Skip to main content
Some steps need our action: we issue keys, register webhook endpoints and IP addresses, set limits and credit your wallet. This page says what to send for each, so we can act on your first message.

​
How to reach us

Email partners@matambaintelligence.com. We read it from 9:00 to 17:00 West Africa Time (WAT), Monday to Friday, and a message sent outside those hours is read at the start of the next business day. We reply within one business day. Send the details the table below lists for your request. Never send a whole API key or a signing secret. The last four characters of a key are enough for us to find it.

​
How keys and secrets reach you

We give you each API key and each webhook signing secret once, through a one-time link we send to your technical contact. The link opens once. Store what it shows in your secrets manager: we can’t show it again.

​
Urgent problems and incidents

For a problem that stops live trading during market hours, put URGENT at the start of the subject. We read those first. When an incident affects the API, we email your technical contact, and again when it’s resolved. There’s no status page yet. When our operations team pauses trading, new orders, applications and allocations get 503 trading_paused until we resume, while cancels and reads still work. We email your technical contact when we pause and again when we resume.

​
If a key leaks

Revoke it yourself, at once. This works at any hour, from any address, and whatever the key’s scopes. The request revokes the key it’s sent with. Send the request to the key’s own host: a live key to the live host. Sent to the other host, it returns 401 unauthorized, and nothing is revoked.
Response
The key stops working on its next request, and your other keys keep working. The answer is the same whether or not the key still worked, so it never tells anyone a key is real. To check, send any request with the key from one of your servers: 401 unauthorized means it is revoked. Then email partners@matambaintelligence.com with the key’s environment (sandbox or live) and its last four characters, and we issue you a new key during support hours. Don’t rotate a leaked key. Rotation keeps the old key working through the overlap. Hold a second live key in reserve, issued for the same addresses and scopes. If you revoke one at night or at a weekend, you keep trading with the other until we issue its replacement.

​
If a signing secret leaks

Email partners@matambaintelligence.com with URGENT at the start of the subject, and the environment. We rotate the secret with no overlap, so the old secret stops signing at once, and send you the new one. Our rotation changes only the secret we sign with. Until your endpoint stops accepting the old secret, anyone holding it can sign an event your endpoint accepts, so remove it from your verifier at once. Until the new secret reaches you, don’t act on a webhook alone: find its id in GET /v1/events, which only your API key can read, and act on what the list returns. Between our rotation and your switch to the new secret, your endpoint can’t verify our events. Refuse them, and we retry each one on the retry schedule.

​
What to send for each request

​
Report a problem

When a request fails in a way the error reference doesn’t explain, or an order, application or allocation doesn’t resolve, send us:
  • the x-request-id header of the response,
  • the time of the request, with its time zone,
  • the method and path, such as POST /v1/orders,
  • the error.code, if there was one,
  • the id of the order, application or allocation, if there is one.
Don’t send your customers’ personal details, such as a name, a BVN or a phone number. We don’t store them, so they don’t help us trace a request.

​
Found a mistake in these pages?

Email partners@matambaintelligence.com with the page and what’s wrong or missing.