Connect your own systems to pawa Loans.
For accounting software, a mobile app, or another internal system that needs to read member/loan/savings/share data or record a loan repayment, this is the real reference, published here so you can evaluate it before you sign up. There's no separate sandbox or API-only account: a token is generated from inside a real business account.
Authentication
Bearer-token auth. A token isn't a standalone API key, it is a staff user. Every request runs with that user's own role and branch access, exactly as if they were using the app themselves.
Base URL: https://pawaloans.openteq.co.ke/api/v1
Record a loan repayment
A payroll/HR system usually only knows the borrower by their own National ID, never our internal loan id, so the repayment endpoint accepts that directly, alongside three other identifiers. Send exactly one:
| Field | Use when |
|---|---|
id_number | You only know the borrower's National ID (the natural key for an external HR/payroll system, same as Paylist HR's own API). |
member_number | You have our member reference instead. |
loan_number | You have our human-readable loan reference (e.g. L00001). |
loan_id | You already looked it up via GET /loans. |
id_number/member_number resolve to that member's active/overdue loan. More than one? This never guesses, it 422s with every candidate listed:
Prefer to check first? total_balance tells you what's actually still owed:
Call this once the payment has already happened on your side, it records a repayment that occurred, it does not itself collect one. The loan must be active or overdue.
| Field | Required | Notes |
|---|---|---|
loan_id / loan_number / id_number / member_number | Exactly one | See above. |
amount | Yes | KES, > 0. May be less than, equal to, or more than the balance. |
payment_date | Yes | YYYY-MM-DD |
payment_method | Yes | cash | mpesa | bank | other |
reference_number | No | Your own transaction reference. |
phone_number | No | Payer's phone. |
notes | No | Free text, max 1000 chars. |
The member is notified automatically (SMS/email/WhatsApp, per their own preference) the moment this call succeeds.
Multi-branch behavior
There's no separate "branch-restricted API key" concept, a token's branch access is exactly whatever the user it belongs to already has. If the issuing user is branch-restricted:
| Endpoint | Behavior |
|---|---|
GET list endpoints | Filtered to that user's own branch(es) only. |
GET one record by id | A record outside that branch returns 404, indistinguishable from "doesn't exist." |
POST /repayments | The target loan must be within the token's branch access, or 404 before anything is recorded. |
All endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /members | List members (paginated, 20/page) |
| GET | /members/{id} | Get one member |
| GET | /loans | List loans |
| GET | /loans/{id} | Get one loan |
| GET | /savings-accounts | List savings accounts |
| GET | /savings-accounts/{id} | Get one savings account |
| GET | /share-accounts | List share accounts |
| GET | /share-accounts/{id} | Get one share account |
| GET | /branches | List branches |
| GET | /repayments | List repayments, optional ?loan_id= |
| POST | /repayments | Record a repayment (see above) |
Errors
| HTTP | Meaning | Fix |
|---|---|---|
| 401 | Missing or invalid token | Check the Authorization: Bearer header. |
| 403 | Token's user has no role, no business, or an inactive subscription | Issue a token from a real staff user with an active subscription. |
| 404 | Doesn't exist, or exists outside the token's branch access | Check the id and the issuing user's branch access. |
| 422 | Validation failed, or the loan isn't open for repayment | See message/errors in the response. |
| 429 | Rate limit exceeded | 60 requests/minute per token, back off and retry. |
base_url is pre-filled to https://pawaloans.openteq.co.ke/api/v1, just set your token after importing. Download the collection →Employer payroll check-off integration
If your organization's staff are members of a SACCO on pawa Loans and repay loans through payroll deduction, your own payroll system can push deduction data directly, no separate account, no polling. Unlike the token-based API above, this isn't per-business, it's per-employer: each connected employer gets its own webhook URL and secret, generated from inside the SACCO's account (Check-off Centre > Employers), never shared across employers or businesses.
Ask the SACCO to connect your organization as an employer with an API connection method (Check-off Centre > Employers > Connect Employer). They'll generate a secret and share your webhook URL with you, shown to them only once, so ask them to send it securely.
Identify each employee by their National ID, same natural key most payroll systems already use. loan_reference is optional, only needed to disambiguate an employee who has more than one loan with the SACCO at once.
The batch for that period is created automatically if it doesn't exist yet. Every deduction is reconciled against the SACCO's own loan schedule, deducted from a payslip is never treated as money the SACCO has actually received until it's separately confirmed as remitted, so this call reports what payroll withheld, it doesn't itself move money.
| HTTP | Meaning |
|---|---|
| 200 | Processed - check matched/unmatched/ambiguous counts in the response, a 200 doesn't mean every line matched. |
| 401 | Missing or wrong X-Checkoff-Secret, or this employer isn't set up for API connection. |
| 422 | Malformed payload, see message/errors. |
employer_id and checkoff_webhook_secret after importing. Download the collection →