IMEI Locks Reseller API

HTTP headers
Authentication

Every request requires your confidential API secret in the X-API-Key header. Treat your API key as a password: it is stored hashed on our side and is shown exactly once when issued.

Copycurl -H "X-API-Key: sk_live_your_secret_key" \
  https://api.imeilocks.com/api/v1/me

Quota headers
Rate limits & live quota

Requests are limited to 60 requests per minute per API key. Live budget headers are returned on every response.

HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1788944424

Guarantees
Atomic settlement & zero-debit idempotency

Simulator
Price calculator

Pricing is a flat unit price per product: final_total = unit_price × quantity. Preview any order with GET /quote or below (needs a sandbox or live key from the console).

Endpoints

GET/api/v1/products — List available products

Returns the live catalogue with available stock per product. input_type is quantity (buy N units) or accounts (send one line per unit in items; input_hint shows the format). custom_pricing is true when the product is at or below its low-stock buffer (orders that dip into the buffer must send accept_normal_price: true).

Copycurl -X GET "https://api.imeilocks.com/api/v1/products" \
  -H "X-API-Key: YOUR_API_KEY"

Copyimport requests
r = requests.get("https://api.imeilocks.com/api/v1/products",
                 headers={"X-API-Key": "YOUR_API_KEY"}, timeout=15)
print(r.json())

Copyconst r = await fetch("https://api.imeilocks.com/api/v1/products",
  { headers: { "X-API-Key": "YOUR_API_KEY" } });
console.log(await r.json());

Response (200 OK)

{
  "currency": "USD",
  "rate": "1 USD = 100 INR (fixed)",
  "products": [
    {
      "service_id": "gemini_pro_1m",
      "name": "Gemini Pro 1 Month",
      "description": "",
      "input_type": "quantity",
      "input_hint": "",
      "stock": 482,
      "custom_pricing": false,
      "unit_price": 0.5,
      "pricing_tiers": [{ "min": 1, "max": null, "price": 0.5 }],
      "bulk_discounts": []
    }
  ]
}

GET/api/v1/me — Account profile & balance

Returns your account name, Telegram chat id (if linked) and active wallet balance in USD.

Copycurl -H "X-API-Key: YOUR_API_KEY" https://api.imeilocks.com/api/v1/me

{ "chat_id": 123456789, "name": "My Bot", "balance": 145.5, "currency": "USD", "mode": "live", "key_created_at": "2026-09-15T10:00:00Z" }

GET/api/v1/quote — Price quote preview

Validates the exact financials before submission: unit price, total, stock situation and whether your balance is sufficient. Nothing is committed.

Copycurl -H "X-API-Key: YOUR_API_KEY" \
  "https://api.imeilocks.com/api/v1/quote?service_id=gemini_pro_1m&quantity=500"

{
  "service_id": "gemini_pro_1m",
  "service_name": "Gemini Pro 1 Month",
  "quantity": 500,
  "stock": 482,
  "stock_warning": "Only 482 in stock. The order will be queued and fulfilled automatically once restocked.",
  "currency": "USD",
  "pricing": {
    "unit_price": 0.5, "slab_range": "1+", "base_total": 250.0,
    "bulk_discount_pct": 0, "bulk_discount_amount": 0.0,
    "final_total": 250.0, "price_source": "normal"
  },
  "fx": { "code": "INR", "rate": 100, "final_total": 25000.0 },
  "your_balance": 350.0,
  "sufficient_balance": true
}

POST/api/v1/order — Place automated order

Executes an atomic balance deduction and immediate digital product delivery. Always pass external_order_id for safe zero-duplicate retries.

Copycurl -X POST "https://api.imeilocks.com/api/v1/order" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"service_id": "gemini_pro_1m", "quantity": 2, "external_order_id": "bot_order_99812"}'

Copyimport requests
r = requests.post("https://api.imeilocks.com/api/v1/order",
    headers={"X-API-Key": "YOUR_API_KEY"},
    json={"service_id": "gemini_pro_1m", "quantity": 2, "external_order_id": "bot_order_99812"},
    timeout=30)
data = r.json()
if r.status_code in (200, 201):
    print(data["order_id"], data["status"], data["products"])
else:
    print("error:", data["error"], data["message"])

Copyconst r = await fetch("https://api.imeilocks.com/api/v1/order", {
  method: "POST",
  headers: { "X-API-Key": "YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ service_id: "gemini_pro_1m", quantity: 2, external_order_id: "bot_order_99812" })
});
const data = await r.json();

Account-based services (input_type: "accounts") — send the lines instead of a quantity:

Copycurl -X POST "https://api.imeilocks.com/api/v1/order" \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{
    "service_id": "extract_12m",
    "items": ["budi@gmail.com|Passw0rd!|JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP"],
    "external_order_id": "bot_order_99813"
  }'

Each delivered code is labelled with its account. Passwords and 2FA secrets are never echoed back: responses show "items": ["budi@gmail.com|••••|••••"].

