API reference

The AQ Pay API is REST over HTTPS with JSON bodies. Resources are consistent across every connected provider; provider-specific details appear in a route object rather than in the shape of the resource. This reference describes the v1 contract; a machine-readable OpenAPI document will be published alongside the sandbox.

Authentication

Server calls use a secret key in the Authorization: Bearer header. Browser-side tokenization uses a publishable key that can only create tokens. Keys are scoped to one environment and one tenant.

{{ k.p }}

Conventions

{{ c.k }}{{ c.v }}

Error model

Errors return a stable type and code. Provider decline codes are normalised into a shared taxonomy and the raw provider code is preserved for support.

{ "error": {
    "type": "card_declined",
    "code": "insufficient_funds",
    "retryable": false,
    "provider": { "id": "acquirer_a", "raw_code": "51" },
    "request_id": "req_…" } }

{{ e.m }}{{ e.p }}{{ e.d }}

Key fields

{{ f.n }}{{ f.ty }}{{ f.d }}

Webhooks

Events are signed with an HMAC-SHA256 over timestamp.body using your endpoint secret, delivered at least once, and retried with exponential backoff for 24 hours until your endpoint returns 2xx. Reject signatures older than five minutes to prevent replay.

{{ ev.t }}

Need sandbox access?

Sandbox tenants are issued after a short call so we can configure simulated providers for your use case.

Request sandbox access

Authentication

Conventions

Error model

{{ r.t }}

Webhooks