API reference

Payout Payment API

Do you have question? Ask us here

If you want to use or implement our API, please contact us on [email protected].

Production environment

https://app.payout.one

Sandbox environment

https://sandbox.payout.one

Sandbox is for test purposes only.

Authentication

View as Markdown Spec

Bearer

For accessing the API a valid token must be passed in all the queries in the 'Authorization' header. A valid token is obtained from POST /api/v1/authorize with the client_id and client_secret of an API key generated in Admin section of your account. The token is valid for the number of seconds returned in valid_for (6000); after that, request a new one.

The following syntax must be used in the 'Authorization' header :

Code

Bearer <<token>>

So Authorization header can be like:

Code

Authorization: Bearer SFMyNTY.EXAMPLE-TOKEN.dGhpcy1pcy1hLWZha2Utc2lnbmF0dXJlLWV4YW1wbGU

mTLS + QSEAL (M2M Withdrawals)

Withdrawals run on the mTLS hosts api-mtls-sandbox.payout.one and api-mtls.payout.one. Besides the bearer token, they need an approved QWAC for the TLS connection and, for requests that create or cancel, a QSEAL signature in Digest and X-JWS-Signature. See M2M Withdrawals and Certificates.

Errors

View as Markdown Spec

Errors are returned as JSON with an errors key. Its value is either a message or an object (or list of objects) with messages per field. Send Accept: application/json with every request.

401

Code

{
    "errors": "Bad credentials. Check your credentials or contact support."
}

401 - missing, invalid or expired token

Code

{
    "errors": "Unauthorized access. Check your token."
}

429 - after 5 failed POST /api/v1/authorize attempts for the same client_id within 5 minutes; retry after the number of seconds in the Retry-After header

Code

{
    "errors": "Too many failed authentication attempts for this client. Try again in a few minutes."
}

POST

Authorize (receive API token)

View as Markdown Spec

/api/v1/authorize

Exchanges the client_id and client_secret of your API key for a Bearer token. Send the token in the Authorization: Bearer <token> header of all other requests. The token is valid for valid_for seconds.

After 5 failed attempts for the same client_id within 5 minutes, the endpoint responds with 429 and a Retry-After: 300 header.

Request body

client_id requiredstring

API key (client ID) · e.g. 8b0f3c52-6d1e-4a7b-9c2d-5e4f3a2b1c0d

client_secret requiredstring

API key secret · e.g. example-client-secret-not-real

Response 200

tokenstring

Bearer token for the Authorization header · e.g. SFMyNTY.EXAMPLE-TOKEN.dGhpcy1pcy1hLWZha2Utc2lnbmF0dXJlLWV4YW1wbGU

valid_forinteger

Token validity in seconds · e.g. 6000

Other responses

401

Bad credentials (also returned when client_id or client_secret is missing)

429

Too many failed attempts for this client_id

Request

curl -X POST 'https://sandbox.payout.one/api/v1/authorize' \
  -H "Content-Type: application/json" \
  -d '{
       "client_id": "8b0f3c52-6d1e-4a7b-9c2d-5e4f3a2b1c0d",
       "client_secret": "example-client-secret-not-real"
     }'

const res = await fetch("https://sandbox.payout.one/api/v1/authorize", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "client_id": "8b0f3c52-6d1e-4a7b-9c2d-5e4f3a2b1c0d",
    "client_secret": "example-client-secret-not-real"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://sandbox.payout.one/api/v1/authorize",
    json={
        "client_id": "8b0f3c52-6d1e-4a7b-9c2d-5e4f3a2b1c0d",
        "client_secret": "example-client-secret-not-real",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/authorize");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "client_id" => "8b0f3c52-6d1e-4a7b-9c2d-5e4f3a2b1c0d",
  "client_secret" => "example-client-secret-not-real"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "token": "SFMyNTY.EXAMPLE-TOKEN.dGhpcy1pcy1hLWZha2Utc2lnbmF0dXJlLWV4YW1wbGU",
  "valid_for": 6000
}

POST

Create checkout

View as Markdown Spec

/api/v1/checkouts

This request create checkout for payment where customer will authorize payment method for transaction.

To perform an idempotent request, provide an additional Idempotency-Key: <key> header to the request. An idempotency key is a unique value generated by the client which the server uses to recognize subsequent retries of the same request. How you create unique keys is up to you, but we suggest using v4 UUIDs, or another random string with enough entropy to avoid collisions. If a checkout with the same key already exists for your account, it is returned with status 200; if its amount differs, the request fails with 409.

Use mode for pre-authorization with later capture (pre_authorization), storing a card (store_card), payments with a stored card (card_on_file) and recurrent payments (recurrent). These modes must be enabled for your account.

How to create the `signature`

Signature is created by few steps. First step is to create string concatenated with character | by joining arguments in following order:

amount (exactly as sent in the request)
currency
external_id
nonce
client_secret (obtained from merchant's API key)

After this step we should have string that looks like this: amount|currency|external_id|nonce|client_secret

Now, we use SHA256 hashing algorithm to hash this string and encode it using Base16 in lowercase. The signature is now complete and you can send it with the request.

Checkout statuses:

processing - created payment form
requires_capture - additional authorization requested (if some gateway has additional authorization)
succeeded - from checkout created transaction
expired - no transaction has been created. Expires after the checkout expiration time of your account (by default 10 days after creation)

Other statuses the API can return: requires_payment_method, requires_action, requires_authorization, requires_3ds, pisp_processing, awaiting_confirmation, cancelled, failed.

Parameters

Idempotency-Keyheader · string

Unique key of the request, used to recognize retries of the same request · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

Request body

amount requiredinteger

Amount in cents (integer). A numeric string is also accepted. e.g. 1050

currency requiredstring

Currency code by ISO 4217. Currencies not supported by Payout are rejected. max 3 · e.g. EUR

customer requiredobject

Required nested JSON structure with details about customer. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

email requiredstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

external_id requiredstring

Client order's ID or another ID for reference to reason of payment. max 50 · e.g. f0ac316a-9ea6-7998-01a7-720437afb34c

idempotency_keystring

Stored with the checkout and returned in responses. Repeated requests are detected only by the Idempotency-Key header; when the header is sent, its value replaces this field. max 50 · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

metadataobject

Can be used for payment notation or also for internal use, for example set origin of payment if merchant has more systems. e.g. {"source": "eshop"}

nonce requiredstring

Required random data so signature cant be reused · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

redirect_url requiredstring

URL where user will be redirected after payment form is filled. Must be an absolute URL with a scheme and a host. e.g. https://eshop.example.com/payment/redirect

signature requiredstring

Request signature · e.g. 5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52

modestring

Checkout mode. pre_authorization only authorizes the amount on the card, capture it later with the capture endpoint. store_card stores the card and sends its token in the payu_token.created webhook. card_on_file pays with a stored card (requires card_token). recurrent makes a recurrent payment (requires recurrent_token). one of standard, pre_authorization, store_card, card_on_file, recurrent · default standard

recurringboolean

Used with mode store_card. true requires recurrent payments to be enabled for your account. default false

recurrent_tokenstring

Token from the payu_token.created webhook. Required when mode is recurrent.

card_tokenstring

Token of a stored card from the payu_token.created webhook. Required when mode is card_on_file.

payment_methodstring

Identificator of the payment method the customer is sent to directly (for example card, apple_pay, pisp, bank_transfer). If the value is not available for your account, the customer sees all available methods. e.g. card

ibanstring

Customer's IBAN (optional). Must be a valid IBAN. e.g. SK3112000000198742637541

billing_addressobject

Billing address (optional)

name requiredstring

e.g. John Doe

address_line_1 requiredstring

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_code requiredstring

e.g. 81101

city requiredstring

e.g. Bratislava

country_code requiredstring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

shipping_addressobject

Shipping address (optional)

name requiredstring

e.g. John Doe

address_line_1 requiredstring

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_code requiredstring

e.g. 81101

city requiredstring

e.g. Bratislava

country_code requiredstring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

productsobject[]

