API Documentation Token authentication Advanced filters ETag caching
DataBoom🇳🇬 API Documentation
DataBoom🇳🇬 is a modern, multi-channel bills payment platform you can use on the Web,
WhatsApp and Telegram.
Upgraded users (called Vendors) can run their own WhatsApp/Telegram bots with zero monthly fees — keeping more profit as they grow. This documentation shows you how to connect your app, site, or bot to the API endpoints under /api/*.
Use /api/network-details, /api/data-plans, /api/cable-details,
/api/electricity-providers, and /api/exam-providers to discover provider IDs and plan IDs.
Last updated
2026-07-11
Bootstrap 5
Support email
hello@databoomnigeria.ng
WhatsApp
2347025073473
Never share either API key publicly. Use the sandbox key for demos, development and integration testing.
Every documented endpoint supports sandbox execution. Sandbox write requests return endpoint-specific simulated results but never debit wallets, contact external providers, send campaigns, or modify production records.
ETag caching (performance boost)
Some list endpoints return an ETag. Reuse it in If-None-Match to get 304 Not Modified.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {
"period": "30d"
}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/dashboard?period=30d" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/quick-setup" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save_website
CMS/settings fields
mixed
Send only fields being changed. GET returns the full safe payload.
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"action": "save_website",
"site_name": "My VTU Store",
"hero_title": "Instant digital services",
"primary_color": "#2563eb",
"pwa_enabled": true
}
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {
"period": "30d",
"compare": 1
}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/website-traffic?period=30d&compare=1" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save_bot_whatsapp_number, update_bot_whatsapp_number, unlock_sensitive, get_sensitive, lock_sensitive or regen_secret
bot_whatsapp_number
string
Vendor BOT phone number
bot_session_expires
int
Session lifetime in hours
password / pin
string
Required when revealing or regenerating the secret
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {
"category": "getting-started"
}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/help?category=getting-started" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
bank_resolve, paystack_resolve, security_send_token, kyc_finalize, add_account, delete_account, withdraw or transfer_to_main
password
string
Required for account and money mutations
pin
string
Required for account and money mutations
bank_code / account_number
string
Used for bank resolution and account creation
amount
number
Withdrawal or commission-to-main-wallet transfer amount
account_id
int
Withdrawal account ID
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
Any supported business-console action
action fields
mixed
Same fields used by the matching vendor-panel business-console action
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"action": "save_business_settings",
"business_name": "My VTU Store",
"timezone": "Africa/Lagos"
}
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save_staff, set_staff_status, reset_staff_web_password or another supported staff-console action
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save_settings, smtp_test, smtp_clear or logo_clear
network_percentages
object
Per-network user, agent and vendor percentage markups
logo_light
file/string
Multipart image upload or saved logo path
Supported setting fields
mixed
Business, contact, referral, pricing, SMTP and automatic plan-update fields
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
q / user_q
string
GET-only vendor-user search used when assigning deposits or creating linked accounts
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
user_id
int
Vendor-owned user ID
amount
number
Requested amount
method_key
string
databoom_autostatement, private_autostatement or pocketfi
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
source
string
all, private, events, wallet or databoom
user_id
int
Optional vendor-owned user filter
q / status / method_key
string
Detailed payment filters
date_from / date_to
date
Inclusive YYYY-MM-DD range
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
user_id
int
Vendor-owned user ID
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
create_user, update_user, set_status, update_wallet, update_refwallet, send, pause, resume, meta or delete
user_id
int
Required except when creating; conversation controls may also use sender
password / pin
string
Required for wallet and delete actions
amount / wallet
mixed
Wallet adjustment amount and main/referral wallet selection
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search by user ID, name, username, email or phone. Quick tokens such as id:123, ref:123 and email:name@example.com are supported, and Nigerian local and international phone formats are matched.
status
int|string
Optional: 0/active, 1/blocked or 3/verification_required. Omit it or use all/any for no status filter.
type
int|string
Optional: 1/user/customer, 2/agent or 3/vendor. Omit it or use all/any for no type filter.
