{ "info": { "_postman_id": "870e6432-b7e2-4f34-bc66-1dfc00702769", "name": "GMXAZ Bot Public API", "description": "GMXAZ Bot Public API collection. Base URL: https://gmx.az/api/v1. Includes all request definitions, request and response examples, error responses, variables, tests, idempotency, and webhook receiver samples.\n\nWebhook signature: Recommended: sha256=HMAC_SHA256(timestamp + \".\" + event_id + \".\" + raw_json_body, webhook_secret). Use the timestamp and event-id headers shown above.. Import the accompanying environment JSON and fill in x_api_key, webhook_secret, and callback_url.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "X-API-KEY", "type": "string" }, { "key": "value", "value": "{{x_api_key}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "pm.request.headers.upsert({ key: 'Accept', value: 'application/json' });", "const requestPath = '/' + pm.request.url.path.join('/');", "const stableKey = (name) => {", " let value = pm.collectionVariables.get(name);", " if (!value) { value = pm.variables.replaceIn('{{$guid}}'); pm.collectionVariables.set(name, value); }", " return value;", "};", "if (pm.request.method === 'POST' && requestPath.endsWith('/order')) {", " pm.request.headers.upsert({ key: 'X-Idempotency-Key', value: stableKey('order_idempotency_key') });", "}", "if (pm.request.method === 'POST' && requestPath.endsWith('/redeem-check')) {", " pm.request.headers.upsert({ key: 'X-Idempotency-Key', value: stableKey('redeem_idempotency_key') });", "}" ] } }, { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status code is not 5xx', function () {", " pm.expect(pm.response.code).to.be.below(600);", "});", "if (pm.response.headers.has('X-Request-Id')) { pm.collectionVariables.set('last_request_id', pm.response.headers.get('X-Request-Id')); }" ] } } ], "variable": [ { "key": "base_url", "value": "https://gmx.az/api/v1" }, { "key": "x_api_key", "value": "" }, { "key": "webhook_secret", "value": "" }, { "key": "callback_url", "value": "https://customer.example/webhooks/bot-manager" }, { "key": "callback_mode", "value": "legacy" }, { "key": "product_id", "value": "91" }, { "key": "order_id", "value": "8821" }, { "key": "client_order_id", "value": "" }, { "key": "order_idempotency_key", "value": "" }, { "key": "redeem_idempotency_key", "value": "" }, { "key": "player_id", "value": "51515969536" }, { "key": "server_id", "value": "1234" }, { "key": "charname", "value": "PlayerOne" }, { "key": "input_2", "value": "" }, { "key": "input_3", "value": "" }, { "key": "input_4", "value": "" }, { "key": "input_5", "value": "" }, { "key": "input_6", "value": "" }, { "key": "input_7", "value": "" }, { "key": "input_8", "value": "" }, { "key": "redeem_code", "value": "ABCDEF123456" }, { "key": "last_request_id", "value": "" } ], "item": [ { "name": "Account", "description": "Account", "item": [ { "name": "GET /getMe", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"user_id\": 579365494,\n \"username\": \"reseller_pro\",\n \"balance\": \"1250.5000\",\n \"currency\": \"USD\",\n \"webhook_secret_configured\": true\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns the API user, balance, and currency.\n\nUse this endpoint to verify the API key and account status.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.", "url": { "raw": "{{base_url}}/getMe", "host": [ "{{base_url}}" ], "path": [ "getMe" ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" } ] } ] }, { "name": "Catalog", "description": "Catalog", "item": [ { "name": "GET /games", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": [\n {\n \"id\": 1,\n \"name\": \"PUBG Mobile\",\n \"type\": \"TOPUP\",\n \"categories\": [\n {\n \"id\": 10,\n \"name\": \"Global\",\n \"per_page_count\": 12\n }\n ]\n }\n ]\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active games and their active categories.\n\nGames can be filtered by type or searched by name.\n\n## Parameters\n- `type` (query, optional): Product type filter.\n- `q` (query, optional): Search by game name.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: The type or q parameter is invalid.", "url": { "raw": "{{base_url}}/games", "host": [ "{{base_url}}" ], "path": [ "games" ], "query": [ { "key": "type", "value": "topup", "description": "Product type filter.", "disabled": true }, { "key": "q", "value": "pubg", "description": "Search by game name.", "disabled": true } ] } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"The type or q parameter is invalid.