Ordered products (optional)

name requiredstring

e.g. Product 1

unit_price requiredinteger

Unit price in cents (integer) · e.g. 350

quantity requiredinteger

e.g. 3

datestring<date>

Date of the product or service (optional) · e.g. 2026-10-20

offer_idstring

Offer ID used for transaction splitting (optional) · e.g. PREMIUM

should_splitboolean

Split the payment into one transaction per product offer_id (transaction splitting must be enabled for your account). The sum of unit_price * quantity of all products must equal amount. default false

Response 201

objectstring

Object type · e.g. checkout

idinteger

Checkout ID · e.g. 141447

external_idstring

Client order's ID or another ID for reference to reason of payment. e.g. f0ac316a-9ea6-7998-01a7-720437afb34c

amountinteger

Amount in cents · e.g. 1050

currencystring

Currency code by ISO 4217 · e.g. EUR

redirect_urlstring

URL where user will be redirected after payment form is filled · e.g. https://eshop.example.com/payment/redirect

idempotency_keystring | null

Idempotency key of the request that created the checkout · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

checkout_urlstring

URL of payment form for users order. You should redirect user to this URL. e.g.

https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=R…

metadataobject | null

Can be used for payment notation or also for internal use, for example set origin of payment if merchant has more systems. e.g. {"source": "eshop"}

statusstring

State of checkout, for more information check Checkout statuses · one of processing, requires_payment_method, requires_action, requires_authorization, requires_capture, requires_3ds, pisp_processing, awaiting_confirmation, succeeded, expired, cancelled, failed · e.g. processing

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

signaturestring

Response signature · e.g. 5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52

paymentobject

Most recent payment or bank transfer (a successful one is preferred), null if there is none. See Section with Payment Attributes

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

State of payment, for more information check Payment statuses and Bank transfer statuses · one of pending, in_transit, successful, failed, expired, refunded, partialy_refunded · e.g. successful

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

all_paymentsobject[]

All payments and bank transfers of the checkout

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

billing_addressobject

Billing address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

shipping_addressobject

Shipping address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

productsobject[]

Ordered products, null if not sent

namestring

e.g. Product 1

quantityinteger

e.g. 3

unit_priceinteger

Unit price in cents · e.g. 350

payment_tokenstring

Token used to complete the payment with Payout JS (for example Apple Pay) · e.g. U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl

is_status_finalboolean

Whether the checkout has reached a final state and will no longer change. Always true for succeeded checkouts. e.g. false

Other responses

400

Validation failed (invalid signature, customer, currency, redirect URL, mode, products, or unsupported checkout mode)

401

Missing or invalid bearer token

403

Invalid recurrent_token or card_token

409

A checkout with the same Idempotency-Key but a different amount already exists

Request

curl -X POST 'https://sandbox.payout.one/api/v1/checkouts' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "amount": 1050,
       "currency": "EUR",
       "customer": {
         "first_name": "John",
         "last_name": "Doe",
         "email": "[email protected]"
       },
       "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
       "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
       "metadata": {
         "note": "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been."
       },
       "redirect_url": "https://eshop.example.com/payment/redirect",
       "signature": "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52"
     }'

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "amount": 1050,
    "currency": "EUR",
    "customer": {
      "first_name": "John",
      "last_name": "Doe",
      "email": "[email protected]"
    },
    "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
    "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
    "metadata": {
      "note": "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been."
    },
    "redirect_url": "https://eshop.example.com/payment/redirect",
    "signature": "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://sandbox.payout.one/api/v1/checkouts",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "amount": 1050,
        "currency": "EUR",
        "customer": {
            "first_name": "John",
            "last_name": "Doe",
            "email": "[email protected]",
        },
        "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
        "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
        "metadata": {
            "note": "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been.",
        },
        "redirect_url": "https://eshop.example.com/payment/redirect",
        "signature": "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "amount" => 1050,
  "currency" => "EUR",
  "customer" => [
    "first_name" => "John",
    "last_name" => "Doe",
    "email" => "[email protected]"
  ],
  "external_id" => "f0ac316a-9ea6-7998-01a7-720437afb34c",
  "nonce" => "ZUc0Mk9sVXZDOXNsdklzMQ",
  "metadata" => [
    "note" => "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been."
  ],
  "redirect_url" => "https://eshop.example.com/payment/redirect",
  "signature" => "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 201

{
  "object": "checkout",
  "id": 141447,
  "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
  "amount": 1050,
  "currency": "EUR",
  "redirect_url": "https://eshop.example.com/payment/redirect",
  "idempotency_key": "31f0ac6a-9ea6-01a7-7998-720437afb34c",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": null,
    "note": null
  },
  "checkout_url": "https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=RVhBTVBMRS1BQ0NPVU5ULVRPS0VOLTAwMDAwMDAwMDA",
  "metadata": {
    "note": "Lorem Ipsum is simply dummy text of the printing and typesetting industry."
  },
  "status": "processing",
  "nonce": "WWdVaGk4d3ZqeHFOTjM4Qw",
  "signature": "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52",
  "payment": null,
  "all_payments": [],
  "billing_address": null,
  "shipping_address": null,
  "products": null,
  "payment_token": "U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl",
  "is_status_final": false
}

GET

List checkouts

View as Markdown Spec

/api/v1/checkouts

You can use this request to retrieve list of checkouts. The newest checkouts are returned first.

Parameters

limitquery · integer

Maximum number of checkouts to return · default 10

offsetquery · integer

Number of checkouts to skip · default 0

Response 200 (array)

objectstring

Object type · e.g. checkout

idinteger

Checkout ID · e.g. 141447

external_idstring

Client order's ID or another ID for reference to reason of payment. e.g. f0ac316a-9ea6-7998-01a7-720437afb34c

amountinteger

Amount in cents · e.g. 1050

currencystring

Currency code by ISO 4217 · e.g. EUR

redirect_urlstring

URL where user will be redirected after payment form is filled · e.g. https://eshop.example.com/payment/redirect

idempotency_keystring | null

Idempotency key of the request that created the checkout · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

checkout_urlstring

URL of payment form for users order. You should redirect user to this URL. e.g.

https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=R…

metadataobject | null

Can be used for payment notation or also for internal use, for example set origin of payment if merchant has more systems. e.g. {"source": "eshop"}

statusstring

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

signaturestring

Response signature · e.g. 5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52

paymentobject

Most recent payment or bank transfer (a successful one is preferred), null if there is none. See Section with Payment Attributes

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

all_paymentsobject[]

All payments and bank transfers of the checkout

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

billing_addressobject

Billing address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

shipping_addressobject

Shipping address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

productsobject[]

Ordered products, null if not sent

namestring

e.g. Product 1

quantityinteger

e.g. 3

unit_priceinteger

Unit price in cents · e.g. 350

payment_tokenstring

Token used to complete the payment with Payout JS (for example Apple Pay) · e.g. U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl

is_status_finalboolean

Whether the checkout has reached a final state and will no longer change. Always true for succeeded checkouts. e.g. false

Other responses

401

Missing or invalid bearer token

Request

curl -X GET 'https://sandbox.payout.one/api/v1/checkouts' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/checkouts",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

