For developers

Activation API

Activate your customers’ GR keys on your side – your website, bot or store. The same steps as on this page: check the key, collect the details, activate, get the result.

Base URL
https://grossasupply.online/api/v1

Access

Get an API key in the Grossa bot: “API” → “New key” → “Activation” scope. Send it as Authorization: Bearer gra_… (or X-Api-Key). You can only activate keys from your own orders.

Open the bot ↗

How it works

  1. check – check the key: which product it is, which fields to ask the customer and which rules to show.
  2. Show the rules and fields to the customer: type, label, hint, options, instructions and images.
  3. validate – optionally validate the answers before activation: errors come per field.
  4. activate – redeem the key and start delivery. Repeating with the same key returns the same activation (repeated: true).
  5. Poll the status every 3–5 seconds until final is true. When done, result holds the data (login, password, 2FA key, code or link) and instruction tells what to do with it.
Example
curl -X POST https://grossasupply.online/api/v1/activation/check \
  -H "Authorization: Bearer gra_…" \
  -H "Content-Type: application/json" \
  -d '{"key":"GR-XXXX-XXXX-XXXXXX-X"}'

Endpoints

POST/activation/check
Check a key

state: available – can be activated; activated – already activated (activationId – its status).

{ "key": "GR-XXXX-XXXX-XXXXXX-X" }
{ "ok": true, "key": "GR-…", "state": "available",
  "product": { "service": "ChatGPT", "plan": "Plus", "durationDays": 30 },
  "fields": [ { "key": "session_json", "label": "…", "type": "TEXTAREA", "isRequired": true, … } ],
  "rules": [ { "title": "…", "body": "…" } ], "guide": [ … ] }
POST/activation/validate
Validate details

Redeems nothing. Errors come in errors by field key.

{ "key": "GR-…", "data": { "session_json": "…" } }
{ "ok": true, "valid": true }
POST/activation/activate
Activate

Redeems the key and starts delivery.

{ "key": "GR-…", "data": { "session_json": "…" } }
{ "ok": true, "activationId": "cm…", "status": "QUEUED", "repeated": false }
GET/activation/{id}
Status and result

Poll until final is true.

{ "ok": true, "id": "cm…", "status": "COMPLETED", "final": true,
  "result": { "login": "…", "password": "…", "totp": "…" },
  "instruction": { "title": "…", "lead": "…", "steps": [ … ], "link": null },
  "events": [ … ], "challenge": null, "replacement": null }
POST/activation/{id}/cancel
Cancel

Before delivery starts (canCancel: true): the key is returned and details can be entered again.

{ "ok": true }
POST/activation/{id}/challenge
Check passed

After the customer passes the Stripe check.

{ "ok": true }
GET/me
Key and limits

Key scopes, enabled APIs and limits.

{ "ok": true, "key": { "scopes": ["activation"] }, "limits": { "requestsPerMinute": 120 } }

Activation statuses

QUEUED → PROCESSING / AWAITING_SUPPLIER → COMPLETED. FAILED – did not work, NEEDS_ADMIN – being completed manually (wait, the status changes by itself), CANCELLED – cancelled (the key can be activated again).

Payment check

Sometimes the payment system asks to confirm a human is paying: the status contains challenge (Stripe clientSecret and publishableKey). Run the check in the customer’s browser with Stripe.js (stripe.handleNextAction) and then call /activation/{id}/challenge. About 5 minutes in total.

Errors

An error response has ok: false, a code in error and a human-readable message; field errors are in errors. Response language – ?lang=ru or the Accept-Language header (English by default).

{ "ok": false, "error": "invalid_fields", "message": "…", "errors": { "session_json": "…" } }

Limits

Up to 120 requests per minute per key; above that – 429 with a Retry-After header.

Activation API – Grossa