country / state / city
string
Optional exact location filters
has_balance
boolean|string
Applied only when explicitly supplied. Use true/positive for users with a balance, false/zero for zero balance, or all/any for no balance filter.
min_wallet / max_wallet
number
Optional main-wallet range. The panel aliases minw and maxw are also accepted.
min_referral_wallet / max_referral_wallet
number
Optional referral-wallet range. The panel aliases minrw and maxrw are also accepted.
referrer_user_id
int
Return users referred by this vendor-owned user. The panel alias ref is also accepted.
only_with_transactions
boolean
When true, return only users who already have vendor transaction history. The panel alias only_tx is also accepted.
registered_from / registered_to
date
Inclusive registration-date range in YYYY-MM-DD format. The panel aliases reg_from and reg_to are also accepted.
last_activity_from / last_activity_to
date
Inclusive last-activity range in YYYY-MM-DD format. The panel aliases act_from and act_to are also accepted.
sort_by
string
id, name, email, phone, type, status, wallet, referral_wallet, registered_at, last_activity_at, tx or spent. The sort/dir and panel aliases sId, refwallet, reg and last are also accepted.
sort_dir
string
ASC or DESC
page / per_page
int
Pagination values; per_page supports 1 to 200
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {
"page": 1,
"per_page": 50
}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/users/list?page=1&per_page=50" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
{
"status": "fail",
"code": "vendor_token_required",
"message": "This endpoint accepts API keys belonging to vendor accounts only.",
"request_id": "f6de4a7c9a3b4e7d"
}
/vendor/users/viewGETVendor token required
View vendor user
View one vendor-owned user by ID, email, phone, username or identifier, including balances, security state, transactions, payments, referrals and linked payment accounts.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
user_id
int|string
Vendor-owned user ID. The special value latest returns the vendor’s newest user for safe testing.
email / phone / username / identifier
string
Alternative vendor-scoped user lookup fields when user_id is not supplied
recent_limit
int
Number of recent transactions, payments and referrals to return; 1 to 100
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
capabilities, create_user, update_user, set_status, block, activate, require_verification, update_wallet, update_refwallet, set_password, set_pin, send, pause, resume, meta or delete
user_id / email / phone / username / identifier
mixed
Use any one of these fields to identify a vendor-owned user; create_user and capabilities do not require a user identifier
first_name / last_name / email / phone
string
User identity fields used by create_user and update_user
username / country / state / city / address
string
Optional profile fields
type
int|string
1/user/customer, 2/agent or 3/vendor
status
int|string
0/active, 1/blocked or 3/verification_required
vendor_password / vendor_pin
string
Required only for wallet adjustments and deletion; password and pin remain accepted as compatibility aliases
new_password / force_password_change
mixed
Used by set_password or update_user when changing the user password
new_pin
string
Exactly four digits for set_pin or update_user
amount / wallet
mixed
Wallet adjustment amount and main/referral wallet selection
reason
string
Optional transaction description for a main-wallet adjustment
X-Idempotency-Key
header
Recommended for every management mutation
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search network name, package type, catalogue ID or system ID.
network_id / network
int|string
Filter by network ID, external network ID or network name.
type / airtime_type
string
Filter by package type such as VTU or Share And Sell.
amount
number
Optional face value used to calculate exact subscriber, agent, vendor and buying quotations.
min_buy / max_buy
number
Filter the vendor buying charge percentage.
min_subscriber / max_subscriber
number
Filter the subscriber charge percentage.
min_agent / max_agent
number
Filter the agent charge percentage.
min_vendor / max_vendor
number
Filter the vendor-level user charge percentage.
status
boolean|string
Filter by effective availability after both vendor and central network/service switches are applied.
price_for
string
subscriber, agent or vendor; adds selected_price to every row.
group_by
string
network or type.
sort_by / sort_dir
string
Sort by network, type, buy, subscriber, agent, vendor or margin in ASC/DESC order.
page / per_page / all
mixed
Pagination. all=true returns up to 5,000 matching rows.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
Read all vendor data plans with network metadata, package details, subscriber, agent and vendor prices, margins, status, grouping and advanced filters.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search plan name, provider plan ID, type, network, catalogue ID or system ID.