[
  {
    "object": "checkout",
    "id": 141447,
    "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
    "amount": 1050,
    "currency": "EUR",
    "redirect_url": "https://eshop.example.com/payment/redirect",
    "idempotency_key": "31f0ac6a-9ea6-01a7-7998-720437afb34c",
    "customer": {
      "first_name": "John",
      "last_name": "Doe",
      "name": "John Doe",
      "email": "[email protected]",
      "phone": "+421900000000"
    },
    "checkout_url": "https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=RVhBTVBMRS1BQ0NPVU5ULVRPS0VOLTAwMDAwMDAwMDA",
    "metadata": {
      "source": "eshop"
    },
    "status": "processing",
    "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
    "signature": "5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52",
    "payment": {
      "object": "payment",
      "status": "successful",
      "payment_method": "card",
      "failure_reason": "",
      "created_at": 1759744800,
      "funds": "available",
      "fee": 30,
      "net": 1020,
      "iban": "CZ6508000000192000145399",
      "account_details": {
        "name": "<encrypted>"
      },
      "customer": {
        "iban": "<encrypted>"
      }
    },
    "all_payments": [
      {
        "object": "payment",
        "status": "successful",
        "payment_method": "card",
        "failure_reason": "",
        "created_at": 1759744800,
        "funds": "available",
        "fee": 30,
        "net": 1020,
        "iban": "CZ6508000000192000145399",
        "account_details": {
          "name": "<encrypted>"
        },
        "customer": {
          "iban": "<encrypted>"
        }
      }
    ],
    "billing_address": {
      "name": "John Doe",
      "address_line_1": "Main Street 1",
      "address_line_2": "Flat 2",
      "postal_code": "81101",
      "city": "Bratislava",
      "country_code": "SK"
    },
    "shipping_address": {
      "name": "John Doe",
      "address_line_1": "Main Street 1",
      "address_line_2": "Flat 2",
      "postal_code": "81101",
      "city": "Bratislava",
      "country_code": "SK"
    },
    "products": [
      {
        "name": "Product 1",
        "quantity": 3,
        "unit_price": 350
      }
    ],
    "payment_token": "U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl",
    "is_status_final": false
  }
]

GET

Retrieve checkout

View as Markdown Spec

/api/v1/checkouts/{checkout_id}

You can use this request to retrieve information about specified checkout.

How to verify the `signature`

Signature is created by few steps. First step is to create string concatenated with character | by joining arguments in following order:

amount
currency
external_id
nonce
client_secret (obtained from merchant's API key)

After this step we should have string that looks like this: amount|currency|external_id|nonce|client_secret

Now, we use SHA256 hashing algorithm to hash this string and encode it using Base16 in lowercase. Compare the result with signature from the response.

Checkout statuses:

processing - created payment form
requires_capture - additional authorization requested (if some gateway has additional authorization)
succeeded - from checkout created transaction
expired - no transaction has been created. Expires after the checkout expiration time of your account (by default 10 days after creation)

Other statuses the API can return: requires_payment_method, requires_action, requires_authorization, requires_3ds, pisp_processing, awaiting_confirmation, cancelled, failed.

Payment statuses:

pending - this status should not create because the payment card is verified online
successful - confirmation from acquirer that the transaction was successful
failed - confirmation from acquirer that the transaction was failed
refunded - transaction refund (automatically via API)
partialy_refunded - part of the payment was refunded

Bank transfer statuses:

in_transit - created bank transfer
successful - after reconciliation of the bank statement. (automatic matching)
refunded - transaction refund (manually via IS Payout)
partialy_refunded - part of the transfer was refunded
failed, expired

Funds statuses:

pending - processed transaction, payment affecting pending balance
available - processed transaction, payment affecting available balance
onhold, canceled

Parameters

checkout_id requiredpath · integer

Checkout ID · e.g. 141447

Response 200

objectstring

Object type · e.g. checkout

idinteger

Checkout ID · e.g. 141447

external_idstring

Client order's ID or another ID for reference to reason of payment. e.g. f0ac316a-9ea6-7998-01a7-720437afb34c

amountinteger

Amount in cents · e.g. 1050

currencystring

Currency code by ISO 4217 · e.g. EUR

redirect_urlstring

URL where user will be redirected after payment form is filled · e.g. https://eshop.example.com/payment/redirect

idempotency_keystring | null

Idempotency key of the request that created the checkout · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

checkout_urlstring

URL of payment form for users order. You should redirect user to this URL. e.g.

https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=R…

metadataobject | null

Can be used for payment notation or also for internal use, for example set origin of payment if merchant has more systems. e.g. {"source": "eshop"}

statusstring

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

signaturestring

Response signature · e.g. 5a940ff7f1698f5d334527951519c84fa104c77ecf6691936093835bcac14d52

paymentobject

Most recent payment or bank transfer (a successful one is preferred), null if there is none. See Section with Payment Attributes

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

all_paymentsobject[]

All payments and bank transfers of the checkout

objectstring

Object type · one of payment, bank_transfer · e.g. payment

statusstring

payment_methodstring

Payment method identificator · e.g. card

failure_reasonstring

Payment failure reason (currently always an empty string) · e.g. ""

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

fundsstring

State of funds, for more information check Funds statuses · one of pending, available, onhold, canceled · e.g. available

feeinteger

Fee amount in cents · e.g. 30

netinteger

Net is what remains after subtracting all fees (in cents) · e.g. 1020

ibanstring | null

Payer IBAN from the bank statement. Only in bank_transfer objects. e.g. CZ6508000000192000145399

account_detailsobject

Only for bank payments when payer name encryption is enabled for your account. name is encrypted with your API key (see the Checkout verification webhook guide).

namestring

e.g. <encrypted>

customerobject

Only for bank payments when payer IBAN encryption is enabled for your account. iban is encrypted with your API key.

ibanstring

e.g. <encrypted>

billing_addressobject

Billing address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

shipping_addressobject

Shipping address, null if not sent

namestring

e.g. John Doe

address_line_1string

e.g. Main Street 1

address_line_2string

e.g. Flat 2

postal_codestring

e.g. 81101

citystring

e.g. Bratislava

country_codestring

Country code by ISO 3166-1 alpha-2 · max 2 · e.g. SK

productsobject[]

Ordered products, null if not sent

namestring

e.g. Product 1

quantityinteger

e.g. 3

unit_priceinteger

Unit price in cents · e.g. 350

payment_tokenstring

Token used to complete the payment with Payout JS (for example Apple Pay) · e.g. U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl

is_status_finalboolean

Whether the checkout has reached a final state and will no longer change. Always true for succeeded checkouts. e.g. false

Other responses

401

Missing or invalid bearer token

403

The checkout belongs to another account

404

Checkout not found

Request

curl -X GET 'https://sandbox.payout.one/api/v1/checkouts/{checkout_id}' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts/{checkout_id}", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "object": "checkout",
  "id": 141447,
  "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
  "amount": 1050,
  "currency": "EUR",
  "redirect_url": "https://eshop.example.com/payment/redirect",
  "idempotency_key": "31f0ac6a-9ea6-01a7-7998-720437afb34c",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": null,
    "note": null
  },
  "checkout_url": "https://sandbox.payout.one/checkouts/U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl/?account_id=RVhBTVBMRS1BQ0NPVU5ULVRPS0VOLTAwMDAwMDAwMDA",
  "metadata": {
    "note": "Lorem Ipsum is simply dummy text of the printing and typesetting industry."
  },
  "status": "succeeded",
  "nonce": "OVkzUFBFcFM0QnhzQmR4Uw",
  "signature": "ceea2fdac8d191a5bc49f54447f2ab2d187c74bd5c75c544c7e176b34b0d4fbf",
  "payment": {
    "object": "payment",
    "status": "successful",
    "payment_method": "card",
    "failure_reason": "",
    "created_at": 1759744800,
    "funds": "available",
    "fee": 30,
    "net": 1020
  },
  "all_payments": [
    {
      "object": "payment",
      "status": "successful",
      "payment_method": "card",
      "failure_reason": "",
      "created_at": 1759744800,
      "funds": "available",
      "fee": 30,
      "net": 1020
    }
  ],
  "billing_address": null,
  "shipping_address": null,
  "products": null,
  "payment_token": "U0ZNeU5UWS5FWEFNUExFLUNIRUNLT1VULVRPS0VOLm5vdC1hLXJlYWwtc2lnbmF0dXJl",
  "is_status_final": true
}

DELETE

Cancel pre-authorized checkout

View as Markdown Spec

/api/v1/checkouts/{checkout_id}

Cancels a checkout created with mode pre_authorization, for example if a product or service is not delivered. Only checkouts for which the checkout.captured webhook was not triggered can be cancelled.

