Authentication

Every request is authenticated with your institution's API key, sent in the Authorization header.

Authorization: Bearer uap_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

That's it — no session, no login flow. The key identifies your institution and scopes every request to it: you can only ever read and update your own applications.

Sending the key

Any of these header forms are accepted, so use whichever fits your HTTP client:

# Bearer (recommended)
Authorization: Bearer uap_live_your_key

# or ApiKey
Authorization: ApiKey uap_live_your_key

# or a dedicated header
x-api-key: uap_live_your_key

A full request looks like:

curl https://api.uapply.africa/api/v1/applications \
  -H "Authorization: Bearer uap_live_your_key"

Good to know

• Keys start with uap_live_.
• Your key is shown only once, when you create or rotate it. Store it somewhere safe — it can't be recovered, only replaced.
• Treat the key like a password: keep it server-side and never commit it to source control or expose it in a browser.

Need a key, or lost yours? See API keys to create, view, or rotate one.

Try it without a key

Want to explore before onboarding? Use the public trial key:

uap_sandbox_000000000000

It's read-only and resolves to a small set of demo applications in our sandbox institution, so you can run any read endpoint (list, by-id, search, zip) and see real response shapes. It also answers record verifications from a set of demo registry records (every demo candidate is a John Doe) instead of hitting a real registry. Hit Use trial key in any "Try it" panel to fill it in automatically.

curl "https://api.uapply.africa/api/v1/applications?limit=5&cycle=current" \
  -H "Authorization: Bearer uap_sandbox_000000000000"

Updates (PATCH /applications/update) are disabled for the trial key and return 403. When you're ready for live data, swap in your own uap_live_ key.

Errors

Status	Meaning
401	The API key is missing or invalid.
403	The request was blocked — make sure you're calling api.uapply.africa directly.
404	No institution matches this key.

{ "code": 401, "error": "Invalid API key" }