ResourcePilot API Documentation

Overview

One ResourcePilot API for catalog access and controlled delivery.

The API is plan-aware: active ResourcePilot credentials only receive categories and resources included in their assigned plan. Use the API from your own backend, synchronize the catalog locally, and expose only the fields required by your customer interface.

01Authenticate server-side

Keep the ResourcePilot API token outside browser JavaScript, public repositories and client-side application bundles.

02Synchronize by identifier

Upsert categories with cat_identifier and resources with res_identifier so catalog changes remain stable.

03Deliver on demand

Release a protected download link only inside an authorized customer download journey on the registered domain.

Licensing and permitted use

ResourcePilot provides software/API access and controlled delivery infrastructure. Access to a resource does not grant rights beyond its applicable license. Do not resell, sublicense or redistribute third-party resources unless you independently hold the rights required to do so.

Authentication

Two private credentials with different jobs.

ResourcePilot API token

Authorizes account details, categories, resources, module packages and update requests. Send it as token from your backend.

token=res_••••••••

Download seed

Authorizes resource file delivery. The core also validates account status, plan permission, usage limits and the registered referring domain.

seed=••••••••

Credential handling

Never place the ResourcePilot API token in frontend AJAX. Do not store the download seed or complete download_url in a public JSON catalog. Provide the protected URL only when an authorized user initiates a download.

Recommended implementation

Verify, synchronize, cache and deliver.

1Verify accountRead status and limits

→

2Sync categoriesUpsert authorized groups

→

3Sync resourcesStore current metadata

→

4Serve locallyFast search and filtering

→

5Download on clickProtected delivery flow

Minimal PHP catalog synchronization

<?php
$apiBase = 'https://core.resourcepilot.co/api';
$token = getenv('RESOURCEPILOT_API_TOKEN');

function fmGetJson(string $url): array {
    $context = stream_context_create(['http' => ['timeout' => 120]]);
    $json = file_get_contents($url, false, $context);
    if ($json === false) {
        throw new RuntimeException('ResourcePilot API request failed.');
    }
    return json_decode($json, true, 512, JSON_THROW_ON_ERROR);
}

$categories = fmGetJson($apiBase . '/get-categories.php?token=' . rawurlencode($token));
$resources  = fmGetJson($apiBase . '/get-resources.php?token=' . rawurlencode($token));

$privateCache = ['categories' => $categories, 'resources' => $resources];
$tmp = __DIR__ . '/storage/catalog.tmp';
file_put_contents($tmp, json_encode($privateCache, JSON_UNESCAPED_SLASHES));
rename($tmp, __DIR__ . '/storage/catalog.json');

Important

The resources response contains protected download URLs. Keep the synchronized file outside the public web root or remove download_url before publishing a frontend-safe cache.

Responses and errors

Know which endpoints return JSON and which stream files.

JSON catalog endpoints

Account details, categories, resources and update requests return JSON with an appropriate HTTP status.

Content-Type: application/json; charset=utf-8

Binary delivery endpoints

Resource and module downloads stream files on success. Resource-download errors are plain text; module-download errors are JSON.

Content-Type: application/octet-stream | application/zip

Status	General meaning
`200`	Successful JSON response or file stream.
`201`	Update request created successfully.
`400`	A required parameter is missing or malformed.
`401`	The resource download seed is missing or invalid.
`403`	Credential, account status, brand-domain or plan permission check failed.
`404`	The requested resource, module or related record could not be found.
`405`	The endpoint does not accept the HTTP method used.
`409`	An equivalent pending update request already exists.
`422`	The update-request body failed semantic validation.
`429`	The daily unique resource-download allowance has been reached.
`500`	The core could not complete the request.

Account

Account endpoints

GET /get-reseller-details.php

RESOURCEPILOT API

Get API account details

Returns the account brand, registered delivery domain, active plan, current download usage, effective limits, download seed, membership date and normalized account status.