On success the checkout status changes to failed and a checkout.canceled webhook is sent.

Parameters

checkout_id requiredpath · integer

Checkout ID · e.g. 141447

Responses

200

Pre-authorization cancelled

400

The checkout was not created with mode pre_authorization

401

Missing or invalid bearer token

403

The checkout belongs to another account

404

Checkout not found

422

The acquirer refused the cancellation

Request

curl -X DELETE 'https://sandbox.payout.one/api/v1/checkouts/{checkout_id}' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts/{checkout_id}", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.delete(
    "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

"pre-auth canceled"

POST

Capture pre-authorized checkout

View as Markdown Spec

/api/v1/checkouts/{checkout_id}/capture

In the case of card payments, it is possible to authorize a certain order amount (checkout created with mode pre_authorization) and capture full or only a portion of the funds deposited. This feature needs to be enabled for your account.

Send an empty body to capture the whole pre-authorized amount, or amount for a partial capture. After successful capture of funds the checkout.captured webhook is sent.

Parameters

checkout_id requiredpath · integer

Checkout ID · e.g. 141447

Request body

amountinteger

Amount to capture in cents. It must not be larger than the checkout amount. A numeric string is also accepted. Omit it to capture the whole amount. e.g. 150

Responses

200

Captured

400

amount is larger than the checkout amount

401

Missing or invalid bearer token

403

The checkout belongs to another account

404

Checkout not found

422

The acquirer refused the capture

Request

curl -X POST 'https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/capture' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "amount": 150
     }'

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/capture", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "amount": 150
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/capture",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "amount": 150,
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/capture");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "amount" => 150
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

"captured"

GET

Payment instructions (manual bank transfer)

View as Markdown Spec

/api/v1/checkouts/{checkout_id}/payment_instructions

Retrieves the data your customer needs to pay a checkout manually via bank transfer — recipient name, IBAN, local account number (CZ/SK), variable symbol, amount, currency and a ready-to-render QR code. No email is sent by this endpoint; it is intended for cases where you want to render the instructions in your own UI.

Bank transfer must be enabled for your account in the checkout's currency. The QR code is cached, so repeated calls for the same checkout return the same image and are safe to retry.

Parameters

checkout_id requiredpath · integer

Checkout ID · e.g. 141447

Response 200

recipient_namestring

Name of the beneficiary the customer should send the money to · e.g. Payout a.s.

ibanstring

Beneficiary IBAN in international format · e.g. SK3112000000198742637541

account_numberstring | null

Beneficiary account in local format (prefix-account/bank_code). Filled for Czech (CZ) and Slovak (SK) IBANs, otherwise null. e.g. 000019-8742637541/1200

variable_symbolstring

Variable symbol the customer must include in the transfer. It binds the incoming payment to the checkout. e.g. 1000123411

amountstring

Total amount to transfer, decimal string (not in cents) · e.g. 10.5000

currencystring

Currency code by ISO 4217 · e.g. EUR

qr_codestring

Base64-encoded PNG of the payment QR code · e.g. iVBORw0KGgoAAAANSUhEUgAAAX8AAAHBCAYAAACBh...

Other responses

401

Missing or invalid bearer token

403

The checkout belongs to another account

404

Checkout not found

409

Bank transfer is not enabled for your account in the checkout currency

410

The checkout has expired

422

No beneficiary bank account is available for the checkout currency

500

The QR code could not be generated; the request is safe to repeat

Request

curl -X GET 'https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/payment_instructions' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/payment_instructions", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/payment_instructions",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/checkouts/{checkout_id}/payment_instructions");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "recipient_name": "Payout a.s.",
  "iban": "SK3112000000198742637541",
  "account_number": "000019-8742637541/1200",
  "variable_symbol": "1000123411",
  "amount": "10.5000",
  "currency": "EUR",
  "qr_code": "iVBORw0KGgoAAAANSUhEUgAAAX8AAAHBCAYAAACBh..."
}

POST

Create withdrawal

View as Markdown Spec

/api/v2/withdrawals

Sends money from your Payout balance to the given IBAN.

Call it on the mTLS host with an approved QWAC, and sign the request with your QSEAL certificate: Digest is the SHA-256 of the exact request body, X-JWS-Signature a detached JWS over that Digest value. How to obtain and import the certificates and how to build the signature is described in M2M Withdrawals and Certificates.

To perform an idempotent request, provide an additional Idempotency-Key: <key> header. If a withdrawal with the same key already exists for your account, it is returned instead of creating a new one.

Withdrawal statuses:

pending - manualy created withdrawal
in_transit - process withdrawal
paid - processed withdrawal
canceled - cancelled withdrawal
failed - failed withdrawal

Parameters

Idempotency-Keyheader · string

Unique key of the request, used to recognize retries of the same request · e.g. 31f0ac6a-9ea6-01a7-7998-720437afb34c

Digest requiredheader · string

SHA-256= followed by the Base64 SHA-256 of the exact request body (of an empty body when there is none) · e.g. SHA-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=

X-JWS-Signature requiredheader · string

Detached JWS (<protected header>..<signature>) over the Digest value, made with your QSEAL key. The protected header carries x5t#S256 (QSEAL thumbprint) and sigT (signing time, at most 5 minutes off). e.g. eyJhbGciOiJQUzI1NiIsIng1dCNTMjU2IjoiLi4uIn0..c2lnbmF0dXJl

Request body

amount requiredinteger

A positive number representing how much to send in the smallest currency unit (e.g. 100 cents to withdraw 1.00€). A numeric string is also accepted. e.g. 1050

currency requiredstring

Three-letter ISO currency code, in uppercase. e.g. EUR

iban requiredstring

IBAN of the bank account, where the amount will be sent. e.g. SK3112000000198742637541

customer requiredobject

Object containing customer's information.

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

email requiredstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

external_idstring

Identificator from your system, returned with the withdrawal. e.g. PAYOUT-2026-0001

statement_descriptorstring

Description that will appear on customer's statement. Only letters without accents, digits, spaces and the characters /-?:().,'+ are allowed. max 140 · e.g. Simple statement description

Response 201

idinteger

Withdrawal ID · e.g. 52331

objectstring

Object type · e.g. withdrawal

amountinteger

Amount in cents · e.g. 1050

api_key_idinteger

API key ID · e.g. 42

currencystring

Currency code by ISO 4217 · e.g. EUR

external_idstring

Identificator from your system. e.g. PAYOUT-2026-0001

ibanstring

IBAN · e.g. SK3112000000198742637541

idempotency_keystring | null

Value of the Idempotency-Key header of the request that created the withdrawal · e.g. 7c9e6679-7425-40de-944b-e07fc1f90ae7

statusstring

State of withdrawal, for more information check Withdrawal statuses · one of pending, in_transit, paid, canceled, failed · e.g. pending

metadataobject

Additional data about the withdrawal · e.g. {}

statement_descriptorstring | null

Description that will appear on customer's statement · e.g. Simple statement description

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

signaturestring

Response signature · e.g. cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9

Other responses

400

iban missing, insufficient or zero balance, or invalid or not allowed currency

401

Missing or invalid bearer token

403

No approved QWAC presented in the TLS handshake, or the certificate belongs to another account; for signed requests also a missing, invalid or not approved QSEAL signature, a Digest that does not match the body, or sigT more than 5 minutes off

404

Not the mTLS host (empty response)

422

Validation failed (customer, statement descriptor, blocked IBAN, balance) or the withdrawal is not allowed

