If you run a DHRU Fusion panel, add us as a supplier and you are done in a minute — there is nothing to write. If your site is your own, use the JSON API below: one key in a header, and a finished check comes back in the same reply.
For a site you wrote yourself — PHP, Laravel, WordPress, Node, anything that can POST JSON.
https://gsx.info/api/v1Authorization: Bearer gsx_live_…Add a supplier in your panel and paste three values. Your whole service list appears, at your prices.
API URL https://gsx.info/api/index.php
Username your username
API key your API key
actions accountinfo · imeiservicelist · placeimeiorder
placeimeiorderbulk · getimeiorder
Every call needs the header. Nothing is ever read from a query string, so a key cannot end up in a server log.
GET/api/v1/accountyour balance, your plan and the discount on itGET/api/v1/servicesthe catalogue, priced for your accountGET/api/v1/services/{id}one service, with the fields it needsPOST/api/v1/ordersplace a check — a finished one is in the replyPOST/api/v1/orders/batchup to 50 at once, each answering for itselfGET/api/v1/orders/{id}one order and its resultGET/api/v1/ordersyour history, newest first, pagedPlace a check
curl https://gsx.info/api/v1/orders \
-H "Authorization: Bearer gsx_live_…your access token…" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: order-1001" \
-d '{"service_id": 1, "imei": "356938035643809"}'
What comes back
{
"id": 251284,
"status": "done", // done | pending | rejected
"service_id": 1,
"service_name": "#1050 Model Info Check",
"identifier": "356938035643809",
"result": "<div style=…>Model: iPhone 17 Pro Max…", // the result HTML, byte for byte
"charged": "0.020",
"currency": "USD",
"took_ms": 840,
"created_at": "2026-09-16T11:04:22"
}
Including the one header that makes a retry safe.
$ch = curl_init("https://gsx.info/api/v1/orders");
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer " . GSX_ACCESS_TOKEN,
"Content-Type: application/json",
"Idempotency-Key: " . $myOrderId, // safe to send again after a timeout
],
CURLOPT_POSTFIELDS => json_encode([
"service_id" => 1,
"imei" => $imei,
]),
]);
$order = json_decode(curl_exec($ch), true);
if ($order["status"] === "done") {
echo $order["result"]; // show it to your customer as it was sent
} else {
// pending: read it again later, or let our webhook bring it to you
$pendingId = $order["id"];
}
Put your own order number in
Idempotency-Key. If your script times out and sends the same call again, you get the
first order back — marked Idempotency-Replayed: true — and you are charged once. If the
first call was refused, nothing was bought and the key is free to use again.
Most checks answer inside the call that placed them. The few that do not are finished in the background — and rather than leaving you polling, we POST the finished order to your address. Set it on your API Access page once you have an account.
// $secret is the signing secret you set on your API Access page
[$t, $v1] = sscanf($_SERVER["HTTP_X_GSX_SIGNATURE"], "t=%d,v1=%s");
$body = file_get_contents("php://input");
$mine = hash_hmac("sha256", $t . "." . $body, $secret);
if (!hash_equals($mine, $v1) || abs(time() - $t) > 300) {
http_response_code(400); // not from us, or too old to trust
exit;
}
$order = json_decode($body, true)["data"];
// $order is exactly what GET /api/v1/orders/{id} returns
Three attempts, then we give up — the order
is still in GET /api/v1/orders/{id} and in your history either way.
A real HTTP status, and a code your script can branch on. Money is never taken for an answer you did not get: a refusal is refunded to your balance the moment it happens.
| HTTP | code | what it means |
|---|---|---|
| 401 | no_credentials / bad_credentials | the key is missing or not ours |
| 403 | account_suspended | the account exists but cannot order |
| 402 | insufficient_credit | nothing was bought — fund the account and send it again |
| 404 | no_such_service / no_such_order | it does not exist, or is not yours |
| 409 | refused | we would not take the order (a service that is off, bad input) |
| 409 | in_flight | that Idempotency-Key is being used by a call still running |
| 502 | source_failed | the check could not be completed — you were not charged, try again |
Resellers who put a small "Powered by" line in their site's footer get the free checks' traffic sent their way in return. Paste this where your footer HTML goes — DHRU Fusion: Settings › Website › Footer; WordPress: Appearance › Widgets › Footer › Custom HTML. Click the box to copy it.
<a href="https://gsx.info/free/imei-blacklist-check" title="Free IMEI check">Free IMEI check by GSX.info</a>
Change the wording as you like; keep the address. Tell us when it is up and we credit your account.
An account is free and starts empty. Your key is shown once, on the API Access page, the moment the account is open.