API documentation — Syriatel Portal

One API for the Syriatel Cash and ShamCash accounts you linked on this platform: balances, histories, transaction look-ups and transfers, as JSON, with the same outputs as apisyria.com.

Base URL

Every answer is UTF-8 JSON. Success: "success": true; error: "success": false with an Arabic "error".

Authentication

Each accountant gets their key from the API settings page. Send it in the X-Api-Key header (preferred), as ?api_key= in the URL, as Authorization: Bearer, or as an api_key field in a POST body.

GET https://api.eaglebot99.com?resource=status
X-Api-Key: YOUR_API_KEY

GET https://api.eaglebot99.com?resource=status&api_key=YOUR_API_KEY

Sign in (or create an account) to get your key.

GET 1) API status resource=status

Checks that the API works; returns the key's owner and the linked-accounts limit of their plan.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.

curl -s "https://api.eaglebot99.com?resource=status" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=status');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "message": "API is working.",
    "user": {
        "id": 123,
        "name": "User Name",
        "email": "[email protected]"
    },
    "limits": {
        "max_linked_accounts": 10
    }
}

GET 2) Linked accounts resource=accounts&action=list

Every active Syriatel Cash number and every active ShamCash account linked to the key's owner within their plan (oldest first), basic fields only: the values to send as gsm and account_address.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.

curl -s "https://api.eaglebot99.com?resource=accounts&action=list" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=accounts&action=list');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "syriatel": [
            {
                "gsm": "0933xxxxxx",
                "cash_code": "123456"
            },
            {
                "gsm": "0944xxxxxx",
                "cash_code": "654321"
            }
        ],
        "shamcash": [
            {
                "account_address": "251a***********************e"
            },
            {
                "account_address": "251b***********************f"
            }
        ]
    }
}

GET 3) Syriatel Cash balance resource=syriatel&action=balance

The balance of one of the linked, active Syriatel Cash numbers (as text). gsm chooses which one: the number or its cash code.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`gsm`	URL	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.

curl -s "https://api.eaglebot99.com?resource=syriatel&action=balance&gsm=0933xxxxxx" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=balance&gsm=0933xxxxxx');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "gsm": "0933xxxxxx",
        "cash_code": "123456",
        "balance": "150000"
    }
}

GET 4) Syriatel Cash incoming history resource=syriatel&action=history

The money received by the account over the period, read live from Syriatel and archived. At most 10 pages are read per call (20 for all): in a very busy period, older lines are left out.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`gsm`	URL	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.
`period`	URL	Optional	The period: 7 or 30 (days) or all — default 7.

curl -s "https://api.eaglebot99.com?resource=syriatel&action=history&gsm=0933xxxxxx&period=7" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=history&gsm=0933xxxxxx&period=7');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "gsm": "0933xxxxxx",
        "cash_code": "123456",
        "period": "7",
        "items": [
            {
                "transaction_no": "123456789",
                "date": "2025-01-01 11:20:00",
                "from": "0933xxxxxx",
                "to": "0944yyyyyy",
                "amount": "25000"
            }
        ]
    }
}

GET 5) Syriatel Cash outgoing history resource=syriatel&action=outgoing_history

Like the incoming history, for the money sent from the account, with "history_type": "outgoing".

Aliases: action=history_outgoing · action=sent_history

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`gsm`	URL	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.
`period`	URL	Optional	The period: 7 or 30 (days) or all — default 7.

curl -s "https://api.eaglebot99.com?resource=syriatel&action=outgoing_history&gsm=0933xxxxxx&period=7" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=outgoing_history&gsm=0933xxxxxx&period=7');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "gsm": "0933xxxxxx",
        "cash_code": "123456",
        "period": "7",
        "history_type": "outgoing",
        "items": [
            {
                "transaction_no": "123456789",
                "date": "2025-01-01 11:20:00",
                "from": "0933xxxxxx",
                "to": "0944yyyyyy",
                "amount": "25000"
            }
        ]
    }
}

GET 6) Find a Syriatel Cash transaction resource=syriatel&action=find_tx

Looks for a transaction received by one account within the period, by its number: the archive first (the account's own outgoing lines, and lines older than the period, left out), then the incoming history live. If the reading stopped at the page limit (10, 20 for all) before the start of the period, the answer is 502 (search incomplete), not found:false.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`tx`	URL	Required	The transaction number as shown in the app (digits only, 3 to 30).
`gsm`	URL	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.
`period`	URL	Optional	The period: 7 or 30 (days) or all — default 7.

curl -s "https://api.eaglebot99.com?resource=syriatel&action=find_tx&tx=123456789&gsm=0933xxxxxx&period=7" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=find_tx&tx=123456789&gsm=0933xxxxxx&period=7');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "found": true,
        "transaction": {
            "transaction_no": "123456",
            "date": "2025-01-01 11:20:00",
            "from": "0933xxxxxx",
            "to": "0944yyyyyy",
            "amount": "25000"
        },
        "account": {
            "gsm": "0933xxxxxx",
            "cash_code": "ABC123"
        }
    }
}

POST 7) Syriatel Cash transfer resource=syriatel&action=transfer_cash

Sends from a linked account to a beneficiary number (or cash code). A number must be the beneficiary Syriatel finds, else nothing is sent (400). One transfer at a time per account; any answer to the transfer that is neither a success nor Syriatel's explicit refusal makes its result unknown, and it is never sent again (502): check the outgoing history first.

