Kirish

Premium API — Telegram Premium obunasini string session + karta + SMS kod orqali avtomatik rasmiylashtirish uchun REST interfeys. Bitta so‘rov bilan xarid boshlanadi, tizim to‘lovni yuboradi va sizga SMS qaysi raqamga ketganini qaytaradi; siz kodni qaytarasiz — qolgani (3-D Secure, tasdiqlash, avto-to‘lovni /stop bilan o‘chirish) avtomatik bajariladi.

Bazaviy manzil: https://premium.paymall.uz
Format: JSON (UTF-8) · Versiya: v1

Har bir javobda ok maydoni bo‘ladi. Xato bo‘lsa ok:false, code (mashina uchun) va error (odam uchun) qaytadi.

Autentifikatsiya

Har bir so‘rovda API kalit yuboriladi. Kalit panelning API kalitlar bo‘limida yaratiladi va faqat bir marta ko‘rsatiladi.

X-API-Key: pk_live_xxxxxxxxxxxxxxxxxxxxxxxx
# yoki
Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Kalit noto‘g‘ri bo‘lsa 401 BAD_API_KEY, o‘chirilgan bo‘lsa 403 KEY_DISABLED, hisob deaktiv qilingan bo‘lsa 403 USER_DISABLED.

Xarid oqimi

1. POST /v1/premium/purchase        → { purchase_id, status: "queued" }
2. GET  /v1/premium/purchases/{id}  → status: running → awaiting_otp
                                      + otp_target: "***5544"  ← SMS shu raqamga ketdi
3. POST /v1/premium/purchases/{id}/otp  { code: "123456" }
4. GET  /v1/premium/purchases/{id}  → status: success
                                      + premium_until, autorenew_stopped: true

2-qadamda 1-2 soniyada bir marta so‘rov yuborish kifoya (yoki callback ishlating). Kod kutish oynasi 10 daqiqa; undan keyin xarid expired holatiga o‘tadi.

Holat tekshiruvi

{ "ok": true, "user": "demo", "server_time": "2026-08-15T09:30:00+00:00" }

Hisob ma'lumoti

{
  "ok": true,
  "user": { "id": 2, "username": "demo", "full_name": "Demo Dev", "role": "user" },
  "cards_total": 4,
  "cards_available": 3,
  "limits": { "max_concurrent": 8, "otp_window_sec": 600, "otp_max_attempts": 2 }
}

Kartalar ro‘yxati

Kartalar faqat panelda qo‘shiladi/o‘zgartiriladi. API orqali ularni ko‘rish va id bo‘yicha tanlash mumkin. available — hozir bo‘sh limit soni.

{
  "ok": true,
  "cards": [
    {
      "id": 7, "label": "Asosiy", "bank_name": "Kapitalbank", "brand": "VISA",
      "masked": "454104••••9133", "last4": "9133", "exp_month": 3, "exp_year": 2029,
      "limit_total": 3, "limit_window_days": 7, "available": 2,
      "is_active": true, "expired": false, "phone_hint": "+998 ** *** 5544"
    }
  ]
}

Banklar

{ "ok": true, "banks": [ { "id": 1, "name": "Milliy bank (NBU)" }, ... ] }

Xaridni boshlash

curl -X POST https://premium.paymall.uz/v1/premium/purchase \
  -H "X-API-Key: pk_live_xxx" -H "Content-Type: application/json" \
  -d '{
    "session_string": "1BJWap1wBu...",
    "api_id": 26986908,
    "api_hash": "d3eecfa767f5b31812f5119e5bd3e160",
    "months": 1,
    "card_id": 7
  }'

import requests
H = {"X-API-Key": "pk_live_xxx"}
r = requests.post("https://premium.paymall.uz/v1/premium/purchase", headers=H, json={
    "session_string": SESSION, "api_id": 26986908, "api_hash": API_HASH,
    "months": 1,            # 1 yoki 12
    "card_id": None,        # None = avto tanlov
}).json()
pid = r["purchase_id"]

const r = await fetch("https://premium.paymall.uz/v1/premium/purchase", {
  method: "POST",
  headers: { "X-API-Key": "pk_live_xxx", "Content-Type": "application/json" },
  body: JSON.stringify({ session_string, api_id, api_hash, months: 1 })
}).then(r => r.json());

Javob:

{
  "ok": true,
  "purchase_id": "pr_9f2a1c4b7d8e5061",
  "status": "queued",
  "card_id": 7,
  "next": "GET /v1/premium/purchases/{id} — status 'awaiting_otp' bo'lganda otp_target qaytadi"
}

Xarid holati

Bosqichlar tarixini ham olish uchun: ?events=true

{
  "ok": true,
  "purchase_id": "pr_9f2a1c4b7d8e5061",
  "status": "awaiting_otp",         # ← kod kutilmoqda
  "stage": "awaiting_otp",
  "tg_user_id": 7149420551, "tg_username": "example",
  "amount": 720.0, "currency": "PKR",
  "otp_target": "***5544",          # ← SMS shu raqamga yuborildi
  "otp_attempts": 0,
  "otp_expires_at": "2026-08-15T09:41:12+00:00",
  "ip_used": "84.54.72.18",
  "premium_until": null,
  "autorenew_stopped": false,
  "created_at": "2026-08-15T09:31:02+00:00"
}