Response (201 Created) — a replay of an existing external_order_id returns 200 with "idempotent_replay": true. Queued orders return "status": "queued" with an empty products array.

{
  "success": true,
  "order_id": "IL7K3M9QX2",
  "external_order_id": "bot_order_99812",
  "service_id": "gemini_pro_1m",
  "service_name": "Gemini Pro 1 Month",
  "quantity": 2,
  "status": "delivered",
  "total_cost": 1.0,
  "new_balance": 144.5,
  "currency": "USD",
  "price_breakdown": { "unit_price": 0.5, "slab_range": "1+", "base_total": 1.0, "bulk_discount_pct": 0, "bulk_discount_amount": 0.0, "final_total": 1.0, "price_source": "normal" },
  "created_at": "2026-09-15T10:00:00Z",
  "delivered_at": "2026-09-15T10:00:00Z",
  "products": ["KEY-GEMINI-A1904-8842", "KEY-GEMINI-B8912-7719"],
  "idempotent_replay": false
}

GET/api/v1/stats — Reseller account analytics

Order counts and USD spend for today, 7d, 30d and all-time, plus a per-product breakdown. Optional start / end (ISO 8601) add a range block and filter the breakdown.

Copycurl -H "X-API-Key: YOUR_API_KEY" "https://api.imeilocks.com/api/v1/stats?start=2026-09-01&end=2026-09-30"

{
  "orders":   { "today": 4, "7d": 28, "30d": 142, "all_time": 680 },
  "spending": { "today": 2.8, "7d": 18.2, "30d": 84.5, "all_time": 395.0 },
  "currency": "USD",
  "balance": 145.5,
  "range": { "start": "2026-09-01T00:00:00Z", "end": "2026-09-30T00:00:00Z", "orders": 140, "spending": 83.0 },
  "products_breakdown": [
    { "service_id": "gemini_pro_1m", "name": "Gemini Pro 1 Month", "orders": 120, "quantity_ordered": 540, "total_spent": 243.0 }
  ]
}

GET/api/v1/order/{order_id} — Single order status & codes

Fetches status, timestamps and delivered codes for any previous order by its order_id (your external_order_id is accepted too).

Copycurl -H "X-API-Key: YOUR_API_KEY" https://api.imeilocks.com/api/v1/order/IL7K3M9QX2

{
  "order_id": "IL7K3M9QX2", "external_order_id": "bot_order_99812",
  "service_id": "gemini_pro_1m", "service_name": "Gemini Pro 1 Month",
  "quantity": 2, "status": "delivered", "total_cost": 1.0, "currency": "USD",
  "price_breakdown": { … },
  "created_at": "2026-09-15T10:00:00Z", "delivered_at": "2026-09-15T10:00:00Z",
  "products": ["KEY-GEMINI-A1904-8842", "KEY-GEMINI-B8912-7719"]
}

Statuses: delivered (codes assigned), queued (charged, awaiting restock), failed (cancelled and fully refunded; see failed_reason).

GET/api/v1/orders — Paginated order history

Copycurl -H "X-API-Key: YOUR_API_KEY" "https://api.imeilocks.com/api/v1/orders?page=1&limit=20"

{
  "page": 1, "limit": 20, "total": 1, "has_more": false, "currency": "USD",
  "orders": [
    { "order_id": "IL7K3M9QX2", "external_order_id": "bot_order_99812", "service_id": "gemini_pro_1m",
      "service_name": "Gemini Pro 1 Month", "quantity": 2, "total_cost": 1.0, "status": "delivered",
      "created_at": "2026-09-15T10:00:00Z", "delivered_at": "2026-09-15T10:00:00Z" }
  ]
}

GET/api/v1/orders/export — Bulk order export (CSV / JSON)

Copycurl -H "X-API-Key: YOUR_API_KEY" \
  "https://api.imeilocks.com/api/v1/orders/export?format=csv" -o orders_export.csv

POST/api/v1/topup — Add funds (crypto)

Opens a SYNQ Pay Express checkout for your account. Send the amount to the address shown there; your wallet is credited automatically (minus the gateway fee) the moment the payment confirms — no support ticket, no waiting.

Copycurl -X POST "https://api.imeilocks.com/api/v1/topup" \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"amount": 50}'

{ "deposit_id": 12, "invoice_number": "INV-7QW2…", "checkout_url": "https://pay.synqapi.co/pay/INV-7QW2…",
  "amount": 50.0, "status": "pending", "asset": "USDT", "network": "BEP20", "currency": "USD",
  "message": "Send the exact amount to the checkout address. Your wallet is credited automatically once the payment confirms." }

GET /api/v1/topup/{deposit_id} re-checks one payment with the gateway and returns its status plus your new balance; GET /api/v1/topups lists the last 25.

POST/api/v1/keys/rotate — Self-service key rotation

Instantly revokes your existing key and issues a new secret. The previous key stops working immediately.

