Home/Documentation
API Reference v2

Kapix Documentation

Complete reference for the Kapix API — authentication, endpoints, request schemas, response formats, and integration guides.

Overview

What is Kapix?

Kapix is a financial intelligence platform that exposes real-time credit scoring, fraud detection, risk assessment, and decision automation via a unified REST API.

Every API call returns a structured decision object — score, confidence, feature attribution, and a full audit trail — within single-digit milliseconds. The platform is built to be dropped into existing systems with minimal integration overhead.

Sub-15ms
Average end-to-end latency per request
🔐
SOC 2 Type II
Certified and PCI DSS compliant
🔌
REST + gRPC
Flexible integration for every stack
Quick Start

Make your first API call

Get up and running in under five minutes. You'll need an API key — grab one from the dashboard.

1. Install the SDK

bash
# Node.js
npm install @kapix/sdk

# Python
pip install kapix-sdk

# Go
go get github.com/kapix/kapix-go

2. Initialise the client

typescript
import Kapix from "@kapix/sdk";

const client = new Kapix({
  apiKey: process.env.KAPIX_API_KEY,
  region: "af-west-1", // or "eu-west-1", "us-east-1"
});

3. Score a credit request

typescript
const result = await client.credit.score({
  entity_id:   "ent_01HXYZ4A3B",
  entity_type: "individual",
  data_sources: ["bureau", "mobile_money", "transaction_history"],
});

console.log(result.score);        // 0.847
console.log(result.decision);     // "approve"
console.log(result.latency_ms);   // 11
Tip
Set KAPIX_API_KEY in your environment rather than hardcoding it. All requests are authenticated via Bearer token — see Authentication below.
Authentication

Authenticating requests

Kapix uses API keys transmitted as Bearer tokens in the Authorization header. All endpoints require authentication.

http
Authorization: Bearer kpx_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Warning
Never expose your API key in client-side code or public repositories. Rotate keys immediately from the dashboard if a key is compromised.

Key types

PrefixEnvironmentUsage
kpx_live_ProductionLive traffic, billed
kpx_test_SandboxFree, returns synthetic data
Core API

Credit Scoring

Score any entity — individual, SME, or corporate — in real time with fully explainable AI outputs and regulatory-compliant audit trails.

POST/v2/credit/score

Request body

ParameterTypeDescription
entity_idreqstringUnique identifier for the entity being scored.
entity_typereqenum"individual" | "sme" | "corporate"
data_sourcesreqstring[]Array of data source keys to include in the scoring run.
contextobjectOptional metadata such as loan purpose, amount, or tenure.
explainbooleanSet true to include feature attribution in the response. Default: true.

Example request

typescript
const score = await client.credit.score({
  entity_id:   "ent_01HXYZ4A3B",
  entity_type: "individual",
  data_sources: ["bureau", "mobile_money"],
  context: {
    loan_amount:  500000,   // in minor currency units
    loan_purpose: "working_capital",
    tenure_days:  90,
  },
  explain: true,
});

Response

json
{
  "score":        0.847,
  "decision":     "approve",
  "confidence":   0.94,
  "risk_band":    "A2",
  "latency_ms":   11,
  "request_id":   "req_01JXYZ9QWE",
  "explanation": {
    "top_features": [
      { "feature": "repayment_consistency", "weight": 0.31, "direction": "positive" },
      { "feature": "mobile_money_velocity", "weight": 0.24, "direction": "positive" },
      { "feature": "bureau_derogatory",     "weight": 0.18, "direction": "negative" }
    ]
  },
  "audit_id": "aud_01JXYZ9QWF"
}
Core API

Fraud Detection

Detect anomalous patterns across transaction streams in real time. Multi-layered detection reduces false positives by 73% over rule-based systems.

POST/v2/fraud/evaluate

Example request

typescript
const result = await client.fraud.evaluate({
  transaction_id: "txn_01HABC1234",
  amount:         45000,          // minor currency units
  currency:       "NGN",
  sender_id:      "ent_01HXYZ4A3B",
  receiver_id:    "ent_01HABC5678",
  channel:        "mobile_app",
  metadata: {
    device_fingerprint: "fp_xxxx",
    ip_address:         "102.89.x.x",
    session_age_s:      120,
  },
});

// result.fraud_score  — 0.0 (clean) to 1.0 (definite fraud)
// result.action       — "allow" | "challenge" | "block"
// result.signals      — array of triggered signal names

Response

json
{
  "fraud_score": 0.07,
  "action":      "allow",
  "confidence":  0.96,
  "signals":     [],
  "latency_ms":  9,
  "request_id":  "req_01JXYZABCD"
}
Core API

Risk Assessment

Quantify and decompose portfolio risk in real time. Dynamic models adjust to market shifts, counterparty changes, and macro-economic signals.

