Rebecca API

Current version: V1.1.0

elyar/rebecca-api (namespace Elyar\RebeccaApi) is a standalone PHP client for the Rebecca VPN panel API. Like Marzban API, it has no dependency on Essence or any telegram-bot-essentials/* package — it's a plain Laravel-Http-based HTTP client, structurally identical to Marzban API but covering a larger, more feature-rich panel API surface (ads, per-service usage analytics, panel/subscription/Telegram settings, TLS certificate management, and more).

Installation

composer require elyar/rebecca-api

Requires Laravel (illuminate/http for the Http facade).

Authenticating and creating a client

Identical pattern to Marzban API:

use Elyar\RebeccaApi\RebeccaClient;

$client = RebeccaClient::loginAndMake($baseUrl, $username, $password);
// or
$client = RebeccaClient::make($baseUrl, $token);
// or, to manage the token/expiry yourself
$accessToken = RebeccaClient::authenticate($baseUrl, $username, $password);
$accessToken->token;
$accessToken->expiresAt;
$accessToken->isValid(now(), bufferSeconds: 60);

$client->base() issues a bare GET / — useful as a lightweight reachability/health check before doing real work.

Available groups

Same lazy-accessor pattern as Marzban API ($client->group()->method()), but with more groups reflecting Rebecca's larger API:

Group	Notable methods
admin()	createAdmin, modifyAdmin, removeAdmin, getAdmins, bulkUpdateStandardAdminPermissions, disableAdminAccount/enableAdminAccount, getAdminUsage, getAdminUsageChart, getAdminUsageDaily, getAdminUsageByNodes
user()	Same shape as Marzban's UserApi — addUser, getUser, modifyUser, removeUser, getUsers, resetUserDataUsage, revokeUserSubscription, getUserUsage, activeNextPlan, setOwner, getExpiredUsers, deleteExpiredUsers
userTemplate()	addUserTemplate, getUserTemplates, getUserTemplate, modifyUserTemplate, removeUserTemplate
serviceV2()	getServices, createService, getServiceDetail, modifyService, deleteService, createServiceAutoInbound, deleteServiceAutoInbound, resetServiceUsage, getServiceUsers, performServiceUsersAction, plus usage-timeseries endpoints (getServiceAdminUsageTimeseries, getServiceUsageByAdmin, getServiceUsageTimeseries)
node()	Everything Marzban's NodeApi has, plus issueNodeCertificate, getMasterNodeState/updateMasterNodeState, resetMasterNodeUsage, regenerateNodeCertificate, updateNodeGeo, restartNodeService/updateNodeService, getNodeUsageDaily, resetNodeUsage, updateNodeCore
core()	Beyond stats/config: getAccessInsights, getMultiNodeAccessInsights, getRawAccessLogs, resolveAccessLogOperators, geo-asset management (listGeoTemplates, applyGeoAssets, updateGeoAssets), Warp integration (getWarpAccount, registerWarpAccount, updateWarpLicense, ...), listXrayReleases/updateCoreVersion, getOutboundsTraffic/resetOutboundsTraffic
system()	Beyond inbounds/hosts: redisStatus, getInboundsFull, createInbound/updateInbound/deleteInbound, updateHostStatus, maintenance-mode controls (getMaintenanceInfo, restartPanelFromMaintenance, softReloadPanelFromMaintenance, updatePanelFromMaintenance), and crypto/cert generation helpers (generateEchCert, generateMldsa65, generateRealityKeypair, generateRealityShortid, generateVlessEncryptionKeys)
subscription()	Same as Marzban plus *ByKey variants (userSubscriptionByKey, userSubscriptionInfoByKey, userGetUsageByKey, userSubscriptionWithClientTypeByKey) for key-based (rather than username-based) subscription lookup
settings()	getPanelSettings/updatePanelSettings, getSubscriptionSettings/updateSubscriptionSettings/updateAdminSubscriptionSettings, issueCertificate/renewCertificate, subscription template content, getTelegramSettings/updateTelegramSettings
myAccount()	getMyAccount, listApiKeys/createApiKey/deleteApiKey, changePassword, getMyAccountNodes
ads()	readAds

Error handling

Identical to Marzban API — HttpClient::request() throws Elyar\RebeccaApi\Exceptions\ApiUnauthorizedException on HTTP 401 and ApiException for any other non-2xx response, both carrying the status code and response body.

Relationship to Marzban API

This package and Marzban API are independent clients for two different panels with no shared code (each has its own HttpClient, AccessToken, exceptions, etc.) but an intentionally identical shape (*Client::make()/loginAndMake()/authenticate(), lazy per-section *Api accessors extending BaseApi). If your bot resells access to both panel types, both clients can be used side by side without any naming or behavioral surprises.