API Reference

Base URL: https://api.wakalisms.com

All request/response bodies are JSON unless noted otherwise (CSV import/export are the only exceptions). All endpoints below require authentication unless marked Public.

Authenticating

Send one of these headers on every request:


X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxx


Authorization: Bearer <access_token>

Get an API key from the api_key field returned by POST /auth/register, or rotate it with POST /auth/rotate-api-key. Get a bearer token from POST /auth/login.

Import into Postman

Rather than a hand-maintained collection that drifts out of date, import the live API spec directly — it always reflects exactly what’s currently deployed:

In Postman: Import → Link
Paste https://api.wakalisms.com/openapi.json
Postman generates a full collection — every endpoint, request body, and response shape, grouped the same way as this reference.

Re-run the import any time to pick up new/changed endpoints.

Pagination

List endpoints that return many rows share the same shape:


{
  "data": [ /* ... */ ],
  "total": 142,
  "page": 1,
  "page_size": 20,
  "pages": 8
}

Pass ?page= and ?page_size= as query parameters. page always defaults to 1; the default page_size is 20 on most endpoints, but check each page below for exceptions.

Conventions

All amounts are in KES, as floats (e.g. 12.50).
All phone numbers are normalised server-side to E.164 (+254712345678) — you can send 0712345678, 254712345678, or +254712345678 and they’ll all resolve the same way.
Timestamps are ISO-8601 UTC strings.
IDs are UUIDs, returned as strings.

Next: Auth · SMS · Errors