Veloxiom API Reference

Complete REST API documentation for the Veloxiom ISP Management Platform. Manage customers, billing, network, and integrations programmatically.

🔐 Authentication

Veloxiom exposes two distinct surfaces. Choose the right one for your integration:

REST API v1 — the public, programmatic API at /api/v1.php. Authenticated with a scoped API token (Bearer). This is what third-party integrations should use.
Panel / Mobile actions — the action-based endpoints at /mikrotik/process.php used internally by the admin panel and mobile apps. These require an authenticated admin session cookie (or a mobile app token) plus a CSRF token — they are not a Bearer API.

API Tokens (REST API v1)

Create scoped tokens in the panel under Admin → API & Webhooks. Each token is shown once (only a SHA-256 hash is stored), carries per-module scopes, supports an expiry, and can be revoked. A token is tenant-scoped — it only ever sees its own tenant's data.

# Send the token one of three ways (Bearer preferred):
Authorization: Bearer vlx_xxxxxxxxxxxxxxxxxxxxxxxx
X-Api-Token: vlx_xxxxxxxxxxxxxxxxxxxxxxxx
?token=vlx_xxxxxxxxxxxxxxxxxxxxxxxx
# Base URL (tenant resolved by host/slug)
https://{your-domain-or-slug}/api/v1.php
    

# Example: list customers (needs customers:view scope)
curl https://panel.veloxiom.com/{tenant}/api/v1.php?resource=customers&limit=3 \
  -H "Authorization: Bearer vlx_..."
    

Token Scopes

Each token grants per-module access at level none / view / write (write implies view). Endpoints require a specific scope; insufficient scope returns HTTP 403.

Scope module	Grants access to
customers	Customers / subscribers
plans	Service plans
billing	Invoices & billing
routers	Network devices / routers
monitoring	Monitoring data (can also read routers)
crm	Tickets & messaging (write required to send)

2FA (Two-Factor Authentication)

POST

action=start_2fa_enroll

Initiate TOTP 2FA enrollment — returns QR code and secret

POST

action=finish_2fa_enroll

Complete 2FA enrollment with verification code

POST

action=disable_own_2fa

Disable 2FA for current admin account

POST

action=reset_admin_2fa

Reset 2FA for another admin (requires admin password)

🔌 REST API v1 (Token)

The public read-first REST API. Send a GET with ?resource=<name> and a Bearer token. Responses are JSON with a top-level ok flag; list resources also return count and data. All queries use prepared statements and never expose passwords or router secrets.

Read Resources (GET)

GET

?resource=ping

Health check — no scope required. Returns {ok, pong, ts}.

GET

?resource=me

Returns the calling token's name and scopes. No scope required.

GET

?resource=customers

List subscribers. Scope: customers:view. Fields: username, name, email, phone. Supports q, limit, offset.

GET

?resource=customer&username=…

Single subscriber. Scope: customers:view. Fields: username, profile, rate_limit, meta{} (password/secret meta stripped).

GET

?resource=plans

List service plans. Scope: plans:view. Fields: id, name, rate_limit, price.

GET

?resource=invoices

List invoices. Scope: billing:view. Filters: status, q. Fields: id, number, customer, username, total, status, issue_date.

GET

?resource=routers

List network devices. Scope: routers:view OR monitoring:view. Fields: id, name, ip, hostname, site, role, health.

GET

?resource=tickets

List CRM tickets. Scope: crm:view. Filter: q. Fields: id, subject, customer, status, priority, created_at, updated_at.

GET

?resource=messages

List messages. Scope: crm:view. Filters: direction, channel, phone.

Mutations (POST)

POST

action=send_message

Send an outbound message. Scope: crm:write. Params: channel (default sms), to, text (or body), username. Emits the message.sent webhook.

Common Query Parameters

Parameter	Type	Description
resource / r	`string`	Resource name (see list above)
limit	`int`	Page size, 1–500 (default 100)
offset	`int`	Row offset for pagination (default 0)
q	`string`	Free-text search (customers/invoices/tickets)

Errors

HTTP	Body	Meaning
401	`{"ok":false,"error":"unauthorized"}`	Missing/invalid/revoked/expired token
403	`{"ok":false,"error":"insufficient_scope","need":"module:level"}`	Token lacks the required scope
404	`{"ok":false,"error":"unknown_resource"}`	No such resource
400	`{"ok":false,"error":"unknown_action"}`	Unknown POST action / missing required param
429	`{"ok":false,"error":"rate_limited"}`	Rate limit exceeded (120 req/min per token)

# Example response — GET ?resource=customers&limit=1
{
  "ok": true,
  "data": [
    { "username": "000001", "name": "...", "email": "...", "phone": "..." }
  ],
  "count": 1,
  "pagination": { "limit": 1, "offset": 0, "total": 128, "has_more": true, "next_offset": 1 },
  "meta": { "request_id": "req_5f3c…", "ts": "2026-08-15T01:20:00+00:00" }
}
    

Envelope, Pagination & Request IDs

Field	Description
`ok`	Always present. `true` on success, `false` on error.
`data`	The payload (array for lists, object for single resources).
`count`	Number of rows in the current response.
`pagination`	limit, offset, total, has_more, next_offset — on list resources.
`meta.request_id`	Per-call id, also returned as the `X-Request-Id` header (quote it in bug reports).

