API Documentation

Introduction

The AccsZone API is a RESTful API that uses JSON for request and response bodies. All endpoints are prefixed with /api/v1 and all of them require an API key.

📦 Response Format

Every response carries a boolean success. On success the payload is in data; on failure you get a machine-readable error_code and a human-readable message. Branch on success and error_code, never on the wording of message — that text can change.

200 Success

{
    "success": true,
    "data": { ... },
    "meta": { ... }        // paginated endpoints only
}

4xx Error

{
    "success": false,
    "error_code": "insufficient_stock",
    "message": "Insufficient stock. Available: 12",
    "errors": { ... }      // validation failures only (422)
}

⚠️ One exception

Authentication failures (401 / 403) are produced before the request reaches the API and return only success and message — no error_code. Treat a missing error_code on a 401/403 as an auth problem.

💵 Money & dates

All monetary values are returned as strings with two decimals ("5.00") so no precision is lost in JSON parsing — convert them yourself before arithmetic. Dates are noted per endpoint: some are full ISO 8601 timestamps, some are date-only YYYY-MM-DD.

Authentication

The API uses API key authentication. Generate a key from your dashboard and send it in the X-API-Key header on every request. There is no OAuth flow and no session — the header is the whole of it.

🔑 API Key Header

Include in all requests:
X-API-Key: YOUR_API_KEY

⚠️ Key Security

Your API key is shown only once when created — we store only a SHA-256 hash and cannot recover it for you. Store it securely. You can hold up to 5 keys and set an optional expiry on each from your API Details dashboard. AccsZone keys begin with acz_.

A request is rejected before it reaches any endpoint if any of the following is true:

Status	Reason
401	No `X-API-Key` header was sent.
401	The key is unknown, revoked, or past its expiry date.
403	The key does not belong to this platform.
403	API access is not enabled on your account — contact support.
403	Your account has been deactivated.

Pagination

Four endpoints return collections. Each adds a meta object alongside data, and each takes a page query parameter.

Endpoint	Page size	Adjustable?
`GET /api/v1/categories`	20	No — fixed
`GET /api/v1/categories/{id}/subcategories`	20	No — fixed
`GET /api/v1/listings`	20	No — fixed
`GET /api/v1/orders`	20	Yes — `per_page`, max 50

📄 The `meta` block

current_page — the page you are on · per_page — rows in this page · last_page — highest page number · total — rows matching your filters across all pages. Keep requesting page+1 until current_page === last_page.

⚠️ `per_page` on the catalogue endpoints

The three catalogue endpoints always return 20 rows per page. Sending ?per_page=50 there is not an error — it is simply ignored, and meta.per_page will come back as 20. Only /orders honours per_page.

🔁 Walking every page safely

Results are ordered on a unique tiebreaker, so paging through the whole catalogue visits every row exactly once — no duplicates, no silently skipped rows. A page requested beyond last_page returns an empty data array rather than an error. Note that listings are live inventory: stock and prices can change between page 1 and page 62.

Rate Limiting

Rate limiting applies to the four catalogue browsing endpoints only. Every other endpoint — purchases, order lookups, balance, profile, promo validation — is not rate limited.

30

Requests per minute, shared across the four catalogue endpoints below

∞

All other endpoints — no limit

Endpoint	Limit
`GET /api/v1/categories`	30 / minute
`GET /api/v1/categories/{id}/subcategories`	30 / minute
`GET /api/v1/listings`	30 / minute
`GET /api/v1/listings/{slug}`	30 / minute
Everything else — `/user/profile`, `/user/balance`, `/purchase`, `/orders`, `/orders/{id}`, `/promo/validate` — has no rate limit.

🪣 One bucket per account

The 30 requests are shared across all four endpoints and across all of your API keys. The bucket is keyed to your account, not to the key or to your IP address, so rotating keys or calling from several servers does not raise your ceiling — and another reseller sharing your datacentre's IP can never consume your allowance.

⏱️ Rolling window

The window is a rolling 60 seconds from your first counted request, not a clock minute. Read Retry-After on a 429 for the exact number of seconds to wait — do not assume 60.

429 Rate limit exceeded

Retry-After: 44
X-RateLimit-Limit: 30
X-RateLimit-Remaining: 0

{
    "success": false,
    "error_code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Catalogue endpoints allow 30 requests per minute. Retry after 44 seconds."
}

💡 Staying under the limit

Cache categories and subcategories — they change rarely. To mirror the full catalogue, walk /listings page by page rather than fetching /listings/{slug} per item, and pass ?include=description so one pass gives you everything. At 20 rows a page and 30 requests a minute you can read 600 listings per minute.

