How to retrieve remote FTP backup file list via API (password hidden)

[amoozesh98com]

Hey everyone,

I'm developing a WHMCS module for our DirectAdmin servers and I've hit a wall. The goal is to let our users see what backup files are available on the remote FTP server (the one configured in Admin Backup/Reseller Backup) so they can request a specific restore date via a support ticket.

Everything works fine for local backups – I can get the settings via CMD_API_ADMIN_BACKUP?json=yes and even list the files. But for remote FTP backups, the API returns all the FTP connection details except the actual password. It just shows XXXXXXXXXX or an empty string for ftp_password. I've tried:

• CMD_API_ADMIN_BACKUP (raw & JSON) – password masked.
• CMD_API_ADMIN_BACKUP_MODIFY?cron=2 – same.
• CMD_API_USER_BACKUP and CMD_API_SITE_BACKUP – either empty password or "You do not own that domain".
• Logging in with a session cookie and parsing the HTML of the backup page – the password field is still XXXXXXXXXX and obviously the browser just shows dots.
• Task queue, cron jobs API – no password there either.
• Even trying to read the config files via the file editor API (CMD_API_FILE_EDITOR) just redirects to the login page.

I understand this is a security measure – you shouldn't be able to pull plaintext passwords via the API. But is there any official way to list the contents of the remote FTP backup directory without knowing the password? Something like an API call that uses the stored credentials internally and returns the file list? Or maybe a hook/script that runs on the server and can be triggered via API?

I'm running the latest Evolution skin, and the backup cron is working perfectly (I can see the backup progress and files in the DA panel). I just need a way to expose that file list to my module so users can pick a backup date for restore.

Any pointers would be greatly appreciated. If there's truly no way, I'll just have to ask the admin to manually enter the FTP password into a custom field, but that's not ideal.

Thanks in advance!

 

[sysdev]

Well, it's not very smart to have an api return passwords.

How about just registering the backups locally using a web hook like all_backups_post.sh? Use it to update e.g. a backups.json in the user directory. If you need a users backups meta data, just retrieve that file using the api.

 

[amoozesh98com]

I need to provide our WHMCS users with a list of available backup files stored on a remote FTP server (configured via Admin Backup in DirectAdmin), including file names, creation dates, and sizes. The goal is to let users pick a specific backup date when requesting a restore via support ticket.

The problem: DirectAdmin API (CMD_API_ADMIN_BACKUP?json=yes) masks the FTP password (shows XXXXXXXXXX), so I can't connect to the FTP server to list files.

I understand that exposing plaintext passwords via API is a security risk. So I'm looking for a secure, recommended approach:

1. Can I use all_backups_post.sh hook (which receives ftp_password, ftp_ip, ftp_path, etc. as environment variables) to generate a metadata file (e.g., backups.json) in /home/admin/ after each backup, containing file names, sizes, and timestamps?
2. Then read that JSON file via CMD_API_EXEC or CMD_API_FILE_EDITOR from WHMCS?
3. Is there a built-in API endpoint that returns the list of files already stored on the remote FTP, using the stored credentials internally without exposing them?

I'm running DirectAdmin v1.689+ with Evolution skin. The backup cron is working perfectly – I just need to expose the file list to my module securely.

Any guidance on the best practice for this scenario would be greatly appreciated.