PawaPesa API v1 — Documentation

HomeDocumentation

Karibu kwenye Nyaraka za PawaPesa API

PawaPesa ni lango moja la malipo linalokuwezesha kukusanya na kutuma fedha kupitia mobile money, benki na kadi kwa kutumia API moja rahisi. Nyaraka hizi zinaonyesha kila endpoint kwa mifano halisi ya cURL, request na response, ili uweze kuanza kupokea malipo ndani ya dakika chache.

Vitambulisho Utakavyohitaji

  • Merchant ID — namba ya akaunti yako inayotumika kwenye baadhi ya maombi.
  • API Token — token ya siri inayotumika kwenye header ya Authorization.
  • Till Number — kitambulisho cha mahali fedha zinapoingia (mfano PWP-TILL-40219).

Vitambulisho hivi vinapatikana baada ya kufungua akaunti kwenye https://stabetpro.com na kwenda Dashboard → Developer → API Keys. Hifadhi token yako kwa usiri; usiiweke kwenye msimbo wa upande wa mteja (frontend).

Mahitaji ya Kiufundi

  • cURL au HTTP client yoyote (Postman, Axios, Guzzle, Requests).
  • Muunganisho wa HTTPS — maombi ya HTTP yatakataliwa.
  • Endpoint ya webhook inayopatikana hadharani kwa taarifa za mwisho za malipo.

Authentication

PawaPesa hutumia Bearer Token. Kila ombi kwenye endpoint iliyolindwa lazima libebe token yako kwenye header ya Authorization.

http
Authorization: Bearer PWP_LIVE_XXXXXXXX
Content-Type: application/json
Accept: application/json

Headers za Lazima

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Sandbox: token zinazoanza na PWP_TEST_ hufanya kazi kwenye mazingira ya majaribio bila kuhamisha fedha halisi. Badilisha kuwa PWP_LIVE_ ukiwa tayari kwa uzalishaji.

Base URLs

Njia zote za endpoint zinaongezwa mwishoni mwa base URL.

MazingiraBase URL
Productionhttps://stabetpro.com/api
Sandboxhttps://stabetpro.com/api/sandbox

Core Payments

POST

2. Lipa Moja kwa Moja kwa Mobile Money (USSD Push)

Tuma ombi la malipo moja kwa moja kwenye simu ya mteja. Mteja atapokea kidirisha cha USSD na kuthibitisha kwa PIN yake ya M-Pesa, Airtel Money, Tigo Pesa au Halopesa.

POST https://stabetpro.com/api/payments/mobile

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Request Body

ParameterTypeRequiredMaelezo
merchant_idintegerYesKitambulisho chako cha mfanyabiashara.mfano: 1042
customer_namestringYesJina la mlipaji.mfano: Juma Kileo
customer_emailstringNoBarua pepe ya mlipaji.mfano: juma@mfano.co.tz
msisdnstringYesNamba itakayopokea USSD push.mfano: 255765432198
channelstringNoMPESA-TZ, AIRTELMONEY, TIGOPESA au HALOPESA. Ikiachwa, Pawapesa hutambua mtandao yenyewe.mfano: MPESA-TZ
amountintegerYesKiasi cha kulipwa.mfano: 5000
currencystringYesSarafu.mfano: TZS
referencestringYesKumbukumbu ya kipekee kwenye mfumo wako.mfano: TXN-88213
callback_urlstringYesWebhook ya kupokea matokeo ya mwisho.
descriptionstringNoMaelezo ya muamala.mfano: Ada ya usajili

Mfano wa Request

json
{
  "merchant_id": 1042,
  "customer_name": "Juma Kileo",
  "customer_email": "juma@mfano.co.tz",
  "msisdn": "255765432198",
  "channel": "MPESA-TZ",
  "amount": 5000,
  "currency": "TZS",
  "reference": "TXN-88213",
  "callback_url": "https://duka.co.tz/api/pawapesa/webhook",
  "description": "Ada ya usajili"
}