\"\n }\n}" } ] }, { "name": "GET /categories", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": [\n {\n \"id\": 10,\n \"name\": \"Global\",\n \"per_page_count\": 12\n }\n ]\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"game_id is missing or is not an integer.\"\n }\n}" }, { "name": "GAME_NOT_FOUND", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active categories for the selected game.\n\ngame_id is required and must be taken from the /games response.\n\n## Parameters\n- `game_id` (query, required): Active game ID.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: game_id is missing or is not an integer.\n- `GAME_NOT_FOUND` HTTP 404: The game was not found or is inactive.", "url": { "raw": "{{base_url}}/categories", "host": [ "{{base_url}}" ], "path": [ "categories" ], "query": [ { "key": "game_id", "value": "1", "description": "Active game ID.", "disabled": false } ] } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"GAME_NOT_FOUND\",\n \"message\": \"The game was not found or is inactive.\"\n }\n}" } ] }, { "name": "GET /products", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": [\n {\n \"id\": 91,\n \"name\": \"PUBG Mobile 60 UC\",\n \"game_id\": 1,\n \"game\": \"PUBG Mobile\",\n \"category_id\": 10,\n \"category\": \"Global\",\n \"type\": \"TOPUP\",\n \"fulfillment_type\": \"standard\",\n \"is_qr_login\": false,\n \"price\": \"0.8800\",\n \"currency\": \"USD\",\n \"stock_status\": \"INFINITE\",\n \"stock_count\": null,\n \"min_qty\": 1,\n \"max_qty\": 1,\n \"fields\": [\n {\n \"key\": \"player_id\",\n \"label\": \"Player ID\",\n \"required\": true\n }\n ],\n \"supports_player_validation\": true\n }\n ],\n \"meta\": {\n \"current_page\": 1,\n \"last_page\": 1,\n \"per_page\": 50,\n \"total\": 1\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns active products with price, stock, input fields, and pagination.\n\nFilters can be combined. Only products linked to active games and categories are returned.\n\n## Parameters\n- `type` (query, optional): voucher or topup.\n- `game` (query, optional): Partial game-name search.\n- `category` (query, optional): Partial category-name search.\n- `game_id` (query, optional): Game ID.\n- `category_id` (query, optional): Category ID.\n- `q` (query, optional): Search by product name.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Current maximum: 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/products", "host": [ "{{base_url}}" ], "path": [ "products" ], "query": [ { "key": "type", "value": "topup", "description": "voucher or topup.", "disabled": true }, { "key": "game", "value": "PUBG", "description": "Partial game-name search.", "disabled": true }, { "key": "category", "value": "Global", "description": "Partial category-name search.", "disabled": true }, { "key": "game_id", "value": "1", "description": "Game ID.", "disabled": true }, { "key": "category_id", "value": "10", "description": "Category ID.", "disabled": true }, { "key": "q", "value": "60 UC", "description": "Search by product name.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Current maximum: 100.", "disabled": true } ] } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"A filter or pagination parameter is invalid.\"\n }\n}" } ] } ] }, { "name": "Validation", "description": "Validation", "item": [ { "name": "POST /validate-player", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"nickname\": \"PlayerOne\",\n \"player_name\": \"PlayerOne\",\n \"region\": \"TR\",\n \"country\": \"TR\",\n \"server\": \"1234\",\n \"nickname_verified\": true,\n \"validation_optional\": false\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"A required body field is missing or invalid.\"\n }\n}" }, { "name": "PRODUCT_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"PRODUCT_NOT_FOUND\",\n \"message\": \"The top-up product was not found or is inactive.\"\n }\n}" }, { "name": "PLAYER_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Validates the player ID and, when required, the server ID.\n\nIf validation is optional, validation_optional=true may be returned and the order can continue.\n\n## Parameters\n- `product_id` (body, required): Top-up product ID.\n- `player_id` (body, required): Player ID.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A required body field is missing or invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The top-up product was not found or is inactive.\n- `PLAYER_NOT_FOUND` HTTP 404: The player could not be validated and validation is required.", "url": { "raw": "{{base_url}}/validate-player", "host": [ "{{base_url}}" ], "path": [ "validate-player" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"PLAYER_NOT_FOUND\",\n \"message\": \"The player could not be validated and validation is required.