API prête à l'intégration

# 1. Lister les investisseurs consentants pour votre SGI
curl "https://api.getinopay.com/v1/sgi/portfolio/connections" \
  -H "Authorization: Bearer inopay_test_abc123..."

# 2. Créer une session KYC hébergée pour un investisseur
curl -X POST "https://api.getinopay.com/v1/kyc/sessions" \
  -H "Authorization: Bearer inopay_test_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "email": "amadou@example.com",
    "full_name": "Amadou Diallo",
    "phone": "+33612345678",
    "requested_level": "KYC2"
  }'

# 3. Confirmer l'exécution d'un ordre routé vers votre SGI
curl -X PATCH "https://api.getinopay.com/v1/sgi/portfolio/orders/ORDER_ID/execute" \
  -H "Authorization: Bearer inopay_test_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "execution_ref": "EXEC-20260423-001",
    "executed_at": "2026-04-23T10:30:00Z",
    "gross_amount_fcfa": 1500000
  }'

// npm install node-fetch (Node 18+ : fetch natif)
const API = "https://api.getinopay.com";
const KEY = process.env.INOPAY_API_KEY;

// Lister les investisseurs consentants
const res = await fetch(`${API}/v1/sgi/portfolio/connections`, {
  headers: { Authorization: `Bearer ${KEY}` }
});
const { connections } = await res.json();

// Vérifier une attestation KYC signée Ed25519 offline (sans réseau)
import { createPublicKey, verify } from "crypto";
const inopayPubKey = createPublicKey(fs.readFileSync("./inopay-kyc-pubkey.pem"));
function verifyAttestation(attestationJwt) {
  const [header, payload, sig] = attestationJwt.split(".");
  const signingInput = `${header}.${payload}`;
  return verify(null, Buffer.from(signingInput),
    inopayPubKey, Buffer.from(sig, "base64url"));
}

# pip install requests cryptography
import os, requests, json, base64
from cryptography.hazmat.primitives.serialization import load_pem_public_key

API = "https://api.getinopay.com"
KEY = os.environ["INOPAY_API_KEY"]
headers = {"Authorization": f"Bearer {KEY}"}

# Lister les ordres routés vers votre SGI (à exécuter)
r = requests.get(f"{API}/v1/sgi/portfolio/orders?status=pending_routing", headers=headers)
for order in r.json()["orders"]:
    print(order["id"], order["direction"], order["quantity"])

# Confirmer l'exécution
r = requests.patch(f"{API}/v1/sgi/portfolio/orders/{order_id}/execute",
    headers=headers,
    json={"execution_ref": "EXEC-20260423-001",
          "gross_amount_fcfa": 1500000})

<?php
// Vérifier la signature HMAC d'un webhook reçu
$secret = getenv("INOPAY_HMAC_SECRET"); // depuis dashboard SGI
$body  = file_get_contents("php://input");
$sig   = $_SERVER["HTTP_X_INOPAY_SIGNATURE"] ?? "";

$expected = "sha256=" . hash_hmac("sha256", $body, $secret);

if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit("invalid signature");
}

$event   = $_SERVER["HTTP_X_INOPAY_EVENT"]; // ex : kyc.validated
$payload = json_decode($body, true);

switch ($event) {
    case "consent.granted":  onConsentGranted($payload); break;
    case "kyc.validated":    onKycValidated($payload); break;
    case "order.routed":     onOrderRouted($payload); break;
}
http_response_code(200);
echo json_encode(["ok" => true]);