network_id / network / datanetwork
int|string
Filter by network. Use all_for_network=true to return every matching plan for one network in one response.
all_for_network
boolean
Return all plans associated with the selected network, up to 5,000 rows.
status
boolean|string
Filter the vendor plan row: active/on/1, inactive/off/0 or all.
effective_status
boolean|string
Filter effective purchase availability after vendor plan, central plan, network and service switches are combined.
type / category / variant_group
string
Filter plan type, plan category or smart-variant group.
plan_id / system_id / provider_plan_id
int|string
Filter by vendor catalogue ID, DataBoom system ID or provider plan ID.
pId / planId
int
Vendor-panel aliases that filter by the DataBoom system plan ID.
name / datavalue
string|int
Filter by plan-name text or exact plan size in megabytes.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search plan name, provider plan ID, provider name, catalogue ID or system ID.
provider_id / provider / cableprovider
int|string
Filter by provider row ID, system ID, provider code or provider name.
all_for_provider
boolean
Return all packages associated with the selected provider, up to 5,000 rows. A provider filter is required.
status
boolean|string
Filter by effective provider availability after vendor and central provider switches are combined.
plan_id / system_id / provider_plan_id
int|string
Filter by vendor package ID, DataBoom system package ID or provider plan ID.
min_days / max_days
int
Filter package validity.
min_cost / max_cost
number
Filter API buying price.
min_subscriber / max_subscriber
number
Filter subscriber price.
min_agent / max_agent
number
Filter agent price.
min_vendor / max_vendor
number
Filter vendor-level user price.
price_for
string
subscriber, agent or vendor; adds selected_price to every row.
group_by
string
provider.
sort_by / sort_dir
string
Sort by provider, name, validity, cost, subscriber, agent or vendor.
page / per_page / all
mixed
Pagination. all=true returns up to 5,000 matching rows.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
Read the vendor’s electricity providers, availability, amount-based pricing formula and optional quotations for subscribers, agents and vendor-level users.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search provider name, abbreviation, provider code, catalogue ID or system ID.
provider_id / provider
int|string
Filter by provider row ID, system ID, provider code, name or abbreviation.
status
boolean|string
Filter by provider availability.
amount
number
Optional electricity face value used to calculate subscriber, agent and vendor quotations.
min_discount / max_discount
number
Filter the vendor discount percentage.
min_profit / max_profit
number
Filter the configured profit percentage.
sort_by / sort_dir
string
Sort by provider, abbreviation, status, discount or profit.
page / per_page / all
mixed
Pagination.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search provider name, provider code, catalogue ID or system ID.
provider_id / provider
int|string
Filter by provider row ID, system ID, provider code or provider name.
status
boolean|string
Filter by provider availability.
min_buying_price / max_buying_price
number
Filter buying price.
min_price / max_price
number
Filter subscriber, agent and vendor selling price.
sort_by / sort_dir
string
Sort by provider, status, buying_price, price, margin or markup.
page / per_page / all
mixed
Pagination.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
q
string
Search network name, external network code, vendor network row ID or DataBoom system network ID.
network_id / network
int|string
Filter by vendor network row ID, DataBoom system network ID, external network code or network name.
status
boolean|string
Filter effective whole-network availability after vendor and central network switches are combined.
service
string
network, vtu, share_and_sell, airtime_pin, sme, gifting, corporate or data_pin.
service_status
boolean|string
Filter effective availability of the selected service after vendor and central switches are combined.
min_airtime_packages / max_airtime_packages
int
Filter the number of vendor airtime packages associated with a network.
min_data_plans / max_data_plans
int
Filter the total number of vendor data plans associated with a network.
min_active_data_plans / max_active_data_plans
int
Filter data plans that are enabled both on the vendor row and central DataBoom plan.
sort_by / sort_dir
string
Sort by network, status, airtime_packages, data_plans or active_data_plans in ASC/DESC order.