\"\n }\n}" } ] } ] }, { "name": "Orders", "description": "Orders", "item": [ { "name": "POST /order", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"order_id\": 8821,\n \"order_uuid\": \"a80f63d7-cabb-4e1d-a177-045f6467e7b2\",\n \"client_order_id\": \"order-10001\",\n \"product_id\": 91,\n \"product_name\": \"PUBG Mobile 60 UC\",\n \"product_type\": \"TOPUP\",\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"player_name\": \"PlayerOne\",\n \"region\": \"TR\",\n \"status\": \"PROCESSING\",\n \"price\": \"0.8800\",\n \"currency\": \"USD\",\n \"delivery\": null,\n \"manual_action_required\": false,\n \"delivery_message\": null,\n \"created_at\": \"2026-07-25T13:30:00+04:00\",\n \"completed_at\": null\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"One of the request-body fields is invalid.\"\n }\n}" }, { "name": "PRODUCT_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"PRODUCT_NOT_FOUND\",\n \"message\": \"The product was not found or is inactive.\"\n }\n}" }, { "name": "INVALID_QUANTITY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_QUANTITY\",\n \"message\": \"The quantity exceeds the product or API limit.\"\n }\n}" }, { "name": "PLAYER_ID_REQUIRED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"PLAYER_ID_REQUIRED\",\n \"message\": \"player_id is required for top-up orders.\"\n }\n}" }, { "name": "SERVER_ID_REQUIRED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"SERVER_ID_REQUIRED\",\n \"message\": \"server_id is required for this product.\"\n }\n}" }, { "name": "PLAYER_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"PLAYER_NOT_FOUND\",\n \"message\": \"Required player validation failed.\"\n }\n}" }, { "name": "INSUFFICIENT_FUNDS", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INSUFFICIENT_FUNDS\",\n \"message\": \"The balance is insufficient for this order.\"\n }\n}" }, { "name": "OUT_OF_STOCK", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"OUT_OF_STOCK\",\n \"message\": \"The order could not be created or sent for processing.\"\n }\n}" }, { "name": "IDEMPOTENCY_KEY_REQUIRED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_KEY_REQUIRED\",\n \"message\": \"A stable idempotency key is required for this operation.\"\n }\n}" }, { "name": "IDEMPOTENCY_KEY_INVALID", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_KEY_INVALID\",\n \"message\": \"The idempotency key is invalid or longer than 128 characters.\"\n }\n}" }, { "name": "IDEMPOTENCY_CONFLICT", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_CONFLICT\",\n \"message\": \"The same idempotency key was reused with a different payload.\"\n }\n}" }, { "name": "CLIENT_ORDER_ID_CONFLICT", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"CLIENT_ORDER_ID_CONFLICT\",\n \"message\": \"The same client_order_id is already assigned to another order.\"\n }\n}" }, { "name": "SECURITY_ERROR", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"SECURITY_ERROR\",\n \"message\": \"The callback URL does not meet the security requirements.\"\n }\n}" }, { "name": "ORDER_FAILED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{order_idempotency_key}}", "type": "text", "description": "Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a voucher or top-up order and deducts the amount from the customer balance.\n\nThis endpoint creates a real financial operation. Use X-Idempotency-Key to protect retries. Top-up quantity is always 1.\n\n## Parameters\n- `X-Idempotency-Key` (header, optional): Unique retry key. Required for money-changing operations; on POST /order client_order_id can be used as the fallback key.\n- `product_id` (body, required): Active product ID.\n- `qty` (body, optional): Voucher maximum: 500; top-up maximum: 1.\n- `player_id` (body, optional): Required for top-up products.\n- `server_id` (body, optional): Server or zone ID when required.\n- `input_2...input_8` (body, optional): Additional input_2...input_8 values matching the product fields list.\n- `client_order_id` (body, optional): Your own order reference. If X-Idempotency-Key is omitted on POST /order, this value also becomes the retry key.\n- `callback_url` (body, optional): Secure HTTPS callback URL.\n- `callback_mode` (body, optional): Callback format. Current default: legacy.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: One of the request-body fields is invalid.\n- `PRODUCT_NOT_FOUND` HTTP 404: The product was not found or is inactive.