AuthenticationResourcePilot API token. This is the only account endpoint that accepts a valid suspended or inactive account so your integration can read its current status.

Successful returnapplication/json object

Parameters

Parameter	Type	Requirement	Location	Description
`token`	string	required	query	Private ResourcePilot API token.

Request

curl --get "https://core.resourcepilot.co/api/get-reseller-details.php" \
  --data-urlencode 'token=rp_your_private_token'

200 JSON response

{
  "brand_name": "Acme Resources",
  "brand_domain": "resources.acme.test",
  "plan_name": "Professional",
  "daily_download_limit": 100,
  "daily_limit_used": 12,
  "monthly_download_limit": 2000,
  "monthly_limit_used": 154,
  "download_seed": "your_private_download_seed",
  "member_since": "2026-06-01 09:30:00",
  "status": "Active"
}

Behavior and implementation notes

The legacy endpoint filename get-reseller-details.php is retained for backward compatibility only; it does not grant resale or redistribution rights.
The status value is either Active or Suspended. Any database status other than active is normalized to Suspended.
A limit can be an integer or the string Unlimited when no plan or account override is set.
Daily and monthly usage count distinct resources downloaded during the relevant period.

HTTP status codes

Status	Meaning for this endpoint
`200`	Account details returned. A suspended account can still receive this response.
`400`	The token parameter is missing.
`403`	The token does not match a ResourcePilot account.
`404`	The account exists but its plan details could not be resolved.
`500`	A database error prevented the response.

Catalog

Catalog endpoints

GET /get-categories.php

RESOURCEPILOT API

List authorized categories

Returns every active category assigned to the account plan. Categories are sorted alphabetically and include both the legacy numeric ID and the stable public identifier.

AuthenticationActive ResourcePilot API token.

Successful returnapplication/json array

Parameters

Parameter	Type	Requirement	Location	Description
`token`	string	required	query	Private token for an active ResourcePilot account.

Request

curl --get "https://core.resourcepilot.co/api/get-categories.php" \
  --data-urlencode 'token=rp_your_private_token'

200 JSON response

[
  {
    "id": 7,
    "cat_identifier": "Ab12Cd34",
    "name": "WordPress Plugins",
    "image_url": "https://core.resourcepilot.co/uploads/categories/plugins.png"
  }
]

Behavior and implementation notes

Use cat_identifier as the durable integration key. The numeric id remains available for legacy integrations.
image_url is an absolute URL when an image exists and null when the category has no image.
An empty authorized catalog returns an empty JSON array, not an error object.

HTTP status codes

Status	Meaning for this endpoint
`200`	Authorized categories returned.
`400`	The token parameter is missing.
`403`	The token is invalid or the ResourcePilot account is not active.
`500`	A database error prevented the category query.

GET /get-resources.php

RESOURCEPILOT API

List authorized resources

Returns the current active resources included in the account plan. The response contains catalog metadata, descriptions, preview URLs, current versions and a protected download URL for each resource.

AuthenticationActive ResourcePilot API token.

Successful returnapplication/json array

Parameters

Parameter	Type	Requirement	Location	Description
`token`	string	required	query	Private token for an active ResourcePilot account.
`cat_identifier`	string	optional	query	Preferred category filter. Must be exactly eight alphanumeric characters and must belong to the account plan.
`cat`	integer	optional	query	Legacy numeric category ID filter. Ignored when cat_identifier is supplied.