Copycurl -X POST "https://api.imeilocks.com/api/v1/keys/rotate" -H "X-API-Key: YOUR_OLD_API_KEY"

{ "success": true, "new_api_key": "sk_live_9f83a04b12c8e9f…", "message": "Your old key has been revoked. Store this new key securely." }

Real-time webhooks
Architecture & cryptographic verification

Webhooks remove polling. Whenever an order is delivered, queued or fails, we push a signed HTTPS POST to your endpoint (retried with backoff for up to 6 attempts: 1 m, 5 m, 30 m, 2 h, 6 h).

Payload

{ "event": "order.delivered", "delivery_id": 41, "created_at": "2026-09-15T10:00:01Z",
  "data": { "order_id": "IL7K3M9QX2", "external_order_id": "bot_order_99812", "status": "delivered", "quantity": 2,
            "total_cost": 1.0, "products": ["KEY-…", "KEY-…"], … } }

HMAC-SHA256 signature verification. Every delivery carries X-Webhook-Signature: sha256=<hex> (plus X-Webhook-Event and X-Webhook-Delivery). Verify with your webhook secret over the raw request body:

Copyimport hmac, hashlib

def verify_webhook(raw_payload_bytes, signature_header, webhook_secret):
    expected = "sha256=" + hmac.new(webhook_secret.encode(), raw_payload_bytes, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

Copyconst crypto = require("crypto");
function verifyWebhook(rawBody, signatureHeader, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

Copy$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);
$ok = hash_equals($expected, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '');

Respond with any 2xx status within 10 seconds. Anything else is retried.

POST/api/v1/webhooks — Register webhook endpoint

Copycurl -X POST "https://api.imeilocks.com/api/v1/webhooks" \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"url": "https://mybot.com/webhooks/orders", "events": ["order.delivered", "order.queued"]}'

{ "id": 1, "url": "https://mybot.com/webhooks/orders", "events": ["order.delivered", "order.queued"],
  "created_at": "2026-09-15T10:00:00Z", "active": true,
  "secret": "9a38f7b2c01824d67e89ab32c10f8231e57c6…",
  "note": "Store this secret securely — use it to verify webhook signatures (X-Webhook-Signature)." }

GET/api/v1/webhooks — List registered webhooks

Copycurl -H "X-API-Key: YOUR_API_KEY" https://api.imeilocks.com/api/v1/webhooks

DELETE/api/v1/webhooks/{id} — Delete webhook endpoint

Copycurl -X DELETE "https://api.imeilocks.com/api/v1/webhooks/1" -H "X-API-Key: YOUR_API_KEY"

{ "deleted": true, "id": 1 }

POST/api/v1/webhooks/test — Test delivery ping

Sends an instant signed test event to all your registered webhooks and returns the HTTP status each returned.

Copycurl -X POST "https://api.imeilocks.com/api/v1/webhooks/test" \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" -d '{"event": "order.delivered"}'

{ "event": "order.delivered", "test_results": [ { "webhook_id": 1, "url": "https://mybot.com/webhooks/orders", "status": 200, "success": true } ] }

Interactive developer console
Execute real and simulated requests

The sandbox gives you a free sk_test_ key with a $50.00 wallet: orders deliver SANDBOX-* codes and never touch live stock. Switch to live and paste your own key to hit production.

Status codes
Error reference catalog

Errors are JSON: {"error": "<key>", "message": "<human text>"}.

Panels & shops
DHRU Fusion compatible API

Run a DHRU / Fusion style panel? Add IMEI Locks as a supplier with three values — no coding. The same API key works for both APIs; get it from your account or the Telegram bot.

Actions

curl -X POST "https://api.imeilocks.com/api/index.php" \
  -d "username=you@example.com" -d "apiaccesskey=sk_live_your_key" \
  -d "action=placeserverorder" \
  -d "parameters=<PARAMETERS><ID>12</ID><QNT>2</QNT></PARAMETERS>"

{"SUCCESS":[{"MESSAGE":"Order received","REFERENCEID":"ILB3PKQGXQ","STATUS":4,"CODE":"KEY-1<br>KEY-2"}]}

Errors come back as {"ERROR":[{"MESSAGE":"…"}]} with HTTP 200, the way Fusion clients expect. Wrong credentials answer Authentication Failed.

Releases
API changelog

v1.0.0 — Production release (September 2026)

• Catalogue, account, quote, order, order status, paginated history, CSV/JSON export, analytics.
• Single-commit atomic settlement and external_order_id idempotent replays.
• Queued orders with automatic FIFO fulfilment on restock; cancellation with full refund.
• Webhooks engine (register, list, delete, test ping) with HMAC-SHA256 signatures and retry backoff.
• Self-service key rotation, live X-RateLimit-* headers, free sandbox environment.
• Crypto self-service top-ups through SYNQ Pay Express — wallet credited automatically on confirmation.