reseller
POST /v1/reseller/services/{siteId}/sso
A one-time sign-in link into the panel for this client.
Authentication
Send an API key as a bearer token. The key must carry the reseller.provision permission; a key without it is refused with 403, not 404.
Where your organisation id goes
This endpoint takes org_id as a query parameter. Leave it out and the call covers your whole tenancy subtree; send it to narrow the call to one organisation.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/reseller/services/{siteId}/sso \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Mints a single-use, short-lived URL that drops your client straight into their own account in the panel, already signed in, with no password to remember. This is what the "Log in to your hosting" button in your billing panel or on your WordPress site opens. Requires `reseller.provision`. The ticket travels in the URL **fragment**, so it is never sent to a server, never appears in a `Referer` and never reaches an access log. It is good for a few minutes and can be redeemed once. The session it opens is confined to that one client organization and is audit-logged against you, not against them.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
org_id (query) | Uuid | No | Which of your organizations this applies to. Required only when you belong to more than one here — otherwise it is inferred, and an id outside your direct memberships is a 404 r… |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
url | string | Yes | Open this in the client's browser. The single-use ticket is in the URL fragment, so it never reaches a server log. Redeem once, within `expires_at`. |
expires_at | string | Yes | — |
client_org_id | Uuid | No | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
Errors this endpoint can return
401 · 403 · 404 · 409 · 429 · 503