Skip to main content
The PanoFlow API is a REST API over JSON for running a business’s money: accounts and balances, payouts to any Nigerian bank account over NIP, collections, payroll, webhooks, and AI agents that pay and invoice inside guardrails. The PanoFlow web app is built on the same API, so anything you see in the app comes from these endpoints.

​
What you can do

Accounts and transactions

Read accounts and balances, open sub-accounts, list transactions and generate statements.

Payments

Confirm account names, save recipients, and send single, batch and scheduled payments.

Collections

Get paid with invoices, payment links and static virtual accounts, and track every inbound credit.

Payroll

Manage people and deductions, prepare and run monthly pay runs, and issue payslips.

Webhooks and events

Receive signed events when payments settle, money arrives or invoices are paid.

Agents and MCP

Let an AI agent use one agent account through the PanoFlow MCP server.

​
Base URL

Send every request to:
All requests use HTTPS. Authenticate with a bearer API key or OAuth access token; see Authentication.

​
Sandbox and live

Sandbox uses the same URLs as live. The credential decides which one you reach: Objects carry livemode so you can tell them apart. Webhook endpoints are per mode: sandbox and live endpoints are separate and have separate signing secrets. Using a pk_test_ key on an operation that only exists in live mode returns 403 test_key_on_live.

​
Conventions

These rules hold for every endpoint, so you can rely on them in your client code.

​
JSON

  • Every field, query parameter and enum value is snake_case (created_at, account_number, pending_approval).
  • Every resource has id and object (its type, for example "object": "transfer"), then created_at. Resources that can change also carry updated_at.
  • Timestamps are RFC 3339 in UTC with Z, for example 2026-10-27T08:41:00Z. Dates without a time are YYYY-MM-DD and are interpreted in Africa/Lagos time.
  • Unknown optional fields are left out rather than sent as null, unless a field documents what null means.
  • metadata, where offered, is a flat object of up to 20 string keys (40 characters or fewer) with string values (500 characters or fewer).
  • Money is always a Money object in minor units. See Money and amounts.

​
IDs

IDs are opaque strings with a type prefix, an underscore and a 26-character body, for example trf_01JC8Z4M9Q2X7H3N5B6V8D0K1R for a transfer or acc_... for an account. Don’t parse them; store and compare them as strings. Some human-facing numbers are not IDs and keep their own formats, such as invoice numbers (INV-0152) and NIP session ids (30 digits).

​
Writes

  • POST creates something or performs an action. PATCH partially updates. There is no PUT.
  • Actions are sub-resources named with a verb, for example POST /v1/transfers/{transfer_id}/cancel.
  • Anything with history is never deleted. You archive or close it instead, for example POST /v1/recipients/{recipient_id}/archive.

​
Request ids

Every response carries an X-Request-Id header (req_...). You can also send your own X-Request-Id and it is echoed back. Quote the request id when you contact support.

​
Next steps

Authenticate

Use API keys and scopes, or OAuth for apps and agents.

Handle errors

Read the error shape, codes and ISO 8583 response codes.