Документация по API

curl https://sellmycode.net/api

curl https://sellmycode.net/api/account/details \
  -H "Authorization: Bearer YOUR_API_KEY"

curl https://sellmycode.net/api/account/details \
  -H "X-Api-Key: YOUR_API_KEY"

{
  "status": "error",
  "msg": "Invalid request"
}

curl https://sellmycode.net/api/account/details \
  -H "Authorization: Bearer YOUR_API_KEY"

curl https://sellmycode.net/api/items/all \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://sellmycode.net/api/items/item?item_id=123" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://sellmycode.net/api/sales?from=2026-01-01&status=active&per_page=25" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 132, "last_page": 6 },
  "sales": [
    {
      "id": 981,
      "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
      "item": { "id": 123, "name": "My Theme" },
      "buyer": "johndoe",
      "license_type": "Regular",
      "price": 29.0,
      "fee": 5.8,
      "earning": 23.2,
      "currency": "USD",
      "sale_status": "active",
      "cleared": true,
      "date": "2026-07-01T09:30:00+00:00"
    }
  ]
}

curl "https://sellmycode.net/api/purchases?status=active" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 3, "last_page": 1 },
  "purchases": [
    {
      "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
      "item": { "id": 123, "name": "My Theme", "url": "https://sellmycode.net/item/my-theme/123" },
      "license_type": "Regular",
      "price": 29.0,
      "currency": "USD",
      "purchase_status": "active",
      "download_expiry_at": "2027-01-01T00:00:00+00:00",
      "download_expired": false,
      "date": "2026-07-01T09:30:00+00:00"
    }
  ]
}

curl "https://sellmycode.net/api/balance?statements=1&wallet=balance" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "currency": "USD",
  "wallets": {
    "balance": 1250.75,
    "pending_balance": 89.4,
    "store_credit": 12.5
  },
  "pagination": { "page": 1, "per_page": 25, "total": 57, "last_page": 3 },
  "statements": [
    {
      "id": 4021,
      "title": "[Sale] #981 (My Theme)",
      "wallet": "balance",
      "type": "credit",
      "amount": 29.0,
      "total": 23.2,
      "date": "2026-07-01T09:30:05+00:00"
    }
  ]
}

curl -X POST https://sellmycode.net/api/purchases/validation \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "purchase_code=BUYER_PURCHASE_CODE"

// license check from your app / plugin
$ch = curl_init('https://sellmycode.net/api/purchases/validation');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => http_build_query(['purchase_code' => $code]),
]);
$res = json_decode(curl_exec($ch), true);
$valid = ($res['status'] ?? '') === 'success';

// Node.js 18+ (built-in fetch)
const res = await fetch('https://sellmycode.net/api/purchases/validation', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ purchase_code: code }),
});
const data = await res.json();
const valid = res.ok && data.status === 'success';

# Python 3 + requests
import requests

res = requests.post(
    'https://sellmycode.net/api/purchases/validation',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    data={'purchase_code': code},
    timeout=10,
)
valid = res.status_code == 200 and res.json().get('status') == 'success'

{
  "status": "success",
  "buyer": "johndoe",
  "item": {
    "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
    "license_type": "Regular",
    "price": 29.0,
    "currency": "USD",
    "item": { "…item fields…" },
    "supported_until": "2026-12-01T00:00:00+00:00",
    "download_expiry": "2026-08-01T00:00:00+00:00",
    "downloaded": true,
    "date": "2026-07-01T09:30:00+00:00"
  }
}

curl "https://sellmycode.net/api/catalog/items?search=woocommerce&sort=popular" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 64, "last_page": 3 },
  "items": [
    {
      "id": 123,
      "name": "My Theme",
      "url": "https://sellmycode.net/item/my-theme/123",
      "thumbnail": "https://sellmycode.net/files/thumbnails/…",
      "category": { "id": 4, "name": "WordPress", "slug": "wordpress" },
      "author": "janedoe",
      "price": { "regular": 29.0, "extended": 145.0 },
      "currency": "USD",
      "rating": { "average": 4.8, "count": 36 },
      "version": "2.1.0",
      "updated_at": "2026-07-10T08:00:00+00:00",
      "published_at": "2026-01-05T12:00:00+00:00"
    }
  ]
}

curl https://sellmycode.net/api/catalog/items/123 \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "categories": [
    { "id": 4, "name": "WordPress", "slug": "wordpress", "url": "https://sellmycode.net/categories/wordpress", "items_count": 128 }
  ]
}

