Connect Oxflare to the Rest of Your Business
A clean, scoped, idempotent API and signed webhooks, so your accounting package, website or reporting tools can work with live property data.
Designed Around Safety
Keys are scoped, requests are isolated to your organization and every write can be retried without risk.
Scoped keys
Keys look like rp_prefix_secret, are shown once and only a hash is stored. Scopes: read, payments:write, invoices:write. Revoke any time.
Read what you need
Properties, units, tenants, leases, invoices and payments, with cursor pagination.
Idempotent writes
Every POST needs an Idempotency-Key. Retries replay the first response, and a reused key with a different body is refused.
Isolated by organization
Every request runs as the key's organization. Other organizations' ids return 404.
Rate limited
120 requests per minute per key, so a runaway script cannot affect your live operations.
Audited
Changes made through the API are recorded in the audit log with the key id.
Raise an Invoice From Your Own System
curl -X POST https://your-domain.co.ke/api/v1/invoices \
-H "Authorization: Bearer rp_xxxxxxxx_yyyyyyyyyyyyyyyy" \
-H "Idempotency-Key: 6b0d2c9e-event-2026-11-001" \
-H "Content-Type: application/json" \
-d '{"lease_id": 1042, "type": "service", "amount": 3500, "description": "Gate repair levy"}'Illustrative request. Field names and full reference are provided with your API access.
Be Told the Moment Something Happens
Subscribe an HTTPS endpoint and receive signed events as they happen. Events are queued in the same database transaction as the change, so a rolled-back change never emits.
- payment.received and payment.reversed
- invoice.created, invoice.credited and invoice.cancelled
- lease.started and lease.ended
- Retries with the same event id, and a Send again button
$header = $_SERVER['HTTP_X_RENTPRO_SIGNATURE'];
// t=<time>,v1=<hmac>
parse_str(str_replace(',', '&', $header), $p);
$expected = hash_hmac('sha256', $p['t'] . '.' . $body, $secret);
if (!hash_equals($expected, $p['v1'])) { http_response_code(400); exit; }Webhooks That Do Not Give Up Easily
- Failed deliveries retry with growing delays, up to eight attempts
- An endpoint that fails 50 times in a row is switched off to protect you
- Private, local and non-HTTPS addresses are refused
- Delivery history with Send again for any dead delivery
- Signing secrets are encrypted and can be replaced
- Organizations with an unpaid subscription receive a clear 402 response
Developer FAQ
API and webhook access is a plan feature. Ask us which plan includes it for your portfolio.
No. M-Pesa payments arrive only through the M-Pesa Centre. The API can record cash, bank, cheque, card and other payments through the normal payment engine.
Each request is signed with HMAC-SHA256 using a secret shown once when you create the endpoint. Only HTTPS addresses are accepted, redirects are not followed, and each delivery times out after 10 seconds.
Each key is limited to 120 requests per minute.
Build on Top of Your Property Data
Talk to us about API access for your organization.