Majibu (Responses)

202 Accepted

json
{
  "status": "pending",
  "message": "USSD push sent to customer.",
  "data": {
    "order_id": "PWP-20260729-0004318",
    "reference": "TXN-88213",
    "channel": "MPESA-TZ",
    "msisdn": "255765432198",
    "amount": 5000,
    "payment_status": "PENDING",
    "requested_at": "2026-07-29T13:42:11+03:00"
  }
}

400 Bad Request

json
{
  "status": "error",
  "code": "PWP-1042",
  "message": "The msisdn provided is not supported by any mobile money channel."
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/payments/mobile' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "merchant_id": 1042,
    "customer_name": "Juma Kileo",
    "msisdn": "255765432198",
    "amount": 5000,
    "currency": "TZS",
    "reference": "TXN-88213",
    "callback_url": "https://duka.co.tz/api/pawapesa/webhook"
  }'
POST

3. Angalia Hali ya Oda (Order Status)

Thibitisha hali halisi ya muamala wowote kwa kutumia order_id uliyopewa wakati wa kuanzisha malipo. Tumia endpoint hii kama nyongeza ya webhook.

POST https://stabetpro.com/api/payments/status

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Request Body

ParameterTypeRequiredMaelezo
order_idstringYesKitambulisho cha oda kilichotolewa na Pawapesa.mfano: PWP-20260729-0004318
referencestringNoMbadala wa order_id — kumbukumbu yako mwenyewe.mfano: TXN-88213

Mfano wa Request

json
{
  "order_id": "PWP-20260729-0004318"
}

Majibu (Responses)

200 OK — COMPLETED

json
{
  "status": "success",
  "message": "Order retrieved successfully.",
  "data": {
    "order_id": "PWP-20260729-0004318",
    "reference": "TXN-88213",
    "amount": "5000.00",
    "currency": "TZS",
    "payment_status": "COMPLETED",
    "channel": "MPESA-TZ",
    "msisdn": "255765432198",
    "receipt": "PWP7C3H91KQ",
    "paid_at": "2026-07-29T13:43:02+03:00"
  }
}

200 OK — PENDING

json
{
  "status": "pending",
  "message": "Payment has not been confirmed yet.",
  "data": {
    "order_id": "PWP-20260729-0004318",
    "payment_status": "PENDING",
    "receipt": null,
    "paid_at": null
  }
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/payments/status' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{ "order_id": "PWP-20260729-0004318" }'
POST

4. Tuma Fedha (Disbursement)

Tuma malipo kwa wateja, mawakala au wafanyakazi moja kwa moja kwenye pochi ya mobile money au akaunti ya benki.

POST https://stabetpro.com/api/payouts/send

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Request Body

ParameterTypeRequiredMaelezo
merchant_idintegerYesKitambulisho chako cha mfanyabiashara.mfano: 1042
destination_typestringYesmobile au bank.mfano: mobile
destinationstringYesNamba ya simu au namba ya akaunti ya benki.mfano: 255712345678
channelstringYesMtandao au benki lengwa.mfano: AIRTELMONEY
amountintegerYesKiasi cha kutuma.mfano: 150000
currencystringYesSarafu.mfano: TZS
referencestringYesKumbukumbu ya kipekee ya malipo.mfano: PAYOUT-5521
narrationstringNoMaelezo yatakayoonekana kwa mpokeaji.mfano: Malipo ya wiki

Mfano wa Request

json
{
  "merchant_id": 1042,
  "destination_type": "mobile",
  "destination": "255712345678",
  "channel": "AIRTELMONEY",
  "amount": 150000,
  "currency": "TZS",
  "reference": "PAYOUT-5521",
  "narration": "Malipo ya wiki"
}

Majibu (Responses)

200 OK

json
{
  "status": "success",
  "message": "Payout queued successfully.",
  "data": {
    "payout_id": "PWO-20260729-000911",
    "reference": "PAYOUT-5521",
    "amount": "150000.00",
    "fee": "1500.00",
    "total_debited": "151500.00",
    "payout_status": "PROCESSING"
  }
}

