We use cookies

We use cookies and Google Analytics to understand how you use our site and improve your experience. Read our Privacy Policy for details.

Back to Documentation

API Reference

The REST API behind the Commission Wizard web app. Today you sign in with a user account and every request runs with that user's role and organization. API keys for system-to-system integrations are coming soon.

Base URL:https://commissionswizard.com/api

Authentication

Commission Wizard uses JWT (JSON Web Tokens) for authentication. Sign in with POST /auth/login, then send the access token in the Authorization header with a Bearer prefix.

Authorization Header
curl https://commissionswizard.com/api/auth/me \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

Token Expiration

Access tokens expire after 15 minutes (expires_in: 900). Exchange the refresh token at POST /auth/refresh for a new pair; refresh tokens last 7 days and each one can be used once.

Endpoints

Send the credentials as form data (application/x-www-form-urlencoded), not JSON. Limited to 5 attempts per minute per IP address.

Form Fields

usernameRequired
string

Username or email

passwordRequired
string

User's password

Example Request
curl -X POST https://commissionswizard.com/api/auth/login \
  --data-urlencode "username=jane" \
  --data-urlencode "password=your_password"
Example Response
{
  "access_token" "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type" "bearer",
  "expires_in" 900,
  "refresh_token" "kq3V9x..."
}

Jobs

A job is one reconciliation: an AMS file compared against a carrier statement. Jobs are created in the web app; the API lets you read them and download the reports. Not available to the Viewer role.

Agents

Manage agents, read their commission history and export their reports. Agents are also created automatically from AMS data when a job is processed.

Agent Payments

Track payments made to agents. Balance = total agent commission minus payments that have not been voided. Owner, Admin and Processor roles only.

Coming Soon

API Keys

Long-lived keys for system-to-system integrations, so you don't have to store a user's password. Until then, sign in with a user account as shown above.

Rate Limits

Limits are per IP address and the same on every plan: 5 login attempts per minute, 10 token refreshes per minute, and about 10 requests per second (short bursts allowed) for the rest of the API. A few endpoints, such as file uploads and the assistant, have tighter limits. Requests over a limit get HTTP 429; wait and retry.