SWYCH U API

https://swychu.com/api

The SWYCH U API allows authorized partners to provision and manage member accounts on the SWYCH U platform. All requests are made over HTTPS to https://swychu.com and return JSON responses.

This reference covers the partner integration endpoints as well as the affiliate tracking URL used to attribute new registrations to a partner.

Authentication

All API endpoints require an apikey field in the request body. This key is issued per partner and must be included with every request.

Requests with a missing or invalid API key are rejected and logged. There is no rate limiting beyond normal server capacity, but repeated invalid-key attempts will be flagged.

POST /api/partner/enroll
Content-Type: application/json

{
  "apikey": "YOUR_API_KEY",
  ...
}

Provisions a new member account, re-activates an existing member's subscription, or creates an order for an existing member who is already in the system. The behavior depends on whether a matching email address already exists and whether the course field is included.

Request Body

Behavior

Example Request

POST https://swychu.com/api/partner/enroll
Content-Type: application/json

{
  "apikey": "YOUR_API_KEY",
  "first_name": "Jane",
  "last_name": "Smith",
  "email": "[email protected]",
  "phone": "+15551234567",
  "country": "US",
  "language": "en",
  "password": "SecurePassword123",
  "course": "helocu"
}

Example Responses

{
  "result": "success",
  "message": ""
}

{
  "result": "error",
  "message": "invalid api key"
}

{
  "result": "error",
  "message": "missing first_name"
}

Deactivates a member's SWYCH U subscription. The member record is retained but their access is cancelled. Only members originally provisioned through the partner API can be downgraded via this endpoint.

Request Body

Example Request

POST https://swychu.com/api/partner/downgrade
Content-Type: application/json

{
  "apikey": "YOUR_API_KEY",
  "email": "[email protected]"
}

Example Responses

{
  "result": "success",
  "message": ""
}

{
  "result": "error",
  "message": "no member record found for: [email protected]"
}

{
  "result": "error",
  "message": "[email protected] member record not associated to this partner"
}

This is not an API endpoint in the traditional sense — it's a redirect URL used to hand off a prospect from a partner platform to SWYCH U. When visited, it verifies the request signature, drops a first-party affiliate tracking cookie (rid) in the visitor's browser, and immediately redirects them to the appropriate page on swychu.com.

The cookie persists for 180 days. Any account created on SWYCH U while this cookie is active will be attributed to your affiliate ID. Requests without a valid HMAC signature are silently rejected — the visitor is redirected to the home page and no cookie is set.

Access is restricted to approved referring domains. The HMAC signing secret (REF_HMAC_SECRET) is provisioned by SWYCH U on a per-partner basis. A partner domain cannot generate valid signed URLs until SWYCH U has approved the integration and issued the shared secret. This ensures that affiliate attribution cannot be claimed by any domain that has not been explicitly authorized.

Query Parameters

Example URLs

https://swychu.com/ref?rid=123456789&return=signup&email=jane%40example.com&ts=1710000000&sig=<hmac>

https://swychu.com/ref?rid=123456789&return=signup&ts=1710000000&sig=<hmac>

https://swychu.com/ref?rid=123456789&return=heloc&ts=1710000000&sig=<hmac>

Signature Generation

The signature is an HMAC-SHA256 digest of the message `${rid}:${ts}:${email}`, where email is an empty string if not included in the URL. The output is the full 64-character lowercase hex digest. A fresh ts must be generated for each URL — signatures expire after 15 minutes.

$secret = 'YOUR_SHARED_SECRET';   // same value as REF_HMAC_SECRET on SWYCH U
$rid    = 123456789;               // affiliate's rid
$email  = '[email protected]';      // prospect's email, or '' if unknown
$return = 'signup';                // signup | login | heloc | crypto | banku | basics | ebook
$ts     = time();
$msg    = $rid . ':' . $ts . ':' . strtolower(trim($email));
$sig    = hash_hmac('sha256', $msg, $secret);

$url = 'https://swychu.com/ref'
     . '?rid='    . urlencode($rid)
     . '&return=' . urlencode($return)
     . '&ts='     . $ts
     . '&sig='    . $sig
     . ($email ? '&email=' . urlencode(strtolower(trim($email))) : '');

import { createHmac } from "crypto";

const secret = process.env.REF_HMAC_SECRET;
const rid    = 123456789;
const email  = "[email protected]";  // or "" if unknown
const ret    = "signup";
const ts     = Math.floor(Date.now() / 1000);
const msg    = `${rid}:${ts}:${email.trim().toLowerCase()}`;
const sig    = createHmac("sha256", secret).update(msg).digest("hex");

const url = `https://swychu.com/ref?rid=${rid}&return=${ret}&ts=${ts}&sig=${sig}`
          + (email ? `&email=${encodeURIComponent(email.trim().toLowerCase())}` : "");

Response Format

All API responses return HTTP 200 with a JSON body. The result field indicates the outcome. Inspect this field — do not rely solely on the HTTP status code.

{
  "result": "success" | "error",
  "message": ""         // empty string on success; error description on failure
}

Common Error Messages