402 Payment Required

json
{
  "status": "error",
  "code": "PWP-2010",
  "message": "Insufficient merchant wallet balance."
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/payouts/send' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "merchant_id": 1042,
    "destination_type": "mobile",
    "destination": "255712345678",
    "channel": "AIRTELMONEY",
    "amount": 150000,
    "currency": "TZS",
    "reference": "PAYOUT-5521"
  }'
GET

5. Orodha ya Miamala

Pata orodha ya miamala yote ya akaunti yako kwa mfumo wa kurasa (pagination), pamoja na vichujio vya tarehe na hali.

GET https://stabetpro.com/api/transactions

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Query Parameters

ParameterTypeRequiredMaelezo
pageintegerNoNamba ya ukurasa.mfano: 1
per_pageintegerNoIdadi kwa ukurasa (upeo 100).mfano: 25
statusstringNoCOMPLETED, PENDING, FAILED, REVERSED.mfano: COMPLETED
fromstringNoTarehe ya kuanzia (YYYY-MM-DD).mfano: 2026-07-01
tostringNoTarehe ya kuishia (YYYY-MM-DD).mfano: 2026-07-29

Majibu (Responses)

200 OK

json
{
  "status": "success",
  "message": "Transactions retrieved successfully.",
  "data": {
    "transactions": [
      {
        "id": 90211,
        "order_id": "PWP-20260729-0004318",
        "reference": "TXN-88213",
        "type": "collection",
        "amount": "5000.00",
        "fee": "100.00",
        "channel": "MPESA-TZ",
        "msisdn": "255765432198",
        "payment_status": "COMPLETED",
        "created_at": "2026-07-29 13:43:02"
      },
      {
        "id": 90180,
        "order_id": "PWO-20260729-000911",
        "reference": "PAYOUT-5521",
        "type": "payout",
        "amount": "-150000.00",
        "fee": "1500.00",
        "channel": "AIRTELMONEY",
        "msisdn": "255712345678",
        "payment_status": "COMPLETED",
        "created_at": "2026-07-29 11:07:44"
      }
    ],
    "pagination": {
      "current_page": 1,
      "last_page": 4,
      "per_page": 25,
      "total": 87
    }
  }
}

Mfano wa cURL

bash
curl -X GET 'https://stabetpro.com/api/transactions?page=1&per_page=25&status=COMPLETED' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Accept: application/json'
GET

6. Salio la Pochi ya Mfanyabiashara

Angalia salio lililopo na lililoshikiliwa kwenye pochi yako ya Pawapesa kabla ya kutuma malipo.

GET https://stabetpro.com/api/wallet/balance

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Majibu (Responses)

200 OK

json
{
  "status": "success",
  "data": {
    "currency": "TZS",
    "available_balance": "842500.00",
    "pending_balance": "35000.00",
    "updated_at": "2026-07-29T13:50:10+03:00"
  }
}

Mfano wa cURL

bash
curl -X GET 'https://stabetpro.com/api/wallet/balance' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Accept: application/json'

Webhooks

Pawapesa hutuma ombi la POST kwenye URL uliyotoa mara tu hali ya muamala inapobadilika. Server yako inapaswa kujibu 200 OK ndani ya sekunde 10. Endapo hutajibu, tutajaribu tena mara 5 kwa muda unaoongezeka (dakika 1, 5, 15, 60, 180).

Matukio (Events)

  • payment.completed — malipo yamekamilika.
  • payment.failed — malipo yameshindikana.
  • payment.reversed — fedha zimerudishwa.
  • payout.completed — malipo ya kutoka yamefanikiwa.

