Information
- OpenAPI version:
3.1.0
Overview
Xaalis API 0.1.0
Section titled “Xaalis API 0.1.0”Accept Wave & Orange Money payments and send payouts in Senegal. Amounts are integer XOF.
Authentication
Section titled “ Authentication ”bearerAuth
Section titled “bearerAuth”Merchant key (sk_* or rk_). Restricted rk_ keys use the same permissions listed by the OAuth alternative.
Security scheme type: http
oauth2
Section titled “oauth2”Owner-consented merchant access via authorization code with PKCE (S256 required). Request resource=https://mcp.xaalis.org when authorizing and exchanging the code; tokens are bound to that MCP resource and the selected merchant and mode. Account introspection needs no API permission; request openid for that flow. Scopes do not bypass owner consent, merchant status or test/live restrictions.
Security scheme type: oauth2
Flow type: authorizationCode
Authorization URL: https://api.xaalis.org/dashboard/auth/oauth2/authorize
Token URL: https://api.xaalis.org/dashboard/auth/oauth2/token
Refresh URL: https://api.xaalis.org/dashboard/auth/oauth2/token
Scopes:
- openid - Identify the consenting owner
- offline_access - Refresh consented access
- payments:read - Read payments and their refunds
- payments:write - Create payments and simulate test payments
- refunds:write - Create full payment refunds
- subscriptions:read - Read subscriptions and invoices
- subscriptions:write - Create and cancel subscriptions; advance test subscriptions
- payouts:read - Read merchant payouts
- payouts:write - Create merchant payouts
- balance:read - Read the merchant balance and payout fee
- webhooks:read - Read webhook delivery history
- webhooks:write - Update the merchant webhook URL
- agent_wallets:read - Read agent wallets, balances, transfers, payouts and key metadata
- agent_wallets:write - Create, fund, reclaim and disable wallets; issue and revoke agent keys
whatsappServiceAuth
Section titled “whatsappServiceAuth”Internal WhatsApp service credential plus a current owner link; no merchant-wide authority
Security scheme type: http
agentBearerAuth
Section titled “agentBearerAuth”Wallet-scoped agent key: ak_test_… or ak_live_…
Security scheme type: http
dashboardSession
Section titled “dashboardSession”Better Auth dashboard session cookie; obtain via /dashboard/auth/sign-in/magic-link.
Security scheme type: apiKey
Cookie parameter name: better-auth.session_token
checkoutSecret
Section titled “checkoutSecret”Payment or invoice link client secret from checkout_url; required for hosted checkout routes.
Security scheme type: apiKey
Query parameter name: cs