One endpoint for Dhru and GSM Hub clients
List services and account-specific prices, place IMEI/server/file orders, and retrieve results using the client format your software already supports.
Endpoint and authentication
POST https://fastunlocking.co.uk/api/index.php
Required form fields
username — your Fast Unlocking Hub account email or account nameapiaccesskey — an active key from My Accountaction — action name belowrequestformat — JSONparameters — encoded as described below
Get a key
Log in and open My Account → API Key Details. Generate a fuh_-prefixed key, copy it when it is shown once, restrict its allowed IPs and permissions, and keep it secret. Only a one-way key hash remains in the database. Pricing and service access are resolved from the authenticated account—never from values sent by the caller.
Ready-to-use script settings
Dhru Fusion / Dhru-compatible sites
API type: Dhru Fusion
API URL: https://fastunlocking.co.uk/api/index.php
Username: your account email or account name
API key: generated in My Account
Currency: USD
One Dhru connection imports IMEI, server and remote services. Dhru officially uses imeiservicelist, placeimeiorder and getimeiorder for both IMEI and server services.
GSM Hub sites
Use the same endpoint, username and key. For IMEI services select the Dhru/IMEIFusion connector. For server services select Dhru Server / Gsmhub Server+ when the GSM Hub panel separates API types.
Do not select DhruFileService for IMEI or server services. Use DhruFileService only for file-upload services. If the script requires separate IMEI and server connections, add the same FastUnlocking credentials to both.
Supported request formats
Dhru format
parameters is base64-encoded JSON (base64 XML is also accepted).
{
"ID": 123,
"IMEI": "123456789012345"
}GSM Hub format
parameters is raw XML generated by the GSM Hub IMEIFusion class.
<PARAMETERS> <ID>123</ID> <IMEI>123456789012345</IMEI> <REQUESTID>shop-order-84721</REQUESTID> </PARAMETERS>
For compatibility, common parameters may also be posted directly as form fields. JSON responses use the familiar SUCCESS or ERROR envelope.
Actions
| Action | Parameters | Purpose | Compatibility |
|---|---|---|---|
accountinfo | None | Wallet credit, currency and account email. | Dhru + GSM Hub |
imeiservicelist | None | Enabled non-file services with your exact tier/custom prices. | Dhru + GSM Hub |
serverservicelist | None | Server and remote-server services; includes REQUIRED JSON where applicable. | GSM Hub |
fileservicelist | None | Enabled file services. | GSM Hub |
getimeiservicedetails | ID | Details and authenticated price for one visible service. | GSM Hub |
modellist | ID accepted | Configured brand/model reference catalog. | GSM Hub |
providerlist | ID accepted | Configured country/provider reference catalog. | GSM Hub |
meplist | ID accepted | Returns an empty list when no MEP catalog is configured. | GSM Hub |
placeimeiorder | ID; IMEI for IMEI services, or server custom fields; unique REQUESTID recommended | Creates and atomically charges IMEI, server or remote orders through the standard Dhru action. | Dhru + GSM Hub |
getimeiorder | ID (order reference) | Returns only an order owned by the authenticated customer. | Dhru + GSM Hub |
placeserverorder | ID, QUANTITY=1, REQUIRED JSON; unique REQUESTID recommended | Creates a server/remote order using its required fields. | GSM Hub |
getserverorder | ID (order reference) | Retrieves an owned server order. | GSM Hub |
placefileorder | ID, FILENAME, base64 FILEDATA; unique REQUESTID recommended | Validates, stores and charges a file order. | GSM Hub |
getfileorder | ID (order reference) | Returns status and, when available, base64 result file data. | GSM Hub |
placeimeiorderbulk | Up to 100 keyed order objects | Bulk placement with per-item isolation. | Dhru extension |
getimeiorderbulk | Up to 100 keyed reference objects | Bulk status retrieval with per-item isolation. | Dhru extension |
Examples
GSM Hub-compatible PHP request
$xml = new DOMDocument('1.0', 'UTF-8');
$root = $xml->createElement('PARAMETERS');
$xml->appendChild($root);
$root->appendChild($xml->createElement('ID', '123'));
$root->appendChild($xml->createElement('IMEI', '123456789012345'));
$post = [
'username' => 'reseller@example.com',
'apiaccesskey' => 'YOUR_API_KEY',
'action' => 'placeimeiorder',
'requestformat' => 'JSON',
'parameters' => $xml->saveXML($xml->documentElement),
];
$ch = curl_init('https://fastunlocking.co.uk/api/index.php');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($post),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_TIMEOUT => 45,
]);
$response = json_decode((string)curl_exec($ch), true);
Dhru-compatible parameters
$parameters = base64_encode(json_encode([
'ID' => 123,
'IMEI' => '123456789012345',
'REQUESTID' => 'shop-order-84721',
]));
GSM Hub server order
<PARAMETERS>
<ID>123</ID>
<QUANTITY>1</QUANTITY>
<REQUIRED>{"SERIAL_NUMBER":"ABC123456"}</REQUIRED>
<REQUESTID>server-order-84722</REQUESTID>
</PARAMETERS>
GSM Hub file order
<PARAMETERS> <ID>123</ID> <FILENAME>device.bin</FILENAME> <FILEDATA>BASE64_FILE_BYTES</FILEDATA> <REQUESTID>file-order-84723</REQUESTID> </PARAMETERS>
Maximum decoded file size: 25 MB. Allowed extensions: zip,rar,7z,bin,cert,crt,pem,txt,log,img,tar,gz,hex,mbn,dat,backup.
Order status values
0 pending, 1 submitted/processing/attention, 3 rejected/refunded/error, 4 completed. Successful responses use SUCCESS; failures use ERROR. The placement response REFERENCEID is used for the matching get-order action.
Security, permissions and retry safety
API keys are shown once and stored only as SHA-256 hashes. Each key may be restricted by IP, rate, action scope (read, order or results), and service type (IMEI, server/remote or file). HTTPS is required.
For every placement request, send a stable unique REQUESTID, ORDERREF, IDEMPOTENCYKEY or CLIENTREF. References are account-wide across all of your API keys. Retrying the same reference with the same data returns the existing REFERENCEID without another wallet charge. Reusing it with different data is rejected. Accounts with duplicate orders disabled also receive a short legacy duplicate guard when no request reference is supplied.
Every service lookup enforces the authenticated account's tier, service-type permissions, and per-client group/individual Access Service rules. A blocked service remains unavailable even when its numeric ID is submitted directly. Prices are calculated server-side, wallet deductions are row-locked and atomic, order queries are owner-scoped, authentication failures are rate-limited and audited, and file bytes are stored outside the public web root.