NotificationsSupport
English
Register
API

API documentation

Generated from the API core so endpoints, scopes and integration examples stay together.

Open storeSign in to create an API key
API referenceAPI navigation7 endpoints · 5 groups
WSMarket API

Integrate through one clear flow

Start with an API key, send a Bearer token, read services, then create and track orders. The endpoints below share the same runtime catalog.

Endpoint7
Groups5
AuthBearer
Start integrating

Follow 4 steps

The shortest path to connect a client to the contract and keep debugging straightforward.

01
Create an API key

Grant only the scopes you need. Give each bot or client its own key so it can be revoked independently.

02
Send a Bearer token

Use the Authorization: Bearer <API_KEY> header. Do not put the key in the URL.

03
Read services and stock

Call services/stock to obtain service_id and check availability before creating an order.

04
Create and track orders

Use an idempotency key when creating an order, then read the result by order_code.

7 / 7 endpoints
Base URL/api/
AuthBearer token

Recommended: Authorization: Bearer <API_KEY>. Do not pass the key in the URL.

ScopeGrant the minimum access

Each endpoint has its own scope; the server still enforces wallet, inventory and actor authorization rules.

Response contract

Common errors

Every response includes request_id. For 405 errors, allowed_methods contains the endpoint method; for 403 errors, scope contains the missing scope.

Response examples5 variants

Check the HTTP status and error code first; use request_id to trace logs when needed.

Response400 · Invalid request
{
    "success": false,
    "error": "invalid_request",
    "message": "invalid_request",
    "request_id": "req_example_common_error_400_1"
}
Response401 · Missing API key
{
    "success": false,
    "error": "missing_api_key",
    "request_id": "req_example_common_error_401_1"
}
Response403 · Missing scope
{
    "success": false,
    "error": "scope_required",
    "scope": "service.view",
    "request_id": "req_example_common_error_403_1"
}
Response405 · Wrong HTTP method
{
    "success": false,
    "error": "method_not_allowed",
    "message": "HTTP method không được hỗ trợ cho endpoint này.",
    "allowed_methods": [
        "GET"
    ],
    "request_id": "req_example_common_error_405_1"
}
Response500 · System error
{
    "success": false,
    "error": "system_error",
    "message": "Lỗi hệ thống khi xử lý API. Vui lòng thử lại hoặc cung cấp request_id cho quản trị viên.",
    "request_id": "req_example_common_error_500_1"
}
Endpoint group

Services & stock

2 endpoints
GET/api/services.php
#

List services

Returns services visible to the API key. Buyers receive buyable services; suppliers/uploaders receive only owned local inventory services plus operational metadata.

Scopeservice.view
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestGET /api/services.php
GET /api/services.php
Authorization: Bearer <API_KEY>
Response examples2 variants

These cards are variants of the same endpoint by role or parameter; shared fields keep the same contract.

Response200 · Buyer service
{
    "success": true,
    "data": [
        {
            "id": 12,
            "service_code": "FB_ACC_VN",
            "slug": "facebook-account-vn",
            "name": "Facebook Account Việt Nam",
            "description": "Tài khoản định dạng uid|pass|cookie",
            "price": 2500,
            "currency": "VND",
            "min_quantity": 1,
            "max_quantity": 100,
            "output_format": "uid|password|cookie|2fa",
            "parser_type": "facebook_line",
            "service_type_id": 1,
            "service_type_display": "Phở Bò",
            "stock_available": 84,
            "stock_total": 120
        }
    ],
    "request_id": "req_example_services_1"
}
Response200 · Supplier/uploader service
{
    "success": true,
    "data": [
        {
            "id": 12,
            "service_code": "FB_ACC_VN",
            "slug": "facebook-account-vn",
            "name": "Facebook Account Việt Nam",
            "description": "Tài khoản định dạng uid|pass|cookie",
            "price": 2500,
            "currency": "VND",
            "min_quantity": 1,
            "max_quantity": 100,
            "output_format": "uid|password|cookie|2fa",
            "parser_type": "facebook_line",
            "service_type_id": 1,
            "service_type_display": "Phở Bò",
            "stock_available": 84,
            "stock_total": 120,
            "delivery_mode": "local_stock",
            "service_status": 1,
            "lock_source": "",
            "lock_reason": "",
            "upload_allowed": true
        }
    ],
    "request_id": "req_example_services_2"
}
GET/api/stock.php
#

Check service stock

Returns sellable/live/unknown stock for a visible service. Does not expose the owner, cost price or internal configuration.

Scopeservice.view
Parameters1 parameters
service_idquery · required · int > 0
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestGET /api/stock.php
GET /api/stock.php?service_id=12
Authorization: Bearer <API_KEY>
Response examplesJSON result

This is the real response shape the client should handle.