5Uk3p1+J0PXzJkwS4wVFvTN9GcHpJzX5ClRI8zlI0yQ=

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA5Uk3p1+J0PXzJkwS4wVFvTN9GcHpJzX5ClRI8zlI0yQ=
-----END PUBLIC KEY-----

{
  "payload": "{\"status\":\"success\",\"code\":\"activated\", … }",
  "signature": "base64 Ed25519 signature of payload",
  "kid": "k1",
  "alg": "Ed25519"
}

{
  "status": "success",
  "code": "activated",
  "domain": "customer-site.com",
  "license_type": "Regular",
  "activation_limit": 2,
  "activations_used": 1,
  "updates": { "active": true, "until": "2027-01-30T10:00:00+00:00" },
  "activation_token": "9f2c…e41a",
  "grace_until": "2026-10-16T08:00:00+00:00",
  "nonce": "the nonce you sent",
  "issued_at": "2026-10-09T08:00:00+00:00"
}

// PHP 7.2+ (sodium is built in)
function sellmycode_license(string $action, array $fields): ?array
{
    // kid => raw 32-byte public key (Base64). Add the "next" key here when one is announced.
    $keys = ['k1' => '5Uk3p1+J0PXzJkwS4wVFvTN9GcHpJzX5ClRI8zlI0yQ='];
    $fields['nonce'] = bin2hex(random_bytes(16));

    $ch = curl_init('https://sellmycode.net/api/license/' . $action);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15,
        CURLOPT_POSTFIELDS => http_build_query($fields),
    ]);
    $res = json_decode((string) curl_exec($ch), true);

    // unreachable, 5xx, unsigned or forged: return null and keep the cached state
    if (!isset($res['payload'], $res['signature'], $keys[$res['kid'] ?? ''])
        || !sodium_crypto_sign_verify_detached(base64_decode($res['signature']), $res['payload'], base64_decode($keys[$res['kid']]))) {
        return null;
    }
    $data = json_decode($res['payload'], true);

    // must answer THIS request, not be an old answer replayed
    return ($data['nonce'] ?? '') === $fields['nonce'] ? $data : null;
}

// first run: activate and keep the token
$r = sellmycode_license('activate', ['purchase_code' => $code, 'domain' => $_SERVER['HTTP_HOST']]);
if ($r && $r['status'] === 'success' && $r['activation_token']) {
    save_setting('license_token', $r['activation_token']);
}

// daily: verify, cache the signed answer, run on it through an outage
$r = sellmycode_license('verify', ['purchase_code' => $code, 'domain' => $_SERVER['HTTP_HOST']]);
if ($r && $r['code'] !== 'rate_limited') {
    save_setting('license_state', $r);
}
$state = get_setting('license_state');
$licensed = $state && $state['status'] === 'success' && strtotime($state['grace_until']) > time();

// Node.js 18+
import crypto from 'node:crypto';

const PUBLIC_KEY = crypto.createPublicKey({
  format: 'jwk',
  key: { kty: 'OKP', crv: 'Ed25519',
         x: Buffer.from('5Uk3p1+J0PXzJkwS4wVFvTN9GcHpJzX5ClRI8zlI0yQ=', 'base64').toString('base64url') },
});

async function sellmycodeLicense(action, fields) {
  const nonce = crypto.randomBytes(16).toString('hex');
  let res;
  try {
    const r = await fetch('https://sellmycode.net/api/license/' + action, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ ...fields, nonce }),
    });
    res = await r.json();
  } catch { return null; }
  if (!res.payload || !res.signature) return null;
  const ok = crypto.verify(null, Buffer.from(res.payload), PUBLIC_KEY, Buffer.from(res.signature, 'base64'));
  if (!ok) return null;
  const data = JSON.parse(res.payload);
  return data.nonce === nonce ? data : null;
}

# Python 3 + requests + cryptography
import base64, json, secrets, requests
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

PUBLIC_KEY = Ed25519PublicKey.from_public_bytes(base64.b64decode("5Uk3p1+J0PXzJkwS4wVFvTN9GcHpJzX5ClRI8zlI0yQ="))

def sellmycode_license(action, fields):
    nonce = secrets.token_hex(16)
    try:
        res = requests.post("https://sellmycode.net/api/license/" + action, json=dict(fields, nonce=nonce), timeout=15).json()
        PUBLIC_KEY.verify(base64.b64decode(res["signature"]), res["payload"].encode())
    except Exception:
        return None   # unreachable, unsigned or forged
    data = json.loads(res["payload"])
    return data if data.get("nonce") == nonce else None

curl "https://sellmycode.net/api/updates/check" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"packages":[{"slug":"my-theme","type":"theme","version":"1.4.0"}]}'

