API v2 Reference

API v2 is the preferred interface for new server-to-server integrations. It uses API client credentials, operator-scoped data, consistent JSON resource envelopes, and per-client rate limiting.

Base path:

https://app.ispbills.com/api/v2

See Authentication and fundamentals before calling protected routes.

Authentication

Method	Endpoint	Access	Description
POST	/api/v2/auth/token	Public client credentials	Exchange client_id and client_secret for a bearer token
POST	/api/v2/auth/revoke	Authenticated client	Revoke the current bearer token

Customers

Method	Endpoint	Access	Description
GET	/api/v2/customers	customers:read	List customers with pagination
POST	/api/v2/customers	customers:write	Create a customer
GET	/api/v2/customers/{id}	customers:read	Retrieve a customer and recent bills
PUT	/api/v2/customers/{id}	customers:write	Update a customer
DELETE	/api/v2/customers/{id}	customers:write	Delete a customer
GET	/api/v2/customers/{id}/bills	customers:read	List customer bills
GET	/api/v2/customers/{id}/payments	customers:read	List customer payments
GET	/api/v2/customers/{id}/subscriptions	customers:read	List customer subscription records
GET	/api/v2/customers/{id}/usage	customers:read	Return active usage/session data

Create a customer

Required fields:

Field	Rules
username	String, maximum 64 characters
name	String, maximum 255 characters
mobile	String, maximum 20 characters
password	String, minimum 6 characters
connection_type	String
billing_type	String

POST /api/v2/customers
Authorization: Bearer YOUR_V2_TOKEN
Accept: application/json
Content-Type: application/json

{
  "username": "fatima-2087",
  "name": "Fatima Begum",
  "mobile": "01898765432",
  "password": "temporary-password",
  "connection_type": "PPPoE",
  "billing_type": "Monthly"
}

The response has status 201 and wraps the new resource in data.

Update a customer

PUT /api/v2/customers/{id} accepts any of:

Field	Rules
name	String, maximum 255 characters
mobile	String, maximum 20 characters
status	String

Billing

All billing data is restricted to the API client’s operator.

Method	Endpoint	Description
GET	/api/v2/billing/bills	List bills with pagination
POST	/api/v2/billing/bills	Create a bill
GET	/api/v2/billing/bills/{id}	Retrieve a bill
PUT or PATCH	/api/v2/billing/bills/{id}	Update a bill
DELETE	/api/v2/billing/bills/{id}	Delete a bill
GET	/api/v2/billing/payments	List payments with pagination

Create a bill with customer_id, amount, and due_date. currency is optional and must be a three-character code; package_name is also optional.

POST /api/v2/billing/bills
Authorization: Bearer YOUR_V2_TOKEN
Accept: application/json
Content-Type: application/json

{
  "customer_id": 2087,
  "amount": 1500,
  "currency": "BDT",
  "due_date": "2026-09-01",
  "package_name": "Fiber 100 Mbps"
}

Bill updates accept amount, currency, due_date, and is_paid.

Packages

Method	Endpoint	Description
GET	/api/v2/packages	List packages with page and per_page pagination

Each item exposes id, name, downstream/upstream speed, price, currency, and validity where available.

Network

Method	Endpoint	Description
GET	/api/v2/network/routers	List routers/NAS devices
GET	/api/v2/network/olts	List OLTs
GET	/api/v2/network/onus	List ONUs with pagination
GET	/api/v2/network/pools	List IPv4 pools

These responses expose operational summaries rather than secrets or complete device configurations.

Monitoring

Method	Endpoint	Description
GET	/api/v2/monitoring/zabbix/hosts	List Zabbix hosts
GET	/api/v2/monitoring/zabbix/problems	List active Zabbix problems
GET	/api/v2/monitoring/devices	Return device status overview
GET	/api/v2/monitoring/status-checks	Return infrastructure status checks

An integration should handle an empty data array when a monitoring provider is not configured or temporarily unavailable.

SMS

Method	Endpoint	Access	Description
GET	/api/v2/sms/balance	Authenticated client	Return gateway name, balance, and update time
POST	/api/v2/sms/send	sms:send	Send one message
POST	/api/v2/sms/broadcast	sms:send	Send one message to as many as 500 numbers

Send one SMS:

{
  "phone": "01712345678",
  "message": "Your payment has been received."
}

Broadcast SMS:

{
  "phones": ["01712345678", "01898765432"],
  "message": "Scheduled maintenance starts at 02:00."
}

Messages may contain up to 640 characters. A broadcast may contain 1–500 phone numbers and returns sent, failed, and total counts.

VPN

Method	Endpoint	Description
GET	/api/v2/vpn/accounts	List VPN accounts for the operator
GET	/api/v2/vpn/accounts/{id}/config	Return the account configuration

The configuration route returns 404 when the account is outside the operator or has no linked VPN server.

Webhook management

Method	Endpoint	Description
GET	/api/v2/webhooks	List registered webhook endpoints
POST	/api/v2/webhooks	Register an endpoint and return its signing secret once
PUT	/api/v2/webhooks/{id}	Update URL, event list, or active state
DELETE	/api/v2/webhooks/{id}	Delete an endpoint

The create and update field is named events_json, not events. Continue to the dedicated Webhooks guide for payload and signature details.

Response examples

A paginated collection:

{
  "data": [],
  "total": 0,
  "page": 1,
  "last_page": 0
}

A missing operator-scoped resource:

{
  "error": "Not found"
}

An insufficient customer or SMS scope:

{
  "error": "Insufficient scope"
}