Mfano wa Payload

json
{
  "event": "payment.completed",
  "sent_at": "2026-07-29T13:43:05+03:00",
  "data": {
    "order_id": "PWP-20260729-0004318",
    "reference": "TXN-88213",
    "amount": "5000.00",
    "currency": "TZS",
    "payment_status": "COMPLETED",
    "channel": "MPESA-TZ",
    "msisdn": "255765432198",
    "receipt": "PWP7C3H91KQ"
  }
}

Kuthibitisha Saini

Kila ombi hubeba header X-Pawapesa-Signature yenye HMAC SHA-256 ya mwili wa ombi ukitumia webhook secret yako. Linganisha kabla ya kuchakata.

php
$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_PAWAPESA_SIGNATURE'] ?? '';
$expected  = hash_hmac('sha256', $payload, getenv('PAWAPESA_WEBHOOK_SECRET'));

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

http_response_code(200);
echo 'ok';

User Authentication

POST

Sajili Mtumiaji (Register)

Fungua akaunti mpya ya Pawapesa kwa njia ya API. Jibu linarudisha access token ya kutumia mara moja.

POST https://stabetpro.com/api/auth/register

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Request Body

ParameterTypeRequiredMaelezo
full_namestringYesJina kamili la mtumiaji.mfano: Neema Mushi
emailstringYesBarua pepe ya kipekee.mfano: neema@mfano.co.tz
phonestringYesNamba ya simu.mfano: 255712345678
business_namestringNoJina la biashara kwa akaunti za kibiashara.mfano: Neema Digital
account_typestringYespersonal au merchant.mfano: merchant
regionstringYesMkoa au jiji.mfano: Dar es Salaam
passwordstringYesNywila (angalau herufi 8).
password_confirmationstringYesLazima ilingane na password.

Mfano wa Request

json
{
  "full_name": "Neema Mushi",
  "email": "neema@mfano.co.tz",
  "phone": "255712345678",
  "business_name": "Neema Digital",
  "account_type": "merchant",
  "region": "Dar es Salaam",
  "password": "Salama@2026",
  "password_confirmation": "Salama@2026"
}

Majibu (Responses)

201 Created

json
{
  "status": "success",
  "message": "Account created successfully.",
  "access_token": "PWP_LIVE_7f21c9be4a3d5106e8b24ac9",
  "token_type": "Bearer",
  "user": {
    "id": 1042,
    "full_name": "Neema Mushi",
    "email": "neema@mfano.co.tz",
    "phone": "255712345678",
    "account_type": "merchant",
    "merchant_id": 1042,
    "verified": false,
    "created_at": "2026-07-29T09:11:04+03:00"
  }
}

422 Unprocessable Entity

json
{
  "status": "error",
  "message": "Registration failed due to validation errors.",
  "errors": {
    "email": ["The email has already been taken."],
    "phone": ["The phone number format is invalid."]
  }
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/auth/register' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "full_name": "Neema Mushi",
    "email": "neema@mfano.co.tz",
    "phone": "255712345678",
    "account_type": "merchant",
    "region": "Dar es Salaam",
    "password": "Salama@2026",
    "password_confirmation": "Salama@2026"
  }'
POST

Ingia (Login)

Thibitisha mtumiaji na upate access token mpya ya kutumia kwenye maombi yote yanayohitaji uthibitisho.

POST https://stabetpro.com/api/auth/login

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Request Body

ParameterTypeRequiredMaelezo
emailstringYesBarua pepe iliyosajiliwa.mfano: neema@mfano.co.tz
passwordstringYesNywila ya akaunti.

Mfano wa Request

json
{
  "email": "neema@mfano.co.tz",
  "password": "Salama@2026"
}

Majibu (Responses)

200 OK

json
{
  "status": "success",
  "message": "Login successful.",
  "access_token": "PWP_LIVE_7f21c9be4a3d5106e8b24ac9",
  "token_type": "Bearer",
  "expires_in": 86400,
  "user": {
    "id": 1042,
    "full_name": "Neema Mushi",
    "email": "neema@mfano.co.tz",
    "account_type": "merchant",
    "merchant_id": 1042,
    "verified": true
  }
}

401 Unauthorized

json
{
  "status": "error",
  "code": "PWP-1001",
  "message": "Invalid email or password."
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/auth/login' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "email": "neema@mfano.co.tz",
    "password": "Salama@2026"
  }'
POST

Toka (Logout)

Futa token inayotumika sasa. Baada ya hapo maombi yote yanayotumia token hiyo yatakataliwa.

