Resellers

Two pages live under Resellers:

A reseller may be assigned an ACL plan; without one it is unrestricted. Enforcement is server-side: a request from a reseller session to a capability its plan withholds is refused with 403 PERMISSION_DENIED, and the body names the permission. This covers the sub-account management endpoints and the reseller's own client-panel surface (DNS, SSL, PHP, databases, email with the mailboxes' spam lists, FTP, files, cron, backups, logs, metrics, phpMyAdmin and webmail single sign-on, and logging in as a sub-account). A narrow permission never overrides a broad one — phpMyAdmin access also requires database management. The reseller's panel reads the plan's flags with its profile and does not offer what the plan withholds: the menu entry of a withheld surface is left out, the Remote tab of Backups and the sub-account firewall switch follow backup_remote and modsecurity_manage, and the API Access page states the refusal without asking. Naming a plan and setting the limits directly are the same permission: with account plan change withheld, a reseller can change neither plan_id nor a sub-account's package limits.

Shell Access governs whether the reseller may give a sub-account an interactive login shell (see § 3). ModSecurity governs the firewall switch on the reseller's sub-account page. API Access governs whether the reseller may mint and use its own API keys on the client API (see § API Access → Reseller keys); with it withheld, minting and every request signed with an existing reseller key are refused.

Login to Client Panel (the SSO control on the Resellers list) opens the reseller's own client panel in a new tab, acting as that reseller: the sub-account pages there work even though the operator's own session cookie stays in the browser.

The client panel does not yet read the ACL, so a reseller sees a refused section as empty rather than as "not permitted".

Suspended sub-accounts still count toward a reseller's sub-account quota; only termination frees a slot. An ACL plan a reseller still uses cannot be deleted (409 PLAN_IN_USE, with the reseller count); the three system plans can be edited but never deleted; a new plan whose name resolves to an existing plan id is refused with 409 PLAN_EXISTS.

Endpoints used: GET /accounts?is_reseller=true, GET /resellers/acl-plans, POST /resellers/acl-plans, PUT /resellers/acl-plans/{id}, DELETE /resellers/acl-plans/{id}, PUT /accounts/{u} (reseller flag, limits and ACL plan).