# WHM API integration notes

Official docs:
- https://api.docs.cpanel.net/whm/tokens
- https://api.docs.cpanel.net/whm/introduction
- https://api.docs.cpanel.net/specifications/whm.openapi/account-permissions

## Rules for this project
- Use HTTPS to WHM port 2087.
- Use an API token with only the required privileges; never request `acl=all` by default.
- The provider/reseller owner must explicitly authorize token creation and API use.
- Store secrets outside the web root and source control.
- Keep TLS verification enabled. Install the correct CA bundle if needed; do not disable certificate verification.
- Start with a read-only connectivity test. Do not call create/suspend/terminate functions until the provider approves a test account and test domain.
- The API token must be restricted to the smallest supported privileges and, where practical, a source IP allowlist.

## Required provider confirmation
1. Is WHM API access enabled for this reseller account?
2. Does the account have the `create-acct` privilege and any required package/DNS permissions?
3. Which functions are allowed by the provider's reseller policy?
4. Are test accounts allowed, and what is the cleanup process?
5. Is remote API access restricted by IP allowlist or firewall?

## PHP client skeleton
The `src/WhmApiClient.php` class is a skeleton for future approved calls. It uses curl with TLS verification enabled and rejects requests while `WHM_API_ENABLED` is false. Do not configure production secrets in `.env.example`.