\n- `INVALID_QUANTITY` HTTP 422: The quantity exceeds the product or API limit.\n- `PLAYER_ID_REQUIRED` HTTP 422: player_id is required for top-up orders.\n- `SERVER_ID_REQUIRED` HTTP 422: server_id is required for this product.\n- `PLAYER_NOT_FOUND` HTTP 404: Required player validation failed.\n- `INSUFFICIENT_FUNDS` HTTP 400: The balance is insufficient for this order.\n- `OUT_OF_STOCK` HTTP 409: The order could not be created or sent for processing.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `CLIENT_ORDER_ID_CONFLICT` HTTP 409: The same client_order_id is already assigned to another order.\n- `SECURITY_ERROR` HTTP 400: The callback URL does not meet the security requirements.\n- `ORDER_FAILED` HTTP 409: The order could not be created or sent for processing.", "url": { "raw": "{{base_url}}/order", "host": [ "{{base_url}}" ], "path": [ "order" ] }, "body": { "mode": "raw", "raw": "{\n \"product_id\": 91,\n \"qty\": 1,\n \"player_id\": \"51515969536\",\n \"server_id\": \"1234\",\n \"input_3\": \"CharacterName\",\n \"client_order_id\": \"{{client_order_id}}\",\n \"callback_url\": \"{{callback_url}}\",\n \"callback_mode\": \"{{callback_mode}}\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_FAILED\",\n \"message\": \"The order could not be created or sent for processing.\"\n }\n}" } ] }, { "name": "GET /order/{id}/qr-login/status", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"order_id\": 8821,\n \"order_status\": \"PROCESSING\",\n \"session_status\": \"QR_READY\",\n \"status_label\": \"QR code is ready.\",\n \"has_qr\": true,\n \"qr_version\": 1,\n \"qr_image_url\": \"https://gmx.az/api/v1/order/8821/qr-login/preview?v=1\",\n \"expires_at\": \"2026-08-17T16:30:00+04:00\",\n \"can_mark_scanned\": true,\n \"can_request_new_qr\": true,\n \"can_submit_otp\": false,\n \"is_final\": false\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Get the live QR Login fulfillment state for an owned order.\n\nReturns QR availability, version, worker state, expiry and the actions currently allowed.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/status", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "status" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "GET /order/{id}/qr-login/preview", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "\"Binary image/jpeg response.\"" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Fetch the currently active QR image.\n\nReturns a private JPEG only while the QR is active. Authenticate this request with the same API key. Browser tags cannot attach X-API-KEY, so fetch the image as an authenticated binary/blob request and display the returned object URL.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `v` (query, optional): Optional QR version cache-buster.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/preview", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "preview" ], "query": [ { "key": "v", "value": "1", "description": "Optional QR version cache-buster.", "disabled": true } ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "POST /order/{id}/qr-login/scanned", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"session_status\": \"customer_scanned\",\n \"has_qr\": true\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tell the assigned worker that the customer scanned the active QR.\n\nUse only after the customer actually scans the QR. This does not itself complete the order.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/scanned", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "scanned" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "POST /order/{id}/qr-login/new-qr", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"session_status\": \"awaiting_new_qr\",\n \"has_qr\": false\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Invalidate the current QR and request a replacement.\n\nUse when the displayed QR expired or cannot be scanned.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/new-qr", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "new-qr" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "POST /order/{id}/qr-login/otp", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"session_status\": \"customer_scanned\",\n \"has_qr\": true\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"OTP must contain 4-10 digits.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Send the one-time code requested by the assigned worker.\n\nOTP is accepted only during awaiting_otp and is forwarded to the assigned worker without being stored.