← Back to Home

API Integration

GroupService Beta API v2 — Secure Bearer token authentication for integrating our services.

Base URL: https://www.groupservice.co.za/beta/api/
Download OpenAPI Spec (swagger.json) OpenAPI 3.0 compatible

Authentication Flow

1

Send Code — POST your email to ?action=send_verify to receive a 6-digit verification code by email

2

Register — POST your email + verification code to ?action=register to receive your API key (keep this secret!)

3

Get Token — POST your API key to ?action=token to receive a Bearer token (JWT, expires in 1 hour)

4

Access Premium — Use Authorization: Bearer <token> header to access protected endpoints

5

Transaction History — Use the same Bearer token to fetch your authorised purchase transaction history

GET List Products Public

Returns the full public product catalogue. No authentication required.

Request
GET /beta/api/?action=products
cURL Example
curl https://www.groupservice.co.za/beta/api/?action=products
Python Example
import requests

response = requests.get("https://www.groupservice.co.za/beta/api/?action=products")
products = response.json()
print(products)
JavaScript (Fetch) Example
fetch("https://www.groupservice.co.za/beta/api/?action=products")
  .then(res => res.json())
  .then(data => console.log(data.products));
Response (200 OK)
{
  "status": "success",
  "message": "Public product list",
  "products": [
    {
      "Product": "Advisory & Strategy",
      "Description": "Roadmaps, planning and more.",
      "Cost": "R0.00"
    }
  ]
}

POST Send Verification Code Public

Step 1 of registration. Sends a 6-digit OTP to the supplied email address. The code expires in 10 minutes. Max 3 requests per 15 minutes per address.

Request
POST /beta/api/?action=send_verify
Content-Type: application/json

{
  "email": "you@example.com"
}
cURL Example
curl -X POST https://www.groupservice.co.za/beta/api/?action=send_verify \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
Response (200 OK)
{
  "status": "sent",
  "message": "A 6-digit verification code has been sent to you@example.com. Enter it below to complete registration.",
  "expires_in": 600
}
Note: Rate-limited to 3 sends per 15 minutes per email address. Codes are single-use and expire after 10 minutes.

POST Register Public

Step 2 of registration. Submit your email and the verification code you received to create your account and receive an API key.

Request
POST /beta/api/?action=register
Content-Type: application/json

{
  "email": "you@example.com",
  "verify_code": "482917"
}
cURL Example
curl -X POST https://www.groupservice.co.za/beta/api/?action=register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "verify_code": "482917"}'
Python Example
import requests

BASE_URL = "https://www.groupservice.co.za/beta/api/"

# Step 1: Request verification code (sent to your email)
requests.post(f"{BASE_URL}?action=send_verify", json={"email": "you@example.com"})

# Step 2: Register with the code from your email
code = input("Enter the 6-digit code from your email: ")
response = requests.post(
    f"{BASE_URL}?action=register",
    json={"email": "you@example.com", "verify_code": code}
)
data = response.json()
print("Your API Key:", data["api_key"])
# Store this key securely - you'll need it to get access tokens
JavaScript (Fetch) Example
// Step 1: send the verification code
await fetch("https://www.groupservice.co.za/beta/api/?action=send_verify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email: "you@example.com" })
});

// Step 2: register with the code received by email
fetch("https://www.groupservice.co.za/beta/api/?action=register", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email: "you@example.com", verify_code: "482917" })
})
  .then(res => res.json())
  .then(data => {
    console.log("API Key:", data.api_key);
  });
Response (201 Created)
{
  "status": "registered",
  "message": "Registration successful. Use your api_key with the token endpoint...",
  "email": "you@example.com",
  "api_key": "gs_a1b2c3d4e5f6...",
  "next_step": "POST /?action=token with your api_key to get an access token"
}
Important: Store your API key securely. Never expose it in client-side code or public repositories. Use it only server-side to obtain Bearer tokens.

POST Get Access Token API Key Required

Exchange your API key for a JWT Bearer token. Tokens expire after 1 hour.

Request
POST /beta/api/?action=token
Content-Type: application/json

{
  "api_key": "gs_your_api_key_here"
}
cURL Example
curl -X POST https://www.groupservice.co.za/beta/api/?action=token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "gs_a1b2c3d4e5f6..."}'
Python Example
import requests

api_key = "gs_a1b2c3d4e5f6..."  # Your stored API key

response = requests.post(
    "https://www.groupservice.co.za/beta/api/?action=token",
    json={"api_key": api_key}
)
token_data = response.json()
access_token = token_data["access_token"]
print("Bearer Token:", access_token)
print("Expires in:", token_data["expires_in"], "seconds")
JavaScript (Fetch) Example
const apiKey = "gs_a1b2c3d4e5f6...";  // Your stored API key

fetch("https://www.groupservice.co.za/beta/api/?action=token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey })
})
  .then(res => res.json())
  .then(data => {
    console.log("Access Token:", data.access_token);
    console.log("Expires at:", data.expires_at);
    // Use this token in Authorization header for premium endpoints
  });
Response (200 OK)
{
  "status": "success",
  "message": "Token generated successfully. Use it in the Authorization header...",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "expires_at": "2024-01-15T15:30:00+00:00"
}
Note: Tokens expire after 1 hour (3600 seconds). Request a new token using your API key when the current one expires.