{
  "status": "success",
  "checked": 1,
  "updates": [
    {
      "item_id": 123,
      "slug": "my-theme",
      "type": "theme",
      "name": "My Theme",
      "installed_version": "1.4.0",
      "new_version": "1.6.2",
      "changelog": { "version": "1.6.2", "body": "Fixed ..." },
      "can_download": true,
      "reason": null,
      "update_window_ends_at": "2027-01-30T10:00:00+00:00",
      "download_url": "https://sellmycode.net/api/updates/download/123",
      "renew_url": null
    }
  ]
}

curl -L -o update.zip "https://sellmycode.net/api/updates/download/123" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "id": "1c2f6a7e-9d31-4c3e-8f5b-2d9f8f4f1a10",
  "event": "sale.created",
  "created_at": "2026-07-18T10:30:00+00:00",
  "data": {
    "sale_id": 981,
    "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
    "type": "item",
    "item": { "id": 123, "name": "My Theme" },
    "buyer": "johndoe",
    "license_type": "Regular",
    "price": 29.0,
    "earning": 23.2,
    "currency": "USD",
    "date": "2026-07-18T10:30:00+00:00"
  }
}

$secret  = 'whsec_...'; // from Settings → API Key → Webhooks
$body    = file_get_contents('php://input');
$header  = $_SERVER['HTTP_X_SMC_SIGNATURE'] ?? '';

parse_str(str_replace(',', '&', $header), $sig); // ['t' => ..., 'v1' => ...]

$expected = hash_hmac('sha256', $sig['t'] . '.' . $body, $secret);

if (!hash_equals($expected, $sig['v1'] ?? '') || abs(time() - (int) $sig['t']) > 300) {
    http_response_code(400); exit;
}

http_response_code(200); // ack fast, process async

// Express: use express.raw() so the RAW body is available for the HMAC
const crypto = require('crypto');
const SECRET = 'whsec_...'; // from Settings → API Key → Webhooks

app.post('/webhooks/sellmycode', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-SMC-Signature') || '';
  const sig = Object.fromEntries(header.split(',').map(p => p.split('=')));

  const expected = crypto.createHmac('sha256', SECRET)
    .update(sig.t + '.' + req.body.toString('utf8')).digest('hex');

  const fresh = Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  const valid = sig.v1 &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1));

  if (!valid || !fresh) return res.sendStatus(400);

  const event = JSON.parse(req.body); // { id, event, created_at, data }
  res.sendStatus(200); // ack fast, process async
});

# Flask — request.get_data() is the RAW body needed for the HMAC
import hmac, hashlib, time
from flask import Flask, request

SECRET = 'whsec_...'  # from Settings → API Key → Webhooks

@app.route('/webhooks/sellmycode', methods=['POST'])
def webhook():
    header = request.headers.get('X-SMC-Signature', '')
    sig = dict(p.split('=', 1) for p in header.split(',') if '=' in p)

    body = request.get_data()  # bytes, unparsed
    expected = hmac.new(
        SECRET.encode(), (sig.get('t', '') + '.').encode() + body, hashlib.sha256
    ).hexdigest()

    fresh = abs(time.time() - float(sig.get('t', 0))) < 300
    if not (hmac.compare_digest(expected, sig.get('v1', '')) and fresh):
        return '', 400

    event = request.get_json()  # { id, event, created_at, data }
    return '', 200  # ack fast, process async

# Rails / Rack — request.body.read is the RAW body needed for the HMAC
SECRET = 'whsec_...' # from Settings → API Key → Webhooks

def webhook
  header = request.headers['X-SMC-Signature'].to_s
  sig = header.split(',').to_h { |p| p.split('=', 2) }

  body = request.body.read
  expected = OpenSSL::HMAC.hexdigest('SHA256', SECRET, "#{sig['t']}.#{body}")

  fresh = (Time.now.to_i - sig['t'].to_i).abs < 300
  valid = sig['v1'] &&
    ActiveSupport::SecurityUtils.secure_compare(expected, sig['v1'])

  return head :bad_request unless valid && fresh

  event = JSON.parse(body) # { id, event, created_at, data }
  head :ok # ack fast, process async
end