Console API

Version 2. Use Authorize in the explorer below and paste your x-api-key. Base URL for requests is https://smconnect.researchershubgh.com/api/v2 (the spec uses the site root as the server URL so "Try it out" resolves paths correctly). Configure your webhook URL and signing secret on the dashboard API Console (after sign-in).

Outbound webhooks

When a console order item’s status or api_status changes, we POST JSON to the HTTPS URL on your API key. Respond with 2xx within 10 seconds.

Headers

Header	Value
`Content-Type`	`application/json`
`X-DataConnectGH-Event`	e.g. `order.status_updated`
`X-DataConnectGH-Timestamp`	Unix seconds — reject requests > 300s skew
`X-DataConnectGH-Signature`	`hex( hmac_sha256( webhook_secret, timestamp + "." + body ) )`

Order item `status` codes

Code	Meaning
`1`	Placed
`2`	Processing
`3`	Delivered

Payload

{
  "event": "order.status_updated",
  "order_item_id": 12345,
  "order_code": "ORD-abc123",
  "msisdn": "0241234567",
  "network": "MTN",
  "volume_mb": 1024,
  "status": 2,
  "api_status": "Processing",
  "price": 5.00,
  "timestamp": "2026-05-21T12:00:00+00:00"
}

Verification (PHP)

$ts  = $request->header('X-DataConnectGH-Timestamp');
$sig = $request->header('X-DataConnectGH-Signature');
$body = $request->getContent();
if (abs(time() - (int) $ts) > 300) { abort(401); }
$expected = hash_hmac('sha256', $ts . '.' . $body, $webhookSecret);
if (! hash_equals($expected, (string) $sig)) { abort(401); }

Retries: non-2xx responses are retried up to 5 times with backoff (30s, 2min, 10min, 1h, 6h). After exhaustion, deliveries may appear in the admin Webhook Failures tool for manual retry. Configure your URL and signing secret in the dashboard API Console after sign-in.