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n- `otp` (body, required): 4-10 digit one-time code.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: OTP must contain 4-10 digits.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}/qr-login/otp", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}", "qr-login", "otp" ], "variable": [ { "key": "order_id", "value": "8821" } ] }, "body": { "mode": "raw", "raw": "{\n \"otp\": \"123456\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "GET /order/{id}", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"order_id\": 8821,\n \"order_uuid\": \"a80f63d7-cabb-4e1d-a177-045f6467e7b2\",\n \"client_order_id\": \"order-10001\",\n \"product_id\": 17,\n \"product_name\": \"Steam Wallet 10 USD\",\n \"product_type\": \"VOUCHER\",\n \"qty\": 2,\n \"player_id\": null,\n \"server_id\": null,\n \"player_name\": null,\n \"region\": null,\n \"status\": \"COMPLETED\",\n \"price\": \"19.9800\",\n \"currency\": \"USD\",\n \"delivery\": [\n \"CODE-ONE-XXXX\",\n \"CODE-TWO-XXXX\"\n ],\n \"manual_action_required\": false,\n \"delivery_message\": null,\n \"created_at\": \"2026-07-25T13:30:00+04:00\",\n \"completed_at\": \"2026-07-25T13:31:10+04:00\"\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Finds an order by local ID, UUID, or client_order_id.\n\nReturns the current order status and voucher delivery codes when available.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found or belongs to another API user.", "url": { "raw": "{{base_url}}/order/{{order_id}}", "host": [ "{{base_url}}" ], "path": [ "order", "{{order_id}}" ], "variable": [ { "key": "order_id", "value": "8821" } ] } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found or belongs to another API user.\"\n }\n}" } ] }, { "name": "GET /order-status/{id}", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"order_id\": 8821,\n \"status\": \"COMPLETED\",\n \"delivery\": [\n \"CODE-ONE-XXXX\"\n ],\n \"manual_action_required\": false,\n \"delivery_message\": null\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "ORDER_NOT_FOUND", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "A compatibility alias for /order/{id}.\n\nUse /order/{id} for new integrations. The response and behavior are identical.\n\n## Parameters\n- `id` (path, required): Order ID, order_uuid, or client_order_id.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `ORDER_NOT_FOUND` HTTP 404: The order was not found.", "url": { "raw": "{{base_url}}/order-status/{{id}}", "host": [ "{{base_url}}" ], "path": [ "order-status", "{{id}}" ], "variable": [ { "key": "id", "value": "8821" } ] } }, "status": "Error", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"ORDER_NOT_FOUND\",\n \"message\": \"The order was not found.\"\n }\n}" } ] }, { "name": "GET /orders", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": [\n {\n \"order_id\": 8821,\n \"product_name\": \"Steam Wallet 10 USD\",\n \"product_type\": \"VOUCHER\",\n \"qty\": 1,\n \"status\": \"COMPLETED\",\n \"price\": \"9.9900\",\n \"currency\": \"USD\",\n \"delivery\": [\n \"CODE-ONE-XXXX\"\n ],\n \"manual_action_required\": false,\n \"delivery_message\": null\n }\n ],\n \"meta\": {\n \"current_page\": 1,\n \"last_page\": 1,\n \"per_page\": 50,\n \"total\": 1\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json", "type": "text" } ], "description": "Returns orders for the current API user with filters and pagination.\n\nCustomers can only access their own orders. per_page is limited to 100.\n\n## Parameters\n- `status` (query, optional): Order status.\n- `type` (query, optional): Product type.\n- `page` (query, optional): Page number.\n- `per_page` (query, optional): Page size. Maximum 100.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `VALIDATION_ERROR` HTTP 422: A filter or pagination parameter is invalid.", "url": { "raw": "{{base_url}}/orders", "host": [ "{{base_url}}" ], "path": [ "orders" ], "query": [ { "key": "status", "value": "completed", "description": "Order status.", "disabled": true }, { "key": "type", "value": "voucher", "description": "Product type.", "disabled": true }, { "key": "page", "value": "1", "description": "Page number.", "disabled": true }, { "key": "per_page", "value": "50", "description": "Page size. Maximum 100.", "disabled": true } ] } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"A filter or pagination parameter is invalid.