All API requests require authentication using a Bearer token in the Authorization header.
Headers:
\nAuthorization: Bearer
Content-Type: application/json
Signature:
All requests and responses should be signed using HMAC-SHA256 with your secret key. This ensures the integrity and authenticity of the data exchanged between your system and the API.
\nTo generate a signature, create an HMAC-SHA256 hash of the request body using your secret key.
\nThere is a simple piece of PHP code that shows how to generate a signature:
\n/** @var \\Psr\\Http\\Message\\RequestInterface $request */\n$signature = hash_hmac(\n 'sha256',\n $request->getBody()->getContents(),\n $secretKey\n);\n$request->withHeader('Signature', $signature);\n\nOr JavaScript/Node.js:
\nconst hmac = require('crypto-js/hmac-sha256');\nconst body = {\n orderId: '123',\n // ...\n};\nconst signature = hmac(JSON.stringify(body), 'secretKey')\n .toString();\n// 0a059c58184f388c6fe56bc07bf0b71f941ad85175283b5257fc9490422d9f6e\n\nOr Python:
\nimport hashlib\nimport hmac\nimport json\ndef _signature(data: dict, secret: str) -> str:\n # IMPORTANT: use separators to remove spaces after : and ,\n string = json.dumps(data, separators=(\",\", \":\"))\n secret_key = bytes(secret, \"utf8\")\n return hmac.new(secret_key, string.encode(), hashlib.sha256).hexdigest()\ndef _gen_headers(payload: dict, api_key: str, secret: str) -> tuple:\n sign = _signature(payload, secret)\n headers = {\n \"Signature\": sign,\n \"Content-Type\": \"application/json\",\n \"Authorization\": f\"Bearer {api_key}\"\n }\n return headers, payload\n# Example usage:\ndata = {\n 'orderId': '123',\n 'merchantId': 'your_merchant_id',\n 'amount': 1000\n}\nheaders, payload = _gen_headers(data, 'your_api_key', 'your_secret_key')\nprint(headers['Signature'])\n# 0ff2fa58c4811407c4cd5fcb5adef76bf32c4213a579da5b17ebffb61525cb11\n\nEach callback contains a Signature header signed with your secret key. It is important to verify callback signature in order to prevent possible security vulnerabilities.
Example in JavaScript (verifying callback):
\nconst crypto = require('crypto');\n// callbackBody - raw body string received from callback request\nconst signature = callbackHeaders['Signature'];\nconst expectedSignature = crypto.createHmac('sha256', secretKey).update(callbackBody).digest('hex');\nif (signature === expectedSignature) {\n // Signature is valid - process the callback\n} else {\n // Signature is invalid - reject the callback\n}\n\nExample in PHP (verifying callback):
\n$callbackBody = file_get_contents('php://input');\n$signature = $_SERVER['HTTP_SIGNATURE'] ?? '';\nif($signature === hash_hmac('sha256', $callbackBody, $secretKey))\n{\n // Signature is valid - you can trust this callback\n}\n\nBelow is a summary of error codes that can be returned by the API:
\nWhen a payment's status changes, the system can send a callback to the callbackUri provided during payment creation. The callback will include a signed payload similar to the response from the \"Get Payment Status\" endpoint. Header has signature.
Possible state Values:
\ncreated - payment created without an invoice (no method selected, user is redirected to choose a method)
pending- payment successfully created with the chosen method!
dispute- dispute/appeal
in_check- payment verification initiated by the user or an active payout in progress.
finished- payment successfully completed (final status).
canceled- canceled by the user or the gateway (final status for payouts).
expired- payment expired.
failed- payment creation failed; no suitable requisite found (final status)
Error Handling: Always check for status: false in the response to handle errors gracefully.
Rate Limiting: Excessive requests may result in rate limiting. Ensure your application handles HTTP 429 responses.
\nThis endpoint allows you to create a new payment request.
