---
name: phylex-reseller-api
description: Safely integrate an approved reseller workspace with the Phylex Reseller API v1.
---

# Phylex Reseller API

Use this skill only for server-side integrations owned by the reseller that issued the key.

## Required rules

1. Read `https://billing.phylex.net/docs/api/reseller` and `https://billing.phylex.net/docs/api/security` before writing code.
2. Use `https://billing.phylex.net/openapi/reseller-api-v1.yaml` as the endpoint contract.
3. Read the key from `PHYLEX_API_KEY`. Never print, log, embed, commit, or return it.
4. Send the key in `Authorization: Bearer`. Never put it in a URL or browser bundle.
5. Use only public references returned by the API. Never invent or persist internal numeric IDs.
6. Treat `404` as opaque. Do not attempt to distinguish a missing object from another tenant's object.
7. Request the narrowest scopes and use a fixed-egress CIDR allowlist where possible.
8. Use bounded timeouts and retries. Retry mutations only when the endpoint contract explicitly supports idempotency, using the same key and payload.
9. Do not add credential, console, payment, or provider-control behavior that is absent from the OpenAPI contract.

## Workflow

- Identify the exact operation and required scope.
- Generate or update a typed client from OpenAPI.
- Validate all user-controlled input before the API call.
- Map stable error codes without exposing raw upstream messages.
- Add tests for success, insufficient scope, revoked key, cross-tenant reference, timeout, and retry behavior.
- Return a concise verification summary without secret values.