Money operation: POST only, and its parameters in the request body only (x-www-form-urlencoded, multipart or JSON) — any of them in the URL is refused (400). Send an Idempotency-Key header to avoid running it twice.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`gsm`	Request body	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.
`to_gsm`	Request body	Required	The beneficiary number (or their cash code).
`amount`	Request body	Required	The amount: a positive number.
`pin_code`	Request body	Required	The Syriatel Cash PIN: 4 digits. Never stored nor logged.

# A NEW Idempotency-Key for every transfer; send the same one again only to retry THAT transfer.
IDEMPOTENCY_KEY="$(openssl rand -hex 16)"
curl -s -X POST "https://api.eaglebot99.com?resource=syriatel&action=transfer_cash" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --data-urlencode "gsm=0933xxxxxx" \
  --data-urlencode "to_gsm=0995xxxxxxx" \
  --data-urlencode "amount=100" \
  --data-urlencode "pin_code=1234"

<?php
// A NEW Idempotency-Key for every transfer (keep it with your order): send the same one
// again only to retry THAT transfer. Reused for another transfer, it returns the first
// transfer's stored answer and sends nothing.
$idempotencyKey = bin2hex(random_bytes(16));

$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=transfer_cash');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json', 'Idempotency-Key: '.$idempotencyKey],
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'gsm' => '0933xxxxxx',
        'to_gsm' => '0995xxxxxxx',
        'amount' => '100',
        'pin_code' => '1234',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "source_account": {
            "gsm": "0933xxxxxx",
            "cash_code": "123456"
        },
        "beneficiary": {
            "gsm": "0995xxxxxxx"
        },
        "amount": "100",
        "fee": "5",
        "billcode": "ABCDEF123",
        "message": "تم التحويل بنجاح"
    }
}

POST 8) Syriatel mobile recharge resource=syriatel&action=mobile_recharge

Checks the request (account, number, category, PIN) then answers 501: recharge is not supported on this platform for now and nothing is sent to Syriatel.

Money operation: POST only, and its parameters in the request body only (x-www-form-urlencoded, multipart or JSON) — any of them in the URL is refused (400). Send an Idempotency-Key header to avoid running it twice.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`gsm`	Request body	Required	One of your linked Syriatel Cash numbers (you may link several; accounts/list returns them all): the number (09…, 9639… or +9639…) or its cash code. Required: there is no default number. A number not linked to you: 404; not active or beyond your plan: 403.
`target_gsm`	Request body	Required	The number to recharge.
`category`	Request body	Required	The recharge category: one of the fixed values (e.g. 1.92, 125, 1250).
`pin_code`	Request body	Required	The Syriatel Cash PIN: 4 digits. Never stored nor logged.

# A NEW Idempotency-Key for every transfer; send the same one again only to retry THAT transfer.
IDEMPOTENCY_KEY="$(openssl rand -hex 16)"
curl -s -X POST "https://api.eaglebot99.com?resource=syriatel&action=mobile_recharge" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --data-urlencode "gsm=0933xxxxxx" \
  --data-urlencode "target_gsm=0998xxxxxxx" \
  --data-urlencode "category=1.92" \
  --data-urlencode "pin_code=1234"

<?php
// A NEW Idempotency-Key for every transfer (keep it with your order): send the same one
// again only to retry THAT transfer. Reused for another transfer, it returns the first
// transfer's stored answer and sends nothing.
$idempotencyKey = bin2hex(random_bytes(16));

$ch = curl_init('https://api.eaglebot99.com?resource=syriatel&action=mobile_recharge');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json', 'Idempotency-Key: '.$idempotencyKey],
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'gsm' => '0933xxxxxx',
        'target_gsm' => '0998xxxxxxx',
        'category' => '1.92',
        'pin_code' => '1234',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": false,
    "error": "شحن رصيد الموبايل غير مدعوم حالياً على هذه المنصة."
}

GET 9) ShamCash balance resource=shamcash&action=balance

The balance of every currency (USD, SYP, EUR) of a linked ShamCash account, as numbers.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`account_address`	URL	Required	The address of one of your linked ShamCash accounts (the source; accounts/list returns them all).