Request

# Complete authorized catalog
curl --get "https://core.resourcepilot.co/api/get-resources.php" \
  --data-urlencode 'token=rp_your_private_token'

# One category using the stable identifier
curl --get "https://core.resourcepilot.co/api/get-resources.php" \
  --data-urlencode 'token=rp_your_private_token' \
  --data-urlencode 'cat_identifier=Ab12Cd34'

200 JSON response

[
  {
    "id": 142,
    "res_identifier": "R9x2Lm7Q",
    "title": "Example Resource",
    "image_url": "https://core.resourcepilot.co/uploads/resources/example.png",
    "version": "3.2.1",
    "is_featured": true,
    "category": "WordPress Plugins",
    "cat_identifier": "Ab12Cd34",
    "live_demo_url": "https://demo.example.test",
    "short_description": "Short catalog summary.",
    "long_description": "Complete resource description.",
    "download_url": "https://core.resourcepilot.co/api/get-download.php?id=142&seed=..."
  }
]

Behavior and implementation notes

The endpoint returns the full matching array and currently has no server-side pagination. Cache the response in your own database or private JSON file.
Resources are sorted with featured items first and then by title A–Z.
res_identifier and cat_identifier are the preferred durable keys for synchronization. Numeric IDs are still required by the download endpoint.
Do not publish the returned download_url or download seed inside a public catalog cache. Release it only during an authorized download flow.

HTTP status codes

Status	Meaning for this endpoint
`200`	Authorized resources returned. An empty result is an empty array.
`400`	Missing token, invalid linked plan, or invalid cat_identifier format.
`403`	Invalid/inactive account or the requested category is not included in the plan.
`500`	A database or server error prevented catalog generation.

Delivery

Delivery endpoints

GET /get-download.php

RESOURCEPILOT API

Download a resource securely

Validates the account download seed, account status, registered referring domain, plan category permission and unique-download allowance before streaming the current resource file with a branded filename.

AuthenticationDownload seed plus a valid browser Referer from the account brand domain or one of its subdomains.

Successful returnBinary file stream; plain-text errors

Parameters

Parameter	Type	Requirement	Location	Description
`id`	integer	required	query	Numeric resource ID returned by get-resources.php.
`seed`	string	required	query	Private download seed returned by get-account-details.php or embedded in download_url.
`Referer`	URL	required	header	A page URL whose host exactly matches the registered brand domain or is one of its subdomains. Browsers normally send this automatically when the link is opened from the registered website.

Request

curl -L "https://core.resourcepilot.co/api/get-download.php?id=142&seed=your_private_download_seed" \
  -H 'Referer: https://resources.acme.test/library' \
  --output resource.zip

200 binary response

Content-Type: application/octet-stream
Content-Disposition: attachment; filename="Acme Resources_original-resource.zip"
Content-Length: 1843200

[binary file body]

Behavior and implementation notes

Direct access without a Referer header is rejected. The referring host may be the exact registered domain or any subdomain of it.
The plan must include the resource category and both the resource and ResourcePilot account must be active.
The daily allowance counts unique resource IDs. Downloading the same resource again on the same day does not consume another unique slot.
The delivered filename is built as Brand Name_original-file-name.ext.
Unlike the catalog endpoints, download failures are plain text rather than JSON.

HTTP status codes

Status	Meaning for this endpoint
`200`	The current resource file is streamed.
`400`	The resource ID is missing or invalid.
`401`	The download seed is missing or invalid.
`403`	Inactive account, missing/unauthorized Referer, or plan permission denied.
`404`	The resource does not exist or is inactive.
`429`	The account daily unique-download allowance has been reached.
`500`	The file is missing/unreadable or a database error occurred.

GETPOST /download-module.php

RESOURCEPILOT API

Download an integration module

Downloads the official ResourcePilot WHMCS or WordPress integration package for a valid active ResourcePilot account.

AuthenticationActive ResourcePilot API token.

Successful returnapplication/zip; JSON errors

Parameters

Parameter	Type	Requirement	Location	Description
`token`	string	required	query or form	Private token for an active ResourcePilot account.
`file`	enum	required	query or form	Allowed values: whmcs or wordpress.