Errors & Status Codes

The API uses standard HTTP status codes. Where a failure is specific to the API, an error_code string accompanies it — branch on that rather than on the status code alone.

Code	Meaning	Description
200	OK	Request succeeded
201	Created	Purchase completed and the order was created
400	Bad Request	Business rule rejected the request (stock, balance, promo)
401	Unauthorized	Missing, unknown, revoked or expired API key
403	Forbidden	API access disabled, account deactivated, or key not valid for this platform
404	Not Found	Category, listing or order does not exist (or is not yours)
409	Conflict	`client_reference` already used by a different account
422	Validation Error	Request body failed validation — see the `errors` object
429	Too Many Requests	Catalogue rate limit exceeded
500	Server Error	Internal error — safe to retry a read; see the note below for purchases

error_code values

error_code	Status	What it means
`validation_failed`	422	Body failed validation. The `errors` object lists the offending fields.
`category_not_found`	404	No active main category with that ID.
`listing_not_found`	404	No active listing with that slug.
`listing_unavailable`	404	The listing you tried to purchase is no longer on sale.
`insufficient_stock`	400	Fewer units in stock than requested. The response includes `available` and `requested`.
`insufficient_accounts`	400	Stock count and deliverable accounts disagree; fewer accounts could actually be handed over. Retry with a smaller quantity.
`insufficient_balance`	400	Your balance does not cover the order. Top up and retry.
`promo_invalid`	400	Promo code is unknown, expired, or not applicable to this amount.
`client_reference_conflict`	409	That `client_reference` UUID belongs to another account's order. Generate a fresh UUID.
`order_not_found`	404	No such order, or it belongs to another account.
`rate_limit_exceeded`	429	Catalogue limit hit. Wait `Retry-After` seconds.
`profile_update_failed`	500	Profile could not be saved.
`promo_validation_failed`	500	Promo check could not be completed.
`internal_error`	500	Unexpected failure during a purchase. See the warning below.

⛔ Retrying a failed purchase

A purchase is executed inside a database transaction, so a 4xx or 500 means nothing was charged and no accounts were handed over. A timeout or dropped connection is different — the order may have completed after you stopped listening. Always send a client_reference on /purchase so a retry returns the original order instead of buying twice. See the Purchase endpoint for details.

Response Headers

Headers worth reading on every response.

Header	On	Meaning
`X-Request-Id`	Every response	A UUID identifying this exact call in our logs. Log it. Quoting it in a support ticket lets us find the precise request rather than guessing from a timestamp.
`X-RateLimit-Limit`	Catalogue endpoints	Your ceiling for the window — `30`.
`X-RateLimit-Remaining`	Catalogue endpoints	Requests left in the current window. Slow down as this nears zero.
`Retry-After`	429 only	Seconds to wait before the next catalogue request will be accepted.

ℹ️ Note

The X-RateLimit-* headers appear only on the four rate-limited catalogue endpoints. Their absence on /purchase or /orders is expected — those endpoints have no limit to report.

User Endpoints

Read and update your account profile, and check your spendable balance. Not rate limited.

GET /api/v1/user/profile 🔒 Get user info ▼

Retrieve your account profile, including the balance the API will spend on purchases. Fields you have never filled in come back as null rather than being omitted.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Example Request

curl https://accszone.com/api/v1/user/profile \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": {
        "id": 20,
        "name": "John",
        "lname": "Doe",
        "email": "[email protected]",
        "phone": "+1234567890",
        "address": "123 Main St",
        "country": "US",
        "balance": "86.00",
        "skype": null,
        "telegram": "@johndoe",
        "whatsApp": null,
        "member_since": "2023-10-03T00:00:00.000000Z"
    }
}

PUT /api/v1/user/profile 🔒 Update profile ▼

Update your profile. Every field is optional — send only the ones you want to change; omitted fields are left untouched. Email cannot be changed through the API.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Parameters

Name	Type	Required	Description
name	string	Optional	First name (max 255)
lname	string	Optional	Last name (max 255)
phone	string	Optional	Phone number (max 20)
address	string	Optional	Address (max 500)
country	string	Optional	Country (max 100)
skype	string	Optional	Skype handle (max 255)
telegram	string	Optional	Telegram handle (max 255)
whatsApp	string	Optional	WhatsApp number (max 255). Note the capital A.