curl -s "https://api.eaglebot99.com?resource=shamcash&action=balance&account_address=251awSOURCE" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=shamcash&action=balance&account_address=251awSOURCE');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "account_address": "251aw******************",
        "balances": [
            {
                "currency": "USD",
                "balance": 0
            },
            {
                "currency": "SYP",
                "balance": 20980
            },
            {
                "currency": "EUR",
                "balance": 0
            }
        ]
    }
}

GET 10) ShamCash incoming logs resource=shamcash&action=logs

The transfers received by a linked ShamCash account: the newest page is read live, then everything archived is returned, newest first.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`account_address`	URL	Required	The address of one of your linked ShamCash accounts (the source; accounts/list returns them all).
`limit`	URL	Optional	Operations in the answer: 1 to 500 (default 100).

curl -s "https://api.eaglebot99.com?resource=shamcash&action=logs&account_address=251awSOURCE" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=shamcash&action=logs&account_address=251awSOURCE');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "account_address": "251aw******************",
        "items": [
            {
                "tran_id": "987654321",
                "from_name": "Client Name",
                "to_name": "Your Name",
                "currency": "SYP",
                "amount": 25000,
                "datetime": "2025-01-01 10:15:00",
                "account": "251aw******************",
                "note": "شحن رصيد"
            }
        ]
    }
}

GET 11) ShamCash outgoing logs resource=shamcash&action=outgoing_logs

Like the incoming logs, for the transfers sent from the account, with "log_type": "outgoing".

Aliases: action=logs_outgoing · action=sent_logs

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`account_address`	URL	Required	The address of one of your linked ShamCash accounts (the source; accounts/list returns them all).
`limit`	URL	Optional	Operations in the answer: 1 to 500 (default 100).

curl -s "https://api.eaglebot99.com?resource=shamcash&action=outgoing_logs&account_address=251awSOURCE" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=shamcash&action=outgoing_logs&account_address=251awSOURCE');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "account_address": "251aw******************",
        "log_type": "outgoing",
        "items": [
            {
                "tran_id": "987654321",
                "from_name": "Your Name",
                "to_name": "Client Name",
                "currency": "SYP",
                "amount": 25000,
                "datetime": "2025-01-01 10:15:00",
                "account": "251aw******************",
                "note": "تحويل رصيد"
            }
        ]
    }
}

GET 12) Find a ShamCash transaction resource=shamcash&action=find_tx

Looks for a transaction received by a linked ShamCash account, by its number: the archive first, then the history live. A transfer the account itself sent is not counted (found:false), so a payout's number never passes for a payment received.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`tx`	URL	Required	The transaction number as shown in the app (digits only, 3 to 30).
`account_address`	URL	Required	The address of one of your linked ShamCash accounts (the source; accounts/list returns them all).

curl -s "https://api.eaglebot99.com?resource=shamcash&action=find_tx&tx=123456789&account_address=251awSOURCE" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

<?php
$ch = curl_init('https://api.eaglebot99.com?resource=shamcash&action=find_tx&tx=123456789&account_address=251awSOURCE');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json'],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "found": true,
        "transaction": {
            "tran_id": "987654321",
            "from_name": "Client Name",
            "to_name": "Your Name",
            "currency": "SYP",
            "amount": 25000,
            "datetime": "2025-01-01 10:15:00",
            "account": "251aw******************",
            "note": "شحن رصيد"
        },
        "account": {
            "account_address": "251aw******************"
        }
    }
}

POST 13) ShamCash transfer resource=shamcash&action=transfer

Sends from a linked, active ShamCash account to another ShamCash account, once the delay after linking it to the platform is over (24 hours). Note up to 50 characters.

Money operation: POST only, and its parameters in the request body only (x-www-form-urlencoded, multipart or JSON) — any of them in the URL is refused (400). Send an Idempotency-Key header to avoid running it twice.

Parameters

Parameter	Where		Description
`api_key`	Header or URL	Required	The API key: in the X-Api-Key header (preferred), ?api_key= in the URL, Authorization: Bearer, or an api_key field in a POST body.
`account_address`	Request body	Required	The address of one of your linked ShamCash accounts (the source; accounts/list returns them all).
`receive_key`	Request body	Required	The recipient ShamCash account address.
`amount`	Request body	Required	The amount: a positive number.
`currency`	Request body	Required	The currency: USD or SYP (EUR is read only).
`note`	Request body	Optional	An optional note, up to 50 characters.
`confirm_code`	Request body	Optional	The financial confirmation code, only if ShamCash asks for it for this amount. Never stored.

