> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panoflow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PanoFlow API: business banking for Nigerian businesses

> What the PanoFlow API covers, its base URL, sandbox and live keys, and the JSON, id and timestamp conventions every endpoint follows.

The PanoFlow API is a REST API over JSON for running a business's money: accounts and balances, payouts to any Nigerian bank account over NIP, collections, payroll, webhooks, and AI agents that pay and invoice inside guardrails. The PanoFlow web app is built on the same API, so anything you see in the app comes from these endpoints.

## What you can do

> [card] [Accounts and transactions](https://docs.panoflow.io/api-reference/accounts/list-accounts.md)
>
> Read accounts and balances, open sub-accounts, list transactions and generate statements.

> [card] [Payments](https://docs.panoflow.io/api-reference/transfers/create-a-transfer.md)
>
> Confirm account names, save recipients, and send single, batch and scheduled payments.

> [card] [Collections](https://docs.panoflow.io/api-reference/invoices/create-an-invoice-draft-or-create-and-send.md)
>
> Get paid with invoices, payment links and static virtual accounts, and track every inbound credit.

> [card] [Payroll](https://docs.panoflow.io/api-reference/pay-runs/list-pay-runs.md)
>
> Manage people and deductions, prepare and run monthly pay runs, and issue payslips.

> [card] [Webhooks and events](https://docs.panoflow.io/webhooks.md)
>
> Receive signed events when payments settle, money arrives or invoices are paid.

> [card] [Agents and MCP](https://docs.panoflow.io/agents-and-mcp.md)
>
> Let an AI agent use one agent account through the PanoFlow MCP server.

## Base URL

Send every request to:

```text theme={null}
https://api.panoflow.io/v1
```

All requests use HTTPS. Authenticate with a bearer API key or OAuth access token; see [Authentication](https://docs.panoflow.io/authentication.md).

```bash theme={null}
curl https://api.panoflow.io/v1/accounts \
  -H "Authorization: Bearer pk_test_..."
```

## Sandbox and live

Sandbox uses the same URLs as live. The credential decides which one you reach:

| Credential | Reaches |
| - | - |
| `pk_live_...` API key | Your live business |
| `pk_test_...` API key | Your sandbox business, with simulated partners. Sandbox calls never reach a real bank. |

Objects carry `livemode` so you can tell them apart. Webhook endpoints are per mode: sandbox and live endpoints are separate and have separate signing secrets. Using a `pk_test_` key on an operation that only exists in live mode returns `403 test_key_on_live`.

## Conventions

These rules hold for every endpoint, so you can rely on them in your client code.

### JSON

* Every field, query parameter and enum value is `snake_case` (`created_at`, `account_number`, `pending_approval`).
* Every resource has `id` and `object` (its type, for example `"object": "transfer"`), then `created_at`. Resources that can change also carry `updated_at`.
* Timestamps are RFC 3339 in UTC with `Z`, for example `2026-10-27T08:41:00Z`. Dates without a time are `YYYY-MM-DD` and are interpreted in Africa/Lagos time.
* Unknown optional fields are left out rather than sent as `null`, unless a field documents what `null` means.
* `metadata`, where offered, is a flat object of up to 20 string keys (40 characters or fewer) with string values (500 characters or fewer).
* Money is always a `Money` object in minor units. See [Money and amounts](https://docs.panoflow.io/money.md).

### IDs

IDs are opaque strings with a type prefix, an underscore and a 26-character body, for example `trf_01JC8Z4M9Q2X7H3N5B6V8D0K1R` for a transfer or `acc_...` for an account. Don't parse them; store and compare them as strings.

Some human-facing numbers are not IDs and keep their own formats, such as invoice numbers (`INV-0152`) and NIP session ids (30 digits).

### Writes

* `POST` creates something or performs an action. `PATCH` partially updates. There is no `PUT`.
* Actions are sub-resources named with a verb, for example `POST /v1/transfers/{transfer_id}/cancel`.
* Anything with history is never deleted. You archive or close it instead, for example `POST /v1/recipients/{recipient_id}/archive`.

### Request ids

Every response carries an `X-Request-Id` header (`req_...`). You can also send your own `X-Request-Id` and it is echoed back. Quote the request id when you contact support.

## Next steps

> [card] [Authenticate](https://docs.panoflow.io/authentication.md)
>
> Use API keys and scopes, or OAuth for apps and agents.

> [card] [Handle errors](https://docs.panoflow.io/errors.md)
>
> Read the error shape, codes and ISO 8583 response codes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.