Response200 · Service stock
{
    "success": true,
    "data": {
        "id": 12,
        "service_code": "FB_ACC_VN",
        "name": "Facebook Account Việt Nam",
        "price": 2500,
        "currency": "VND",
        "min_quantity": 1,
        "max_quantity": 100,
        "sellable_items": 84,
        "available_items": 84,
        "live_items": 90,
        "unknown_items": 6,
        "updated_ts": 1785128400
    },
    "request_id": "req_example_stock_1"
}
Endpoint group

Orders

2 endpoints
POST/api/order_create.php
#

Create an order

Creates a purchase order. Idempotency-Key is required so retries do not create duplicate orders or charge twice. include_raw=1 requires order.download and returns delivered data in data.accounts.

Scopeorder.createExtra scopeorder.download
Parameters7 parameters
Idempotency-Keyheader or JSON idempotency_key/client_order_id · required · string 1-160
service_idjson · required · int > 0
quantityjson · required · int > 0
min_age_secjson · optional · int|null
max_age_secjson · optional · int|null
include_rawJSON or query · optional · 0|1; requires order.download
voucher_code / promo_codejson · optional · rejected; vouchers are for top-ups only
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestPOST /api/order_create.php
POST /api/order_create.php
Authorization: Bearer <API_KEY>
Idempotency-Key: order-client-000001
Content-Type: application/json

{"service_id":12,"quantity":5,"include_raw":0}
Response examples3 variants

These cards are variants of the same endpoint by role or parameter; shared fields keep the same contract.

Response200 · Create order
{
    "success": true,
    "status": "completed",
    "order_code": "ORD20260727000000ABCDEF",
    "requested_count": 5,
    "delivered_count": 5,
    "missing_count": 0,
    "processing": false,
    "message": "Mua thành công — đã giao 5/5 sản phẩm.",
    "idempotent_replay": false,
    "order_created": true,
    "response_degraded": false,
    "retryable": false,
    "voucher_policy": "disabled_reject_non_empty",
    "purchase_ms": 142,
    "request_id": "req_example_order_create_1"
}
Response200 · include_raw=1
{
    "success": true,
    "status": "completed",
    "order_code": "ORD20260727000000ABCDEF",
    "requested_count": 5,
    "delivered_count": 5,
    "missing_count": 0,
    "processing": false,
    "message": "Mua thành công — đã giao 5/5 sản phẩm.",
    "idempotent_replay": false,
    "order_created": true,
    "response_degraded": false,
    "retryable": false,
    "voucher_policy": "disabled_reject_non_empty",
    "purchase_ms": 142,
    "data": {
        "accounts": [
            "61512345678901|pass|cookie"
        ]
    },
    "raw_pagination": {
        "returned": 1,
        "limit": 5000,
        "limited": false,
        "next_cursor": 0
    },
    "raw_access_rule": "refund_revokes_user_payload",
    "request_id": "req_example_order_create_2"
}
Response409 · Order is being processed
{
    "success": false,
    "error": "purchase_busy",
    "message": "purchase_busy",
    "retryable": true,
    "request_id": "req_example_order_create_3"
}
GET/api/order_result.php
#

Get order results

Returns public order metadata and items. include_raw=1 requires order.download, supports cursors and is blocked after refund. Internal member, order and item IDs are not returned.

Scopeorder.viewExtra scopeorder.download
Parameters3 parameters
order_codequery · required · string
include_rawquery · optional · 0|1; requires order.download
cursorquery · optional · int >= 0; only when include_raw=1
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestGET /api/order_result.php
GET /api/order_result.php?order_code=ORD20260727000000ABCDEF&include_raw=0
Authorization: Bearer <API_KEY>
Response examples2 variants

These cards are variants of the same endpoint by role or parameter; shared fields keep the same contract.

Response200 · Order metadata
{
    "success": true,
    "order": {
        "order_code": "ORD20260727000000ABCDEF",
        "service_id": 12,
        "service_name": "Facebook Account Việt Nam",
        "service_description": "Tài khoản định dạng uid|pass|cookie",
        "quantity": 5,
        "unit_price": 2500,
        "total_amount": 12500,
        "currency": "VND",
        "status": 1,
        "payment_status": 1,
        "delivery_line_count": 5,
        "download_count": 1,
        "created_ts": 1785128280,
        "completed_ts": 1785128290
    },
    "items": [
        {
            "item_identifier": "61512345678901",
            "status": 1,
            "delivered_raw_hash": "5d41402abc4b2a76b9719d911017c592",
            "delivered_raw_size_bytes": 128
        }
    ],
    "raw_access_revoked": false,
    "raw_access_rule": "refund_revokes_user_payload",
    "request_id": "req_example_order_result_1"
}
Response200 · include_raw=1
{
    "success": true,
    "order": {
        "order_code": "ORD20260727000000ABCDEF",
        "service_id": 12,
        "service_name": "Facebook Account Việt Nam",
        "service_description": "Tài khoản định dạng uid|pass|cookie",
        "quantity": 5,
        "unit_price": 2500,
        "total_amount": 12500,
        "currency": "VND",
        "status": 1,
        "payment_status": 1,
        "delivery_line_count": 5,
        "download_count": 1,
        "created_ts": 1785128280,
        "completed_ts": 1785128290
    },
    "data": {
        "accounts": [
            "61512345678901|pass|cookie"
        ]
    },
    "raw_pagination": {
        "returned": 1,
        "limit": 5000,
        "limited": false,
        "next_cursor": 0
    },
    "raw_access_rule": "refund_revokes_user_payload",
    "request_id": "req_example_order_result_2"
}
Endpoint group

