Authentication

Every request carries your API key in the X-API-Key header. The key tells Pulse which business you are, so you never pass a business id yourself.

curl https://engine-api.pilot.pulseshiga.io/v1/banks \
  -H "X-API-Key: <your key>"

A request without a valid key returns 401 with the code unauthorized.

Create and rotate keys

Manage keys in Pulse Console. Select the test or live environment before you create or rotate a key. A secret key is shown only when it is created, so copy it into your secret manager before you close the dialog. Use the secret key in X-API-Key; do not send the publishable key to these server-side endpoints.

Rotation invalidates the old key immediately. If you need both credentials to work during deployment, create a separate key, deploy it, confirm traffic uses it, then rotate the old key. If a key is exposed, rotate it immediately and update every service that used it.

Base URLs

You get a separate key for each environment. Build against pilot, then switch to production when you go live.

Every path sits under /v1. Send and receive JSON, with Content-Type: application/json. The examples in these guides use the pilot host. In the API reference, the request runner has a server selector for pilot and production.

Responses

Every response has the same shape. A success returns status: true and a data object. A failure returns status: false with an error string and a code.

{
  "status": true,
  "data": { }
}

Check status first. When it is false, switch on code, not error: the code is stable, the message can change. See Errors and retries for the full list of codes.

Amounts

Amounts are strings, like "150000", never raw numbers. A JSON number rounds large or fractional values, and money cannot lose a kobo. Send strings, read strings, and do the math with a decimal type on your side.