{
  "info": {
    "_postman_id": "62a47af5-15ac-49d0-a327-f80da77891d7",
    "name": "FICA sure API",
    "description": "Server-to-server integration collection for the FICA sure API. Keep API keys and client passwords out of browser code, source control, screenshots and logs. The API key determines whether a request uses the test or live environment.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "apikey",
    "apikey": [
      { "key": "key", "value": "X-API-Key", "type": "string" },
      { "key": "value", "value": "{{api_key}}", "type": "string" },
      { "key": "in", "value": "header", "type": "string" }
    ]
  },
  "event": [
    {
      "listen": "prerequest",
      "script": {
        "type": "text/javascript",
        "exec": [
          "if (!pm.collectionVariables.get('external_client_id')) {",
          "  const stamp = new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14);",
          "  pm.collectionVariables.set('external_client_id', `POSTMAN-${stamp}`);",
          "}"
        ]
      }
    }
  ],
  "variable": [
    { "key": "base_url", "value": "https://api.ficasure.com/api", "type": "string" },
    { "key": "api_key", "value": "", "type": "string" },
    { "key": "environment", "value": "test", "type": "string" },
    { "key": "name_matching_level", "value": "1", "type": "string" },
    { "key": "client_email", "value": "", "type": "string" },
    { "key": "client_password", "value": "", "type": "string" },
    { "key": "external_client_id", "value": "", "type": "string" },
    { "key": "case_id", "value": "", "type": "string" }
  ],
  "item": [
    {
      "name": "1. Client registration and credentials",
      "description": "Registration is needed only for a new client organisation. Existing activated clients can issue, rotate or revoke their test/live key with their client email and password.",
      "item": [
        {
          "name": "Register pending client",
          "request": {
            "auth": { "type": "noauth" },
            "method": "POST",
            "header": [
              { "key": "Accept", "value": "application/json" },
              { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
            ],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "organization_name", "value": "Example Organisation", "type": "text" },
                { "key": "full_name", "value": "Jane Doe", "type": "text" },
                { "key": "email", "value": "{{client_email}}", "type": "text" },
                { "key": "password", "value": "{{client_password}}", "type": "text" }
              ]
            },
            "url": "{{base_url}}/register.php",
            "description": "Creates a pending organisation. A FICA sure administrator must activate it and allocate credits before API keys can be issued. Do not run this for an organisation that already exists."
          }
        },
        {
          "name": "Issue API key",
          "request": {
            "auth": { "type": "noauth" },
            "method": "POST",
            "header": [
              { "key": "Accept", "value": "application/json" },
              { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
            ],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "email", "value": "{{client_email}}", "type": "text" },
                { "key": "password", "value": "{{client_password}}", "type": "text" },
                { "key": "environment", "value": "{{environment}}", "type": "text", "description": "Use test or live." },
                { "key": "action", "value": "issue", "type": "text" }
              ]
            },
            "url": "{{base_url}}/credentials.php",
            "description": "Returns the raw API key once. Copy it directly into the collection api_key variable or secure server-side secret storage. Never commit it."
          }
        },
        {
          "name": "Rotate API key",
          "request": {
            "auth": { "type": "noauth" },
            "method": "POST",
            "header": [
              { "key": "Accept", "value": "application/json" },
              { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
            ],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "email", "value": "{{client_email}}", "type": "text" },
                { "key": "password", "value": "{{client_password}}", "type": "text" },
                { "key": "environment", "value": "{{environment}}", "type": "text" },
                { "key": "action", "value": "rotate", "type": "text" }
              ]
            },
            "url": "{{base_url}}/credentials.php",
            "description": "Immediately invalidates the current key for the selected environment and returns a replacement once."
          }
        },
        {
          "name": "Revoke API key",
          "request": {
            "auth": { "type": "noauth" },
            "method": "POST",
            "header": [
              { "key": "Accept", "value": "application/json" },
              { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
            ],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "email", "value": "{{client_email}}", "type": "text" },
                { "key": "password", "value": "{{client_password}}", "type": "text" },
                { "key": "environment", "value": "{{environment}}", "type": "text" },
                { "key": "action", "value": "revoke", "type": "text" }
              ]
            },
            "url": "{{base_url}}/credentials.php",
            "description": "Revokes the selected test or live key. Use with care."
          }
        }
      ]
    },
    {
      "name": "2. Account and schema",
      "item": [
        {
          "name": "Get account and credit balance",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": "{{base_url}}/account.php",
            "description": "Confirms the API key, its environment and the organisation's balance, reserved credits and available credits."
          },
          "event": [{
            "listen": "test",
            "script": {
              "type": "text/javascript",
              "exec": [
                "pm.test('Authenticated account response', function () { pm.expect(pm.response.code).to.eql(200); });",
                "pm.test('Response is JSON', function () { pm.response.to.be.json; });"
              ]
            }
          }]
        },
        {
          "name": "Get application types and requirements",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": "{{base_url}}/application_types.php",
            "description": "Load this before building a form. It returns the authoritative field_modes and document_modes for personal, company, trust, NGO/NPO and merchant applications."
