19 endpoints · base URL https://flexysure.intrepidprojects.co.ke/api/v1
A customer's own account for your app or website, compatible with Insurance Cloud's Client Area: passwordless sign-in by one-time code, details, policies, policy detail with documents and a ledger-backed statement. Sign-in returns client_no and client_key; send them as X-Client-No and X-Client-Key with your organisation's bearer token. Money in the Insurance Cloud endpoints is in shillings; the Flexysure-only endpoints (loans, pay, claims) use integer cents (*_minor). Policy status is 1 for active cover and 0 for any other status. A new sign-in (verify-otp or register) replaces the client's earlier keys; the key returned when your system saves a policy (portal.client_key) replaces only earlier policy keys, so it never signs the customer out of their app.
Send the email or phone saved on the client record (or its login). If both are sent both must match the same account. The same six-digit code goes by SMS and email and expires after 5 minutes. No bearer token is needed; when the same contact is a client of more than one organisation, send the organisation's bearer token to choose. The answer never reveals whether an account exists: unknown, disabled or (without a token) ambiguous contacts get the same 200 body, and channels is always ["email", "sms"], but no code is sent and the otp_id never verifies.
Scope
None
Authentication
None (client credentials in the body)
Rate limit
3 codes per 5 minutes per identifier and per account
Idempotency
Not keyed. Check before retrying.
Headers
Header
Meaning
Accept
application/json
Content-Type
application/json
Authorization
Optional. Bearer token of the organisation, to pick the account when the contact exists at several.
Body fields
Field
Type
Required
Description
email
string
No
Saved email (max 255). Required without phone.
Example: jane@example.com
phone
string
No
Saved phone (max 50). Required without email.
Example: 0712345678
Consumes the code and returns the user with client_no and a new client_key, which replaces any earlier key. Five wrong codes exhaust the request; ask for a new code.
Scope
None
Authentication
None (client credentials in the body)
Rate limit
60 requests per minute per token (per-client override)
Creates an individual or corporate client in the token's organisation, a customer login for the contact and a client key. For a corporate client the company is the client and the contact is its login. An existing login with that email, or a client with that ID number or KRA PIN, returns 403: sign in by code instead.
Scope
portal
Authentication
Bearer token
Rate limit
60 requests per minute per token (per-client override)
Idempotency
Not keyed. Check before retrying.
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
Accept
application/json
Content-Type
application/json
Body fields
Field
Type
Required
Description
type
string
Yes
Client type.
One of: individual, corporate
company
object
No
Required for corporate.
company.name
string
Yes
Max 255.
company.phone
string
Yes
Max 50.
company.email
string
Yes
Max 255.
company.kra_pin
string
Yes
Max 50.
contact
object
Yes
The person who signs in.
contact.name
string
Yes
Max 255.
contact.phone
string
Yes
Max 50.
contact.email
string
Yes
Max 255; becomes the login.
contact.id_no
string
No
Required for individual. Max 50.
contact.kra_pin
string
No
Optional. Max 50.
contact.password
string
Yes
At least 8 characters (for the web customer portal).
Same filters as the paginated list, without page and per_page. At most 500 policies, newest first; truncated is true when there were more (page through POST /client/policies instead).
Scope
portal
Authentication
Bearer token plus client-area headers
Rate limit
5 requests per minute per client (per client and policy on the detail)
Idempotency
Not keyed. Check before retrying.
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
Accept
application/json
Content-Type
application/json
X-Client-No
Required. user.client_no from verify-otp (or client.client_no from register).
X-Client-Key
Required. user.client_key (fxck_…) from verify-otp or register. A new sign-in replaces the key.
Body fields
Field
Type
Required
Description
status
integer
Yes
1 active, 0 any other status, 2 all.
One of: 0, 1, 2
Totals, receipt allocations (with receipt PDFs), vehicles, claims, documents (risk note, invoices, motor certificates) and the client's KYC documents. Document links are temporary signed URLs valid for 30 minutes. marine_dmvic is always null (Flexysure has no marine line).
