HF PanelAPI: team members and reseller addresses
List, invite, change, suspend and remove an account's team members, and read a reseller's own addresses through the token API.
These endpoints run the Team screen of the Control Panel and the Your panel address card of My brand. They use the same checks and messages, and every change is written to the activity log.
A=https://api.yourdomain.com:2087/v1
H="Authorization: Bearer hf_xxx"
Who may call them
| Token | Team endpoints | Reseller addresses |
|---|---|---|
| Customer | their own account | — |
| Reseller | their customers' accounts | themselves |
| Administrator | every account | every reseller |
| Scoped to a team role, or a team member's own token | never | — |
Changes need a Read & change token.
List the team
curl -s -H "$H" $A/accounts/sarahbakes/team
The answer has members (each with id, name, email, role, role_label, screens, status, two_factor,
last_login_at, created_at), the plan's limit (-1 = no limit) and how many are used.
GET /accounts/{username}/team/{id} reads one member.
Invite someone
curl -s -H "$H" -H "Content-Type: application/json" -X POST $A/accounts/sarahbakes/team \
-d '{"name":"Tom","email":"tom@example.com","role":"files"}'
| Field | What it is |
|---|---|
email |
required; one team login per email address on the panel |
role |
required: full, sites, webdns, files, email, databases, billing, readonly or custom |
screens |
for custom: the screens (routes), for example ["dns","email"] |
name |
optional, up to 80 characters |
They get the invitation email with a link to choose their password (48 hours). The plan's limit and the 20 invitations an hour apply. Answers 201 with the member.
Change, suspend or remove
curl -s -H "$H" -H "Content-Type: application/json" -X PATCH $A/accounts/sarahbakes/team/5 -d '{"role":"email"}'
curl -s -H "$H" -H "Content-Type: application/json" -X PATCH $A/accounts/sarahbakes/team/5 -d '{"status":"suspended"}'
curl -s -H "$H" -X DELETE $A/accounts/sarahbakes/team/5
status is suspended (signed out at once) or active (let in again). Removing a member also removes their
passkeys and their own API tokens.
Team members' own tokens
A team member can make API tokens for their own login on My login. Such a token can use only what the member's
role allows at the time of each call — /accounts/{username}/email/… for an email role, the DNS and domains for
Websites & DNS, and so on — and answers 401 as soon as the member is suspended or removed. What it changes is
logged with the member's name.
A reseller's own addresses
curl -s -H "$H" $A/resellers/brightweb/domain
curl -s -H "$H" -X POST $A/resellers/brightweb/domain/check
The answer has panel_host, website_url, webmail_host, files_host, sender_name, allowed (both privileges
given), brand_on, in_use (the panel address in use, or empty), checked_at and checks — per name its kind,
dns, addresses, cname, ssl, ssl_expires and error. POST …/domain/check checks the names live first.
Hook events
team.member_invited, team.member_changed, team.member_removed, reseller.domain_changed and
reseller.domain_verified — see Event hooks.