Sandbox

Try every endpoint against demo data before you touch a live organisation.

This is a demo environment

M-Pesa, DMVIC and SMS are simulated here: no money moves, no certificate reaches DMVIC and no text message is sent. The credentials below are public and only work on this demo.

Demo organisation

The API client below belongs to Simba Risk Brokers (code SIMBA), the main demo brokerage, with insurers, clients, quotes, policies, receipts, premium-finance loans, claims and prospects already in place. A second brokerage, Mlima Insurance Agency, cannot see any of it: try a Simba record id with a Mlima token and you get 404. Staff logins for both are on the sign-in page.

API client

client_id: fx_test_simba_demo_0001
client_secret: fxs_SimbaDemoSecret_2026_Flexysure_Open_API_key
Scopes: * (every scope)
Organisation: Simba Risk Brokers

Get a sandbox token cURL

curl -X POST 'https://flexysure.intrepidprojects.co.ke/api/v1/oauth/token' \
  -H 'Content-Type: application/json' \
  -d '{"grant_type": "client_credentials", "client_id": "fx_test_simba_demo_0001", "client_secret": "fxs_SimbaDemoSecret_2026_Flexysure_Open_API_key"}'

Or import the Postman collection: on this demo its client_id and client_secret variables are filled in already.

Agent headers

Kevin Kiprop is a Simba agent who only sees the clients and policies he created. Send his code and key to act as him; GET /me shows the actor.

Header	Value
X-Agent-Code	KK01
X-Agent-Key	agentkey-KK01

Who am I, as agent KK01 cURL

curl 'https://flexysure.intrepidprojects.co.ke/api/v1/me' \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'X-Agent-Code: KK01' \
  -H 'X-Agent-Key: agentkey-KK01'

Client area

The client area endpoints act for one customer. Normally your app gets the client number and key from the one-time-code sign-in; on the demo, Simba's busiest client has a fixed key so you can skip that step.

Header	Value
X-Client-No	C-000003
X-Client-Key	fxck_SimbaDemoClientKey_2026_Flexysure_Portal_01

That client's policies cURL

curl 'https://flexysure.intrepidprojects.co.ke/api/v1/client/policies' \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'X-Client-No: C-000003' \
  -H 'X-Client-Key: fxck_SimbaDemoClientKey_2026_Flexysure_Portal_01'

Simulators

M-Pesa

POST /payment/stk/push returns the same acknowledgement Daraja does, but no phone rings. The request waits as pending until you play the customer's phone: sign in as Simba staff, open Collections and choose paid or cancelled. That runs the real callback handler: receipt, allocation, activation, the certificate and the payment.received webhook. Poll GET /payment/stk/{uuid} to watch it change. Paybill (C2B) payments can be simulated on the same page.

DMVIC

Certificate calls go to a bundled DMVIC simulator that speaks DMVIC's API: it checks for double insurance, draws from certificate stock and returns a printable certificate. The simulator's operator console (DMVIC operator demo login) shows stock and every certificate issued.

Webhook sink

Simba has a webhook endpoint pointing at a demo receiver, subscribed to every event, so you can see deliveries arrive under Settings → Webhooks without hosting anything. Register your own endpoint (a request bin works) to receive the same events signed with your secret.

https://flexysure.intrepidprojects.co.ke/webhooks/sink/nRAUgRiijTQTDTV2Z7f0w0RbTAL1i5vgQkczHoCt5exLxZKn

A first run

Get a token (above) and call GET /insurers.
Price a car with POST /motor/quote, then save it with POST /motor/save and an Idempotency-Key.
Send the premium prompt with POST /payment/stk/push and pay it from Collections.
Watch the policy go active and the certificate arrive, by polling or through your webhook endpoint.