Skip to content
Pesapal API 3.0

Overview

Unofficial, sandbox-verified specification for the Pesapal API 3.0.

Pesapal API 3.0 3.0

Section titled “Pesapal API 3.0 3.0”

Every operation, field and response in this document was verified by calling the Pesapal sandbox and recording what came back. The captures are published alongside this specification.

Two behaviours apply to every operation and are easy to miss:

  • Application errors return HTTP 200. Wrong credentials, an unsupported currency and a rejected order all arrive with a 200 status and an error body. The transport status cannot be used to detect failure.
  • The status field is a quoted string, not a number, and does not match the HTTP status. It is "200" on success and usually "500" on failure.

Endpoints that exist but have never been called are deliberately absent, as are request fields whose effect has not been observed.

Information

  • License: MIT
  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
POST
/Auth/RequestToken
POST
/URLSetup/RegisterIPN
GET
/URLSetup/GetIpnList
POST
/Transactions/SubmitOrderRequest
POST
/transactions/stk
GET
/Transactions/GetTransactionStatus
GET
/Transactions/GetTransactionByMerchantReference
GET
/Transactions/QueryStatusByConfirmationCode
POST
/Transactions/CancelOrder
POST
/Transactions/RefundRequest

Authentication

Section titled “Authentication”

bearerAuth

Section titled “bearerAuth”

The token returned by requestToken. Valid for 60 minutes.

A missing token returns HTTP 401. An invalid or expired token returns HTTP 500, so an expired token cannot be detected from the status code alone. Match on error.code of invalid_api_credentials_provided.

Security scheme type: http

Bearer format: JWT