cPanel

Let Konrado check the hosting account behind each ticket, through the WHM API or the Konrado plugin.

Hosting panel

The hosting account behind every ticket

With cPanel connected, Konrado checks the hosting account behind a ticket: the plan, the domains, DNS, SSL, mail and disk use. It only reads. Nothing on your server changes.

You connect a server in one of two ways. With the API, Konrado reads WHM with a token and nothing is installed. With the Konrado plugin, you run one command as root and Konrado also reads the firewall, CloudLinux and Imunify. The API is the current way. The plugin is the legacy way: it keeps working where it is installed, and a new server should use the API. Pick a tab below: every section follows your choice.

API

Nothing to install

A WHM API token for root or a reseller.

Konrado plugin

Legacy method

One command as root. Adds firewall, CloudLinux and Imunify data.

Access

Read-only

Konrado never changes an account.

Agents get

Account lookups

For the customer behind each ticket.

What Konrado reads

Data	How it helps
Account	Plan, limits, usage, domains and the account's owner
Website	Document roots, addon, parked and subdomains, DNS records and SSL details
Mail	Mailboxes, forwarders, autoresponders, filters and delivery events of the last 24 hours
Databases	MySQL databases, their users and the database server's version
Files	A short listing of the document root and the FTP accounts
Backups	cPanel backups, and JetBackup 5 backups where it is installed
Server	Load, disks, services and installed components. Only with a root token

A reseller token reads only the accounts that reseller owns. A root token reads every account and the server.

Data	How it helps
Account and owner	Username, owner or reseller, plan, quota, domains and account status
Domain setup	Main, addon, parked and subdomains, document root, IP, DNS zone, SSL and PHP version
Mail	Mailboxes, forwarders, autoresponders, mailbox size, recent Exim delivery logs, bounces, rejections, deferrals and the mail queue
Usage	Disk, bandwidth, load, services, and CloudLinux (LVE) history where it runs
Backups	JetBackup 5 accounts, backups, downloads, logs and alerts, where it is installed
Security	The CSF status of an IP, and Imunify360 or ImunifyAV malware, scan and WAF results where they run

What Konrado cannot do

Not possible	Why
Create, suspend, upgrade or delete an account	Konrado reads. Account changes stay in WHM or your billing system
Change DNS, mail, PHP, SSL, files, databases or cron jobs	Konrado can read them, not change them
Restore a backup, clean malware, unblock an IP or clear the mail queue	Backup, security and mail data are for diagnosis only
Show passwords, keys or the contents of mail	Secrets and private messages never go into a reply
See past the server	A problem at the registrar, a CDN or another mail host needs its own check
Run shell commands	Konrado uses fixed lookups, not a terminal
Read the firewall, CloudLinux or Imunify over the API	Those come only with the Konrado plugin

Security model

Konrado calls WHM over HTTPS with one API token you can revoke at any time. Never type the WHM password into Konrado. After you save the token, the console shows only its last characters.

Only https:// addresses work, and the TLS certificate must be valid.
The address must lead to a public IP. Konrado refuses private, loopback and other internal ranges.
Konrado limits the size of each answer and removes secrets from it first.
Konrado uses seven fixed lookups. It cannot call any other WHM function.

Security model

The install command carries a key that links the server to your organization, so treat it like a password. Konrado then calls the plugin on port 8000, the default. Open that port to Konrado's IP addresses and to no one else.

Example ticket questions

"example.com stopped working after a DNS change. Is it on the right account and document root?"
"Webmail is empty for sales@example.com. Does the mailbox exist on the server?"
"Mail from example.com bounces. Is there delivery evidence for the reply?"
"AutoSSL fails for an addon domain. Do the domain and certificate details explain it?"
"The account is out of disk space. Is it files, mail, databases, backups or logs?"
"The customer says this domain is theirs, but billing does not match. Is it on a reseller's account?"

Before you start

cPanel & WHM 110 or newer. Konrado was tested end to end on version 11.134.
WHM at a public HTTPS address with a valid certificate, on port 2087 unless you enter another.
A WHM root or reseller account that can create an API token.
If WHM sits behind a firewall, allow Konrado's IP addresses to reach the WHM port.
Your help desk connected, with the customer's hosting service in your billing system. Konrado finds the account through that service, so its server needs the same hostname or IP as the WHM address.

Root SSH access to the cPanel server, with curl, unzip and systemd.
Outbound internet access. The installer downloads the plugin and reports to app.konrado.ai.
Port 8000 open to Konrado's IP addresses (see the list).
Your help desk connected, with the customer's hosting service in your billing system. Konrado finds the account through that service, so its server needs the same hostname or IP as the server you install on.

Connect

Create a WHM API token

Sign in to WHM as the root or reseller account Konrado should use. Open Development › Manage API Tokens and click Generate Token. Enter a name such as konrado and pick an expiry that fits how you rotate credentials. In Whitelisted IPs, enter Konrado's IP addresses (see the list), or leave it empty to accept the token from any address.

WHM Generate API Token form with the token name, the expiry choice and Whitelisted IPs

Allow the read privileges

Under Privileges, clear everything Konrado does not need and allow these:

WHM privilege	API value
Account Summary	`acct-summary`
Basic System Information	`basic-system-info`
Basic WHM Functions	`basic-whm-functions`
Perform cPanel API and UAPI functions through the WHM API	`cpanel-api`
Manage DNS Records	`manage-dns-records`
MySQL Information	`mysql-info`
SSL Information	`ssl-info`
Track Email	`track-email`
List Accounts	`list-accts`
View Server Status	`status`
View Server Information	`stats`

Never allow account creation, termination, suspension, password changes, service restarts, Manage API Tokens or Create User Session. Konrado does not need them.

