Replace an account

Swap a faulty account on one of your orders, inside the warranty. Self-serve, no ticket.

POSTGET/api/v1/replace

Send the order and the steam id of the account that does not work. If our check agrees it is faulty, the new account comes back in the same response. This is self-serve: every full key can do it, with nothing to set up or approve. Read-only keys get E1701.

In short: 3 replacements per order, 6 hours from delivery (12 with the extended warranty), and only a real swap uses one. The Replacements and warranty guide explains every rule.

Request

curl -X POST "https://www.nfa.pub/api/v1/replace?result=json" \  -H "X-Api-Key: rsk_..." \  -H "Content-Type: application/json" \  -d '{"order":"4b53000e7b4677d2-c69a8e94132d75e8","account":"76561199...","reason":"cannot log in"}'

Body

Field	Description
`order`required	The `order_id` from the buy, or the order token. `order_id` and `invoice` also work.
`account`required	The steam id of the faulty account. `steam_id` also works.
`reason`	Optional free text, kept with the request.
`result`	Query parameter. `json` for a JSON body. Without it you get the new account line as plain text.

order, account and reason also work as query parameters, and GET works too. Prefer POST with a JSON body.

Response

200 OK

{  "ok": true,  "account": "76561199...----...",  "replaced": "76561199...",  "used": 1,  "remaining": 2,  "warranty_ends_at": "2026-10-25T20:31:04.472Z",  "paused_ms": 0,  "reason": "login_failed"}

account is the new account line, in the same format as a purchase. Without result=json it is the whole body.
replaced is the steam id of the new account, the one at the start of account. It is not the account you reported.
used and remaining count this order's 3 replacements, the website's included.
warranty_ends_at is when the order's cover ends, in UTC. paused_ms is currently always 0.
reason is what our check found wrong. It is also sent as the X-Replace-Reason header, in both formats.

Errors

Code	HTTP	Meaning
`E1001`	401	The key is missing, malformed, revoked or unknown.
`E1002`	429	Too many requests. Wait for the minute to roll over and retry. See Rate limits.
`E1101`	400	You did not send both `order` and `account`.
`E1202`	409	The product is misconfigured on our side. Contact support.
`E1602`	404	No order with that id.
`E1603`	403	That order was not bought by this key's account, so this key cannot see or act on it.
`E1604`	409	That order has not been delivered yet, so there is nothing to replace.
`E1605`	409	The warranty on that order has run out.
`E1606`	400	That account is not on that order.
`E1607`	409	That account was already replaced. Report the new one instead.
`E1608`	409	That order has used all of its replacements.
`E1609`	409	No replacement in stock. Nothing was used. Try again when it restocks.
`E1610`	409	Our check says the account works, so it was not replaced. Nothing was used.
`E1611`	503	The account check was inconclusive. Try again in a few minutes.
`E1612`	403	Purchases and replacements are blocked for this customer.
`E1614`	409	Held for review. A person has to look before more replacements go through.
`E1615`	503	Replacements are paused right now. Try again later.
`E1616`	409	A CS2 cooldown is not a fault and runs out on its own, so it is not replaced.
`E1617`	409	The warranty on that account ended with an earlier cooldown or ban claim. Other accounts on the order keep theirs.
`E1618`	409	A VAC ban, or a ban after delivery, is not covered, so the account is not replaced.
`E1619`	409	That order was refunded in full, so it has no warranty left.
`E1620`	409	A chargeback is open on that order. Replacements wait until it is settled.
`E1621`	409	Another replacement on that order is still running. Retry in a few seconds.
`E1701`	403	This key is read-only. It can look things up, but not buy, replace, change or cancel a pre-order, export logins with `include=accounts` or change webhooks.
`E1702`	403	The request came from an IP that is not on your allowlist.
`E1000`	500	Something went wrong on our side. Retry, and contact support if it keeps happening.

Rate limits: 60 requests a minute per IP address, and 20 requests a minute per key.