Wallet

1 endpoints
GET/api/wallet_balance.php
#

Wallet balance

Returns main balance, promo balance, hold and cumulative totals for the account tied to the API key. Does not expose member_id or internal wallet IDs/versions.

Scopewallet.balance
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestGET /api/wallet_balance.php
GET /api/wallet_balance.php
Authorization: Bearer <API_KEY>
Response examplesJSON result

This is the real response shape the client should handle.

Response200 · Wallet balance
{
    "success": true,
    "data": {
        "currency": "VND",
        "status": 1,
        "updated_ts": 1785128400,
        "balance": 100000,
        "promo_balance": 5000,
        "hold_balance": 0,
        "total_credit": 250000,
        "total_debit": 145000,
        "total_spent": 140000,
        "total_refund": 5000
    },
    "request_id": "req_example_wallet_balance_1"
}
Endpoint group

Local inventory

1 endpoints
Local inventory only

upload_inventory.php only accepts services with delivery_mode=local_stock. remote_api services fetch and synchronize through Provider API instead of uploading raw data into local inventory.

POST/api/upload_inventory.php
#

Upload local inventory

Uploads up to 5,000 raw lines into an owned local_stock service. The parser can auto-detect the format; clients cannot set live_status themselves.

Scopeinventory.upload
Parameters4 parameters
service_idjson · required · int > 0
parser_typejson · optional · string; defaults to auto_detect
linesjson · required · array|string; maximum 5,000 lines
source_refjson · optional · string
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestPOST /api/upload_inventory.php
POST /api/upload_inventory.php
Authorization: Bearer <API_KEY>
Content-Type: application/json

{"service_id":12,"parser_type":"auto_detect","lines":["61512345678901|pass|cookie"]}
Response examplesJSON result

This is the real response shape the client should handle.

Response200 · Upload result
{
    "success": true,
    "batch_code": "API20260727100000ABCDEF",
    "inserted": 1,
    "duplicate_in_file": 0,
    "duplicate_in_db": 0,
    "invalid": 0,
    "live_status": 0,
    "parser_type": "facebook_line",
    "parser_detection": {
        "parser_type": "facebook_line",
        "confidence": 1,
        "reason": "Nhận diện UID Facebook hợp lệ.",
        "uid_rows": 1,
        "checked_rows": 1
    },
    "checker_type": "fb_uid",
    "checker_auto_configured": true,
    "request_id": "req_example_upload_inventory_1"
}
Endpoint group

Other

1 endpoints
GET/api/key_info.php
#

Inspect the current API key

Confirm which username/role owns the key and distinguish stored scopes from scopes currently effective under RBAC. Does not return member_id or the full key.

Scopeapi.use
Request exampleEndpoint call example

Send the documented method, Bearer token and parameters exactly as defined above.

RequestGET /api/key_info.php
GET /api/key_info.php
Authorization: Bearer <API_KEY>
Response examplesJSON result

This is the real response shape the client should handle.

Response200 · Current API key
{
    "success": true,
    "data": {
        "key_name": "Automation buyer",
        "key_prefix": "wsm_live_ab12",
        "key_format": "wsm_live",
        "username": "buyer01",
        "account_role": "buyer",
        "stored_scopes": [
            "api.use",
            "service.view",
            "order.create",
            "order.view"
        ],
        "effective_scopes": [
            "api.use",
            "service.view",
            "order.create",
            "order.view"
        ],
        "expires_ts": 0,
        "last_used_ts": 1785128400
    },
    "request_id": "req_example_key_info_1"
}
API

Reseller tip

Order creation can return delivered data immediately when the key has the required scope.

When creating an order, set include_raw=1 to receive delivered data in data.accounts when the API key has order.download.

Provider

Use WSMarket as a source for another site

Connect through the Provider API preset instead of rebuilding the contract.

Admins can select the WebBanHang v2 API preset. It uses /api/services.php for services, /api/order_create.php for purchasing and /api/wallet_balance.php for wallet balance.