Example Request

curl -X PUT https://accszone.com/api/v1/user/profile \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"John","phone":"+1234567890"}'

Example Response

200 Success

{
    "success": true,
    "message": "Profile updated successfully"
}

422 Validation failed

{
    "success": false,
    "error_code": "validation_failed",
    "message": "Validation failed",
    "errors": {
        "phone": ["The phone must not be greater than 20 characters."]
    }
}

GET /api/v1/user/balance 🔒 Check balance ▼

Get your current spendable balance. This is the figure a purchase is checked against. Cheaper than /user/profile if balance is all you need, and not rate limited — safe to poll before each order.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Example Request

curl https://accszone.com/api/v1/user/balance \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": {
        "balance": "86.00"
    }
}

Category Endpoints

Browse the category tree. Both endpoints are paginated at 20 per page and share the 30 requests/minute catalogue limit. Categories change rarely — cache them.

GET /api/v1/categories 🔒 30/min List all categories ▼

Retrieve active main categories, 20 per page. Disabled categories are never returned. Use the id from here as the category_id filter on /listings.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

⏱️ Rate limited — 30 requests/minute

Shares one per-account bucket with the other three catalogue endpoints. See Rate Limiting.

Parameters

Name	Type	Required	Description
page	integer	Optional	Page number (default: 1)

Example Request

curl "https://accszone.com/api/v1/categories?page=1" \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": [
        {
            "id": 22,
            "title": "Facebook Accounts",
            "slug": "buy-facebook-accounts",
            "image": "https://accszone.com/uploads/facebook.png"
        }
    ],
    "meta": {
        "current_page": 1,
        "last_page": 4,
        "per_page": 20,
        "total": 66
    }
}

GET /api/v1/categories/{id}/subcategories 🔒 30/min By category ▼

List active subcategories under one main category, 20 per page. The meta block describes data.subcategories — the category object is not paginated. Disabled subcategories are never returned.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

⏱️ Rate limited — 30 requests/minute

Shares one per-account bucket with the other three catalogue endpoints. See Rate Limiting.

Parameters

Name	Type	Required	Description
id	integer	Required	Main category ID (URL segment)
page	integer	Optional	Page number (default: 1)

Example Request

curl https://accszone.com/api/v1/categories/22/subcategories \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": {
        "category": { "id": 22, "title": "Facebook Accounts" },
        "subcategories": [
            { "id": 129, "title": "USA Facebook", "slug": "buy-usa-facebook-accounts" },
            { "id": 146, "title": "Facebook With Friends", "slug": "facebook-accounts-with-friends" }
        ]
    },
    "meta": {
        "current_page": 1,
        "last_page": 1,
        "per_page": 20,
        "total": 15
    }
}

404 Unknown or disabled category

{
    "success": false,
    "error_code": "category_not_found",
    "message": "Category not found"
}

Listing Endpoints

Browse live inventory. Both endpoints are rate limited at 30 requests/minute (shared with the category endpoints). Stock and prices are live and change constantly — treat anything you cache as a hint, and let /purchase be the authority.

GET /api/v1/listings 🔒 30/min Browse all ▼

Browse active listings with filtering, search and sorting. Always 20 per page — per_page is not honoured here. Listings with zero stock are still returned; check available_stock before purchasing.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

⏱️ Rate limited — 30 requests/minute

Shares one per-account bucket with the other three catalogue endpoints. See Rate Limiting.

Parameters

Name	Type	Required	Description
category_id	integer	Optional	Filter by main category ID
subcategory_id	integer	Optional	Filter by subcategory ID
search	string	Optional	Case-insensitive substring match on the listing title
sort	string	Optional	sort_key (default), total_price, available_stock or title. Any other value falls back to sort_key.
direction	string	Optional	asc (default) or desc
include	string	Optional	Comma-separated extras. Only description is supported. Omitted by default because descriptions are large.
page	integer	Optional	Page number (default: 1)

Example Request

curl "https://accszone.com/api/v1/listings?category_id=22&search=facebook&page=1" \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": [
        {
            "id": 623,
            "title": "GMX Accounts | 2 Days to 2 Weeks Old",
            "slug": "gmx-accounts-2-days-to-2-weeks-old-fresh",
            "price": "0.44",
            "available_stock": 1433,
            "sold": 1066,
            "sort_key": 0,
            "category": { "id": 35, "title": "GMX Email Accounts", "slug": "buy-gmx-accounts" },
            "subcategory": { "id": 54, "title": "Mail", "slug": "mail" }
        }
    ],
    "meta": {
        "current_page": 1,
        "last_page": 62,
        "per_page": 20,
        "total": 1238
    }
}

GET /api/v1/listings/{slug} 🔒 30/min Single listing ▼

Get one listing by slug. Identical to a row from /listings plus description and supplier. If you are syncing many listings, use /listings with ?include=description instead — one request per 20 listings rather than one per listing.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

⏱️ Rate limited — 30 requests/minute

Shares one per-account bucket with the other three catalogue endpoints. See Rate Limiting.