\"\n }\n}" } ] } ] }, { "name": "Redeem check", "description": "Redeem check", "item": [ { "name": "POST /redeem-check", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "name": "Successful response example", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": true,\n \"data\": {\n \"id\": 142,\n \"status\": \"found\",\n \"code_masked\": \"REDE********MPLE\",\n \"charged_amount\": \"0.0500\",\n \"charged_amount_text\": \"$ 0.05\",\n \"balance\": \"1250.4500\",\n \"balance_text\": \"$ 1250.45\",\n \"currency_code\": \"USD\",\n \"currency_symbol\": \"$\",\n \"redemption_time\": \"2026-07-25 13:30:00\",\n \"expiration_time\": null,\n \"amount\": 60,\n \"product_name\": \"PUBG Mobile 60 UC\",\n \"player_id\": \"51515969536\",\n \"player_name\": \"PlayerOne\",\n \"created_at\": \"2026-07-25 13:30:02\"\n },\n \"meta\": {\n \"idempotent_replay\": false\n }\n}" }, { "name": "API_DISABLED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 503, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_DISABLED\",\n \"message\": \"Public API has been disabled by the administrator.\"\n }\n}" }, { "name": "API_KEY_MISSING", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"API_KEY_MISSING\",\n \"message\": \"The X-API-KEY header was not sent.\"\n }\n}" }, { "name": "INVALID_API_KEY", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"INVALID_API_KEY\",\n \"message\": \"The API key is invalid or disabled, or the customer is inactive.\"\n }\n}" }, { "name": "IP_NOT_ALLOWED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IP_NOT_ALLOWED\",\n \"message\": \"The requesting IP address is not allowed.\"\n }\n}" }, { "name": "RATE_LIMIT_EXCEEDED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"RATE_LIMIT_EXCEEDED\",\n \"message\": \"The per-minute request limit has been exceeded.\"\n }\n}" }, { "name": "IDEMPOTENCY_KEY_REQUIRED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_KEY_REQUIRED\",\n \"message\": \"A stable idempotency key is required for this operation.\"\n }\n}" }, { "name": "IDEMPOTENCY_KEY_INVALID", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_KEY_INVALID\",\n \"message\": \"The idempotency key is invalid or longer than 128 characters.\"\n }\n}" }, { "name": "IDEMPOTENCY_CONFLICT", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"IDEMPOTENCY_CONFLICT\",\n \"message\": \"The same idempotency key was reused with a different payload.\"\n }\n}" }, { "name": "VALIDATION_ERROR", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"VALIDATION_ERROR\",\n \"message\": \"The code is missing or has an invalid length.\"\n }\n}" }, { "name": "REDEEM_CHECK_FAILED", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "X-Idempotency-Key", "value": "{{redeem_idempotency_key}}", "type": "text", "description": "Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.", "disabled": false }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Checks the code and charges the amount that matches the result.\n\nThis endpoint creates a real balance operation. A maximum amount can be reserved and the unused portion refunded.\n\n## Parameters\n- `X-Idempotency-Key` (header, required): Required unique retry key. Reusing it with the same code returns the original result without charging or checking upstream again.\n- `code` (body, required): Code to check. 6-160 characters.\n\n## Errors\n- `API_DISABLED` HTTP 503: Public API has been disabled by the administrator.\n- `API_KEY_MISSING` HTTP 401: The X-API-KEY header was not sent.\n- `INVALID_API_KEY` HTTP 401: The API key is invalid or disabled, or the customer is inactive.\n- `IP_NOT_ALLOWED` HTTP 403: The requesting IP address is not allowed.\n- `RATE_LIMIT_EXCEEDED` HTTP 429: The per-minute request limit has been exceeded.\n- `IDEMPOTENCY_KEY_REQUIRED` HTTP 422: A stable idempotency key is required for this operation.\n- `IDEMPOTENCY_KEY_INVALID` HTTP 422: The idempotency key is invalid or longer than 128 characters.\n- `IDEMPOTENCY_CONFLICT` HTTP 409: The same idempotency key was reused with a different payload.\n- `VALIDATION_ERROR` HTTP 422: The code is missing or has an invalid length.\n- `REDEEM_CHECK_FAILED` HTTP 422: The redeem check failed, the service is disabled, or the balance is insufficient.", "url": { "raw": "{{base_url}}/redeem-check", "host": [ "{{base_url}}" ], "path": [ "redeem-check" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"REDEEM-CODE-EXAMPLE\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Error", "code": 422, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": \"REDEEM_CHECK_FAILED\",\n \"message\": \"The redeem check failed, the service is disabled, or the balance is insufficient.