API documentation

Open your Palert dashboard, go to Businesses, pick the business you want to connect, and open the API tab. Only the owner of a business can create keys.

Choose what the key is allowed to do when you create it. Give each key the smallest set of permissions its job needs:

transactions:read

List and look up this business's transactions.

transactions:write

Mark received payments as verified or unverified.

Send your key as a bearer token on every request. A key belongs to one business, so you never pass a business id anywhere: Palert works out which business you mean from the key itself.

curl https://palert.app/api/v1/me \
  -H "Authorization: Bearer plk_live_YOUR_KEY_HERE"

Keep keys on your server. The API deliberately sends no CORS headers, so a browser cannot call it directly, and a key in your website's JavaScript would be readable by every visitor. Store keys in environment variables, not in your code or your repository.

GET /v1/me confirms which business and permissions a key carries. It is the quickest way to check a new key works:

{
  "data": {
    "business": { "id": "A1B2C3", "name": "Avas Store" },
    "key": {
      "name": "Website checkout",
      "prefix": "plk_live_a1b2c3d4",
      "scopes": ["transactions:read", "transactions:write"],
      "rate_limit": 120
    }
  }
}

All paths are relative to https://palert.app/api/v1.

curl "https://palert.app/api/v1/transactions?from=2026-09-01&type=received&verified=false" \
  -H "Authorization: Bearer $PALERT_API_KEY"

{
  "data": [
    {
      "id": 48219,
      "type": "received",
      "amount": 250,
      "from": "AHMED ALI",
      "to": "7730000012345",
      "datetime": "2026-09-10T06:41:22Z",
      "verified": false
    }
  ],
  "next_cursor": null
}

curl https://palert.app/api/v1/transactions/48219 \
  -H "Authorization: Bearer $PALERT_API_KEY"

curl -X POST https://palert.app/api/v1/transactions/48219/verify \
  -H "Authorization: Bearer $PALERT_API_KEY"

{
  "data": {
    "id": 48219,
    "type": "received",
    "amount": 250,
    "from": "AHMED ALI",
    "to": "7730000012345",
    "datetime": "2026-09-10T06:41:22Z",
    "verified": true
  }
}

curl -X POST https://palert.app/api/v1/transactions/48219/unverify \
  -H "Authorization: Bearer $PALERT_API_KEY"

id

Number. Unique within Palert.

type

Either "received" (money in) or "sent" (money out).

amount

Number, in Maldivian rufiyaa.

from

The sending account or name, as your bank reported it.

to

The receiving account, as your bank reported it.

datetime

When Palert recorded the payment, in UTC (ISO 8601, ending in Z).

verified

Boolean. Whether the payment has been confirmed.

Times are returned in UTC. The from and to date filters, by contrast, are calendar dates in Maldives time (UTC+5), because that is the day you mean when you ask for today's payments.

List responses include next_cursor. When it is not null, pass it back as the cursor parameter to fetch the next page. When it is null, you have reached the end.

curl "https://palert.app/api/v1/transactions?limit=100&cursor=WyIyMDI2LTA5LTEwVDA2OjQxOjIyIiw0ODIxOV0" \
  -H "Authorization: Bearer $PALERT_API_KEY"

Treat the cursor as opaque: it is a position in your result set, not a value to build or parse yourself. Because it points at a position rather than counting pages, new payments arriving while you page through history will not shuffle or duplicate rows.

Any status other than 200 returns a body of this shape:

{
  "error": {
    "code": "forbidden_scope",
    "message": "This key does not have the transactions:write scope"
  }
}

Each key may make 120 requests per minute. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining; exceeding the limit returns 429 with a Retry-After header giving the seconds until the window resets.

If your integration polls for new payments, one request every few seconds is plenty. If you need a higher limit for a legitimate workload, get in touch.

Message us on Telegram at t.me/simplygeek and a real person will get back to you. New to Palert? See how it works.