Skip to documentation

OPEN API
Data Exchange
Documentation

A centralized data-exchange gateway for B2B partner integrations. Every endpoint accepts a secure HTTPS POST payload, authenticated with an OAuth2 bearer token issued by Laravel Passport, and returns a predictable JSON envelope.

Endpoints
13
Transport
HTTPS / JSON
Auth
OAuth2 (Passport)
Your first request 
curl -X POST https://yourservice.com/open-api/v1/services \
  -H "Authorization: Bearer {YOUR_PARTNER_TOKEN}" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "", "page": 0, "size": 20}'

Getting started

Two things apply to every call in this reference: the base URL you prefix onto each route, and three headers you send with each request.

Base URL

Prefix every route below with this address. Routes are listed without it.

https://yourservice.com/open-api/v1

Requests are accepted over TLS only, and every route uses POST — there are no GET variants. Begin with /services to resolve the service codes the other endpoints expect.

Required headers

Send the OAuth2 access token from Authentication. A missing or expired token returns code 500 with the message Invalid access token.

Authorization
Bearer {YOUR_PARTNER_TOKEN}
Accept
application/json
Content-Type
application/json

Response envelope

Every endpoint answers with the same three top-level keys, so you can write one handler for all of them. Check code, not the HTTP status. 

{
  "code": 0,
  "message": "Successfully",
  "data": { ... }
}
0
Request succeeded.
400
No matching record found.
422
Validation failed; data.errors lists each field.
500
Invalid or expired access token.

Authentication

The gateway is an OAuth2 server built on Laravel Passport. Exchange your client credentials for an access token, then send that token as a bearer token on every data-exchange call. Tokens are issued per partner organisation.

1. Request an access token

Post your credentials to the token endpoint. This route lives at the domain root — it is not under the open-api/v1 prefix.

POST /oauth/token 
curl -X POST https://yourservice.com/oauth/token \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "{YOUR_CLIENT_ID}",
    "client_secret": "{YOUR_CLIENT_SECRET}",
    "scope": ""
  }'

2. Send it with each request

The response carries the token and its remaining lifetime in seconds. Cache it and reuse it until it expires rather than requesting a new one per call.

200 OK 
{
  "token_type": "Bearer",
  "expires_in": 7200,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi..."
}

Then set Authorization: Bearer {access_token} on every endpoint in this reference.

Authorization server
Laravel Passport 13
Grant type
client_credentials
Access token lifetime
120 minutes
Refresh endpoint
POST /oauth/token/refresh

Client secrets are hashed when issued and shown once at creation time. If a secret is lost or exposed, request a new client rather than attempting to recover the old one.

Application processing

Search submitted applications, open a single record, pull its attached documents, and read its status history.

POST /applications

Search applications across the services your partnership covers.

Required
service_codes[] application_statuses[] application_types[] keyword
Optional
page size sort
POST /applications/info

Retrieve the full detail record for one application.

Required
application_id
Optional
None
POST /applications/documents

Download one document attached to an application.

Required
application_id document_id
Optional
None
POST /applications/info/histories

List every status change recorded against an application.

Required
application_id
Optional
None
POST /applications/statistics

Aggregate application counts by service, status, and type.

Required
service_codes[] application_statuses[] application_types[]
Optional
from_date to_date page size

Profile & customer LCP management

Look up issued profiles and their documents, resolve a customer LCP record, and verify a registered business activity.

POST /profiles

Search issued profiles by service, status, and issue or expiry window.

Required
service_codes[] profile_statuses[] keyword
Optional
issued_date expired_date page size sort
POST /profiles/info

Retrieve the full detail record for one profile.

Required
profile_id
Optional
None
POST /profiles/documents

Download one document attached to a profile.

Required
profile_id document_id
Optional
None
POST /profile/lcp/info

Retrieve a customer LCP profile record.

Required
profile_id
Optional
None
POST /profile/lcp/documents

Download an LCP document identified by taxpayer and licence details.

Required
service_code single_id id_number tin lcp_id document_type
Optional
None
POST /profiles/statistics

Aggregate profile counts by service and status.

Required
service_codes[] profile_statuses[]
Optional
from_date to_date page size sort
POST /profiles/verification/business-activity

Confirm a business activity against the registered record.

Required
single_id tin
Optional
None

Core system utilities

Resolve the service catalogue. Start here: the service codes returned by this endpoint are the values every other request expects.

POST /services

List available services with their codes, English and Khmer names, and type.

Required
None
Optional
keyword page size sort