Users

Every route on this page needs the users scope. A user’s sessions and sign-in history are under Logins and audit (scope logins).

List users

GET/seller/v1/usersscope: users

Query	Notes
app_id	Your token’s app
q	Username (up to 32 characters)
banned	true or false
page, page_size	See paging

200 OK

{
  "ok": true,
  "data": {
    "items": [
      {
        "id": "usr_9206d97f8a2f426a9dc457b0177ae800",
        "app_id": "app_ea9745b1df9e4a9bacb22cb1c200993b",
        "app_name": "My App",
        "username": "carol",
        "login_method": "key",
        "hwid": "4ccd18389bb5a0309978674695321f6f7b1fa67c12ca8392e5f115d73886e85e",
        "hwid_check": null,
        "banned": 0,
        "ban_reason": null,
        "created_at": 1794497606,
        "last_login": 1794497606,
        "last_login_ip": "203.0.113.24",
        "hwid_resets_used": 0,
        "paused_at": null,
        "keys_redeemed": 1,
        "active_sessions": 1,
        "subscriptions": [
          { "tier_id": "tier_048ef9f8f38c4ab2af05db05bbde4aed", "tier": "Default", "level": 1, "expires_at": 1797089606, "active": true }
        ],
        "max_hwid_resets": 1,
        "hwid_locked": true,
        "hwid_lock_source": "app"
      }
    ],
    "total": 3,
    "page": 1,
    "page_size": 50
  }
}

• login_method is password or key (a key-login account).
• subscriptions[].expires_at is null for lifetime tiers.
• hwid_lock_source says which setting decided hwid_locked: user, key or app.

Ban and unban

POST/seller/v1/user/banscope: users

Ends the user’s sessions at once and refuses new sign-ins.

Field	Type	Required	Notes
user_id	string	yes
reason	string	no	Up to 200 characters

200 OK

{ "ok": true, "data": { "banned": true, "sessions_revoked": 1 } }

POST/seller/v1/user/unbanscope: users

Request

{ "user_id": "usr_9206d97f8a2f426a9dc457b0177ae800" }

200 OK

{ "ok": true, "data": { "banned": false } }

Pause and unpause

POST/seller/v1/user/pausescope: users

Stops the user’s subscriptions counting down. A paused user can’t sign in (USER_PAUSED).

Request

{ "user_id": "usr_4d97591b6d9040f38bc196b6b4ac0236" }

200 OK

{ "ok": true, "data": { "paused": true } }

POST/seller/v1/user/unpausescope: users

Gives back exactly the time the user was paused for.

200 OK

{ "ok": true, "data": { "paused": false, "seconds_returned": 86400, "tiers": ["Default"] } }

HWID lock

POST/seller/v1/user/hwid-checkscope: users

Sets this user’s PC lock. The user setting wins over keys and the app.

Field	Type	Required	Notes
user_id	string	yes
hwid_check	boolean or null	yes	true always lock, false never lock, null follow keys and app

200 OK

{ "ok": true, "data": { "user_id": "usr_4d97591b6d9040f38bc196b6b4ac0236", "hwid_check": false } }

POST/seller/v1/user/reset-hwidscope: users

Frees the user’s PC lock so they can sign in from a new PC. Counts against their allowance and respects the app’s cooldown.

Field	Type	Required	Notes
user_id	string	yes
force	boolean	no	Ignore the allowance. Owner only, not available to tokens

200 OK

{ "ok": true, "data": { "reset": true, "hwid_resets_used": 1, "allowance": 1 } }

When no PC is bound yet, nothing is used up:

200 OK

{ "ok": true, "data": { "reset": false, "reason": "No HWID is bound" } }

409 HWID_RESET_QUOTA_EXCEEDED when the allowance is used up; 409 HWID_RESET_COOLDOWN when the last reset was too recent.

Rename

POST/seller/v1/user/renamescope: users

Field	Type	Required	Notes
user_id	string	yes
username	string	yes	3 to 32 letters, digits, _, ., -; unique in the app

200 OK

{ "ok": true, "data": { "username": "alice2" } }

409 USERNAME_TAKEN if another account in the app has it.

Per-user variables

The small values your app stores on a user’s account (up to 50, 4 KB each).

GET/seller/v1/user/variablesscope: users

Query	Required
user_id	yes

200 OK

{ "ok": true, "data": { "items": [{ "name": "theme", "value": "dark", "updated_at": 1794497607 }] } }

POST/seller/v1/user/variable/setscope: users

Field	Type	Required	Notes
user_id	string	yes
name	string	yes	Letters, digits, _, ., -, up to 64
value	string or null	yes	Up to 4096 characters. null deletes it

200 OK

{ "ok": true, "data": { "saved": true } }

Add or subtract time

POST/seller/v1/users/timescope: users

For some users or for every user in the app.