\norderId (string): The ID of the order.
merchantId (string): Unique identifier of the merchant.
amount (number): The amount of the payment.
assetOrBank (string, optional): Bank or crypto name.
method (string): The payment method.
q_ecom - qvazi ecom, AZN
p2p - card-number transfer, EUR/USD
upi - UPI id mail transfer, INR
intent - UPI Intent transfer (payment via redirect to UPI/banking app using deep link)
krw - bank account transfer, KRW
kakaopay - mobile wallet payment, KRW
mpesa - mobile phone-based transfer, KES
ars - CVU number transfer, ARS
c2ckz - card-number transfer, KZT
c2cuz - mix card-number transfer, UZS
humo - HUMO card-number transfer, UZS
uzcard - UZCARD card-number transfer, UZS
c2caz - card-number transfer, AZN
kgs - card-number transfer, KGS
deeplink - one click card-number transfer, KGS
qris - QRIS payment, IDR
jz - Jazz Cash JZ, PKR
ep - Easy Paisa EP, PKR
nagad - Nagad wallet payment, BDT
bkash - bKash wallet payment, BDT
upay - Upay wallet payment, BDT
c2cv - Bank transfer, VND
vietqr - VietQR payment, VND
momo - MoMo wallet payment, VND
viettel - Viettel wallet/mobile payment, VND
ewallet - e-wallet payment, VND
gcash_native - GCash Native payment, PHP
maya - Maya wallet payment, PHP
mayab - MayaB payment method, PHP
alipay - Alipay wallet payment, CNY
wechat_pay - WeChat Pay wallet payment, CNY
ecny - e-CNY digital yuan payment, CNY
c2c - card-number transfer, RUB
sbp - phone-number transfer via Russia’s Faster Payments System (RUB)
c2cwt - card-number transfer, RUB (WT)
sbpwt - phone-number transfer via Russia’s Faster Payments System (RUB) (WT)
spay - SberPay one-click QR transfer through Sberbank Online (RUB)
tpay - intrabank phone-number transfer in T-Bank (RUB)
vpay - intrabank phone-number transfer in VTB (RUB)
apay - intrabank phone-number transfer in Alfa-Bank (RUB)
ozon - intrabank phone-number transfer in OZON Bank (RUB)
psb - intrabank phone-number transfer in PSB (RUB)
gazprom - intrabank phone-number transfer in Gazprom (RUB)
abh - cross-border, RUB
m2ctj - cross-border card transfer to Tajikistan (RUB)
m2ntj - cross-border phone-number transfer to Tajikistan (RUB)
m2nam - cross-border phone-number transfer to Armenia (RUB)
connectc2c - card-number matching, RUB
connectsbp - phone-number matching via SBP, RUB
nspk - QR transfer through the Faster Payments System
ecom - classic 3-DS acquiring
revo - internal transfer, EUR
paypal - internal transfer, EUR
crypto - crypto processing (specify asset in assetOrBank)
currency (string, optional): The currency of the payment (RUB, UZS, KZT,IDR, PKR,BDT,VND,PHP, EUR,etc.)
callbackUri (string): The URI to which the callback response will be sent.
successUri (string): The URI to redirect to on successful payment.
failUri (string): The URI to redirect to on failed payment.
payer (object): Information about the payer.