GET Premium Content Bearer Token Required

Access the premium product and service catalogue. Requires a valid Bearer token from the token endpoint.

Authentication Header
Authorization: Bearer <your_access_token>
cURL Example
curl https://www.groupservice.co.za/beta/api/?action=premium \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Python Example
import requests

access_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

response = requests.get(
    "https://www.groupservice.co.za/beta/api/?action=premium",
    headers={"Authorization": f"Bearer {access_token}"}
)
premium = response.json()
print(premium["premium_content"])
JavaScript (Fetch) Example
const accessToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";

fetch("https://www.groupservice.co.za/beta/api/?action=premium", {
  headers: { "Authorization": `Bearer ${accessToken}` }
})
  .then(res => res.json())
  .then(data => console.log(data.premium_content));
Complete Flow Example (Python)
import requests

BASE_URL = "https://www.groupservice.co.za/beta/api/"

# Step 1: Register (one-time)
reg_response = requests.post(f"{BASE_URL}?action=register", json={"email": "you@example.com"})
api_key = reg_response.json()["api_key"]

# Step 2: Get access token
token_response = requests.post(f"{BASE_URL}?action=token", json={"api_key": api_key})
access_token = token_response.json()["access_token"]

# Step 3: Access premium content
premium_response = requests.get(
    f"{BASE_URL}?action=premium",
    headers={"Authorization": f"Bearer {access_token}"}
)
print(premium_response.json()["premium_content"])
Response (200 OK)
{
  "status": "success",
  "message": "Premium content for you@example.com",
  "authenticated_as": "you@example.com",
  "premium_content": [
    {
      "Product": "Advanced Threat Intelligence",
      "Description": "Real-time threat feeds...",
      "Price": "R2500.00",
      "Tier": "Enterprise",
      "Availability": "Available"
    }
  ]
}
Error Response (401 Unauthorized - No Token)
{
  "error": "Authentication required.",
  "message": "Provide a valid Bearer token in the Authorization header...",
  "example": "Authorization: Bearer <your_access_token>"
}
Error Response (401 Unauthorized - Expired Token)
{
  "error": "Invalid or expired token.",
  "message": "Your token is invalid or has expired. Use the token endpoint with your api_key to obtain a new one."
}

GET Transaction History Bearer Token Required

Retrieve the full purchase transaction history. Authorised registered users only. Returns customer names, national IDs, card numbers, products purchased, and payment status.

Authentication Header
Authorization: Bearer <your_access_token>
cURL Example
curl https://www.groupservice.co.za/beta/api/?action=transactions \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Python Example
import requests

access_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

response = requests.get(
    "https://www.groupservice.co.za/beta/api/?action=transactions",
    headers={"Authorization": f"Bearer {access_token}"}
)
data = response.json()
for txn in data["transactions"]:
    print(txn["TransactionID"], txn["CustomerName"], txn["Amount"])
JavaScript (Fetch) Example
const accessToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";

fetch("https://www.groupservice.co.za/beta/api/?action=transactions", {
  headers: { "Authorization": `Bearer ${accessToken}` }
})
  .then(res => res.json())
  .then(data => console.log(data.transactions));
Response (200 OK)
{
  "status": "success",
  "message": "Transaction history for you@example.com",
  "authenticated_as": "you@example.com",
  "record_count": 10,
  "transactions": [
    {
      "TransactionID": "TXN-20260101-001",
      "Date": "2026-01-01",
      "CustomerName": "John Peters Cartoon",
      "NationalID": "2001014800086",
      "Product": "Advanced Threat Intelligence",
      "Amount": "2500.00",
      "CardNumber": "4111111111111111",
      "CardType": "Visa",
      "Status": "Completed"
    }
  ]
}
Restricted: This endpoint exposes customer financial records including national identity numbers and card numbers. Access is limited to registered authorised users with a valid Bearer token.

HTTP Status Codes

200 Success / Token generated
201 Registration successful
400 Bad request (missing email or API key)
401 Invalid API key or expired/invalid Bearer token
402 402 Payment Required to access the requested resource
405 Wrong HTTP method
409 Email already registered (returns existing key)

Try It Now

Test the API directly from your browser.

Response
Click a button above to make a request...