Errors stay flat for backward compatibility ({ok:false,error:"…"}). Send envelope=2 for a structured error: {ok:false,error:{code,message,details},meta:{request_id}}. Validation failures return 422. Callers still using ?token=… receive Deprecation/Sunset headers — prefer Authorization: Bearer or X-Api-Token.

Field values

`invoice.status`	`unpaid · paid · partial · overdue · cancelled`
`message.channel`	`sms · viber · whatsapp`

Machine-readable spec (OpenAPI)

api/v1.php?resource=openapi returns an OpenAPI 3.0.3 document for your tenant — load it into Postman, Insomnia or a client generator.

👥 Customers / Subscribers (panel/mobile session action)

Manage ISP subscribers — create, edit, delete, and control service status.

POST

action=add

Create a new customer/subscriber with PPPoE/DHCP credentials, service plan, and contact details

POST

action=edit

Update existing customer details — username, plan, speed, contact info, custom fields

POST

action=delete

Delete a customer and associated RADIUS/MikroTik entries

POST

action=toggle_status

Enable/disable a customer service (suspend/unsuspend)

POST

action=save_billing_customer

Save billing-specific settings for a customer (billing cycle, tax info, payment method)

POST

action=aade_lookup

Lookup customer tax info from AADE (Greek Tax Authority) by VAT number

Customer Parameters

Parameter	Type	Description
username	`string`	PPPoE/DHCP username (unique)
password	`string`	PPPoE password
fullname	`string`	Customer full name
email	`string`	Email address
phone	`string`	Phone number
plan	`string`	Service plan name
address	`string`	Installation address
afm	`string`	VAT number (ΑΦΜ) for billing
static_ip	`string`	Static IP assignment (optional)
mac_address	`string`	MAC address for DHCP binding

📋 Service Plans

Create and manage internet service plans with speed profiles, pricing, and FUP policies.

POST

action=add_plan

Create a new service plan with speed limits, price, and MikroTik queue parameters

POST

action=edit_plan

Update an existing service plan

POST

action=delete_plan

Delete a service plan (fails if customers are assigned)

Plan Parameters

Parameter	Type	Description
name	`string`	Plan name (e.g. 'FTTH 100Mbps')
download	`string`	Download speed (e.g. '100M')
upload	`string`	Upload speed (e.g. '10M')
price	`float`	Monthly price (EUR)
burst_limit	`string`	MikroTik burst limit
burst_threshold	`string`	Burst threshold
burst_time	`string`	Burst time duration
priority	`int`	Queue priority (1-8)

💰 Billing & Invoicing

Automated billing engine with invoice generation, status tracking, and batch operations.

POST

action=save_billing_settings

Configure global billing settings — tax rates, billing cycles, invoice numbering, company details

POST

action=generate_invoices_month

Generate invoices for all customers in a billing month

POST

action=create_invoice_manual

Create a manual/ad-hoc invoice for a specific customer

POST

action=invoice_set_status

Update invoice status (paid, unpaid, cancelled, overdue)

POST

action=delete_invoice

Delete an invoice (restricted for submitted e-invoices)

💳 Payments

Process payments via multiple gateways — DIAS interbank, Revolut, Stripe, Viva Wallet, PayPal.

POST

action=pay_invoice

Process payment for a specific invoice

POST

action=customer_bulk_pay

Bulk payment — pay all outstanding invoices for a customer

POST

action=manual_retry_charge

Retry a failed automatic payment charge

Supported Payment Gateways

Gateway	Type	Description
DIAS	`bank`	Greek interbank payment system (RF codes)
Revolut	`online`	Online card payments via Revolut Business
Stripe	`online`	International card & subscription payments
Viva Wallet	`online`	Greek/EU card payments
PayPal	`online`	PayPal payments

📄 e-Invoicing (AADE / myDATA)

Submit invoices electronically to AADE myDATA. Supports multiple e-invoicing providers.

