Customer API

Programmatic ordering, balance and transaction lookups with HMAC authentication.

Authentication

Each request is signed with an X-Api-Key and an HMAC-SHA256 signature over the request body using your secret. Requests outside your IP whitelist are rejected.

POST /api/v1/order
X-Api-Key: gsmx_live_xxxx
X-Api-Secret: gsmx_sk_xxxx
X-Timestamp: 1725900000
X-Signature: {hmac_sha256(secret, "METHOD|path|timestamp|body")}
Content-Type: application/json

{ "service_id": 1, "fields": { "imei": "356938035643809" } }

Endpoints

POST /api/v1/order — place an order

GET /api/v1/order/{id} — order status

GET /api/v1/services — list services & prices

GET /api/v1/balance — wallet balance

GET /api/v1/transactions — wallet ledger