Muvaffaqiyatli yakunda:

{
  "ok": true, "status": "success",
  "premium_until": "2026-09-15T07:54:58+00:00",
  "autorenew_stopped": true,
  "duration_ms": 61840
}

SMS kodni yuborish

curl -X POST https://premium.paymall.uz/v1/premium/purchases/pr_9f2a.../otp \
  -H "X-API-Key: pk_live_xxx" -H "Content-Type: application/json" \
  -d '{"code": "543573"}'

{ "ok": true, "status": "processing", "next": "GET /v1/premium/purchases/{id}" }

Kod noto‘g‘ri bo‘lsa xarid yana awaiting_otp holatiga qaytadi va yangi kod kutiladi (jami 2 urinish). Urinishlar tugasa OTP_REJECTED bilan yopiladi — bu bankning noto‘g‘ri kod hisoblagichini himoya qiladi.

Bekor qilish

Faqat jonli (tugallanmagan) xaridni bekor qiladi: brauzer yopiladi, sessiya uziladi. Pul yechilib bo‘lgan bo‘lsa bekor qilish uni qaytarmaydi.

Xaridlar ro‘yxati

Statistika

{
  "ok": true, "range_days": 30,
  "totals": { "total": 214, "success": 197, "failed": 12, "expired": 5,
              "active": 3, "stopped": 195, "avg_ms": 58412.0 },
  "daily": [ { "d": "2026-08-14T00:00:00+00:00", "total": 18, "success": 17 } ],
  "errors": [ { "error_code": "OTP_TIMEOUT", "n": 4 } ],
  "per_card": [ { "card_id": 7, "label": "Asosiy", "last4": "9133", "n": 42, "success": 40 } ],
  "api": { "calls": 1290, "avg_ms": 41.2, "errors": 18 }
}

Statuslar

Xato kodlari

«—» belgisi: xarid 202 bilan qabul qilingan, xato keyinroq status ichida qaytadi.

Callback (webhook)

So‘rovda callback_url bersangiz, holat o‘zgarganda (kod kutilganda va yakunda) shu manzilga POST keladi:

{
  "purchase_id": "pr_9f2a1c4b7d8e5061",
  "status": "awaiting_otp",
  "otp_target": "***5544",
  "error_code": null, "error": null,
  "premium_until": null, "autorenew_stopped": false
}

Callback bir marta yuboriladi va javobi kutilmaydi — asosiy manba baribir GET status endpointi.

Limit va parallel ishlash

• Karta limiti: har kartada 3 slot. Slot faqat muvaffaqiyatli xaridda band bo‘ladi va aynan 7 kundan keyin o‘zi bo‘shaydi. Ishlab turgan xaridlar ham slotni vaqtincha band qiladi — shu sabab parallel so‘rovlar limitdan oshib ketmaydi.
• Parallel: bir vaqtda max_concurrent ta xarid bajariladi (GET /v1/me da ko‘rinadi), qolganlari navbatda kutadi. Ko‘p xarid kerak bo‘lsa hammasini birdaniga yuborishingiz mumkin — navbat o‘zi boshqaradi.
• IP: har xarid uchun yangi sticky UZ IP olinadi; bitta IP dan oyna ichida belgilangan sondan ko‘p xarid o‘tkazilmaydi. O‘z proksingizni ham berishingiz mumkin.
• Sessiya eskirishi: string session bekor qilingan bo‘lsa xarid darhol INVALID_SESSION bilan yopiladi — pul yechilmaydi.
• Kod oynasi: 10 daqiqa. Bank kodi odatda 2-5 daqiqada eskiradi, shuning uchun kodni imkon qadar tez qaytaring.

To‘liq misol (Python)

import time, requests

BASE = "https://premium.paymall.uz"
H = {"X-API-Key": "pk_live_xxx"}

def buy(session_string, api_id, api_hash, get_code):
    r = requests.post(f"{BASE}/v1/premium/purchase", headers=H, json={
        "session_string": session_string, "api_id": api_id, "api_hash": api_hash,
        "months": 1,          # card_id berilmadi = avto tanlov
    }).json()
    if not r.get("ok"):
        raise RuntimeError(f"{r['code']}: {r['error']}")
    pid = r["purchase_id"]

    sent = False
    while True:
        s = requests.get(f"{BASE}/v1/premium/purchases/{pid}", headers=H).json()
        st = s["status"]
        if st == "awaiting_otp" and not sent:
            code = get_code(s["otp_target"])      # kodni foydalanuvchidan so'rang
            requests.post(f"{BASE}/v1/premium/purchases/{pid}/otp",
                          headers=H, json={"code": code})
            sent = True
        if st in ("success", "failed", "expired", "canceled"):
            return s
        time.sleep(2)

res = buy(SESSION, API_ID, API_HASH, lambda phone: input(f"{phone} raqamiga kelgan kod: "))
print(res["status"], res.get("premium_until"), res.get("error"))

Parallel misol (20 ta akkaunt)

from concurrent.futures import ThreadPoolExecutor
with ThreadPoolExecutor(max_workers=20) as ex:
    natijalar = list(ex.map(lambda a: buy(a["session"], a["api_id"], a["api_hash"], kod_ol), akkauntlar))
# Navbat va IP almashinuvi server tomonda — mijozda qo'shimcha chеklov kerak emas.