Developers

Ship in an afternoon.

Predictable REST, typed SDKs, a sandbox with realistic fixtures, and webhooks for anything asynchronous.

Developers

Ship in an afternoon.

Predictable REST, typed SDKs, a sandbox with realistic fixtures, and webhooks for anything asynchronous. Idempotency keys mean a retry never bills you twice.

SDKsTypeScript, Python, PHP, Go, Java
SandboxTest Ghana Cards, BVNs and NINs included
WebhooksHMAC-signed, retried, replayable
ErrorsOne taxonomy across both sources
# Credit score, routed automatically
curl https://noculto.com/api/v1/credit/score \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 7d2f…" \
  -d '{
    "source": "auto",
    "identifier": { "type": "ghana_card", "value": "GHA-000000000-2" },
    "purpose": "PERSONAL_LOAN",
    "consentReference": "cons_8f2a"
  }'
// Node 18+, no SDK needed
const res = await fetch("https://noculto.com/api/v1/credit/score", {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + process.env.NOCULTO_API_KEY,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    source: "auto",
    identifier: { type: "ghana_card", value: "GHA-000000000-2" },
    purpose: "PERSONAL_LOAN",
    consentReference: "cons_8f2a",
  }),
});
console.log(await res.json());
import os, uuid, requests

res = requests.post(
    "https://noculto.com/api/v1/credit/score",
    headers={
        "Authorization": f"Bearer {os.environ['NOCULTO_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "source": "auto",
        "identifier": {"type": "ghana_card", "value": "GHA-000000000-2"},
        "purpose": "PERSONAL_LOAN",
        "consentReference": "cons_8f2a",
    },
)
print(res.json())
200 OK · 640 ms
{
  "score": 682, "min": 300, "max": 850,
  "band": "VERY_GOOD",
  "meta": { "source": "credit_bureau", "sourceRequestId": "req_91ab", "asOf": "2026-08-24" }
}
Principles

Boring on purpose.

One request shape

Every endpoint takes `source`, an `identifier`, and — for credit — `purpose` and `consentReference`. Learn it once.

One response envelope

Normalised result plus `meta.source`, `meta.sourceRequestId`, cost and latency on every call, for any upstream.

One error taxonomy

Stable codes such as RECORD_NOT_FOUND, SOURCE_UNAVAILABLE and SOURCE_NOT_SUPPORTED, mapped from both vendors.

Idempotency built in

Send an Idempotency-Key and a retry within 24 hours returns the original result — never a second bureau pull.

Sandbox that behaves

Recorded answers for every product, with canonical test Ghana Cards, BVNs and NINs — including failure and outage paths.

Webhooks you can trust

HMAC-SHA256 signed, retried with backoff, and replayable from the dashboard when your endpoint was down.

The interactive API reference, SDK packages and changelog open with the developer portal in a later phase.

Get started

Ready to trust every decision?

Get sandbox keys in minutes, or talk to us about volume pricing, bring-your-own credentials and data residency.