Scope
portal
Authentication
Bearer token plus client-area headers
Rate limit
5 requests per minute per client (per client and policy on the detail)
Idempotency
Safe to repeat (read only).
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
X-Client-No
Required. user.client_no from verify-otp (or client.client_no from register).
X-Client-Key
Required. user.client_key (fxck_…) from verify-otp or register. A new sign-in replaces the key.
Read from the ledger (client receivables): billed amounts are debits; receipts, premium-finance funding and credit notes are credits. The first row is the opening balance; each row carries the running balance; zero debit or credit cells are empty strings. A statement covers at most 366 days (422 range_too_long).
Scope
portal
Authentication
Bearer token plus client-area headers
Rate limit
10 requests per minute per client
Idempotency
Not keyed. Check before retrying.
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
Accept
application/json
Content-Type
application/json
X-Client-No
Required. user.client_no from verify-otp (or client.client_no from register).
X-Client-Key
Required. user.client_key (fxck_…) from verify-otp or register. A new sign-in replaces the key.
Body fields
Field
Type
Required
Description
starting
string
Yes
Y-m-d.
Example: 2026-01-01
ending
string
Yes
Y-m-d, on or after starting, at most 366 days in all.
Example: 2026-12-31
Sends an STK push for the earliest open debit note of the policy (for a premium-finance policy awaiting its deposit, the deposit). amount is in shillings and defaults to what is outstanding on that note. The payment is confirmed by the M-Pesa callback; watch the policy or the payment.* webhooks.
Scope
portal
Authentication
Bearer token plus client-area headers
Rate limit
5 requests per minute per client (per client and policy on the detail)
Idempotency
Required: send an Idempotency-Key; a retry with the same key replays the first response.
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
Accept
application/json
Content-Type
application/json
X-Client-No
Required. user.client_no from verify-otp (or client.client_no from register).
X-Client-Key
Required. user.client_key (fxck_…) from verify-otp or register. A new sign-in replaces the key.
Idempotency-Key
Required. A unique value (a UUID) per write. Replays within 24 hours return the stored response with Idempotent-Replayed: true; the same key with a different body is rejected (idempotency_key_reused).
Registers a claim on one of the client's policies (active, expired or cancelled; the incident must fall inside the cover period). The broker's claims team takes it from there.
Scope
portal
Authentication
Bearer token plus client-area headers
Rate limit
60 requests per minute per token (per-client override)
Idempotency
Required: send an Idempotency-Key; a retry with the same key replays the first response.
Headers
Header
Meaning
Authorization
Bearer <access_token> (scope portal)
Accept
application/json
Content-Type
application/json
X-Client-No
Required. user.client_no from verify-otp (or client.client_no from register).
X-Client-Key
Required. user.client_key (fxck_…) from verify-otp or register. A new sign-in replaces the key.
Idempotency-Key
Required. A unique value (a UUID) per write. Replays within 24 hours return the stored response with Idempotent-Replayed: true; the same key with a different body is rejected (idempotency_key_reused).
Body fields
Field
Type
Required
Description
policy_id
integer
Yes
Policy id.
claim_type
string
Yes
Kind of loss.
One of: accidental_damage, theft, third_party, medical, travel, death, disability, other
incident_on
string
Yes
Y-m-d, inside the cover period, not in the future.
description
string
Yes
What happened.
risk_item
string
No
Defaults to the vehicle registration on motor policies.
Temporary signed URL (30 minutes). No headers needed; an expired or altered link returns 403. Add download=1 (already part of download_url) to download instead of viewing.
Scope
None
Authentication
None (client credentials in the body)
Rate limit
60 requests per minute per token (per-client override)
Idempotency
Safe to repeat (read only).
Parameters
Name
In
Type
Required
Description
uuid
path
string
Yes
Document id.
Example
RequestcURL
curl -X GET 'https://flexysure.intrepidprojects.co.ke/api/v1/client/files/kyc/{uuid}' \
-H 'Accept: application/json'
Responses
Status
Meaning
200
The file
403
Expired or invalid signature
404
Not found
Errors are problem documents; the common codes (401, 403 insufficient_scope, 422, 429) apply to every endpoint.
