XUI.live API
Everything the XUI.live panel does, your own software can do too. Billing systems, automation scripts, reseller dashboards and client apps all talk to the same three APIs the panel itself is built on.
| API | Endpoint | Authentication | Actions | Built for |
|---|---|---|---|---|
| Admin API | /<access-code>/ | api_key of an admin account | 181 | Full panel management |
| Reseller API | /<access-code>/ | api_key of a reseller account | 36 | Reseller tools and billing |
| Xtream Codes API | /player_api.php | line username + password | 11 | Player apps and playlists |
Authentication
Admin and Reseller API
Every panel account carries a 32-character api_key. Two steps unlock API access:
- Generate the key in the panel under Account → API Key.
- Have an administrator create an API-type access code. The code becomes the URL path prefix that routes to the API — think of it as a private, unguessable mount point for your panel’s API.
Every request then carries the key as a parameter:
https://your-panel.com/YOUR_ACCESS_CODE/?api_key=YOUR_API_KEY&action=ACTIONA ten-second sanity check:
curl "https://your-panel.com/YOUR_ACCESS_CODE/?api_key=YOUR_API_KEY&action=user_info"{
"status": "STATUS_SUCCESS",
"data": { "id": "3", "username": "admin", "member_group_id": "1" }
}Xtream Codes API
Client applications authenticate with the username and password of a line — a subscriber account. No key, no access code:
https://your-panel.com/player_api.php?username=USER&password=PASS&action=ACTIONConventions
These apply to the Admin and Reseller APIs.
| Parameter | Purpose |
|---|---|
action | The endpoint to call — required |
api_key | Your key — required |
start | Pagination offset, default 0 |
limit | Rows per page, default 50 |
show_columns | Comma-separated columns to include |
hide_columns | Comma-separated columns to exclude |
Two response shapes. Most endpoints answer with an envelope —
{"status":"STATUS_SUCCESS","data":{...}} for one object, plus recordsTotal and
recordsFiltered on paginated lists. A handful of lookup getters (get_servers, get_bouquets,
get_categories, get_epgs, get_packages) return a bare JSON array instead.
On error, the status names the reason and data echoes your input back:
{"status":"STATUS_INVALID_MAC","data":{...}}.
GET and POST both work. Parameters go in the query string or the request body. Use POST when sending large payloads such as JSON selector arrays.
Status codes
The status field is a string constant. STATUS_SUCCESS and STATUS_SUCCESS_MULTI mean the
operation went through; everything else names the reason it did not.
| Code | Meaning |
|---|---|
STATUS_SUCCESS / STATUS_SUCCESS_MULTI / STATUS_SUCCESS_REPLACE | Operation succeeded |
STATUS_FAILURE | Generic failure — most often a non-existent id |
STATUS_NOT_ADMIN / STATUS_NOT_RESELLER | The key’s account lacks the required role |
STATUS_INVALID_* | A parameter failed validation — the suffix names which: _PASSWORD, _IP, _MAC, _DATE, _EMAIL, _NAME, _CODE, _GROUP, _PACKAGE, _USER, _USERNAME, _TYPE, _DIR, _FILE, _DATA, _INPUT, _PLAYLIST, _SUBRESELLER |
STATUS_EXISTS_* | A unique value is already taken: _USERNAME, _MAC, _NAME, _CODE, _IP, _SOURCE, _DIR, _HMAC |
STATUS_NO_SOURCES / STATUS_NO_KEY / STATUS_NO_DESCRIPTION | A required input is missing |
STATUS_CODE_LENGTH | Access code shorter than 8 characters |
STATUS_NO_TRIALS / STATUS_INSUFFICIENT_CREDITS | Reseller limits reached |
STATUS_TOO_MANY_RESULTS / STATUS_SPACE_ISSUE | Server-side limits: result set or disk space |
Quick start
BASE="https://your-panel.com/YOUR_ACCESS_CODE"
KEY="YOUR_API_KEY"
curl "$BASE/?api_key=$KEY&action=user_info"
curl "$BASE/?api_key=$KEY&action=get_lines&limit=10"Two variables and you have programmatic access to the entire panel. Start with the Admin API reference for the full action catalogue, or jump straight to the Xtream Codes API if you are integrating a player app.