Parameters

Name	Type	Required	Description
slug	string	Required	Listing slug (URL segment) — the slug field from /listings, not the numeric id

Example Request

curl https://accszone.com/api/v1/listings/hotmail-accounts-pop3-smtp-imap-activated \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": {
        "id": 64,
        "title": "Buy Hotmail/Outlook Accounts | POP3, SMTP, IMAP Enabled",
        "slug": "hotmail-accounts-pop3-smtp-imap-activated",
        "price": "0.10",
        "available_stock": 6200,
        "sold": 17638,
        "sort_key": 1,
        "category": { "id": 28, "title": "Outlook Email Accounts", "slug": "buy-outlook-accounts" },
        "subcategory": { "id": 44, "title": "POP3", "slug": "new-hotmail-outlook-accounts" },
        "description": "<p>Looking for high-quality Outlook accounts...</p>",
        "supplier": { "name": "AccsZone" }
    }
}

404 Unknown, disabled or unapproved listing

{
    "success": false,
    "error_code": "listing_not_found",
    "message": "Listing not found"
}

Order Endpoints

Place orders and read your order history. None of these endpoints is rate limited — you will never be told to slow down while buying.

POST /api/v1/purchase 🔒 Buy accounts ▼

Purchase accounts from a listing. The cost is deducted from your balance and the credentials are returned in the same response — there is no separate fulfilment step. The whole operation runs in one database transaction: either you are charged and receive the accounts, or nothing happens at all.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Parameters

Name	Type	Required	Description
ad_id	integer	Required	Listing ID (the id field from /listings, not the slug)
quantity	integer	Required	How many accounts to buy (minimum 1)
promo_code	string	Optional	Promotional code. An invalid code fails the whole purchase — validate it first with /promo/validate.
client_reference	uuid	Optional	Idempotency key. A UUID you generate. Retrying with the same value returns the original order instead of buying again. Strongly recommended.

Notes

🔑 Always send a client_reference — Generate a fresh UUID v4 per intended purchase and reuse it on every retry of that purchase. Without one, a network timeout leaves you unable to tell whether the order went through — and a blind retry buys twice. With one, the retry returns the original order and charges nothing. A successful first call answers 201; a replay answers 200 with "replayed": true, so you can distinguish them. Two simultaneous retries are safe: one wins and the other is handed the winner's order.
📦 Account format — The accounts array contains raw credential strings exactly as the supplier provided them. The separator and field order vary per listing — many are email:password, others add tokens, e.g. email:password:refresh_token:client_id. The listing description states the format. Do not assume a fixed shape across listings.
🔒 Refunded or replaced accounts — On a purchase retry, credentials for accounts that have since been refunded or replaced are returned as ********. Retrying does not restore access to those accounts.
⚠️ Failures — insufficient_stock (400) includes available and requested so you can retry smaller. insufficient_accounts (400) means stock said more than could actually be delivered. insufficient_balance (400) means top up first. listing_unavailable (404) means the listing was pulled from sale. In every one of these cases you have not been charged.

Example Request

curl -X POST https://accszone.com/api/v1/purchase \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ad_id":64,"quantity":2,"client_reference":"3f8a1c22-9e4b-4f2a-bd51-0c7e5a9d1234"}'

Example Response

201 Success

{
    "success": true,
    "message": "Purchase successful",
    "data": {
        "order_id": 42,
        "listing": "Buy Hotmail/Outlook Accounts",
        "quantity": 2,
        "amount": "0.20",
        "discount": "0.00",
        "new_balance": "85.80",
        "accounts": [
            "[email protected]:password123",
            "[email protected]:password456"
        ],
        "purchased_at": "2026-10-07T14:30:00+00:00"
    }
}

200 Idempotent replay — same client_reference sent again

{
    "success": true,
    "message": "Purchase already processed for this client_reference",
    "data": {
        "order_id": 42,
        "listing": "Buy Hotmail/Outlook Accounts",
        "quantity": 2,
        "amount": "0.20",
        "discount": "0.00",
        "new_balance": "85.80",
        "accounts": ["[email protected]:password123", "[email protected]:password456"],
        "purchased_at": "2026-10-07T14:30:00+00:00",
        "replayed": true
    }
}

GET /api/v1/orders 🔒 Order history ▼

List your orders, newest first. This is the one paginated endpoint that honours per_page. Credentials are not included here — fetch them from /orders/{id}.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Parameters

Name	Type	Required	Description
per_page	integer	Optional	Rows per page (default: 20, max: 50). Values above 50 are capped, not rejected.
page	integer	Optional	Page number (default: 1)

Notes

📅 Date format differs from /purchase — purchased_at here and on /orders/{id} is date-only (YYYY-MM-DD). The /purchase response returns a full ISO 8601 timestamp. If you need the exact time of an order, record it from the purchase response — it is not recoverable from the history endpoints.
↩️ Refunds — is_refund is true when the order has been refunded. The amount stays at the original value; it is not negated.

