Skip to main content
POST
Create an order

Idempotency

The comparison is over the raw bytes you sent, so a retry must transmit byte-identical content — same field order, same whitespace. Re-serialising from an object between attempts can change those bytes and turn a safe retry into a 409. Serialise once, then hash and send the same string.
Use a fresh key per distinct order; a UUID is the simplest scheme.

Authorizations

X-Api-Key-Id
string
header
required

Your key id, verbatim. Public — it identifies the credential. The secret is never transmitted.

Headers

Idempotency-Key
string
required

Required on POST /orders. A stable string — a UUID is the simplest scheme — that makes the call safe to retry. Absent means VALIDATION_ERROR.

Minimum string length: 1
X-Timestamp
string

Unix seconds. Optional, carried for symmetry — send the same value as the t= inside X-Signature, which is the one actually validated.

Body

application/json
partner_order_ref
string
required

Your own reference. Trimmed; 1–200 characters after trimming. Unique across your orders — a repeat is a 409.

amount_minor
string
required

Total in minor units. Must equal Σ(denomination_minor × qty). A number must be a safe integer; a string must match ^[0-9]+$.

currency
string
required

^[A-Z]{3}$. Applies to the whole order — lower case is rejected, and a mixed-currency order is refused.

payment_ref
string
required

Your payment reference, 1–200 characters. Recorded but never interpreted or verified.

items
object[]
required

1–50 entries. An empty array is a VALIDATION_ERROR.

Required array length: 1 - 50 elements

Response

Accepted. The order will be worked on.