\"\n }\n}" } ] } ] }, { "name": "Webhooks", "description": "Webhook receiver examples. Requirements:\n- Only HTTPS URLs are accepted.\n- Only port 443 is accepted.\n- Private, reserved, and localhost addresses are blocked.\n- Credentials in the URL are not accepted.\n- Redirects are not followed.\n- The receiving server must return a 2xx response.\n\nRetry schedule: 1 → 1 minute, 2 → 5 minutes, 3 → 15 minutes, 4-6 → 60 minutes, 7-20 → 6 hours", "item": [ { "name": "Legacy final webhook example", "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "X-EPINBULK-Signature-V2", "value": "sha256=CALCULATED_HMAC_V2", "type": "text", "description": "Recommended: sha256=HMAC_SHA256(timestamp + \".\" + event_id + \".\" + raw_json_body, webhook_secret). Use the timestamp and event-id headers shown above." }, { "key": "X-EPINBULK-Signature-Version", "value": "2", "type": "text", "description": "2" }, { "key": "X-EPINBULK-Signature", "value": "sha256=CALCULATED_HMAC", "type": "text", "description": "sha256=HMAC_SHA256(raw_json_body, webhook_secret)" }, { "key": "X-EPINBULK-Timestamp", "value": "2026-09-27T11:39:13+00:00", "type": "text", "description": "ISO-8601 webhook delivery timestamp. Verify freshness when validating the V2 signature." }, { "key": "X-EPINBULK-Event-Id", "value": "{{$guid}}", "type": "text", "description": "Unique UUID for the callback attempt." }, { "key": "X-EPINBULK-Event", "value": "order.status_changed", "type": "text", "description": "Actual event name: order.status_changed or qr_login.*" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"event_id\": \"47c8c6ba-16a5-4089-9f62-7ae1e51d4c0f\",\n \"order_id\": 8821,\n \"client_order_id\": \"order-10001\",\n \"status\": \"COMPLETED\",\n \"product_name\": \"Steam Wallet 10 USD\",\n \"qty\": 2,\n \"player_id\": null,\n \"player_name\": null,\n \"server_id\": null,\n \"region\": null,\n \"price\": \"19.9800\",\n \"currency\": \"USD\",\n \"delivery\": [\n \"CODE-ONE-XXXX\",\n \"CODE-TWO-XXXX\"\n ],\n \"manual_action_required\": false,\n \"delivery_message\": null,\n \"timestamp\": \"2026-07-25T13:31:10+04:00\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{callback_url}}", "host": [ "{{callback_url}}" ] }, "description": "This request represents a payload sent by the platform to your callback_url. Your receiver must verify the HMAC signature, process event_id idempotently, and return 2xx quickly." }, "response": [] }, { "name": "Events webhook example", "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "X-EPINBULK-Signature-V2", "value": "sha256=CALCULATED_HMAC_V2", "type": "text", "description": "Recommended: sha256=HMAC_SHA256(timestamp + \".\" + event_id + \".\" + raw_json_body, webhook_secret). Use the timestamp and event-id headers shown above." }, { "key": "X-EPINBULK-Signature-Version", "value": "2", "type": "text", "description": "2" }, { "key": "X-EPINBULK-Signature", "value": "sha256=CALCULATED_HMAC", "type": "text", "description": "sha256=HMAC_SHA256(raw_json_body, webhook_secret)" }, { "key": "X-EPINBULK-Timestamp", "value": "2026-09-27T11:39:13+00:00", "type": "text", "description": "ISO-8601 webhook delivery timestamp. Verify freshness when validating the V2 signature." }, { "key": "X-EPINBULK-Event-Id", "value": "{{$guid}}", "type": "text", "description": "Unique UUID for the callback attempt." }, { "key": "X-EPINBULK-Event", "value": "order.status_changed", "type": "text", "description": "Actual event name: order.status_changed or qr_login.*" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"event_id\": \"47c8c6ba-16a5-4089-9f62-7ae1e51d4c0f\",\n \"event\": \"order.status_changed\",\n \"callback_mode\": \"events\",\n \"order_id\": 8821,\n \"client_order_id\": \"order-10001\",\n \"product_id\": 91,\n \"product_name\": \"PUBG Mobile 60 UC\",\n \"product_type\": \"TOPUP\",\n \"game_id\": 1,\n \"game_name\": \"PUBG Mobile\",\n \"player_id\": \"51515969536\",\n \"player_name\": \"PlayerOne\",\n \"server_id\": \"1234\",\n \"region\": \"TR\",\n \"qty\": 1,\n \"price\": \"0.8800\",\n \"currency\": \"USD\",\n \"delivery\": [],\n \"manual_action_required\": false,\n \"delivery_message\": null,\n \"status\": \"COMPLETED\",\n \"message\": \"Order completed successfully.\",\n \"timestamp\": \"2026-07-25T13:30:10+04:00\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{callback_url}}", "host": [ "{{callback_url}}" ] }, "description": "This request represents a payload sent by the platform to your callback_url. Your receiver must verify the HMAC signature, process event_id idempotently, and return 2xx quickly." }, "response": [] } ] } ] }