Overview
The Opterius Panel Module (moduleId = 'opterius') is Commerce's first-class provisioning module. It communicates with the Opterius Panel REST API to create, suspend, unsuspend, and terminate hosting accounts.
Authentication
Every request is authenticated with HMAC-SHA256 request signing — no plain bearer tokens.
Each request includes two headers:
| Header | Value |
|---|---|
X-Timestamp |
Current Unix timestamp (seconds) |
X-Signature |
HMAC-SHA256(timestamp + JSON body, api_token) |
The Panel verifies the timestamp is within an acceptable window (prevents replay attacks) and recomputes the signature. If either check fails, the Panel returns 401.
Credentials
Configure these fields when adding a server with module type opterius:
| Field | Description | Example |
|---|---|---|
api_url |
Panel base URL — no trailing slash | https://panel.example.com |
api_token |
Token from Panel → Settings → API | eyJ... |
The api_token is a secret field — it is masked on the edit form and never echoed back to the browser.
API Endpoints Used
| Action | Method | Endpoint |
|---|---|---|
| Create account | POST |
/api/accounts |
| Suspend account | POST |
/api/accounts/{id}/suspend |
| Unsuspend account | POST |
/api/accounts/{id}/unsuspend |
| Terminate account | DELETE |
/api/accounts/{id} |
| Get account info | GET |
/api/accounts/{id} |
| Test connection | GET |
/api/server/stats |
Account Creation Payload
When CreateHostingAccountJob fires, the module sends a POST /api/accounts request with the following JSON body:
| Field | Source |
|---|---|
username |
Auto-generated from the client's domain |
password |
Auto-generated secure random string |
domain |
The service's primary domain |
package |
The package name configured on the Commerce product |
email |
Client's email address |
disk_limit_mb |
From product configuration |
bandwidth_limit_mb |
From product configuration |
On success, the Panel returns the new account's id. Commerce stores this as panel_account_id on the service record for use in subsequent suspend/unsuspend/terminate calls.
Package Names
The package field must exactly match the package name configured in Opterius Panel — the comparison is case-sensitive. If the name doesn't match, the Panel returns a 422 error and the job fails.
To find the correct package name: log in to Panel → Packages → copy the exact name string.
Network Requirements
The Commerce server must be able to reach the Panel's api_url on port 443 (or the configured port). If the Panel server has a firewall, add the Commerce server's IP to the allowlist.
Suspend / Terminate Behavior
- Suspend: the hosting account is disabled on Panel — the site stops serving and FTP/SSH is blocked, but files are preserved.
- Terminate (
DELETE): the account is permanently deleted from Panel. All files, databases, and email accounts are destroyed. This is irreversible.