Developer docs
On this page
What you can build#
The API works on your own ISP's data, with a key you create in your CoreSync admin. Some things ISPs build with it:
Match a caller to an account
Your call center or CRM finds the subscriber from the caller's phone number, in any format.
Self-serviceAnswer “when does my internet expire?”
A chatbot, WhatsApp or USSD menu reads the balance, the plan and the expiry date.
PaymentsRecord money from other channels
A cash desk, a bank transfer or an agent app records the payment. It renews the subscriber the same way M-Pesa does.
OperationsSuspend, reactivate, change plans
Your own tools make the everyday changes. Each one shows on the subscriber's timeline under the key's name.
NetworkSee who is online
List live sessions, check one subscriber's connection, and get session.down when a line drops.
FinanceSync your books
Pull payments and invoices into your accounting, and get payment.received as money lands.
Base URL and formats#
Every request goes to https://coresyncapi.avitechcloud.com/api/v1 over HTTPS. Requests and responses are JSON.
| Thing | How it looks |
|---|---|
| Field names | snake_case, for example subscriber_code |
| Times | ISO 8601 in UTC, for example 2026-11-25T09:00:00Z. Dates are YYYY-MM-DD. |
| Money | {"amount": "1500.00", "currency": "KES"}. The amount is a string, so it never loses a cent. |
| Phone numbers | E.164 in answers (+254712345678). Any common format is accepted in requests. |
| Lists | page and size in, {items, total, page, size} out. See Pagination. |
| Errors | application/problem+json with a stable code. See Errors. |
| Specification | OpenAPI 3.1 at /api/v1/openapi.json, no key needed. |
Key ideas#
- API key
- A secret starting
cs_live_, sent in theX-API-Keyheader. It belongs to your ISP and acts only on your ISP's data. More - Scopes
- What a key may try:
read,subscribers:write,payments:write,webhooks:write, orwritefor all three writes. - Permissions
- A key never does more than the person who created it. Their current role is checked on every call.
- Idempotency key
- A unique string you send when you record a payment or add a webhook, so a retry never does it twice. More
- Webhooks
- Signed events CoreSync POSTs to your HTTPS URL: payments, suspensions, reactivations and dropped sessions. More
- Rate limit
- Each key may make 120 requests a minute unless you set another limit. More
Your first five minutes#
Create a key
In your CoreSync admin, open Settings → API access, click New key, tick
readand copy the key. It is shown once. HowCheck it works
Shellcurl https://coresyncapi.avitechcloud.com/api/v1/account \ -H "X-API-Key: $CORESYNC_API_KEY"Find a subscriber by phone
Shellcurl -G https://coresyncapi.avitechcloud.com/api/v1/subscribers/lookup \ --data-urlencode "phone=+254712345678" \ -H "X-API-Key: $CORESYNC_API_KEY"Do the rest in your language
The quickstart does the same in JavaScript and Python, and records a payment safely.
Good to know#
There is no test mode yet. Every key works on your live data. While you build, use a key with only read, and try writes on a subscriber you set up for testing.
- Call the API from your server. Never put a key in a web page or a mobile app: anyone who has it can act as you.
- The API covers what your staff do every day. Setting up routers, OLTs and plans is still done in the CoreSync admin.
- v1 only gains things. Nothing you build on it will break without a new version. Versioning
Stuck, or missing something? Tell us what you're building.
hello@coresyncisp.com