Build on the Credit Watch API

Overview

Everything your team does in the Credit Watch screens can be done through the API, so you can connect your own app, core banking system, payment channels or data warehouse to one ledger.

Quickstart

From a new account to your first successful call in about five minutes.

1. Create your companyStart a free trial, or ask us for a sandbox company so you can test without touching live data.
2. Create a tokenIn Company Settings, open API Integrations and create a personal access token, or an OAuth client for a server-to-server integration. Choose only the scopes you need.
3. Send your first requestPass the token as a bearer token and ask for JSON.
4. Watch it happenThe API activity view shows each request, its status and any rate-limit hits.

# List active clients, 20 per page
curl "https://creditwatch.online/api/v1/client?status=active&limit=20" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"

const res = await fetch("https://creditwatch.online/api/v1/client?status=active&limit=20", {
  headers: {
    Authorization: "Bearer YOUR_TOKEN",
    Accept: "application/json",
  },
});
const clients = await res.json();
console.log(clients);

<?php
$ch = curl_init("https://creditwatch.online/api/v1/client?status=active&limit=20");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer YOUR_TOKEN",
        "Accept: application/json",
    ],
]);
$clients = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

r = requests.get(
    "https://creditwatch.online/api/v1/client",
    params={"status": "active", "limit": 20},
    headers={"Authorization": "Bearer YOUR_TOKEN", "Accept": "application/json"},
)
print(r.json())

What comes back

[
  {
    "current_page": 1,
    "per_page": 20,
    "total": 134,
    "data": [
      {
        "id": 482,
        "name": "Mary Banda",
        "gender": "female",
        "mobile": "260971234567",
        "email": "mary@example.com",
        "external_id": "CRM-10482",
        "status": "active",
        "branch": "Lusaka Main",
        "staff": "Joseph Mwale"
      }
    ]
  }
]

Authentication

Every request carries a bearer token. Tokens belong to your company, carry only the scopes you gave them, and can be revoked at any time.

Authorization: Bearer YOUR_TOKEN
Accept: application/json
Content-Type: application/json

Scopes

A token can only do what its scopes allow. Give each integration the smallest set that works.

The loan lifecycle, as API calls

Most integrations follow this path. Each step is one call, and the loan is always in a known state.

Create a client, then a loan

curl -X POST https://creditwatch.online/api/v1/client/store \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json" \
  -d first_name=Mary \
  -d last_name=Banda \
  -d gender=female \
  -d dob=1990-04-12 \
  -d branch_id=1 \
  -d created_date=2026-10-15 \
  -d mobile=260971234567

# Required fields include: client_id, loan_product_id, fund_id, loan_purpose_id,
# applied_amount, loan_term, repayment_frequency, repayment_frequency_type,
# interest_rate, expected_disbursement_date, loan_officer_id
curl -X POST https://creditwatch.online/api/v1/loan/store \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: 6f1c0d52-9b7e-4c1a-8d3e-5a2b7c9e1f40" \
  -d client_id=482 \
  -d loan_product_id=3 \
  -d applied_amount=5000 \
  -d loan_term=6 \
  -d repayment_frequency=1 \
  -d repayment_frequency_type=months \
  -d interest_rate=3 \
  -d expected_disbursement_date=2026-10-20

# Approve
curl -X POST https://creditwatch.online/api/v1/loan/910/approve_loan \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Idempotency-Key: a31b6c10-2d8f-4f0e-9a64-7d5c3e8b1a22"

# Disburse
curl -X POST https://creditwatch.online/api/v1/loan/910/disburse_loan \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Idempotency-Key: 0c9d4e77-61aa-43b8-b2f1-9e3a5d7c4b10"

Record a repayment

curl -X POST https://creditwatch.online/api/v1/loan/910/repayment/store \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: mobile-money-TX88213" \
  -d amount=1250.00 \
  -d date=2026-11-05 \
  -d payment_type_id=2 \
  -d receipt=TX88213

await fetch("https://creditwatch.online/api/v1/loan/910/repayment/store", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_TOKEN",
    Accept: "application/json",
    "Idempotency-Key": "mobile-money-TX88213",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ amount: 1250.0, date: "2026-11-05", payment_type_id: 2, receipt: "TX88213" }),
});

import requests

requests.post(
    "https://creditwatch.online/api/v1/loan/910/repayment/store",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Accept": "application/json",
        "Idempotency-Key": "mobile-money-TX88213",
    },
    json={"amount": 1250.0, "date": "2026-11-05", "payment_type_id": 2, "receipt": "TX88213"},
)

Endpoint reference

The calls most integrations use, grouped by area. Paths are relative to /api/v1. The full reference, including every field, is shared with your team when you get access.

No endpoints match that filter.

Requests and responses

Predictable conventions, so your client code stays small.

Status codes

Validation errors

{
  "success": false,
  "errors": {
    "amount": ["The amount field is required."],
    "payment_type_id": ["The payment type id field is required."]
  }
}

Idempotency

Networks fail. When a request that moves money times out, you need to retry without paying someone twice. Add an Idempotency-Key header and we make sure the action runs once.

• First request with a key runs normally, and its response is stored for 24 hours.
• A retry with the same key gets the stored response back. The action does not run again.
• A retry while the first is still running returns 409, so you know to wait and try again.
• Failed requests are not stored, so you can correct them and retry freely.
• Choose a key you can rebuild, such as a payment reference or a UUID you saved before sending. Keys are scoped to your token.

Rate limits

Limits keep the platform fast for everyone. The default is 120 requests per minute for each token, and we can raise it for busy integrations.

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 117

# when you go over
HTTP/1.1 429 Too Many Requests
Retry-After: 23
{ "message": "Too many requests. Slow down." }

Read X-RateLimit-Remaining to pace yourself, and on a 429 wait for Retry-After seconds before you try again. For bulk loads, use the batch migration endpoint instead of many single calls.

Integration patterns

Common ways teams use the API, and where we help.

Environments and go-live

Test safely first, then switch to production with a short checklist.

Go-live checklist

• Tokens stored on your server, one per integration, with the smallest scopes.
• Idempotency-Key on every money-moving call, built from something you can rebuild after a crash.
• 429 and 5xx handling with a wait and retry, not a tight loop.
• Balances reconciled between your system and Credit Watch on a sample of loans.
• Someone watching the API activity view for the first days.

Security and audit

What your risk and security teams will ask about.

Support for your engineers

Talk to people who know the platform and the lending behind it.

• Implementation help. We walk through your first integration with your engineers and credit team.
• Fast answers. Raise a ticket from the support pop-up and we respond with someone who can read your request logs.
• Limits and access. Ask for a sandbox, higher rate limits or the full field-level reference.