SonicPanel Developer API (PHP & JSON)

Use the SonicPanel API to build automation modules, billing integrations, and automated client management workflows.

Requirements & Rate Limits:
  • API Key is required for every request. Obtain it from SonicPanel Root >> Billing & Automation (API).
  • Brute-force security is active by default. Sending an invalid API key 5 times will automatically blacklist the caller IP for 1 hour.
  • Do not send API calls every second or in a very short time like even every 10 seconds for 100+ radios at the same time. This will cause CPU load on your own server. Develop efficient products.
  • Do not use this API system on a public website where anyone can access if the website is not hosted by cloudflare, use it on your projects, on client panels etc.
  • Reseller Management Actions are strictly reserved for the root user only.
  • Security: Keep your API key secure, do not use it on public calls, do not use it with javascript or jquery. Keep it on server side in php only. You can change/reset your API key by the Billing & Automation (API) page.
Default API Endpoint (Port 2087): https://YOUR_SP_DOMAIN:2087/api/sonic_api.php
Alternative Endpoint (Port 443): https://YOUR_SP_DOMAIN/api/sonic_api.php
Getting Started
Include the PHP client class once, then use it in every example.
Helper SonicPanelAPI PHP Client Wrapper

Include this lightweight class in your project to streamline all API calls without repeating cURL logic. Set your server domain, API key and owner once in the CONFIGURATION block at the top of the class; every example below then only needs new SonicPanelAPI().

SonicPanelAPI.php 
<?php
class SonicPanelAPI {
    // ---- CONFIGURATION: set your SonicPanel details here once ----
    private const DOMAIN     = 'yourdomain.com';        // SonicPanel server domain
    private const API_KEY    = 'PKWRURTP48SGK2QYQA6Q';  // API key from SonicPanel Root >> Billing & Automation (API)
    private const OWNER      = 'root';                  // 'root' or the reseller username that owns the API key
    private const PORT       = 2087;                    // 2087 or 443
    private const VERIFY_SSL = false;                   // true when the server has a valid SSL certificate
    // ---------------------------------------------------------------

    private string $domain;
    private string $key;
    private string $owner;
    private int $port;
    private bool $verifySsl;

    // All arguments are optional and override the configuration above
    public function __construct(?string $domain = null, ?string $key = null, ?string $owner = null, ?int $port = null, ?bool $verifySsl = null) {
        $this->domain = $domain ?? self::DOMAIN;
        $this->key = $key ?? self::API_KEY;
        $this->owner = $owner ?? self::OWNER;
        $this->port = $port ?? self::PORT;
        $this->verifySsl = $verifySsl ?? self::VERIFY_SSL;
    }

    public function call(string $cmd, array $params = []) {
        $url = "https://{$this->domain}:{$this->port}/api/sonic_api.php";

        $postData = array_merge([
            'cmd'   => $cmd,
            'owner' => $this->owner,
            'key'   => $this->key,
        ], $params);

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $this->verifySsl ? 1 : 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $this->verifySsl ? 2 : 0);

        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

        if (curl_errno($ch)) {
            $err = curl_error($ch);
            curl_close($ch);
            return ['result' => 'error', 'message' => "cURL Error: {$err}"];
        }
        curl_close($ch);

        if ($httpCode === 401) {
            return ['result' => 'error', 'message' => 'Invalid SonicPanel API Key (HTTP 401).'];
        }
        if ($httpCode === 403) {
            return ['result' => 'error', 'message' => 'Forbidden request (HTTP 403).'];
        }
        if ($httpCode === 500) {
            return ['result' => 'error', 'message' => 'IP address blocked for 1 hour due to multiple login failures, or a server error (HTTP 500).'];
        }
        if ($httpCode >= 400) {
            return ['result' => 'error', 'message' => "Request failed (HTTP {$httpCode}). Check the domain, port and API path."];
        }

        $decoded = json_decode($response, true);
        return $decoded !== null ? $decoded : $response;
    }
}
?>
Radio Account Management
Packages, create, change, suspend and terminate radio accounts.
POST Action: packs

Returns a comma-separated string listing the radio packages created by the (owner) sent with the request: root packages for root, or the reseller's own packages for a reseller username. To list reseller account packages use reseller_packs.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();
$response = $sp->call('packs');

if (is_string($response)) {
    $response = ['packages' => array_values(array_filter(explode(',', trim($response))))];
}
echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: create

Creates a new radio account with the specified package, credentials, and configuration.

Username rules: the rad_username you send is converted to a valid Linux username automatically, so you never get an error for special characters. Turkish and accented letters become English letters (for example ç to c, ş to s), uppercase becomes lowercase, everything else (spaces, @, _, ., - and other symbols) is removed, the name is cut to 32 characters and a name that starts with a number gets an r in front. If nothing is left, or rad_username is empty, a username is generated from the client email. root, icecast, sonicpanel and existing system accounts are rejected. Always use the username returned in the response, it can differ from the one you sent.