POST/v2/risk/assess
GET/v2/risk/portfolio/{portfolio_id}
typescript
// Assess a single exposure
const assessment = await client.risk.assess({
  exposure_id:   "exp_01HXYZ0001",
  exposure_type: "loan",
  counterparty:  "ent_01HABC5678",
  amount:        10_000_000,
  currency:      "NGN",
  tenor_days:    180,
});

// result.risk_score     — 0.0 (minimal) to 1.0 (critical)
// result.risk_category  — "low" | "medium" | "high" | "critical"
// result.var_95         — value at risk at 95% confidence
// result.expected_loss  — expected monetary loss
Core API

Decision Engine

Automate complex multi-signal workflows. Every decision carries a full audit trail, confidence score, and override capability.

POST/v2/decisions/run
GET/v2/decisions/{decision_id}
typescript
const decision = await client.decisions.run({
  policy_id: "pol_loan_origination_v3",
  inputs: {
    credit_score_id: score.request_id,
    fraud_eval_id:   result.request_id,
    applicant_id:    "ent_01HXYZ4A3B",
    requested_amount: 500000,
  },
  override_window_s: 300, // allow manual override for 5 minutes
});

// decision.outcome   — "approve" | "decline" | "refer"
// decision.reason    — human-readable explanation
// decision.audit_id  — immutable audit record ID
Integration

SDKs

Official SDKs are available for Node.js, Python, Go, and Java. All SDKs are typed, tested, and kept in sync with the API.

Node.js / TypeScript
npm install @kapix/sdk
v2.4.1 · MIT License
Python
pip install kapix-sdk
v2.3.0 · MIT License
Go
go get github.com/kapix/kapix-go
v2.2.0 · MIT License
Java
implementation 'io.kapix:sdk:2.1.0'
v2.1.0 · MIT License
Note
All SDKs auto-retry on 429 (rate limit) and 503 (service unavailable) with exponential backoff. Set maxRetries: 0 to disable.
Integration

Webhooks

Subscribe to real-time event notifications. Kapix signs every webhook payload so you can verify its authenticity.

Available events

EventFired when
credit.score.completedA credit scoring request finishes
fraud.alert.raisedA transaction is flagged or blocked
decision.madeA decision engine policy fires
model.drift.detectedA model's accuracy drops below threshold
api_key.rotatedAn API key is created or revoked

Verifying signatures

typescript
import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expected = createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  return timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected,  "hex")
  );
}

// In your Express/Next.js route:
const sig = req.headers["kapix-signature"] as string;
if (!verifyWebhook(rawBody, sig, process.env.KAPIX_WEBHOOK_SECRET!)) {
  return res.status(401).json({ error: "Invalid signature" });
}
Integration

Rate Limits

Limits are applied per API key. Headers on every response tell you your current usage.

PlanRequests / minRequests / dayBurst
Sandbox605,00010
Growth600200,000100
Scale3,0002,000,000500
EnterpriseCustomCustomCustom

Rate limit headers

http
X-RateLimit-Limit:     600
X-RateLimit-Remaining: 594
X-RateLimit-Reset:     1714492800
Retry-After:           12          # only present on 429 responses
Reference

Errors & Codes

All errors return a consistent JSON shape with a machine-readable code and a human-readable message.

json
{
  "error": {
    "code":    "ENTITY_NOT_FOUND",
    "message": "No entity found with id ent_01HXYZ4A3B",
    "docs":    "https://usekapix.com/docs/errors#ENTITY_NOT_FOUND",
    "request_id": "req_01JXYZ9QWE"
  }
}
HTTPCodeMeaning
400VALIDATION_ERRORRequest body failed schema validation
401UNAUTHORIZEDMissing or invalid API key
403FORBIDDENKey lacks permission for this endpoint
404ENTITY_NOT_FOUNDRequested resource does not exist
409DUPLICATE_REQUESTIdempotency key already used
422INSUFFICIENT_DATANot enough data to produce a reliable score
429RATE_LIMIT_EXCEEDEDToo many requests — check Retry-After header
500INTERNAL_ERRORUnexpected server error — auto-retryable
503SERVICE_UNAVAILABLERegion under elevated load — auto-retryable
Tip
Include request_id when contacting support — it lets the team pull the exact trace from our systems.
Ready to build?

Start with the sandbox — it's free.

Sandbox keys return synthetic but realistic data. Switch to a live key when you're ready to go to production.