POST

action=einvoicing_submit_now

Submit invoice to AADE myDATA via configured provider

GET

action=einvoicing_history

Check submission status (MARK, UID, validation errors)

Supported e-Invoicing Providers

Provider	Status	Description
myDATA (AADE)	`active`	Direct AADE API submission
Elorus	`active`	Elorus ERP & e-invoicing platform
IMPACT	`coming soon`	IMPACT e-invoicing provider
Primer (Cosmos)	`coming soon`	Primer/Cosmos e-invoicing
Retail@Link	`coming soon`	Retail@Link e-invoicing
Edpsoft	`coming soon`	Edpsoft e-invoicing

📡 RADIUS / PPPoE / DHCP

FreeRADIUS integration for PPPoE and DHCP authentication, CoA (Change of Authorization), and session management.

PPPoE/DHCP authentication is fully active. The on-demand session/CoA actions below are on the roadmap and not yet exposed as HTTP actions.

GET

action=radius_sessions

List all active RADIUS sessions with traffic stats

POST

action=radius_disconnect

Disconnect a RADIUS session (send CoA Disconnect-Request)

POST

action=radius_coa

Send CoA to update speed/attributes without disconnect

🔧 MikroTik Routers

Manage MikroTik RouterOS devices — add, configure, monitor, and execute API commands.

GET

action=get_routers

List all configured routers with connection status

GET

action=list_routers_ui

Router list with extended UI metadata (uptime, version, CPU, RAM)

POST

action=add_router

Add a new MikroTik router (IP, API credentials, RADIUS secret)

POST

action=edit_router

Update router configuration

POST

action=delete_router

Remove a router and clean up RADIUS/firewall rules

POST

action=switch_router

Switch active router context (for multi-router setups)

Router Parameters

Parameter	Type	Description
ip	`string`	Router management IP address
name	`string`	Router display name
user	`string`	RouterOS API username
pass	`string`	RouterOS API password
radius_ip	`string`	RADIUS NAS IP (defaults to management IP)
radius_secret	`string`	RADIUS shared secret

🌐 Network Settings

POST

action=save_network_settings

Configure IP pools, VLAN settings, OSPF, VPLS, and routing parameters

🗺️ Topology & Maps

Network topology visualization with 2D/3D maps. Supports multiple monitoring backends.

POST

action=save_topology_metrics_source

Configure topology data source — LibreNMS, Observium, Zabbix, or MikroTik direct

Supported Monitoring Backends

Backend	Protocol	Description
LibreNMS	`REST API`	Open-source network monitoring
Observium	`REST API`	Network monitoring platform
Zabbix	`JSON-RPC`	Enterprise monitoring solution
MikroTik	`RouterOS API`	Direct router SNMP/API polling

📦 Device Inventory (IPAM)

IP Address Management and network device inventory with approval workflows.

POST

action=save_inventory_node

Add or update an inventory node (name, IP, type, location, notes)

POST

action=approve_inventory_node

Approve a pending inventory node

POST

action=approve_inventory_all

Bulk approve all pending inventory nodes

POST

action=delete_inventory_node

Delete a single inventory node

POST

action=delete_inventory_bulk

Bulk delete inventory nodes (all_pending, all_approved, or all)

📊 SNMP Monitoring

Real-time network monitoring via SNMP. Collect bandwidth, latency, and interface metrics from routers and switches.

Monitoring runs via scheduled collectors and Grafana dashboards. The on-demand actions below are on the roadmap and not yet exposed as HTTP actions.

GET

action=snmp_collect

Trigger SNMP data collection cycle for all monitored devices

GET

action=router_health

Get router health metrics — CPU, memory, temperature, disk, uptime

📞 VoIP / Telephony (MOR)

MOR/M2 telephony integration — SIP trunk management, CDR records, tariffs, balance management, and VoIP billing.

GET

action=mor_balance_get

Get VoIP account balance and credit info

GET

action=mor_cdr_list_local

Retrieve Call Detail Records with filters (date, number, duration)

GET

action=mor_tariffs_list_local

List available VoIP tariff plans

POST

action=mor_topup_invoice_create

Add credit/balance to a VoIP account

POST

action=mor_create_remote_user

Provision new SIP accounts and assign DID numbers

🔒 WireGuard VPN

POST

action=router_wg_provision

Provision WireGuard VPN tunnel — generate keys, configure peer on MikroTik

🎫 Helpdesk / Tickets

Customer support ticket system with assignment, priorities, and status tracking.

POST

action=crm_tickets

List/search support tickets (status, priority, assignee filters)

POST

action=ticket_create

Create a new support ticket

POST

action=ticket_view

View a ticket with its replies and notes

POST

action=ticket_reply

Post a reply to a ticket

POST

action=crm_tickets_bulk

Bulk update tickets — status change, assignment, priority, close/delete

🤖 AI Assistant

POST

action=save_ai_settings

Configure AI assistant — model selection (GPT-4o, GPT-4o-mini), API key, behavior

🔔 Notifications

Multi-channel notification system — Telegram, Email, Push notifications.