Field	Type	Required	Notes
app_id	string	yes
user_ids	string[]	one of these	1 to 1000 users
all_users	boolean	one of these	true for every user. Give user_ids or all_users, not both
tier_id	string or null	no	Only this tier; absent or null for all of the user’s tiers
seconds	integer	yes	Positive adds, negative subtracts. Not 0; at most ten years either way
reason	string	no	Up to 200 characters

Request

{ "app_id": "app_ea9745b1df9e4a9bacb22cb1c200993b", "all_users": true, "seconds": 86400, "reason": "outage on 12 Nov" }

200 OK

{ "ok": true, "data": { "adjustments": 3 } }

adjustments counts the subscriptions changed.

Delete a user

POST/seller/v1/user/deletescope: users

Removes the account and the keys linked to it.

Request

{ "user_id": "usr_9206d97f8a2f426a9dc457b0177ae800" }

200 OK

{ "ok": true, "data": { "deleted": true, "keys_deleted": 1 } }

Whole-app tools

POST/seller/v1/users/unban-allscope: users

Request

{ "app_id": "app_ea9745b1df9e4a9bacb22cb1c200993b" }

200 OK

{ "ok": true, "data": { "unbanned": 0 } }

POST/seller/v1/users/delete-expiredscope: users

Deletes users with no active subscription, 500 accounts at a time. Paused users and accounts made in the last hour are left alone. Call it again with next_offset while remaining is true.

Field	Type	Required	Notes
app_id	string	yes
offset	integer	no	Default 0; pass the previous next_offset

200 OK

{ "ok": true, "data": { "checked": 500, "deleted": 212, "next_offset": 288, "remaining": true } }

POST/seller/v1/users/reset-all-hwidsnot available to tokens

Resets every user’s PC lock. Owner only: a token gets 403 FORBIDDEN. Use the panel.

Export users

GET/seller/v1/users/exportscope: users

Up to 5,000 users, oldest first.

Query	Required
app_id	yes

200 OK

{
  "ok": true,
  "data": {
    "items": [
      {
        "id": "usr_4d97591b6d9040f38bc196b6b4ac0236",
        "username": "alice",
        "login_method": "key",
        "hwid": null,
        "banned": 0,
        "ban_reason": null,
        "paused_at": null,
        "created_at": 1794497605,
        "last_login": 1794497605,
        "last_login_ip": "203.0.113.24",
        "subscriptions": "Default:1797179605"
      }
    ],
    "truncated": false
  }
}

subscriptions is tier:expires_at pairs separated by spaces, with lifetime in place of a time for lifetime tiers.

Blacklist

Blocks PCs and IP addresses from the app. See Blacklist.

GET/seller/v1/blacklistscope: users

Query	Required
app_id	yes

200 OK

{
  "ok": true,
  "data": {
    "items": [
      { "id": "bl_ea13fe49ab37464c9be58b59e6a0d500", "type": "hwid", "value": "e77c589552ba961b5d6ae3a743e7ea69c04b6f7dbb606895b26a717c72dd8810", "reason": "cracked build", "created_at": 1794497607, "created_by": "tok_2ad338dbbfe44929977a4c4525a9e274" }
    ]
  }
}

POST/seller/v1/blacklist/addscope: users

Matching sessions end at once.

Field	Type	Required	Notes
app_id	string	yes
type	string	yes	hwid or ip
value	string	yes	A 64-character hex HWID, or an IPv4 / IPv6 address
reason	string	no	Up to 200 characters

200 OK

{ "ok": true, "data": { "added": true, "sessions_revoked": 0 } }

The new entry’s ID is in the list.

POST/seller/v1/blacklist/removescope: users

Request

{ "entry_id": "bl_ea13fe49ab37464c9be58b59e6a0d500" }

200 OK

{ "ok": true, "data": { "removed": true } }

Free devices

PCs using the app’s free mode.

GET/seller/v1/free-devicesscope: users

Query	Notes
app_id	Required
q	Part of a HWID or IP address (up to 64 characters)
status	banned or converted
page, page_size	See paging

200 OK

{
  "ok": true,
  "data": {
    "items": [
      {
        "id": "dev_bb0945821ca7419e9ce38e951b678d5b",
        "hwid": "f7cb1fde8e5b66efff9f155b10ba8d442f6e09c17d062dd0cbfa1c2d5d3ba4f8",
        "first_seen_at": 1794497606,
        "last_seen_at": 1794497606,
        "last_version": "1.4.2",
        "last_ip": "203.0.113.50",
        "logins": 1,
        "banned": 0,
        "ban_reason": null,
        "user_id": null,
        "username": null,
        "converted_at": null,
        "online": 1
      }
    ],
    "total": 1
  }
}

user_id, username and converted_at are set once the PC has signed in to an account.

POST/seller/v1/free-device/banscope: users

Field	Type	Required	Notes
device_id	string	yes
reason	string	no	Up to 200 characters

200 OK

{ "ok": true, "data": { "banned": true } }

POST/seller/v1/free-device/unbanscope: users

200 OK

{ "ok": true, "data": { "banned": false } }

POST/seller/v1/free-device/deletescope: users

Forgets the PC. If it signs in again it is a new free device.

200 OK

{ "ok": true, "data": { "deleted": true } }