Request

BODY='{
  "amount": 1050,
  "currency": "EUR",
  "external_id": "PAYOUT-2026-0001",
  "iban": "SK3112000000198742637541",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "email": "[email protected]"
  },
  "statement_descriptor": "Simple statement description"
}'
DIGEST="SHA-256=$(printf %s "$BODY" | openssl dgst -sha256 -binary | base64)"
JWS_SIGNATURE="<detached JWS over $DIGEST>"  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

curl -X POST 'https://api-mtls-sandbox.payout.one/api/v2/withdrawals' \
  --cert qwac.pem --key qwac.key \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Digest: $DIGEST" \
  -H "X-JWS-Signature: $JWS_SIGNATURE" \
  -d "$BODY"

import { readFileSync } from "node:fs";
import { createHash } from "node:crypto";
import { Agent } from "undici";

const dispatcher = new Agent({ connect: { cert: readFileSync("qwac.pem"), key: readFileSync("qwac.key") } });
const body = JSON.stringify({
  "amount": 1050,
  "currency": "EUR",
  "external_id": "PAYOUT-2026-0001",
  "iban": "SK3112000000198742637541",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "email": "[email protected]"
  },
  "statement_descriptor": "Simple statement description"
});
const digest = "SHA-256=" + createHash("sha256").update(body).digest("base64");
const jwsSignature = signDetachedJws(digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

const res = await fetch("https://api-mtls-sandbox.payout.one/api/v2/withdrawals", {
  method: "POST",
  dispatcher,
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
    Digest: digest,
    "X-JWS-Signature": jwsSignature,
  },
  body,
});
const data = await res.json();

import base64, hashlib, json, os, requests

body = json.dumps({
    "amount": 1050,
    "currency": "EUR",
    "external_id": "PAYOUT-2026-0001",
    "iban": "SK3112000000198742637541",
    "customer": {
        "first_name": "John",
        "last_name": "Doe",
        "email": "[email protected]",
    },
    "statement_descriptor": "Simple statement description",
})
digest = "SHA-256=" + base64.b64encode(hashlib.sha256(body.encode()).digest()).decode()
jws_signature = sign_detached_jws(digest)  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

res = requests.post(
    "https://api-mtls-sandbox.payout.one/api/v2/withdrawals",
    cert=("qwac.pem", "qwac.key"),
    headers={
        "Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}",
        "Content-Type": "application/json",
        "Digest": digest,
        "X-JWS-Signature": jws_signature,
    },
    data=body,
)
data = res.json()

<?php
$body = json_encode([
  "amount" => 1050,
  "currency" => "EUR",
  "external_id" => "PAYOUT-2026-0001",
  "iban" => "SK3112000000198742637541",
  "customer" => [
    "first_name" => "John",
    "last_name" => "Doe",
    "email" => "[email protected]"
  ],
  "statement_descriptor" => "Simple statement description"
]);
$digest = "SHA-256=" . base64_encode(hash("sha256", $body, true));
$jwsSignature = sign_detached_jws($digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-mtls-sandbox.payout.one/api/v2/withdrawals");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_SSLCERT, "qwac.pem");
curl_setopt($ch, CURLOPT_SSLKEY, "qwac.key");
curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json", "Digest: " . $digest, "X-JWS-Signature: " . $jwsSignature]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 201

{
  "id": 52331,
  "object": "withdrawal",
  "amount": 1050,
  "api_key_id": 42,
  "currency": "EUR",
  "external_id": "PAYOUT-2026-0001",
  "iban": "SK3112000000198742637541",
  "idempotency_key": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "status": "pending",
  "metadata": {},
  "statement_descriptor": "Simple statement description",
  "created_at": 1759744800,
  "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": "+421900000000"
  },
  "signature": "cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9"
}

GET

List withdrawals

View as Markdown Spec

/api/v2/withdrawals

Lists the withdrawals of your account. Read-only requests need the bearer token and the QWAC, no QSEAL signature.

Parameters

limitquery · integer

Maximum number of withdrawals to return

offsetquery · integer

Number of withdrawals to skip

orderquery · string

Sort order by withdrawal ID · one of ASC, DESC · default DESC

Response 200 (array)

idinteger

Withdrawal ID · e.g. 52331

objectstring

Object type · e.g. withdrawal

amountinteger

Amount in cents · e.g. 1050

api_key_idinteger

API key ID · e.g. 42

currencystring

Currency code by ISO 4217 · e.g. EUR

external_idstring

Identificator from your system. e.g. PAYOUT-2026-0001

ibanstring

IBAN · e.g. SK3112000000198742637541

idempotency_keystring | null

Value of the Idempotency-Key header of the request that created the withdrawal · e.g. 7c9e6679-7425-40de-944b-e07fc1f90ae7

statusstring

State of withdrawal, for more information check Withdrawal statuses · one of pending, in_transit, paid, canceled, failed · e.g. pending

metadataobject

Additional data about the withdrawal · e.g. {}

statement_descriptorstring | null

Description that will appear on customer's statement · e.g. Simple statement description

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

signaturestring

Response signature · e.g. cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9

Other responses

401

Missing or invalid bearer token

403

No approved QWAC presented in the TLS handshake, or the certificate belongs to another account

404

Not the mTLS host (empty response)

Request

curl -X GET 'https://api-mtls-sandbox.payout.one/api/v2/withdrawals' \
  --cert qwac.pem --key qwac.key \
  -H "Authorization: Bearer $TOKEN"

import { readFileSync } from "node:fs";
import { Agent } from "undici";

const dispatcher = new Agent({ connect: { cert: readFileSync("qwac.pem"), key: readFileSync("qwac.key") } });

const res = await fetch("https://api-mtls-sandbox.payout.one/api/v2/withdrawals", {
  method: "GET",
  dispatcher,
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://api-mtls-sandbox.payout.one/api/v2/withdrawals",
    cert=("qwac.pem", "qwac.key"),
    headers={
        "Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-mtls-sandbox.payout.one/api/v2/withdrawals");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_SSLCERT, "qwac.pem");
curl_setopt($ch, CURLOPT_SSLKEY, "qwac.key");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

[
  {
    "id": 52331,
    "object": "withdrawal",
    "amount": 1050,
    "api_key_id": 42,
    "currency": "EUR",
    "external_id": "PAYOUT-2026-0001",
    "iban": "SK3112000000198742637541",
    "idempotency_key": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "status": "pending",
    "metadata": {},
    "statement_descriptor": "Simple statement description",
    "created_at": 1759744800,
    "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
    "customer": {
      "first_name": "John",
      "last_name": "Doe",
      "name": "John Doe",
      "email": "[email protected]",
      "phone": "+421900000000"
    },
    "signature": "cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9"
  }
]

GET

Retrieve withdrawal

View as Markdown Spec

/api/v2/withdrawals/{withdrawal_id}

Returns one withdrawal of your account. Read-only requests need the bearer token and the QWAC, no QSEAL signature.

How to verify the `signature`

The response carries a signature you can check. Join these values with |:

amount
currency
external_id
iban
nonce
client_secret (obtained from merchant's API key)

Now, we use SHA256 hashing algorithm to hash this string and encode it using Base16 in lowercase. Compare the result with signature from the response.

