Quickstart

Get an OAuth access token and use it to list your organization's cards.

Request a client ID and client secret from your Swypex representative.

1. Store your credentials

Keep credentials in a secrets manager and expose them only to your server-side integration. The examples use these environment variables:

SWYPEX_CLIENT_ID
SWYPEX_CLIENT_SECRET

Never commit these values or send them to browser or mobile clients.

2. Obtain an access token

The current OpenAPI 3.1.0 contract requires the complete scope set for authenticated endpoints.

Token request

curl -X POST https://p.swypex.com/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id={client_id}" \
  --data-urlencode "client_secret={client_secret}" \
  --data-urlencode "scope=cards:read cards:write transactions:read"

Token response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "cards:read cards:write transactions:read"
}

See Authentication for token handling and credential-security guidance.

3. Make your first request

Pass the access token in the Authorization header.

List cards

curl -G https://p.swypex.com/v1/card \
  -H "Authorization: Bearer {access_token}" \
  --data-urlencode "limit=10"

Response

{
  "cards": [
    {
      "id": "CRD1000000000",
      "last4": "1234",
      "nickname": "Business Travel Card",
      "cardHolder": {
        "id": "USR1000000000",
        "fullName": "Sara Amr",
        "department": { "id": "TAG1000000000", "name": "Sales" }
      },
      "limits": {
        "daily": 500000,
        "monthly": 2000000,
        "atm": 400000,
        "approvalBased": null
      },
      "availableBalance": 1500000
    }
  ],
  "nextCursor": "eyJpZCI6IkNSRDEwMDAwMDAwMDAifQ=="
}

Use nextCursor to request another page. See Pagination for the complete flow.

Explore the API

Cards — Read card balances and manage limits.
Transactions — Filter and retrieve ledger events.
Errors — Handle every published error type.
OpenAPI Specification — Download the 3.1.0 contract.