Example Request

curl "https://accszone.com/api/v1/orders?per_page=50" \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": [
        {
            "id": 42,
            "listing": "Buy Hotmail/Outlook Accounts",
            "category": "Outlook Email Accounts",
            "subcategory": "POP3",
            "quantity": 2,
            "amount": "0.20",
            "discount": "0.00",
            "is_refund": false,
            "purchased_at": "2026-10-07"
        }
    ],
    "meta": {
        "current_page": 1,
        "last_page": 3,
        "per_page": 50,
        "total": 125
    }
}

GET /api/v1/orders/{id} 🔒 With accounts ▼

Get one order including the purchased credentials. Refunded or replaced accounts return ******** instead of access details; active accounts remain available. The accounts array keeps the same number of entries. Orders belonging to other accounts return 404, not 403.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Parameters

Name	Type	Required	Description
id	integer	Required	Order ID (URL segment)

Example Request

curl https://accszone.com/api/v1/orders/42 \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

200 Success

{
    "success": true,
    "data": {
        "id": 42,
        "listing": "Buy Hotmail/Outlook Accounts",
        "category": "Outlook Email Accounts",
        "subcategory": "POP3",
        "quantity": 2,
        "amount": "0.20",
        "discount": "0.00",
        "is_refund": false,
        "accounts": [
            "[email protected]:password123",
            "[email protected]:password456"
        ],
        "purchased_at": "2026-10-07"
    }
}

404 No such order, or not yours

{
    "success": false,
    "error_code": "order_not_found",
    "message": "Order not found"
}

Promo Endpoints

Check a promotional code before committing to a purchase. Not rate limited.

POST /api/v1/promo/validate 🔒 Check promo code ▼

Validate a promo code against an amount and preview the discount. This does not reserve or consume the code. Worth calling first: passing an invalid promo_code to /purchase fails the entire order.

🔒 API Key Required

Include X-API-Key: YOUR_API_KEY header.

Parameters

Name	Type	Required	Description
code	string	Required	Promotional code
amount	number	Required	Order subtotal to apply the code against (minimum 0.01)

Notes

ℹ️ Rejected codes are a 400, not a 200 — An invalid code does not return "valid": false — it returns HTTP 400 with error_code: promo_invalid. The message explains why (expired, unknown, minimum not met) and is intended for display; do not pattern-match it.

Example Request

curl -X POST https://accszone.com/api/v1/promo/validate \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"SAVE10","amount":50.00}'

Example Response

200 Success

{
    "success": true,
    "data": {
        "valid": true,
        "original_amount": "50.00",
        "discount": "5.00",
        "final_amount": "45.00"
    }
}

400 Code rejected

{
    "success": false,
    "error_code": "promo_invalid",
    "message": "Promo code has expired"
}

AccsZone API

Introduction

📦 Response Format

⚠️ One exception

💵 Money & dates

Authentication

🔑 API Key Header

⚠️ Key Security

Pagination

📄 The meta block

⚠️ per_page on the catalogue endpoints

🔁 Walking every page safely

Rate Limiting

🪣 One bucket per account

⏱️ Rolling window

💡 Staying under the limit

Errors & Status Codes

⛔ Retrying a failed purchase

Response Headers

ℹ️ Note

User Endpoints

🔒 API Key Required

🔒 API Key Required

🔒 API Key Required

Category Endpoints

🔒 API Key Required

⏱️ Rate limited — 30 requests/minute

🔒 API Key Required

⏱️ Rate limited — 30 requests/minute

Listing Endpoints

🔒 API Key Required

⏱️ Rate limited — 30 requests/minute

🔒 API Key Required

⏱️ Rate limited — 30 requests/minute

Order Endpoints

🔒 API Key Required

🔒 API Key Required

🔒 API Key Required

Promo Endpoints

🔒 API Key Required

📄 The `meta` block

⚠️ `per_page` on the catalogue endpoints