Quickstart | GoWaly Docs

1. Create a Sandbox key #

In the client portal, open API keys, select Sandbox, and create a key with the verification:read permission. Copy the secret when it is shown; it cannot be displayed again. Customer Sandbox Verification uses deterministic approved fixtures.

2. Configure your server #

Set GOWALY_BASE_URL to https://api-sandbox.scamrader.com and GOWALY_API_KEY to the Sandbox secret in your server environment. A staging or Production key will not work against the Customer Sandbox host.

3. Send the Sandbox request #

POST/api/v1/check-recipient

Scope: verification:read
Environment: Customer Sandbox
Required headers: Authorization, Content-Type

POST https://api-sandbox.scamrader.com/api/v1/check-recipient requires verification:read. The approved bank fixture uses bank_code 999.

Verification request — cURL

# Run in your server environment. Requires verification:read.
curl --request POST "$GOWALY_BASE_URL/api/v1/check-recipient" \
  --header "Authorization: Bearer $GOWALY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
  "identifier": "9000000001",
  "type": "bank_account",
  "bank_code": "999",
  "currency": "NGN",
  "amount": 0,
  "user_id": "demo-context-001"
}'

Request body

{
  "identifier": "9000000001",
  "type": "bank_account",
  "bank_code": "999",
  "currency": "NGN",
  "amount": 0,
  "user_id": "demo-context-001"
}

Expected 200 response

{
  "request_id": "req_123e4567-e89b-42d3-a456-426614174000",
  "checked_at": "2026-10-14T12:00:00.000Z",
  "identifier_type": "bank_account",
  "risk_level": "low_risk",
  "canonical_risk_level": "low",
  "blocked": false,
  "confidence_score": 0.2,
  "risk_score": 20,
  "report_count": 1,
  "scam_category": "Sandbox Test",
  "recommendation": "allow",
  "last_reported": "2026-01-10",
  "summary_title": "Low risk",
  "summary_message": "Sandbox synthetic low-risk fixture. Test data only.",
  "evidence_links": []
}

4. Confirm the expected response #

5. Troubleshoot and continue #

Result	Check
401	Confirm the Bearer secret is current and copied exactly.
403	Confirm verification:read and a Sandbox-bound key.
429	Honor Retry-After before retrying.
503	Keep the session, use bounded backoff, and retry later.

Verification contract

Authentication and scopes

Error handling