Response fields:
• username = the radio username
• package = the package name the radio was created with
• port = the radio port
• rpass = Radio Stream Password
• radminpass = Radio Admin Password
• panel_pass = the panel login password of the account (the panel_pass value that was sent)

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('create', [
    'package'      => 'shoutcast50',
    'rad_username' => 'sptest5',
    'client_email' => '[email protected]',
    'panel_pass'   => 'SecurePanelPass123!',
    'send_email'   => 'yes'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: change

Upgrades or downgrades an existing account by assigning a new package plan.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('change', [
    'rad_username' => 'sptest5',
    'pack'         => 'newshoutcast100'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: changepass

Changes the SonicPanel web client panel login password for an existing radio account. Root can change any radio, a reseller can only change its own radios. The response returns the radio username and the new password as panel_pass.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('changepass', [
    'rad_username' => 'sptest5',
    'password'     => 'NewStrongPassword456!'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: suspend

Suspends a radio account and shuts down its server and AutoDJ processes. The response also returns the radio username.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('suspend', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: unsuspend

Unsuspends a suspended radio account and restarts the radio stream server. The response also returns the radio username.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('unsuspend', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: terminate

Permanently deletes a radio account, stopping all processes, removing files, playlists, and freeing allocated ports. The response also returns the radio username.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('terminate', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
Radio Control
Start and stop the radio server.
POST Action: startradio

Starts an existing radio stream server process (Shoutcast or Icecast).

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('startradio', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: stopradio

Stops the radio stream server and also halts AutoDJ if active.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('stopradio', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
AutoDJ Control
Start and stop the AutoDJ of a radio.
POST Action: startautodj

Starts the AutoDJ service (Liquidsoap) for an account that already has AutoDJ configured.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('startautodj', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: stopautodj

Stops the AutoDJ service without stopping the core radio server.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('stopautodj', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
DJ Management
Manage the live DJ accounts of a radio.
POST Action: add_dj

Creates an individual DJ account with granular permissions. DJ username and password must be unique across the server.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('add_dj', [
    'rad_username'   => 'sptest5',
    'dj_username'    => 'djalex',
    'dj_pass'        => 'DjSecretPass789!',
    'canstream'      => 'yes',
    'canplayjingles' => 'yes',
    'canusevoice'    => 'no',
    'canchangepass'  => 'no',
    'canuploadpic'   => 'yes',
    'canlogin'       => 'yes',
    'canstartrad'    => 'no',
    'canstartdj'     => 'no',
    'canskip'        => 'no'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: update_dj

Updates an existing DJ user's password and permission rights.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('update_dj', [
    'rad_username'   => 'sptest5',
    'dj_username'    => 'djalex',
    'dj_pass'        => 'NewDjPass999!',
    'canstream'      => 'yes',
    'canplayjingles' => 'yes',
    'canusevoice'    => 'no',
    'canchangepass'  => 'no',
    'canuploadpic'   => 'yes',
    'canlogin'       => 'yes'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: delete_dj

Removes an existing DJ account associated with a radio.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('delete_dj', [
    'rad_username' => 'sptest5',
    'dj_username'  => 'djalex'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: dj_list

Retrieves all DJ accounts associated with a specified radio user, including assigned permissions and email information.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('dj_list', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
Radio Information
Read-only actions that return radio, AutoDJ and live statistics.
POST Action: status

Checks whether the radio server or AutoDJ process is currently online or offline. Root can check any radio, a reseller can only check its own radios.

The type parameter decides which status is returned, only that status is shown:
• radio = radio server status, result is online or offline
• autodj = AutoDJ status, result is online or offline
The radio username is returned as well. If type is left empty, both statuses are returned in radio and autodj and result is complete.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('status', [
    'rad_username' => 'sptest5',
    'type'         => 'radio' // 'radio' or 'autodj'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: get_radio (Get Radio)

Retrieves complete account details, system type, passwords, and assigned limits for a single radio.

Radio Systems (rsys):
• scv26 = ShoutCast v2.6
• scv2 = ShoutCast v2.5
• scv1 = ShoutCast v1
• ic = IceCast

Passwords: rpass is the Radio Stream Password and radminpass is the Radio Admin Password.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('get_radio', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: all_radios (Get All Radios)

Lists radio accounts with package details, assigned limits (Bandwidth, Listeners, Hosting Space, Bitrate, AutoDJ limit), registration creation date, active port, DJ port, Radio Stream Password, and Radio Admin Password.