POST https://stabetpro.com/api/auth/logout

Headers

ParameterTypeRequiredMaelezo
AuthorizationstringYesBearer token yako ya Pawapesa.mfano: Bearer PWP_LIVE_XXXXXXXX
Content-TypestringYesAina ya data unayotuma.mfano: application/json
AcceptstringYesAina ya jibu unalotarajia.mfano: application/json

Majibu (Responses)

200 OK

json
{
  "status": "success",
  "message": "Token revoked."
}

Mfano wa cURL

bash
curl -X POST 'https://stabetpro.com/api/auth/logout' \
  -H 'Authorization: Bearer PWP_LIVE_XXXXXXXX' \
  -H 'Accept: application/json'

Error Codes

Makosa yote hurudishwa kwa muundo mmoja: status, code na message.

CodeHTTPMaanaSuluhisho
PWP-1001401Token si sahihi au imekwisha mudaHakikisha unatumia Authorization: Bearer na token halali kutoka dashboard.
PWP-1002403Akaunti haijathibitishwaKamilisha uthibitisho wa KYC kwenye dashboard ili kuwezesha live mode.
PWP-1010422Data ya ombi haijakamilikaAngalia orodha ya errors kwenye jibu na rekebisha sehemu zilizotajwa.
PWP-1042400Namba ya simu haitambulikiTumia muundo 2557XXXXXXXX bila alama ya +.
PWP-1055409Reference imeshatumikaTumia reference ya kipekee kwa kila muamala.
PWP-2010402Salio halitoshi kwa payoutWeka fedha kwenye pochi yako kabla ya kutuma malipo.
PWP-2044404Oda haipatikaniThibitisha order_id au reference uliyotuma.
PWP-3001429Umezidi kiwango cha maombiPunguza kasi ya maombi; upeo ni maombi 120 kwa dakika.
PWP-5000500Hitilafu ya ndani ya mfumoJaribu tena baada ya sekunde chache; kama itaendelea wasiliana na support.

Support & Resources

Timu yetu inasaidia muunganiko, utatuzi wa hitilafu na usimamizi wa akaunti.

NjiaMawasilianoMuda wa Majibu
Barua pepesupport@stabetpro.comSaa 24
Simu / WhatsApp+255 700 000 00008:00 – 20:00 EAT
Nyarakastabetpro.com/documentation24/7

Changamoto za Kawaida

TatizoUfumbuzi
Token inakataliwaHakikisha kuna nafasi moja kati ya 'Bearer' na token, na token haijafutwa kwenye dashboard.
Namba ya simu haikubalikiTumia muundo 255XXXXXXXXX bila alama ya + wala nafasi.
Webhook haipokelewiThibitisha URL inapatikana hadharani na inarudisha 200 OK haraka.
Malipo yanakaa PENDINGMobile money huchukua hadi dakika 3. Tumia webhook au poll /payments/status kila sekunde 30.
Reference imekataliwaKila muamala unahitaji reference ya kipekee kabisa.

Vidokezo vya Muunganiko

  • Anza majaribio na kiasi kidogo (TZS 500 – 1,000) kwenye sandbox.
  • Tumia webhook pamoja na ukaguzi wa hali ili kuhakikisha uhakika wa taarifa.
  • Hifadhi kila request na response kwa ajili ya utatuzi wa baadaye.
  • Fanya webhook yako iwe idempotent — tukio moja laweza kufika zaidi ya mara moja.

© 2026 PawaPesa API Documentation. Haki zote zimehifadhiwa.