All API requests to the sandbox must include these headers. Contact MoPhones to receive your API key.

x-api-key: <your-api-key>
apollo-require-preflight: 1
Content-Type: application/json

Example cURL:

curl -X POST https://sandbox.mocore.mo.zone/graphql \
  -H "Content-Type: application/json" \
  -H "x-api-key: <your-api-key>" \
  -H "apollo-require-preflight: 1" \
  -d '{"query":"{ customerCursor(pagination: { limit: 10 }) { data { id customer_first_name customer_surname_name } } }"}'

Customer management

Primary queries: customer(id), customerCursor(pagination, filters), customersByPhone(phoneNumber), customerByFilters(filters), customersCount(filters).

Mutations: createCustomer(input), updateCustomer(id, input), deleteCustomer(id).

Customers have nested applications and latestApplication fields resolved automatically.

Fields use snake_case: customer_first_name, customer_surname_name, customer_status, customer_id_number, customer_phone_number.

Applications

Queries: application(id), applicationByFilters(filters).

Linked to customers via the applications resolve field on any customer object.

Inventory and products

Inventory: inventory(id), inventoryWithCursorPagination(pagination, filters), inventoryCount(filters), plus CRUD mutations.

Products: product(id), products(filter), productsWithCursorPagination(pagination, filters), activeProducts(categoryId), plus CRUD mutations.

Used for device catalog and stock management.

Loan module (namespace pattern)

Access via loan_module query, then drill into sub-namespaces:

query {
  loan_module {
    loanContracts {
      loanContract(id: "contract-uuid") {
        contract_id
        customer_id
        status
        principal_amount
      }
    }
    loanLedger { ... }
    loanInstallments { ... }
    loanDelinquency { ... }
  }
}

Payment module (namespace pattern)

Access via payment_module query:

query {
  payment_module {
    paymentOrchestrator { ... }
    payments { ... }
    paymentAdjustments { ... }
  }
}

MDM / device locking

devices and deviceLock queries for device management and remote lock/unlock status.

Credit bureau

creditBureauTransaction(id), creditBureauTransactionByFilters(filters), creditBureauTransactionsCursor(pagination, filters) for credit check results.

The Loan and Payment modules use a namespace pattern where the top-level query returns a namespace object, and actual operations are accessed as resolve fields on that namespace.

Query loan_module { loanContracts { ... } } rather than loanContract(...) directly.

In the schema reference below, look for LoanModuleNamespace, LoanContractsNamespace, PaymentModuleNamespace types to find all available sub-operations.

Most list queries support cursor pagination via CursorPaginationInputType:

query {
  customerCursor(
    pagination: {
      limit: 10
      cursor: null
      sortField: "created_at"
      sortDirection: "DESC"
    }
  ) {
    data {
      id
      customer_first_name
      customer_surname_name
      customer_status
    }
    pagination {
      cursor
      hasMore
    }
  }
}

Fields: limit (required), cursor (null for first page), sortField, sortDirection (ASC/DESC), direction (NEXT/PREVIOUS).

Beyond the Faro-focused domains above, the API also includes:

• Auth -- user, role, and group management
• Config -- system configuration and onboarding config
• Communication -- messaging and notifications
• Territory -- geographic territory management
• Sales and orders -- order processing, delivery, reconciliation
• Price plans -- pricing, commissions, seller tiers
• After-sale -- returns and refunds
• Audit -- audit trail logging
• Export -- data export functionality
• Partner -- partner management

These are fully queryable in the sandbox. See the schema reference below for details.

The sandbox includes 7 seeded customers across loan lifecycle stages:

Customer	Stage	Notes
Alice	Active loan
Bob	Delinquent	Device locked
Carol	Paid off
David	Pre-loan	Has SPIN/CRB data
Eve	Written off	Device locked
Frank	Active loan
Grace	Pre-loan	Has SPIN/CRB data

All external integrations return success stubs in the sandbox:

• MDM (NuovoPay/Scalefusion) -- MockMdmProvider
• Payments (M-Pesa/Stripe) -- MockPaymentProvider
• Liveness/KYC (SmileID/SumSub) -- MockLivenessAdapter
• Credit bureaus, KRA -- disabled via env flags