Welcome to Simplici!

API Guide:

1. Authentication Steps:

To access the Simplici API endpoints, an authentication process is required. Here are the steps:

1.1. Generating Access Token

• Endpoint: https://api.satschel.com/v2/auth/session-tokens

• Sandbox Endpoint: https://api.beta.satschel.com/v2/auth/session-tokens

• Method: POST

• Payload:

  {
    "client_id": "<YOUR_CLIENT_ID>",
    "client_secret": "<YOUR_CLIENT_SECRET>"
  }

• Response Example:

  {
    "access_token": "<YOUR_ACCESS_TOKEN>",
    "token_type": "Bearer",
    "refresh_token": "<YOUR_REFRESH_TOKEN>",
    "expires_in": 1695845492
  }

  Save the access_token value. This is your token which is required to make further API calls.

1.2. Refreshing the Access Token

In case your token expires, you can use the refresh token to get a new access token.

• Endpoint: https://api.satschel.com/v2/auth/refresh-token

• Sandbox Endpoint: https://api.beta.satschel.com/v2/auth/refresh-token

• Method: POST

• Payload:

  {
    "client_id": "<YOUR_CLIENT_ID>",
    "refresh_token": "<YOUR_REFRESH_TOKEN>"
  }

• Response Example:

  {
    "access_token": "<YOUR_NEW_ACCESS_TOKEN>",
    "token_type": "Bearer",
    "refresh_token": "<YOUR_NEW_REFRESH_TOKEN>",
    "expires_in": 1695845563
  }

1.3. Verifying Access Token

To ensure that your access token is valid and has not expired:

• Endpoint: https://api.satschel.com/v2/auth/verify

• Sandbox Endpoint: https://api.beta.satschel.com/v2/auth/verify

• Method: POST

• Headers:

  {
    "Authorization": "Bearer <YOUR_ACCESS_TOKEN>"
  }

2. API Usage

Once authenticated, you can now use the various APIs provided by Simplici. Use the access token in the Authorization header of your requests.

• Headers for API Calls:

  {
    "Authorization": "Bearer <YOUR_ACCESS_TOKEN>"
  }

For detailed information on each API — methods, parameters and sample responses — see the product pages in this section: KYC, KYC – AML, KYB, AML, Face Match, Simplici Sign and Webhook. The operator API behind the admin panel is documented separately under v1.

Always ensure that you handle your client_id, client_secret, access_token, and refresh_token with care, as they provide access to sensitive data. Avoid exposing them in client-side code or public repositories.