Access wallet, verification, CIBIL, marketplace, and more through our secure RESTful API with 3-layer authentication.
https://vistarkriya.com/api/v1
Comprehensive coverage for all platform capabilities. Each module provides RESTful endpoints with consistent JSON responses.
Core wallet balance, transactions, pipeline and license operations
Fetch credit reports and scores for individuals and businesses
PAN, Aadhaar, Bank Account, GST and other verification APIs
Access marketplace services and products programmatically
Commission and earnings management APIs
Customer management and B2C operations
Every request requires 4 headers including HMAC-SHA256 signature for maximum security.
X-API-Key
Your API key from dashboard
vk_live_abc123...
X-Timestamp
Unix timestamp in seconds
1739612345
X-Signature
HMAC-SHA256 signature (hex)
a1b2c3d4e5...
X-Tenant-Code
Your 6-digit tenant code
123456
HMAC-SHA256( timestamp + method + endpoint + body, api_secret )
1739612345GET/api/v1/wallet/core/balance
1739612345GET/api/v1/wallet/core/balance
1739612345POST/api/v1/verify/pan{"pan":"ABCDE1234F"}
Ready-to-use code examples. Or use the API Workspace for interactive testing.
<?php
// Credentials
$api_key = 'vk_live_your_api_key_here';
$api_secret = 'your_api_secret_here';
$tenant_code = '123456';
// Request
$timestamp = time();
$method = 'GET';
$endpoint = '/api/v1/wallet/core/balance';
$body = '';
// HMAC Signature
$sig_string = $timestamp . $method . $endpoint . $body;
$signature = hash_hmac('sha256', $sig_string, $api_secret);
// cURL
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => 'https://vistarkriya.com' . $endpoint,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $api_key,
'X-Timestamp: ' . $timestamp,
'X-Signature: ' . $signature,
'X-Tenant-Code: ' . $tenant_code,
'Content-Type: application/json'
]
]);
$response = curl_exec($ch);
$data = json_decode($response, true);
print_r($data);
{
"success": true,
"data": {
"balance": 15420.50,
"currency": "INR",
"last_updated": "2026-05-01T10:30:00Z"
}
}
Common error codes and how to resolve them.
AUTH_MISSING_KEY
X-API-Key header missing
AUTH_INVALID_KEY
API key not found or invalid
HMAC_INVALID
Signature verification failed
TIMESTAMP_EXPIRED
Request too old (>5 min window)
AUTH_IP_BLOCKED
IP not in whitelist
RATE_LIMITED
Too many requests, slow down
Should look like: 1739612345GET/api/v1/wallet/core/balance
Must be within 5 minutes of server time. Use NTP.
Use GET not get
No extra whitespace. Use the same JSON string in both signature and request body.
X-Tenant-Code is NOT part of the HMAC signature calculation.
{
"success": false,
"error": {
"code": "HMAC_INVALID",
"message": "Signature verification failed",
"http_status": 401
}
}
Fill out the form below and our team will get back to you within 24 hours.
Our team will contact you within 24 hours.
Sign up for a free account, get your API key, and start testing in the interactive workspace.