POST

action=save_telegram_settings

Configure the Telegram notification channel (bot token, chat id)

POST

action=incident_notify

Send an incident notification through the configured channels

POST

action=admin_save_notif_overrides

Set per-admin notification override preferences

👤 Admin Management

POST

action=add_web_admin

Create a new admin account with role-based permissions

POST

action=edit_web_admin

Update admin account (password, permissions, role)

POST

action=delete_web_admin

Delete admin account (cannot delete primary admin)

🏢 Multi-Tenant

Multi-tenant architecture — each tenant is an isolated ISP instance with its own database, domain, branding, and configuration.

Tenant provisioning is a super-admin operation performed from the control panel; it runs the full pipeline (database, schema, RADIUS, WireGuard/NPM, captive portal) internally with rollback on failure.

POST

action=provision

Super-admin: provision a new tenant (database, schema, RADIUS, WireGuard/NPM, captive portal)

⚙️ System Settings

POST

action=save_settings

Save general system settings — company info, logo, favicon, timezone, language, theme

🔗 Webhooks

Receive real-time notifications when events occur in Veloxiom. Configure outbound webhooks in the panel under Admin → API & Webhooks. The signing secret (whsec_…) is shown once at creation.

Available Events

Event	Description
message.received	An inbound message (SMS/other channel) arrived
message.sent	An outbound message was dispatched (e.g. via API send_message)
ping	Test event sent from the admin UI
*	Subscribe to all current and future events

Additional business events (customer.*, invoice.*, ticket.*, router.*) are on the roadmap and not yet emitted.

Delivery & Signature

Each delivery is an HTTPS POST with a JSON body. Verify authenticity with the HMAC-SHA256 signature computed over the raw request body using your webhook secret. Only public HTTPS URLs are accepted (loopback/private/CGNAT ranges are rejected — SSRF protection).

# Delivery headers
Content-Type: application/json
X-Veloxiom-Event: message.sent
X-Veloxiom-Signature: sha256=<hex hmac-sha256 of raw body>
# Body shape
{ "event": "ping", "ts": "2026-06-17T12:00:00+00:00", "data": { ... } }

# Verify (PHP)
$expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
if (hash_equals($expected, $_SERVER['HTTP_X_VELOXIOM_SIGNATURE'])) { /* trusted */ }
    

🏗️ ERP Integrations

Connect Veloxiom with your ERP system for synchronized billing, customer data, and financial reporting.

ERP	Status	Integration Type
Elorus	`active`	Full sync — invoices, customers, payments
SoftOne	`coming soon`	REST API integration
Epsilon Net	`coming soon`	REST API integration
Entersoft	`coming soon`	REST API integration
Galaxy / Real	`coming soon`	REST API integration
QuickBooks Online	`beta`	OAuth2 — customers, invoices, payments via sync queue
Xero	`beta`	OAuth2 — customers, invoices, payments via sync queue
1C:Enterprise	`beta`	OData — customers, invoices, payments via sync queue

📨 Response Format

All API responses return JSON. Successful operations include ok: true.

// Success response
{
  "ok": true,
  "data": { ... }
}

// Error response
{
  "ok": false,
  "error": "missing_username"
}
    

⏱️ Rate Limits

Scope	Limit	Window
REST API v1 token	`120 requests`	per minute, per token (HTTP 429 on excess)

Need Help?

For API support and custom integration assistance, contact us via the contact form.

Veloxiom API Reference

API Sections

🔐 Authentication

API Tokens (REST API v1)

Token Scopes

2FA (Two-Factor Authentication)

🔌 REST API v1 (Token)

Read Resources (GET)

Mutations (POST)

Common Query Parameters

Errors

Envelope, Pagination & Request IDs

Field values

Machine-readable spec (OpenAPI)

👥 Customers / Subscribers (panel/mobile session action)

Customer Parameters

📋 Service Plans

Plan Parameters

💰 Billing & Invoicing

💳 Payments

Supported Payment Gateways

📄 e-Invoicing (AADE / myDATA)

Supported e-Invoicing Providers

📡 RADIUS / PPPoE / DHCP

🔧 MikroTik Routers

Router Parameters

🌐 Network Settings

🗺️ Topology & Maps

Supported Monitoring Backends

📦 Device Inventory (IPAM)

📊 SNMP Monitoring

📞 VoIP / Telephony (MOR)

🔒 WireGuard VPN

🎫 Helpdesk / Tickets

🤖 AI Assistant

🔔 Notifications

👤 Admin Management

🏢 Multi-Tenant

⚙️ System Settings

🔗 Webhooks

Available Events

Delivery & Signature

🏗️ ERP Integrations

📨 Response Format

⏱️ Rate Limits

Need Help?