The Server lookup needs root scope. In WHM that can mean All Features (all), which gives the token full root access even though Konrado only reads. Prefer a reseller token unless you need server health, and protect a root token with an IP list and regular rotation.

Save and copy the token

Click Save. WHM shows the token once. Copy it into your password manager. If you lose it, revoke it and create a new one.

The WHM API Tokens list with the new token and its whitelisted IP addresses

Connect in Konrado

Open Workspace SettingsIntegrations, click Add integration and choose cPanel. API Token is already picked under How should Konrado reach this server?

The cPanel sheet: API Token picked over Konrado plugin, then the Integration Name, WHM URL, Username and API Token fields

Field	What to enter
Integration Name	A name for your team, such as `WHM EU`
WHM URL	The WHM address, such as `https://panel.example.com:2087`. Port 2087 is used when you leave it out. Not the cPanel port 2083
Username	The root or reseller account that created the token
API Token	The token from WHM

Click Test Connection. A green box confirms the token and shows the cPanel version. Click Connect.

The plugin is the legacy way to connect. Servers already connected with it keep working. For a new server, pick the API tab, unless you need the firewall, CloudLinux or Imunify data that only the plugin reads.

Choose the plugin. Open Workspace SettingsIntegrations, click Add integration and choose cPanel. Under How should Konrado reach this server? pick Konrado plugin. The sheet shows three steps and the install command.

Run the command as root. Log in to your cPanel server over SSH as root. Click the copy button next to the command and paste it into the session. The sheet hides your key on screen, but the copied command contains it, so treat it like a password. The key works for 24 hours, on as many servers as you like.

bash <(curl -s https://repo.konrado.ai/init.sh) --api-key=YOUR_KEY --callback-url=https://app.konrado.ai/api/integrations/servers/install --platform=cpanel

Answer the installer. It asks for a few settings, each with a default: press Enter to keep it. Two answers matter. To update the plugin from the console later, answer Yes to Do you want to be able to upgrade this plugin through the Konrado panel? The server address it suggests, such as http://203.0.113.10:8000/mcp, is where Konrado connects to the plugin.

Wait for the connection. The sheet reads Listening for your server… and checks every 5 seconds. When the plugin reports back it shows Connected successfully and the server's address. Click Done. You can close the sheet earlier: the server joins the list once it connects. Running the command again is safe.

Check it works

The server is on the Integrations page as Connected. Its Type reads cPanel · API, with the cPanel version under it. Konrado tests the connection again every hour. Open the row and the Tools tab lists the seven lookups.

The Tools tab of a connected cPanel server: seven read-only lookups, from cpanel_get_client_account to cpanel_get_server_status, each marked Reads

To change the token later, open the row, click Replace next to API Token, paste the new one and click Save.

The server is on the Integrations page as Connected. Its Type reads cPanel · Plugin, with the plugin version under it. The row is named cpanel Server: click it to rename it. Running the install command again sets the name back. Konrado tests the connection again every hour.

If something is wrong

Open the row on the Integrations page. A server that stopped working says Not working, what to check, and the exact error under Technical details.

What you see	What to do
cPanel WHM URL must use HTTPS.	Enter the full `https://` address. Plain HTTP does not work
cPanel WHM URL cannot contain credentials, query parameters, or a fragment.	Enter only the address and port, such as `https://panel.example.com:2087`
cPanel TLS verification failed.	Install a valid certificate for the WHM hostname, with the full chain
cPanel rejected the configured WHM API token.	Check that the username created the token, that you copied all of it, and that it has not expired or been revoked
This cPanel token cannot read that capability.	Allow the privileges above, or check that the reseller owns the account
The cPanel API request timed out.	Check that WHM answers on its port and that your firewall lets in Konrado's IP addresses (see the list)
The address points to a private network	Use a public hostname. Konrado refuses private and internal addresses
No server health	Server health needs a root token
Backups are missing	Check the token's privileges, and that JetBackup 5 is installed if you expect its backups
Konrado looks at the wrong account	Check that the ticket's service in your billing system sits on this server

What you see	What to do
The command stops at once	Run it as root on the cPanel server itself
Listening for your server… never changes	Check that the installer finished without errors and that the server reaches `app.konrado.ai` over HTTPS. After 2 minutes the sheet shows Taking longer than expected? with the same checks
Panel data is missing	Check that this server runs cPanel and that you picked cPanel in the console
Konrado looks at the wrong account	Check that the ticket's service in your billing system sits on this server

The install step shows Connection error. It names the server address and the reason. Check both plugin services, read their recent logs and restart them:

systemctl status   konrado-server.service konrado-root.service
journalctl         -u konrado-server.service -u konrado-root.service --since "15 minutes ago" --no-pager
systemctl restart  konrado-server.service konrado-root.service
systemctl enable   konrado-server.service konrado-root.service
ss -ltnp | grep ':8000'

The last line shows whether the plugin listens on port 8000. Konrado must reach that port: allow Konrado's IP addresses in your firewall. Then run the install command again.

Remove the integration

Open Workspace SettingsIntegrations, open the row menu (three dots) and choose Delete. Then revoke the token in WHM under Development › Manage API Tokens.

To stop for now and keep the settings, choose Disconnect instead.

Uninstall the plugin from the server, then open Workspace SettingsIntegrations, open the row menu (three dots) and choose Delete.

To stop for now and keep the settings, choose Disconnect instead.

On this page