Request

# WHMCS module
curl -L --get "https://core.resourcepilot.co/api/download-module.php" \
  --data-urlencode 'token=rp_your_private_token' \
  --data-urlencode 'file=whmcs' \
  --output ResourcePilot_WHMCS.zip

# WordPress plugin
curl -L --get "https://core.resourcepilot.co/api/download-module.php" \
  --data-urlencode 'token=rp_your_private_token' \
  --data-urlencode 'file=wordpress' \
  --output ResourcePilot_WP.zip

200 binary response

Content-Type: application/zip
Content-Disposition: attachment; filename="ResourcePilot_WHMCS.zip"
Content-Length: 98304

[binary ZIP body]

Behavior and implementation notes

The endpoint accepts either GET query parameters or POST form parameters.
The physical package names are ResourcePilot_WHMCS.zip and ResourcePilot_WP.zip.
Successful responses are ZIP streams. Failure responses use JSON in the form {"success":false,"error":"..."}.

HTTP status codes

Status	Meaning for this endpoint
`200`	The requested ZIP package is streamed.
`400`	A required parameter is missing or file is not whmcs/wordpress.
`403`	The token is invalid or the ResourcePilot account is not active.
`404`	The requested module file could not be found.
`500`	The module directory/file is unreadable or token validation failed at the database layer.

Requests

Requests endpoints

POST /update-request.php

RESOURCEPILOT API

Submit a resource update request

Creates a pending update request for an existing resource ID or an external resource identifier. JSON and standard form bodies are supported.

AuthenticationActive ResourcePilot API token supplied in the request body.

Successful returnapplication/json object

Parameters

Parameter	Type	Requirement	Location	Description
`token`	string	required	JSON or form	Private token for an active ResourcePilot account.
`requested_version`	string	required	JSON or form	Version requested by the account holder.
`resource_id`	integer	conditional	JSON or form	Existing numeric resource ID. Required when external_identifier is not supplied.
`external_identifier`	string	conditional	JSON or form	External reference for a resource not identified by resource_id. Required when resource_id is not supplied.
`notes`	string	optional	JSON or form	Additional context for the update team.

Request

curl -X POST "https://core.resourcepilot.co/api/update-request.php" \
  -H 'Content-Type: application/json' \
  -d '{
    "token": "rp_your_private_token",
    "resource_id": 142,
    "requested_version": "3.3.0",
    "notes": "Vendor release is available."
  }'

201 JSON response

{
  "success": true,
  "request_id": 915,
  "status": "pending",
  "message": "Update request submitted successfully."
}

Behavior and implementation notes

Provide resource_id or external_identifier. When both are present, resource_id is used.
A duplicate pending request for the same account, target and requested version returns HTTP 409 with the existing request_id.
This endpoint only creates the request. It does not publish a new version immediately.

HTTP status codes

Status	Meaning for this endpoint
`201`	The pending update request was created.
`400`	The token parameter is missing.
`403`	The token is invalid or the ResourcePilot account is not active.
`404`	The supplied resource_id does not exist.
`405`	A method other than POST was used.
`409`	An equivalent pending update request already exists.
`422`	requested_version is missing, or neither resource_id nor external_identifier was provided.
`500`	The update request could not be stored.

Complete ResourcePilot API reference.

One ResourcePilot API for catalog access and controlled delivery.

Two private credentials with different jobs.

ResourcePilot API token

Download seed

Verify, synchronize, cache and deliver.

Know which endpoints return JSON and which stream files.

Account endpoints

Get API account details

Parameters

Behavior and implementation notes

HTTP status codes

Catalog endpoints

List authorized categories

Parameters

Behavior and implementation notes

HTTP status codes

List authorized resources

Parameters

Behavior and implementation notes

HTTP status codes

Delivery endpoints

Download a resource securely

Parameters

Behavior and implementation notes

HTTP status codes

Download an integration module

Parameters

Behavior and implementation notes

HTTP status codes

Requests endpoints

Submit a resource update request

Parameters

Behavior and implementation notes

HTTP status codes

No matching ResourcePilot API endpoints