Withdrawal statuses:

pending - manualy created withdrawal
in_transit - process withdrawal
paid - processed withdrawal
canceled - cancelled withdrawal
failed - failed withdrawal

Parameters

withdrawal_id requiredpath · integer

Withdrawal ID · e.g. 52331

Response 200

idinteger

Withdrawal ID · e.g. 52331

objectstring

Object type · e.g. withdrawal

amountinteger

Amount in cents · e.g. 1050

api_key_idinteger

API key ID · e.g. 42

currencystring

Currency code by ISO 4217 · e.g. EUR

external_idstring

Identificator from your system. e.g. PAYOUT-2026-0001

ibanstring

IBAN · e.g. SK3112000000198742637541

idempotency_keystring | null

Value of the Idempotency-Key header of the request that created the withdrawal · e.g. 7c9e6679-7425-40de-944b-e07fc1f90ae7

statusstring

State of withdrawal, for more information check Withdrawal statuses · one of pending, in_transit, paid, canceled, failed · e.g. pending

metadataobject

Additional data about the withdrawal · e.g. {}

statement_descriptorstring | null

Description that will appear on customer's statement · e.g. Simple statement description

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

signaturestring

Response signature · e.g. cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9

Other responses

401

Missing or invalid bearer token

403

No approved QWAC presented in the TLS handshake, or the certificate belongs to another account; or the withdrawal belongs to another account

404

Withdrawal not found, or not the mTLS host

Request

curl -X GET 'https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}' \
  --cert qwac.pem --key qwac.key \
  -H "Authorization: Bearer $TOKEN"

import { readFileSync } from "node:fs";
import { Agent } from "undici";

const dispatcher = new Agent({ connect: { cert: readFileSync("qwac.pem"), key: readFileSync("qwac.key") } });

const res = await fetch("https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}", {
  method: "GET",
  dispatcher,
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}",
    cert=("qwac.pem", "qwac.key"),
    headers={
        "Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_SSLCERT, "qwac.pem");
curl_setopt($ch, CURLOPT_SSLKEY, "qwac.key");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "id": 52331,
  "object": "withdrawal",
  "amount": 1050,
  "api_key_id": 42,
  "currency": "EUR",
  "external_id": "PAYOUT-2026-0001",
  "iban": "SK3112000000198742637541",
  "idempotency_key": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "status": "pending",
  "metadata": {},
  "statement_descriptor": "Simple statement description",
  "created_at": 1759744800,
  "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": "+421900000000"
  },
  "signature": "cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9"
}

POST

Cancel withdrawal

View as Markdown Spec

/api/v2/withdrawals/{withdrawal_id}/cancel

Cancels a withdrawal that has not been processed yet. Signed with QSEAL like Create withdrawal; the request has no body, so Digest is the SHA-256 of an empty body.

On success the response is the cancelled withdrawal. When it can no longer be cancelled, the response is {"allowed": false, "status": "<current status>"}, also with status 200. Use Check cancel allowed first if you need to know in advance.

Parameters

withdrawal_id requiredpath · integer

Withdrawal ID · e.g. 52331

Digest requiredheader · string

SHA-256= followed by the Base64 SHA-256 of the exact request body (of an empty body when there is none) · e.g. SHA-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=

X-JWS-Signature requiredheader · string

Response 200

idinteger

Withdrawal ID · e.g. 52331

objectstring

Object type · e.g. withdrawal

amountinteger

Amount in cents · e.g. 1050

api_key_idinteger

API key ID · e.g. 42

currencystring

Currency code by ISO 4217 · e.g. EUR

external_idstring

Identificator from your system. e.g. PAYOUT-2026-0001

ibanstring

IBAN · e.g. SK3112000000198742637541

idempotency_keystring | null

Value of the Idempotency-Key header of the request that created the withdrawal · e.g. 7c9e6679-7425-40de-944b-e07fc1f90ae7

statusstring

State of withdrawal, for more information check Withdrawal statuses · one of pending, in_transit, paid, canceled, failed · e.g. pending

metadataobject

Additional data about the withdrawal · e.g. {}

statement_descriptorstring | null

Description that will appear on customer's statement · e.g. Simple statement description

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

noncestring

Random data used in the response signature · e.g. ZUc0Mk9sVXZDOXNsdklzMQ

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

signaturestring

Response signature · e.g. cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9

Other responses

401

Missing or invalid bearer token

403

404

Withdrawal not found, or not the mTLS host

Request

BODY=''
DIGEST="SHA-256=$(printf %s "$BODY" | openssl dgst -sha256 -binary | base64)"
JWS_SIGNATURE="<detached JWS over $DIGEST>"  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

curl -X POST 'https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel' \
  --cert qwac.pem --key qwac.key \
  -H "Authorization: Bearer $TOKEN" \
  -H "Digest: $DIGEST" \
  -H "X-JWS-Signature: $JWS_SIGNATURE"

import { readFileSync } from "node:fs";
import { createHash } from "node:crypto";
import { Agent } from "undici";

const dispatcher = new Agent({ connect: { cert: readFileSync("qwac.pem"), key: readFileSync("qwac.key") } });
const body = "";
const digest = "SHA-256=" + createHash("sha256").update(body).digest("base64");
const jwsSignature = signDetachedJws(digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

const res = await fetch("https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel", {
  method: "POST",
  dispatcher,
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    Digest: digest,
    "X-JWS-Signature": jwsSignature,
  },
});
const data = await res.json();

import base64, hashlib, os, requests

body = ""
digest = "SHA-256=" + base64.b64encode(hashlib.sha256(body.encode()).digest()).decode()
jws_signature = sign_detached_jws(digest)  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

res = requests.post(
    "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel",
    cert=("qwac.pem", "qwac.key"),
    headers={
        "Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}",
        "Digest": digest,
        "X-JWS-Signature": jws_signature,
    },
)
data = res.json()

<?php
$body = "";
$digest = "SHA-256=" . base64_encode(hash("sha256", $body, true));
$jwsSignature = sign_detached_jws($digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_SSLCERT, "qwac.pem");
curl_setopt($ch, CURLOPT_SSLKEY, "qwac.key");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Digest: " . $digest, "X-JWS-Signature: " . $jwsSignature]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "id": 52331,
  "object": "withdrawal",
  "amount": 1050,
  "api_key_id": 42,
  "currency": "EUR",
  "external_id": "PAYOUT-2026-0001",
  "iban": "SK3112000000198742637541",
  "idempotency_key": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "status": "pending",
  "metadata": {},
  "statement_descriptor": "Simple statement description",
  "created_at": 1759744800,
  "nonce": "ZUc0Mk9sVXZDOXNsdklzMQ",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": "+421900000000"
  },
  "signature": "cee91937a98c89ea53440e84d367713ba6d196cbd0bf639f15f2f9c05b4762e9"
}

POST

Check cancel allowed

View as Markdown Spec

/api/v2/withdrawals/{withdrawal_id}/cancel_allowed

Tells whether the withdrawal can still be cancelled. It is a POST and is signed with QSEAL like Cancel withdrawal (empty body).

Parameters

withdrawal_id requiredpath · integer

Withdrawal ID · e.g. 52331

Digest requiredheader · string

SHA-256= followed by the Base64 SHA-256 of the exact request body (of an empty body when there is none) · e.g. SHA-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=

X-JWS-Signature requiredheader · string

Response 200

allowedboolean

Whether Cancel withdrawal would succeed now · e.g. true

Other responses

401

Missing or invalid bearer token

403

404

Withdrawal not found, or not the mTLS host

Request

BODY=''
DIGEST="SHA-256=$(printf %s "$BODY" | openssl dgst -sha256 -binary | base64)"
JWS_SIGNATURE="<detached JWS over $DIGEST>"  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

curl -X POST 'https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel_allowed' \
  --cert qwac.pem --key qwac.key \
  -H "Authorization: Bearer $TOKEN" \
  -H "Digest: $DIGEST" \
  -H "X-JWS-Signature: $JWS_SIGNATURE"

import { readFileSync } from "node:fs";
import { createHash } from "node:crypto";
import { Agent } from "undici";

const dispatcher = new Agent({ connect: { cert: readFileSync("qwac.pem"), key: readFileSync("qwac.key") } });
const body = "";
const digest = "SHA-256=" + createHash("sha256").update(body).digest("base64");
const jwsSignature = signDetachedJws(digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

const res = await fetch("https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel_allowed", {
  method: "POST",
  dispatcher,
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    Digest: digest,
    "X-JWS-Signature": jwsSignature,
  },
});
const data = await res.json();

import base64, hashlib, os, requests

body = ""
digest = "SHA-256=" + base64.b64encode(hashlib.sha256(body.encode()).digest()).decode()
jws_signature = sign_detached_jws(digest)  # QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

res = requests.post(
    "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel_allowed",
    cert=("qwac.pem", "qwac.key"),
    headers={
        "Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}",
        "Digest": digest,
        "X-JWS-Signature": jws_signature,
    },
)
data = res.json()

<?php
$body = "";
$digest = "SHA-256=" . base64_encode(hash("sha256", $body, true));
$jwsSignature = sign_detached_jws($digest); // QSEAL key, see M2M Withdrawals: Signing payment instructions with QSEAL

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-mtls-sandbox.payout.one/api/v2/withdrawals/{withdrawal_id}/cancel_allowed");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_SSLCERT, "qwac.pem");
curl_setopt($ch, CURLOPT_SSLKEY, "qwac.key");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Digest: " . $digest, "X-JWS-Signature: " . $jwsSignature]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "allowed": true
}

POST

Refund payment

View as Markdown Spec

/api/v1/refunds

You can initiate refund process with this request. This marks given payment identified by checkout_id as refunded and creates a refund to the original customer.