          },
          "event": [{
            "listen": "test",
            "script": {
              "type": "text/javascript",
              "exec": [
                "pm.test('Application requirements loaded', function () { pm.expect(pm.response.code).to.eql(200); });",
                "pm.test('Response is JSON', function () { pm.response.to.be.json; });"
              ]
            }
          }]
        }
      ]
    },
    {
      "name": "3. Submit verification",
      "description": "Select files manually in Postman before sending. Canonical upload names must be retained, including [] for repeated files.",
      "item": [
        {
          "name": "Submit personal verification",
          "request": {
            "method": "POST",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "body": {
              "mode": "formdata",
              "formdata": [
                { "key": "external_client_id", "value": "{{external_client_id}}", "type": "text", "description": "Required unique identifier from your system." },
                { "key": "source_app", "value": "postman-integration-test", "type": "text" },
                { "key": "application_type", "value": "personal", "type": "text" },
                { "key": "application_reference", "value": "POSTMAN-{{$timestamp}}", "type": "text" },
                { "key": "name_matching_level", "value": "{{name_matching_level}}", "type": "text", "description": "Set the collection variable to 0 for Exact/closest spelling only, 1 for Fuzzy 1/small differences, or 2 for Fuzzy 2/broader variations." },
                { "key": "full_name", "value": "Test Applicant", "type": "text" },
                { "key": "id_number", "value": "", "type": "text" },
                { "key": "date_of_birth", "value": "", "type": "text" },
                { "key": "nationality", "value": "ZA", "type": "text" },
                { "key": "residential_address", "value": "", "type": "text" },
                { "key": "email", "value": "", "type": "text" },
                { "key": "mobile_number", "value": "", "type": "text" },
                { "key": "terms_accepted", "value": "1", "type": "text" },
                { "key": "identity_document[]", "type": "file", "src": [], "disabled": true, "description": "Enable and select the identity image or PDF." },
                { "key": "proof_of_address[]", "type": "file", "src": [], "disabled": true, "description": "Enable and select proof of address file 1. Duplicate this row for up to three files." },
                { "key": "selfie[]", "type": "file", "src": [], "disabled": true, "description": "Enable and select the selfie image." },
                { "key": "supporting_document[]", "type": "file", "src": [], "disabled": true, "description": "Optional. Duplicate for up to five supporting files." }
              ]
            },
            "url": "{{base_url}}/submit.php",
            "description": "Before sending: replace the sample applicant values, enable the required file rows, and select local files. Do not add an environment form field; the X-API-Key determines test or live mode."
          },
          "event": [{
            "listen": "test",
            "script": {
              "type": "text/javascript",
              "exec": [
                "pm.test('Submission accepted', function () { pm.expect(pm.response.code).to.be.oneOf([200, 201, 202]); });",
                "if (pm.response.headers.get('Content-Type')?.includes('application/json')) {",
                "  const body = pm.response.json();",
                "  const id = body.case_id || body.case?.case_id || body.data?.case_id;",
                "  if (id) pm.collectionVariables.set('case_id', String(id));",
                "  const external = body.external_client_id || body.case?.external_client_id || body.data?.external_client_id;",
                "  if (external) pm.collectionVariables.set('external_client_id', String(external));",
                "}"
              ]
            }
          }]
        }
      ]
    },
    {
      "name": "4. Status and results",
      "item": [
        {
          "name": "Get status by case ID",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": {
              "raw": "{{base_url}}/status.php?case_id={{case_id}}",
              "host": ["{{base_url}}"],
              "path": ["status.php"],
              "query": [{ "key": "case_id", "value": "{{case_id}}" }]
            },
            "description": "Poll while queue_status is queued or running. Keep polling modest, for example every 3–5 seconds."
          },
          "event": [{
            "listen": "test",
            "script": {
              "type": "text/javascript",
              "exec": [
                "pm.test('Status returned', function () { pm.expect(pm.response.code).to.eql(200); });",
                "pm.test('Response is JSON', function () { pm.response.to.be.json; });"
              ]
            }
          }]
        },
        {
          "name": "Get status by external client ID",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": {
              "raw": "{{base_url}}/status.php?external_client_id={{external_client_id}}",
              "host": ["{{base_url}}"],
              "path": ["status.php"],
              "query": [{ "key": "external_client_id", "value": "{{external_client_id}}" }]
            }
          }
        },
        {
          "name": "Get stable v1 result by case ID",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": {
              "raw": "{{base_url}}/v1/result.php?case_id={{case_id}}",
              "host": ["{{base_url}}"],
              "path": ["v1", "result.php"],
              "query": [{ "key": "case_id", "value": "{{case_id}}" }]
            },
            "description": "This is the permanent stable result contract client applications should consume."
          },
          "event": [{
            "listen": "test",
            "script": {
              "type": "text/javascript",
              "exec": [
                "pm.test('Stable result returned', function () { pm.expect(pm.response.code).to.eql(200); });",
                "pm.test('Stable v1 schema', function () {",
                "  const body = pm.response.json();",
                "  pm.expect(body.schema?.name).to.eql('cris_fica_result');",
                "  pm.expect(body.schema?.version).to.eql('1.0');",
                "});"
              ]
            }
          }]
        },
        {
          "name": "Get stable v1 result by external client ID",
          "request": {
            "method": "GET",
            "header": [{ "key": "Accept", "value": "application/json" }],
            "url": {
              "raw": "{{base_url}}/v1/result.php?external_client_id={{external_client_id}}",
              "host": ["{{base_url}}"],
              "path": ["v1", "result.php"],
              "query": [{ "key": "external_client_id", "value": "{{external_client_id}}" }]
            }
          }
        }
      ]
    }
  ]
}