page / per_page / all
mixed
Pagination. all=true returns every matching network up to the endpoint limit.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/catalog/summary" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
{
"status": "fail",
"code": "vendor_token_required",
"message": "This endpoint accepts API keys belonging to vendor accounts only.",
"request_id": "f6de4a7c9a3b4e7d"
}
/vendor/upgrade-plansGETVendor token required
Vendor upgrade plans
List the vendor’s Subscriber, Agent and Vendor plans, configured upgrade fees, referral upgrade bonus and an optional quote for one vendor-owned user.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
user_id / email / phone / username / identifier
mixed
Optional vendor-owned user lookup. When supplied, the response includes eligibility, wallet balance and upgrade shortfalls.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"query": {
"user_id": "latest"
}
}
Code examples
curl -X GET "https://databoomnigeria.ng/api/vendor/upgrade-plans?user_id=latest" \
-H "Authorization: Token YOUR_VENDOR_API_KEY"
Quote, upgrade or downgrade a vendor-owned user. Wallet upgrades use the configured fee and user PIN; vendor-authorized manual changes require the vendor password and PIN.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
user_id / email / phone / username / identifier
mixed
Vendor-owned user lookup used by GET quote requests.
action
string
GET defaults to quote.
Request body (JSON)
Field
Type
Description
action
string
quote, upgrade, downgrade or change
user_id / email / phone / username / identifier
mixed
Vendor-scoped user lookup; one lookup value is required.
target_plan / target_type
string|int
subscriber/1, agent/2 or vendor/3
billing_mode
string
user_wallet or no_charge. Wallet upgrades require user_pin. Manual changes and every downgrade require the vendor password and PIN.
user_pin
string
The vendor user’s four-digit transaction PIN for a wallet-funded upgrade.
vendor_password / vendor_pin
string
Required for no-charge upgrades and every downgrade.
reason
string
Optional audit explanation for a vendor-authorized plan change.
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Query parameters
Parameter
Type
Description
user_id / email / phone / username / identifier
mixed
Optional vendor-owned user filter.
action_type / direction
string
upgrade or downgrade.
q
string
Search reference, description, user name, email or phone.
date_from / date_to
date
Inclusive YYYY-MM-DD range.
page / per_page
int
Pagination; per_page supports 1 to 200.
Request body (JSON)
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
receipt_html, receipt, export_csv or export for POST; omit for normal GET listing
transaction_id / txid
int
Transaction to inspect or render as a receipt
filters
mixed
q, user_id, service, status, date_from, date_to, amount_min and amount_max
Complete request example
GET
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save/update, bulk or bulk_update
id / aId
int
Vendor airtime row ID
aUserDiscount / aAgentDiscount / aVendorDiscount
number
Required values from 0 to 120; user ≥ agent ≥ vendor > buy discount
rows
array
Bulk rows containing aId and all three discount values
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
List or update vendor data-plan prices, availability and Auto Update overrides; bulk update or reprice using saved per-network percentages and system availability locks.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save/update, bulk_upsert/bulk_update or reprice
id / pId
int
Vendor plan row ID
userprice / agentprice / vendorprice
number
Final prices must satisfy user ≥ agent ≥ vendor
is_active / status
boolean
A centrally disabled system plan is always forced off
Auto Update overrides
mixed
autoUpdateOverride and the three per-plan percentage override fields
rows
array
Bulk plan updates using the same validations
network_id / networkId
int
0 reprices all networks using saved per-network rates; a specific ID uses submitted percentages
pctUser / pctAgent / pctVendor
number
One-network percentages must satisfy user ≥ agent ≥ vendor
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
update, toggle, set_status or export
id / eId
int
Vendor electricity-provider row ID
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
provider_update, toggle, set_status, plan_save, plans_bulk or export
id / cId / cpId
int
Provider or plan row ID
userprice / agentprice / vendorprice
number
Each must exceed API price and satisfy user ≥ agent ≥ vendor
rows
array
Bulk cable-plan price updates using the same safeguards
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
update, toggle, set_status or export
id / eId
int
Vendor exam-provider row ID
price
number
Selling price; must be strictly greater than buying_price
providerStatus
boolean
1/0 or a boolean-compatible value
logo
file/string
Optional provider logo upload or saved path
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
update, set_status, bulk_set_status, reset_to_system, upload_logo, remove_logo or use_system_logo
id / nId
int
Vendor network row ID
field / value
string
Network availability field and On/Off value
logo
file/string
Multipart network logo or path
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
control_action / action
string
meta, send, pause or resume
log_id / sender / channel
mixed
Conversation target
message / pause_minutes
mixed
Live reply or pause duration
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"action": "send",
"sender": "2348012345678",
"channel": "telegram",
"message": "Your request has been resolved."
