Authentication

Every request needs two headers. Both are mandatory on every call.

Header	Required	What to send
X-API-KEY	required	Your API key. Find it in your reseller panel under API settings.
__reseller	required	Your reseller ID (a GUID). Also shown in your reseller panel next to the API key.
Content-Type	for writes	application/json on POST, PUT and DELETE requests that carry a body.
X-Correlation-ID	recommended	Any unique string you generate per request. We log it. Quoting it in a support ticket makes the request findable in seconds instead of minutes.

A complete request

curl -X POST https://api.domainresellerapi.com/api/v1/domains/search \
  -H 'X-API-KEY: 8f2c41d7a9e5b3104c6f8a2d9b7e1c35' \
  -H '__reseller: 7f3c1a28-9e4b-4c51-b1d2-0a6e5f8c3d94' \
  -H 'X-Correlation-ID: my-app-2026-10-30-000142' \
  -H 'Content-Type: application/json' \
  -d '{"domainName":"apiname.com"}'

Keep your API key secret

The key authenticates every action on your account, including purchases that debit your balance. Never put it in browser-side JavaScript, a mobile app bundle, or a public repository. Call the API from your server only. If you think the key has leaked, regenerate it in your reseller panel immediately — the old key stops working the moment you do.

Authentication failures

These come back as plain text, not JSON, with HTTP 401.

Body	What went wrong
Unauthorized! API Key is missing.	No X-API-KEY header. Check your client is actually sending it — some HTTP libraries drop headers on redirect.
Unauthorized! ResellerId is missing.	No __reseller header. Note the two leading underscores.
Unauthorized! Invalid API Key.	The key does not match the reseller ID. The usual cause is sending the test key to the live address, or the live key to the test address — see Test environment.
Unauthorized! You do not have authorisation for this operation.	The account is a sub-reseller. Only top-level reseller accounts can use this API. Your parent reseller must call it on your behalf.

What your key can reach

There are no scopes or permissions to configure. Your reseller ID defines what you can see: you can act on your own domains, contacts, certificates and hostings and nothing else. Asking about somebody else’s domain does not return “forbidden” — it returns not found, because from your key’s point of view it does not exist.