# A NEW Idempotency-Key for every transfer; send the same one again only to retry THAT transfer.
IDEMPOTENCY_KEY="$(openssl rand -hex 16)"
curl -s -X POST "https://api.eaglebot99.com?resource=shamcash&action=transfer" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --data-urlencode "account_address=251awSOURCE" \
  --data-urlencode "receive_key=251awRECEIVER" \
  --data-urlencode "amount=100" \
  --data-urlencode "currency=USD" \
  --data-urlencode "note=API transfer test"

<?php
// A NEW Idempotency-Key for every transfer (keep it with your order): send the same one
// again only to retry THAT transfer. Reused for another transfer, it returns the first
// transfer's stored answer and sends nothing.
$idempotencyKey = bin2hex(random_bytes(16));

$ch = curl_init('https://api.eaglebot99.com?resource=shamcash&action=transfer');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: YOUR_API_KEY', 'Accept: application/json', 'Idempotency-Key: '.$idempotencyKey],
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'account_address' => '251awSOURCE',
        'receive_key' => '251awRECEIVER',
        'amount' => '100',
        'currency' => 'USD',
        'note' => 'API transfer test',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($response['success'] ?? false) {
    print_r($response);
} else {
    echo $status, ': ', $response['error'] ?? 'unknown error';
}

{
    "success": true,
    "data": {
        "message": "تم تحويل مبلغ 5 USD بنجاح ✅",
        "source_account": {
            "account_address": "251awSOURCE***********"
        },
        "recipient": {
            "address": "251awRECEIVER*********",
            "userName": "Client Name"
        },
        "transfer": {
            "amount": "5",
            "currency": "USD",
            "note": "API transfer test"
        }
    }
}

Avoiding double execution (Idempotency-Key)

With every money request (POST) you may send an Idempotency-Key header with a unique value of yours for each transfer (or a request_id body field: text or an integer; any other type is refused with 400, and it is not accepted in the URL). Never reuse it for another transfer: the first transfer's answer would be returned and nothing sent.

Same key, same parameters: the stored answer is returned as it was and nothing is sent again (with the header Idempotent-Replayed: true).
Same key, other parameters: 422.
Same key while the first request is still running: 409. If it stays without a result more than 10 minutes: 502 (unknown result), and it never runs again.
A key is freed (usable again) only when nothing can have moved: a refusal before anything was sent (a wrong parameter, the account busy with another transfer…), or Syriatel's explicit refusal of the transfer with its code (balance, PIN…). Every other answer stays with the key and is returned as it was: a success, ShamCash's refusal of a transfer that was sent (400), an unknown result (502).
Keys whose answer is known (any answer below 500: a success or a refusal) are kept 30 days after they were created, then deleted: a request with the same key after that runs as a new one, so never retry an old transfer with its key. A key still running, or whose answer was a 5xx (unknown result), is kept for good and never runs again under that key.

Limits

Default request limit per minute per key: 60; a subscription plan or an account setting may set another one (yours is shown here once signed in, and on the API settings page). Beyond it, 429 with retry_after and a Retry-After header.
More than 30 attempts with a missing or wrong key from one address per minute: 429.
You can restrict your key to some IP addresses on the API settings page.
Delay of ShamCash transfers after the account was linked to the platform: 24 hours.
The Syriatel Cash history is read live up to 10 pages per call (20 for period=all): in a very busy period, history leaves older lines out, and find_tx answers 502 (search incomplete), not found:false, when it stopped at that limit before the start of the period.
Parameters of money requests go in the request body only: gsm, to_gsm, amount, pin_code, target_gsm, category, account_address, receive_key, currency, note, confirm_code, request_id

HTTP/1.1 429 Too Many Requests
Retry-After: 30

{
    "success": false,
    "error": "تم تجاوز الحد المسموح للطلبات. حاول مرة أخرى بعد قليل.",
    "retry_after": 30
}

Error codes

An error always looks like:

{
    "success": false,
    "error": "Missing API key. استخدم X-Api-Key أو ?api_key="
}

HTTP	Meaning
200	Success.
400	Incomplete request or invalid parameter (e.g. no gsm or account_address), or the provider refused the operation.
401	Missing or wrong key.
403	Forbidden: key suspended, the account chosen (gsm / account_address) inactive or beyond the plan, subscription without API, IP not allowed, or endpoint switched off.
404	Unknown endpoint, or an account (gsm / account_address) not linked to this user.
405	HTTP method not supported (reads are GET, money operations POST).
409	A request with the same Idempotency-Key is running.
422	The Idempotency-Key was used for a different request.
429	Rate limit exceeded, or another transfer from the account is running.
500	Internal server error.
501	Not supported on this platform (mobile recharge).
502	Provider error (Syriatel / ShamCash), a transfer with an unknown result, or a find_tx search that could not be completed.