}
Code examples
curl -X POST "https://databoomnigeria.ng/api/vendor/bot-stats" \
-H "Authorization: Token YOUR_VENDOR_API_KEY" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: vendor-api-bot-stats-10001" \
-d '{"action":"send","sender":"2348012345678","channel":"telegram","message":"Your request has been resolved."}'
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
save, send, update, enable, disable, toggle or delete
ids
array
Bulk announcement IDs
title / message
string
Announcement title and body
type
string
web, telegram or whatsapp
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
action
string
draft, queue, pause, resume, cancel or delete
channel
string
telegram, web_push or in_app
name / subject / body
string
Campaign content
filters / options
object
Audience and delivery options accepted by the panel campaign engine
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"action": "queue",
"channel": "web_push",
"name": "Weekend promo",
"subject": "Discounted data plans",
"body": "Get discounted data plans this weekend.",
"filters": {
"all_active_users": true
}
}
Code examples
curl -X POST "https://databoomnigeria.ng/api/vendor/campaigns" \
-H "Authorization: Token YOUR_VENDOR_API_KEY" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: vendor-api-campaigns-10001" \
-d '{"action":"queue","channel":"web_push","name":"Weekend promo","subject":"Discounted data plans","body":"Get discounted data plans this weekend.","filters":{"all_active_users":true}}'
The authenticated account must have sType = 3. Valid non-vendor API keys receive HTTP 403.
Every database operation is automatically scoped to the authenticated vendor_sId; request bodies cannot override the vendor scope.
POST/PATCH/DELETE requests may send X-Idempotency-Key to safely replay the same request.
Logo actions accept multipart/form-data. Export actions return structured JSON or CSV text inside the normal JSON envelope instead of forcing a browser download.
Where documented, sensitive account, wallet, withdrawal and WhatsApp-secret operations require the vendor password and PIN in addition to the vendor API key.
Headers
Header
Value
Notes
Authorization
Token {VENDOR_TOKEN}
Required vendor API token
Content-Type
application/json
Required for JSON requests
X-Idempotency-Key
unique-client-key
Recommended for mutations
Request body (JSON)
Field
Type
Description
id
int
Subscription ID
action
string
activate, disable, status or delete
status
string
active, disabled, expired, gone or unsubscribed
Complete request example
POST
GET examples place values under query. Write methods show the JSON body sent to the endpoint.
{
"status": "fail",
"code": "invalid_token",
"message": "The supplied API key is invalid.",
"request_id": "f6de4a7c9a3b4e7d"
}
Try-it console
Send live and sandbox requests from this page
This runs in your browser using a secure, non-persistent key field. Choose live or sandbox, select an endpoint and review the request before sending.
No server storage
API key
Enter your API key to call private endpoints.
Live requests use real balances and can perform real actions. Sandbox requests never debit wallets, call providers, or change production records.
Request builder
Pro tip: Use unique ref values for purchase endpoints, for example 1785213901.
Response
—
{}
That is it
Production-ready integration tips
Finish strong with best practices, safe retries, idempotency, and a reliable integration.
Idempotency and duplicate protection
Purchase endpoints require a unique ref. If you retry after a network failure, reuse the same ref and check /api/transactions?refs=YOUR_REF to confirm the final status.
Performance
Use list endpoints with ETag caching. When you receive 304, reuse your cached response instantly.
Need help?
If something is unclear, contact DataBoom🇳🇬 support via email hello@databoomnigeria.ng or WhatsApp 2347025073473.