Radio Systems (rsys):
• scv26 = ShoutCast v2.6
• scv2 = ShoutCast v2.5
• scv1 = ShoutCast v1
• ic = IceCast

Passwords: rpass is the Radio Stream Password and radminpass is the Radio Admin Password.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('all_radios');

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: all_autodjs (Get All AutoDJs)

Lists configured AutoDJ services along with radio username, owner, active port, encoder, and bitrate settings. Root receives all AutoDJs, a reseller only the AutoDJs of its own radios. The playlist field is the playlist name the AutoDJ plays (for example TodoMusica).

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('all_autodjs');

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: get_radio_stats_live (Get Radio Statistics Live)

Returns the live statistics of a radio: current song, listeners, bitrate, stream type, live DJ and the recently played songs. Works with ShoutCast v1, v2 and IceCast and does not need any extra setup. Root can query any radio, a reseller can only query its own radios.

Response fields:
• online = true when the radio server is running and a source (AutoDJ or live DJ) is connected
• stream = autodj, live or offline
• radio_system = ShoutCast v1, ShoutCast v2.5, ShoutCast v2.6 or IceCast v2
• song = current song name, artist and title = the same song split at the first " - "
• listeners, peak_listeners and bitrate (kbps)
• unique_listeners = unique listeners (ShoutCast only, null for IceCast)
• djusername = live DJ name, No DJ when nobody is connected
• history = recently played songs, newest first (the number of songs follows the song history setting of the radio, 20 by default)

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('get_radio_stats_live', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: autodj_next_song

Returns the next song that the AutoDJ of a radio will play. Root can query any radio, a reseller can only query its own radios. The AutoDJ must be enabled for the account and currently running.

Song fields:
• position = position in the queue
• artist and title = track information
• source = request (listener request), scheduled (scheduled playlist item) or playlist (regular AutoDJ playlist)
song is null when nothing is queued.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('autodj_next_song', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST Action: autodj_next_songs

Returns the next 5 songs that the AutoDJ of a radio will play, in play order. Root can query any radio, a reseller can only query its own radios. The AutoDJ must be enabled for the account and currently running. The song fields are the same as autodj_next_song.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('autodj_next_songs', [
    'rad_username' => 'sptest5'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
Reseller Account Management
Packages, create, change, suspend and terminate reseller accounts. Root only.
POST ROOT ONLY Action: reseller_packs

Lists available reseller packages on the server separated by commas. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();
$response = $sp->call('reseller_packs');

if (is_string($response)) {
    $response = ['reseller_packages' => array_values(array_filter(explode(',', trim($response))))];
}
echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: create_reseller

Creates a new reseller hosting account with the specified reseller package. Only root can call this action.

Username rules: the same conversion as the radio create action is applied to rad_username: Turkish and accented letters become English letters, the name is lowercased, everything except letters and numbers is removed, it is cut to 32 characters and a name that starts with a number gets an r in front. If nothing is left, or rad_username is empty, a username is generated from the client email. root, icecast and sonicpanel are rejected. Always use the username returned in the response, it can differ from the one you sent.

Response fields:
• username = the reseller username
• panel_pass = the panel login password of the reseller (the panel_pass value that was sent)

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('create_reseller', [
    'package'      => 'gold_reseller',
    'rad_username' => 'resellertest',
    'client_email' => '[email protected]',
    'panel_pass'   => 'ResellerSecret123!',
    'send_email'   => 'yes'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: change_reseller

Changes or upgrades/downgrades an existing reseller account's package. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('change_reseller', [
    'rad_username' => 'resellertest',
    'pack'         => 'platinum_reseller'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: changepass_reseller

Changes the SonicPanel panel login password of an existing reseller account. The response returns the reseller username and the new password as panel_pass. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('changepass_reseller', [
    'reseller_username' => 'resellertest',
    'password'          => 'NewResellerPassword456!'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: suspend_reseller

Suspends a reseller and halts all radio streams created under this reseller account. The response also returns the reseller username. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('suspend_reseller', [
    'reseller_username' => 'resellertest'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: unsuspend_reseller

Unsuspends a reseller account and restarts all radio servers owned by that reseller. The response also returns the reseller username. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('unsuspend_reseller', [
    'reseller_username' => 'resellertest'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
POST ROOT ONLY Action: terminate_reseller

WARNING: All radios under the reseller, including all associated data, will be permanently deleted. This action cannot be undone.

Permanently deletes a reseller account, including all radio accounts, media libraries, playlists, and packages created by that reseller. The response also returns the reseller username. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('terminate_reseller', [
    'reseller_username' => 'resellertest'
]);

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>
Reseller Information
Read-only actions that return reseller information. Root only.
POST ROOT ONLY Action: all_resellers

Retrieves a list of all reseller accounts hosted on the server with package names, assigned limits, email, and active status. Only root can call this action.

PHP Example
<?php
require_once 'SonicPanelAPI.php';

$sp = new SonicPanelAPI();

$response = $sp->call('all_resellers');

echo '<pre>' . json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . '</pre>';
?>