ], "apiversion": "5.1" }

GSM Theme compatible endpoint

Endpoint: https://your-store.example/public/api/index.php

Connecting a GSM Theme store? Put https://your-store.example in its API url field. Its client keeps only the scheme and host of whatever you type and appends /public/api/index.php itself, so any path you enter is discarded.

Same dialect as the Legacy API above — the same username + apiaccesskey, the same actions, the same SUCCESS / ERROR envelope and the same STATUS codes. Only the address differs.

POST/public/api/index.php

GSM Theme differences

accountinfo returns the account block under AccountInfo as well as DHRU's historically misspelled AccoutInfo — both keys, same values, so either client reads it.

imeiservicelist returns an ACCOUNTINFO block alongside LIST, so the catalogue and the balance arrive together.

placebulkorder is accepted here and answers in GSM Theme's own shape. Order status is unchanged: getimeiorderbulk returns the same shape both standards share.

curl -X POST https://your-store.example/public/api/index.php \
  -d "username=<username>&apiaccesskey=<token>&action=placebulkorder&requestformat=JSON" \
  --data-urlencode "parameters=$(echo -n '{"7":{"ID":12,"QNT":1,"CUSTOMFIELD":""}}' | base64)"

{ "SUCCESS": { "7": { "status": "success", "message": "Order Received", "referenceid": 100010 } }, "apiversion": "5.1" }

GSM Tool compatible endpoint

Endpoint: https://your-store.example/gsmfusion_api/index.php

Connecting a GSM Tool store? Put https://your-store.example in its API url field — its client appends /gsmfusion_api/index.php itself.

Authentication: form fields apiKey (your access token) and userId (your account username), plus an action. This is the same access as the other APIs — the same token, the same wallet, the same prices.

Responses are XML. Unlike the Legacy API above, this dialect has no JSON form.

POST/gsmfusion_api/index.php

Actions and statuses

Actions: imeiservices, fileservices, placeorder, placefileorder, getimeis, getfileorder. Failures come back as <error>message</error>.

Status ids differ from the Legacy API. Here 1 is Pending, 2 Completed, 3 Rejected and 4 In Process — note that 4 means the order is still being worked on, not that it is finished.

placeorder takes networkId (the service id from imeiservices) and imei, which may be several IMEIs separated by commas. Any that were already in the system come back under <imeiduplicates> rather than as an error.

curl -X POST https://your-store.example/gsmfusion_api/index.php \
  -d "apiKey=<token>&userId=<username>&action=placeorder&networkId=1001&imei=356789104567890"

<?xml version="1.0" encoding="utf-8"?>
<result>
  <imeis>
    <id>100014</id>
    <imei>356789104567890</imei>
    <status>1</status>
  </imeis>
</result>