Send amount for a partial refund; without it, the whole remaining amount is refunded. Depending on the payment method, only a full refund may be possible. For checkouts created with should_split: true, offer_id is required and selects the split transaction to refund.

How to create the `signature`

Signature is created by few steps. First step is to create string concatenated with character | by joining arguments in following order:

amount (as sent in the request; if you omit amount, the checkout amount in cents)
currency (of the checkout)
external_id (of the checkout)
iban (as sent in the request; empty if omitted)
nonce
client_secret (obtained from merchant's API key)

Now, we use SHA256 hashing algorithm to hash this string and encode it using Base16 in lowercase. The signature is now complete and you can send it with the request.

Refund statuses:

pending - manualy created refund
in_transit - process refund
paid - processed refund
canceled - cancelled refund
failed - failed refund

Request body

checkout_id requiredinteger

An ID of Checkout received from webhook, after it's been successfuly paid or after you retrieve successful Checkout object · e.g. 141447

amountinteger

Amount to refund in cents (optional). Without it, the whole remaining amount is refunded. e.g. 500

ibanstring

Customer's IBAN (optional). It is part of the signature. e.g. SK3112000000198742637541

statement_descriptorstring

Description which will appear on customer's statement (optional). Only letters without accents, digits, spaces and the characters /-?:().,'+ are allowed. max 140 · e.g. Refund for order 1001

offer_idstring

Offer ID of the split transaction to refund. Required for checkouts created with should_split: true. e.g. PREMIUM

nonce requiredstring

Random alpha-numeric string, which will be used when creating signature. Max. 64 characters. e.g. cnd0aXJ0cnVuZXg

signature requiredstring

Hash containing vital information about the refund, that will confirm authenticity of the request. Please refer to section below, if you want to know how to create this signature. e.g. 2804703f1e9f40f709ac42c691eefddf207e0c16ffa16b9666cdd850d9565d75

Response 200

idinteger

Refund ID · e.g. 52332

objectstring

Object type · e.g. refund

amountinteger

Refunded amount in cents · e.g. 500

currencystring

Currency code by ISO 4217 · e.g. EUR

external_idstring

external_id of the refunded checkout · e.g. f0ac316a-9ea6-7998-01a7-720437afb34c

idempotency_keystring | null

e.g. null

customerobject

Customer details. See Section with Customer attributes

first_namestring

Customer first name · max 255 · e.g. John

last_namestring

Customer surname · max 255 · e.g. Doe

namestring

Customer full name. Can be sent instead of first_name and last_name; responses always contain it. e.g. John Doe

emailstring

Customer email · max 255 · e.g. [email protected]

phonestring | null

Customer phone number (optional). Characters other than digits and + are removed. e.g. +421900000000

notestring | null

Note about the customer (optional) · e.g. null

statusstring

State of refund, for more information check Refund statuses · e.g. pending

metadataobject

e.g. {}

statement_descriptorstring | null

Description which will appear on customer's statement · e.g. Refund for order 1001

created_atinteger

Timestamp (Unix time in seconds) · e.g. 1759744800

noncestring

Random data used in the response signature · e.g. QjJqWEtiVDBNSmMyTm11dg

signaturestring

Response signature · e.g. f0269fef27c86d64f58276b75d169e9f65625fd1ae4f76f2e13db48a492cd4d4

Other responses

400

The payment cannot be refunded (not paid yet, already refunded, balance not available yet, refund not available, amount too large, missing offer_id or checkout_id)

401

Missing or invalid bearer token

403

Invalid signature, please check How to create the signature

404

Checkout not found

422

The refund could not be created (for example, no split transaction for the given offer_id)

Request

curl -X POST 'https://sandbox.payout.one/api/v1/refunds' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "checkout_id": 141447,
       "amount": 500,
       "iban": "SK3112000000198742637541",
       "statement_descriptor": "Refund for order 1001",
       "offer_id": "PREMIUM",
       "nonce": "cnd0aXJ0cnVuZXg",
       "signature": "2804703f1e9f40f709ac42c691eefddf207e0c16ffa16b9666cdd850d9565d75"
     }'

const res = await fetch("https://sandbox.payout.one/api/v1/refunds", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "checkout_id": 141447,
    "amount": 500,
    "iban": "SK3112000000198742637541",
    "statement_descriptor": "Refund for order 1001",
    "offer_id": "PREMIUM",
    "nonce": "cnd0aXJ0cnVuZXg",
    "signature": "2804703f1e9f40f709ac42c691eefddf207e0c16ffa16b9666cdd850d9565d75"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://sandbox.payout.one/api/v1/refunds",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "checkout_id": 141447,
        "amount": 500,
        "iban": "SK3112000000198742637541",
        "statement_descriptor": "Refund for order 1001",
        "offer_id": "PREMIUM",
        "nonce": "cnd0aXJ0cnVuZXg",
        "signature": "2804703f1e9f40f709ac42c691eefddf207e0c16ffa16b9666cdd850d9565d75",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/refunds");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "checkout_id" => 141447,
  "amount" => 500,
  "iban" => "SK3112000000198742637541",
  "statement_descriptor" => "Refund for order 1001",
  "offer_id" => "PREMIUM",
  "nonce" => "cnd0aXJ0cnVuZXg",
  "signature" => "2804703f1e9f40f709ac42c691eefddf207e0c16ffa16b9666cdd850d9565d75"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "id": 52332,
  "object": "refund",
  "amount": 500,
  "currency": "EUR",
  "external_id": "f0ac316a-9ea6-7998-01a7-720437afb34c",
  "customer": {
    "first_name": "John",
    "last_name": "Doe",
    "name": "John Doe",
    "email": "[email protected]",
    "phone": "+421900000000"
  },
  "status": "pending",
  "metadata": {},
  "statement_descriptor": "Refund for order 1001",
  "created_at": 1759744800,
  "nonce": "QjJqWEtiVDBNSmMyTm11dg",
  "signature": "f0269fef27c86d64f58276b75d169e9f65625fd1ae4f76f2e13db48a492cd4d4"
}

GET

List payment methods

View as Markdown Spec

/api/v1/payment_methods

You can use this request to retrieve list of payment methods enabled for your account. The identificator can be used as payment_method when creating a checkout.

Response 200 (array)

namestring

Payment method name · e.g. Card Payment

identificatorstring

Payment method identificator · e.g. card

fixed_feeinteger

Fixed fee in cents · e.g. 20

percentual_feenumber

Percentual fee · e.g. 1.5

Other responses

401

Missing or invalid bearer token

Request

curl -X GET 'https://sandbox.payout.one/api/v1/payment_methods' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/payment_methods", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/payment_methods",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/payment_methods");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

[
  {
    "name": "Card Payment",
    "identificator": "card",
    "fixed_fee": 20,
    "percentual_fee": 1.5
  },
  {
    "name": "Bank transfer",
    "identificator": "bank_transfer",
    "fixed_fee": 10,
    "percentual_fee": 0.0
  }
]

GET

Balance of current account

View as Markdown Spec

/api/v1/balance

Retrieves balance of current account. Keep in mind, that every API key belongs to a specific account.