{\n \"payer\": {\n \"userId\": \"u-4095\",\n \"userIp\": \"188.11.55.10\",\n \"customerName\": \"Иван Иванов\",\n \"phone\" : \"37434343434\",\n \"email\" : \"email@mail.ru\",\n \"senderBank\": \"sber\", // (string, optional, conditional-required for cross‑border methods) — Identifier of the payer's bank. Used to select FX rate tables, routing rules, and limits for cross‑border payments. Pass a lowercase slug ([a-z0-9_-], max 32 chars), e.g. \"tbank\", \"sber\", \"vtb\", \"alfa\".\n \"fingerprint\": \"device_id\", // (string, optional) — Device fingerprint for fraud prevention.\n \"type\": \"trusted\", // (string, optional) ftd/std/trusted\n \"payments\": {\n \"successful\": 5,\n \"expired\": 1\n }\n }\n}\n\npayer.fingerprint (string, required): A unique identifier for the user’s device/session.Generation options:
\nBrowser: a hash of userAgent + screen + timezone
Mobile app: device_id (Android ID / IDFV)
Server-side integration: a session UUID or a hash of userId + userAgent
Examples of valid values:
\n\"7a3f2b1c\" (hex hash)
\"550e8400-e29b-41d4-a716-446655440000\" (UUID)
\"user_123_session_abc\" (arbitrary string)
Maximum length: 64 characters
\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"Creates a payout request to transfer funds to a specified card number.
\nRequest Body Parameters:
\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"This POST request is used to retrieve the status of a payment with the provided merchant ID and payment ID. The request should include the merchant ID and payment ID in the request body.
\nRequest Body Parameters:
\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"This POST request is used to retrieve receipt (media) links for a payment using the provided merchant ID and order ID. The request should include the merchant ID and order ID in the request body.
\nQuery Parameters:
\nResponse:
\nError Responses:
\nRetrieves the list of banks associated with payment methods for a specific currency.
\nAttention, it does not give the full list of available banks. Request the list from support.
\nQuery Parameters:
\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"Privat method api
\n","_postman_id":"f29f5470-7895-4e4d-a982-149ee0d48685","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"Endpoint to update the status of an order. For 'dispute' status, a file can be uploaded.
\nPath Parameters:
\nRequest Body Parameters:
\nFile Upload Formats:
\nMultipart/form-data (recommended):
\nfile: single file upload
media[]: array of files (multiple file inputs with same name)
Content-Type: multipart/form-data
JSON with base64:
\nfile: single base64-encoded string (e.g., \"data:image/png;base64,iVBORw0KGgo...\")
files: array of base64-encoded strings
Content-Type: application/json
File Upload Limits:
\nMaximum file size: 200KB (204800 bytes)
\nMaximum files per invoice: 3
\nFile is required for dispute/in_check status
Supported formats: images (JPG, PNG, etc.), PDF, and other document types
\nPossible Status Values:
\ndispute- апеляция (Отправка чека доступна)
in_check- инициация проверки оплаты от пользователя \"Я оплатил\". (Отправка чека доступна)
canceled- инициация отмены оплаты от пользователя \"Отменить платеж\". (Отправка чека не доступна)
Response:
\nError Responses:
\nПолучает информацию о платеже по его order_id.
\n","urlObject":{"path":["api","v2","orders",":order_id"],"host":["https://domain.com"],"query":[],"variable":[{"type":"any","value":"6755c96cdfab3","key":"order_id"}]}},"response":[{"id":"091af60f-3bea-447c-9860-e82c29ac2ac3","name":"Get Order by ID","originalRequest":{"method":"GET","header":[{"key":"Authorization","value":"BearerВозвращает список доступных банков для данного платежа (order_id). Можно также использовать фильтры method_code и currency.
Возвращает список доступных методов оплаты для указанного order_id. Можно фильтровать по method_code и currency.
Creates an invoice for the payment after the user selects a payment method.
\nPath Parameters:
\nRequest Body Parameters:
\nCard Data (H2H Flow):
\nFor methods that require card data (e.g., ecom), you can pass card details directly. This is used for Host-to-Host integrations where card data is collected on your side.
Option 1 - Flat structure:
\nOption 2 - Nested card object:
*Required only for H2H card payment methods.
\nExample with card data:
\n{\n \"method\": \"ecom\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"cvv\": \"123\",\n \"expiry\": \"12/25\",\n \"holder\": \"JOHN DOE\"\n }\n}\nResponse:
\nReturns payment details with invoice information including address, bank, rate, etc.
\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"