Response 200 (array)

availableinteger

Available balance in cents · e.g. 1567243

pendinginteger

Pending balance in cents · e.g. 14768

currencystring

Currency code by ISO 4217 · e.g. EUR

Other responses

401

Missing or invalid bearer token

Request

curl -X GET 'https://sandbox.payout.one/api/v1/balance' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/balance", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/balance",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/balance");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

[
  {
    "available": 25500,
    "currency": "USD",
    "pending": 0
  },
  {
    "available": 1567243,
    "currency": "EUR",
    "pending": 14768
  }
]

POST

Import mTLS certificate

View as Markdown Spec

/api/v1/mtls/certificates

Imports a QWAC or QSEAL certificate used by the server-to-server APIs (for example M2M withdrawals). Upload the PEM-encoded certificate — the public part only, never the private key. The certificate must be issued by a QTSP in Payout's trust store.

The certificate starts in status pending; Payout verifies it manually and changes the status to approved (or rejected). See the mTLS client certificates guide.

Request body

type requiredstring

Certificate profile · one of qwac, qseal · e.g. qwac

pem requiredstring

PEM-encoded certificate · e.g.

-----BEGIN CERTIFICATE-----
MIIF...
-----END CERTIFICATE-----

Response 201

thumbprintstring

SHA-256 fingerprint of the certificate (lowercase hex) · e.g. 103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57

typestring

one of qwac, qseal · e.g. qwac

statusstring

one of pending, approved, rejected · e.g. pending

issuer_dnstring

Issuer distinguished name · e.g. C=SK,O=Example QTSP,CN=Example Qualified CA

subject_dnstring

Subject distinguished name · e.g. C=SK,O=Example s.r.o.,organizationIdentifier=NTRSK-12345678,CN=Example s.r.o.

subject_org_idstring | null

Value of the organizationIdentifier subject attribute · e.g. NTRSK-12345678

valid_fromstring<date-time>

e.g. 2026-06-09T06:23:06Z

valid_untilstring<date-time>

e.g. 2027-06-09T06:23:06Z

rejection_reasonstring | null

e.g. null

validated_atstring<date-time> | null

When Payout approved or rejected the certificate · e.g. null

Other responses

401

Missing or invalid bearer token

409

A certificate with the same thumbprint is already imported

422

Malformed PEM, untrusted issuer, or missing or invalid type / pem

Request

curl -X POST 'https://sandbox.payout.one/api/v1/mtls/certificates' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "type": "qwac",
       "pem": "-----BEGIN CERTIFICATE-----\nMIIF...\n-----END CERTIFICATE-----\n"
     }'

const res = await fetch("https://sandbox.payout.one/api/v1/mtls/certificates", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "type": "qwac",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIF...\n-----END CERTIFICATE-----\n"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://sandbox.payout.one/api/v1/mtls/certificates",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "type": "qwac",
        "pem": "-----BEGIN CERTIFICATE-----\nMIIF...\n-----END CERTIFICATE-----\n",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/mtls/certificates");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "type" => "qwac",
  "pem" => "-----BEGIN CERTIFICATE-----\nMIIF...\n-----END CERTIFICATE-----\n"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 201

{
  "thumbprint": "103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57",
  "type": "qwac",
  "status": "pending",
  "issuer_dn": "C=SK,O=Example QTSP,CN=Example Qualified CA",
  "subject_dn": "C=SK,O=Example s.r.o.,organizationIdentifier=NTRSK-12345678,CN=Example s.r.o.",
  "subject_org_id": "NTRSK-12345678",
  "valid_from": "2026-06-09T06:23:06Z",
  "valid_until": "2027-06-09T06:23:06Z"
}

GET

List mTLS certificates

View as Markdown Spec

/api/v1/mtls/certificates

Lists the certificates imported for your account, newest first.

Response 200

dataobject[]

thumbprintstring

SHA-256 fingerprint of the certificate (lowercase hex) · e.g. 103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57

typestring

one of qwac, qseal · e.g. qwac

statusstring

one of pending, approved, rejected · e.g. approved

subject_dnstring

Subject distinguished name · e.g. C=SK,O=Example s.r.o.,organizationIdentifier=NTRSK-12345678,CN=Example s.r.o.

valid_untilstring<date-time>

e.g. 2027-06-09T06:23:06Z

Other responses

401

Missing or invalid bearer token

Request

curl -X GET 'https://sandbox.payout.one/api/v1/mtls/certificates' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/mtls/certificates", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/mtls/certificates",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/mtls/certificates");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "data": [
    {
      "thumbprint": "103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57",
      "type": "qwac",
      "status": "approved",
      "subject_dn": "C=SK,O=Example s.r.o.,organizationIdentifier=NTRSK-12345678,CN=Example s.r.o.",
      "valid_until": "2027-06-09T06:23:06Z"
    }
  ]
}

GET

Certificate approval status

View as Markdown Spec

/api/v1/mtls/certificates/{thumbprint}/status

Returns the approval status of one of your certificates. After approval the status changes to approved and the certificate becomes usable.

Parameters

thumbprint requiredpath · string

SHA-256 fingerprint of the certificate (lowercase hex), as returned on import · e.g. 103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57

Response 200

thumbprintstring

SHA-256 fingerprint of the certificate (lowercase hex) · e.g. 103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57

statusstring

one of pending, approved, rejected · e.g. pending

rejection_reasonstring | null

Reason of rejection, if the certificate was rejected · e.g. null

Other responses

401

Missing or invalid bearer token

404

Certificate not found (or not owned by your account)

Request

curl -X GET 'https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}/status' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}/status", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}/status",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}/status");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "thumbprint": "103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57",
  "status": "pending"
}

DELETE

Remove mTLS certificate

View as Markdown Spec

/api/v1/mtls/certificates/{thumbprint}

Removes one of your certificates.

Parameters

thumbprint requiredpath · string

SHA-256 fingerprint of the certificate (lowercase hex), as returned on import · e.g. 103a697b2fddcad32f63b842fbe48dd47eaf70340edb6df2e6677c7b70889a57

Responses

204

Certificate removed

401

Missing or invalid bearer token

404

Certificate not found (or not owned by your account)

Request

curl -X DELETE 'https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.delete(
    "https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://sandbox.payout.one/api/v1/mtls/certificates/{thumbprint}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Was this page helpful?

Need help? Contact support.
Questions? Contact sales.
Service status? status.payout.one.
LLM? Read llms.txt.

Payout Payment API

Production environment

Sandbox environment

Authentication

Errors

Authorize (receive API token)

Request body

Response 200

Other responses

Create checkout

How to create the signature

Checkout statuses:

Parameters

Request body

Response 201

Other responses

List checkouts

Parameters

Response 200 (array)

Other responses

Retrieve checkout

How to verify the signature

Checkout statuses:

Payment statuses:

Bank transfer statuses:

Funds statuses:

Parameters

Response 200

Other responses

Cancel pre-authorized checkout

Parameters

Responses

Capture pre-authorized checkout

Parameters

Request body

Responses

Payment instructions (manual bank transfer)

Parameters

Response 200

Other responses

Create withdrawal

Withdrawal statuses:

Parameters

Request body

Response 201

Other responses

List withdrawals

Parameters

Response 200 (array)

Other responses

Retrieve withdrawal

How to verify the signature

Withdrawal statuses:

Parameters

Response 200

Other responses

Cancel withdrawal

Parameters

Response 200

Other responses

Check cancel allowed

Parameters

Response 200

Other responses

Refund payment

How to create the signature

Refund statuses:

Request body

Response 200

Other responses

List payment methods

Response 200 (array)

Other responses

Balance of current account

Response 200 (array)

Other responses

Import mTLS certificate

Request body

Response 201

Other responses

How to create the `signature`

How to verify the `signature`

How to verify the `signature`

How to create the `signature`