Endpoints
| Method | Endpoint | Description | Rate Limit |
|---|---|---|---|
| GET | /v1/direct-debit/scenario-code/list | Get supported scenario codes | 200 req/min |
| POST | /v1/direct-debit | Create a new contract | 100 req/min |
| GET | /v1/direct-debit/list | List contracts | 100 req/min |
| GET | /v1/direct-debit/:id | Get contract details | 100 req/min |
| POST | /v1/direct-debit/:id/sync | Query/sync contract status | 50 req/min |
| POST | /v1/direct-debit/:id/terminate | Terminate a contract | 50 req/min |
| POST | /v1/direct-debit/:id/payment | Execute payment against contract | 100 req/min |
Get Scenario Codes
Retrieves a list of supported scenario codes for direct debit contracts. Use these IDs when creating a contract. Scenarios define the type of service and transaction limits.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
provider | string | No | Filter by payment provider: BINANCE_PAY, BYBIT_PAY, KUCOIN_PAY |
active | string | No | Filter by active status (true/false, default: true) |
Example Request
Example Response
Error Responses
| Status | Description |
|---|---|
| 401 | Unauthorized - invalid HMAC signature |
| 429 | Too many requests - rate limit exceeded |
Create Contract
Creates a pre-authorization contract that users can sign to enable on-demand payments. Supports multiple payment providers (currently: BINANCE_PAY). Returns QR code and deep link for user approval.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
provider | string | Yes | Payment provider: BINANCE_PAY |
merchantContractCode | string | No | Unique merchant contract code (alphanumeric, max 32 chars). Auto-generated if not provided |
branchId | string (UUID) | No | Branch ID to associate this contract with |
serviceName | string | Yes | Service name displayed to user (max 32 chars) |
scenarioId | string (UUID) | Yes | Scenario ID from scenario-code/list endpoint |
currency | string | Yes | Contract currency: USDT (crypto) or LKR (fiat) |
singleUpperLimit | number | Yes | Maximum amount per transaction in the specified currency (min 0.01) |
slippageBps | number | No | Slippage buffer in basis points for LKR contracts (0-20000 bps = 0-200%). Not allowed for USDT. Default: 0. Example: 10000 bps = 100% |
webhookUrl | string | No | Webhook URL for contract events |
returnUrl | string (URL) | Yes | URL to redirect user after successful contract signing (max 512 chars) |
cancelUrl | string (URL) | Yes | URL to redirect user after contract signing cancellation (max 512 chars) |
Example Request (USDT Contract)
Example Request (LKR Contract with Slippage)
Example Response (USDT Contract)
Example Response (LKR Contract)
singleUpperLimitshows the USDT amount sent to Binance (after currency conversion + slippage buffer)singleUpperLimitLkrshows the original LKR amount specifiedslippageBpsshows the slippage buffer applied (10000 bps = 100%)- In this example: 33000 LKR ÷ 330 (exchange rate) = 100 USDT, with 100% slippage = 200 USDT total limit
Error Responses
| Status | Description |
|---|---|
| 400 | Bad request - invalid contract data, slippage not allowed for USDT, or missing exchange rate for LKR |
| 401 | Unauthorized - invalid HMAC signature |
| 403 | Forbidden - merchant not authorized |
| 429 | Too many requests - rate limit exceeded |
List Contracts
Retrieves a paginated list of contracts for the authenticated merchant. Supports filtering by status, branch, currency, payment provider, and search.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
page | number | No | Page number (default: 1) |
limit | number | No | Items per page (default: 20, max: 100) |
status | string | No | Filter by status: INITIATED, SIGNED, TERMINATED, EXPIRED |
branchId | string (UUID) | No | Filter by branch ID |
currency | string | No | Filter by currency: USDT, LKR |
paymentProvider | string | No | Filter by provider: BINANCE_PAY, BYBIT_PAY, KUCOIN_PAY |
search | string | No | Search by merchant contract code or service name |
Example Request
Example Response
Error Responses
| Status | Description |
|---|---|
| 401 | Unauthorized - invalid HMAC signature |
| 429 | Too many requests - rate limit exceeded |
Get Contract Details
Retrieves contract details by ID. Only returns contracts belonging to the authenticated merchant.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
id | string (UUID) | Yes | Contract ID |
Example Request
Example Response
Error Responses
| Status | Description |
|---|---|
| 401 | Unauthorized - invalid HMAC signature |
| 403 | Forbidden - contract does not belong to merchant |
| 404 | Contract not found |
| 429 | Too many requests - rate limit exceeded |
Query/Sync Contract Status
Queries the payment provider for the latest contract status and syncs it to the database. Use this to check if a user has signed the contract.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
id | string (UUID) | Yes | Contract ID |
Request Body
Empty object{}
Example Request
Example Response
Error Responses
| Status | Description |
|---|---|
| 401 | Unauthorized - invalid HMAC signature |
| 404 | Contract not found |
| 429 | Too many requests - rate limit exceeded |
Terminate Contract
Terminates a signed Direct Debit contract. Only contracts inSIGNED status can be terminated.
Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
id | string (UUID) | Yes | Contract ID |
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
terminationNotes | string | No | Optional notes about contract termination (max 256 chars) |
Example Request
Example Response
Error Responses
| Status | Description |
|---|---|
| 400 | Bad request - contract not in SIGNED status |
| 401 | Unauthorized - invalid HMAC signature |
| 404 | Contract not found |
| 429 | Too many requests - rate limit exceeded |
Execute Payment
Executes an on-demand payment against a signed Direct Debit contract. Amount must not exceed the contract’s single upper limit.Authentication
Requires HMAC authentication with headers:x-api-key: Your API key ID only (e.g.,ak_live_xxx)x-timestamp: Current Unix timestamp in millisecondsx-signature: HMAC-SHA256 signature (using derived signing key)
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
id | string (UUID) | Yes | Contract ID |
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
currency | string | Yes | Payment currency: USDT or LKR (can differ from contract currency) |
amount | number | Yes | Payment amount in the specified currency (min 0.01). Must not exceed contract’s buffered limit after conversion |
productName | string | Yes | Product name (max 256 chars) |
productDetail | string | No | Product detail (max 256 chars) |
goods | array | No | Array of goods items (see structure below) |
webhookUrl | string | No | Webhook URL to override contract webhook |
customerBilling | object | No | Customer billing information (see structure below) |
Goods Item Structure
| Field | Type | Required | Description |
|---|---|---|---|
goodsType | string | Yes | Goods type (01: Tangible goods, 02: Virtual goods) |
goodsCategory | string | Yes | Goods category code (e.g., Z000) |
referenceGoodsId | string | Yes | Reference goods ID |
goodsName | string | Yes | Goods name (max 256 chars) |
goodsDetail | string | No | Goods detail description (max 256 chars) |
Customer Billing Structure
| Field | Type | Required | Description |
|---|---|---|---|
firstName | string | Yes | Customer first name |
lastName | string | Yes | Customer last name |
email | string | Yes | Customer email |
phone | string | No | Customer phone |
address | string | No | Customer address |
Example Request (USDT Payment)
Example Request (LKR Payment)
Example Response
Response Notes
- Direct debit payments do not include
qrContentorcheckoutLinkfields as the payment is charged directly without user interaction - Payment starts in
INITIATEDstatus and transitions toPAIDvia webhook notification - In sandbox mode, payments are automatically marked as
PAID
Error Responses
| Status | Description |
|---|---|
| 400 | Bad request - contract not signed, expired, amount exceeds limit after currency conversion, or exchange rate unavailable |
| 401 | Unauthorized - invalid HMAC signature |
| 404 | Contract not found |
| 429 | Too many requests - rate limit exceeded |
Currency & Slippage
Currency Support
Direct Debit contracts support two currencies:| Currency | Type | Description |
|---|---|---|
USDT | Crypto | Tether stablecoin on blockchain |
LKR | Fiat | Sri Lankan Rupee |
Cross-Currency Payments
You can execute payments in either USDT or LKR regardless of the contract’s currency:- USDT contract → Can accept both USDT and LKR payments
- LKR contract → Can accept both LKR and USDT payments
Slippage Protection for LKR Contracts
When creating an LKR contract, exchange rates may fluctuate between contract creation and payment execution. Slippage protection adds a buffer to handle these fluctuations. Example:- 0 bps = 0% (no buffer)
- 5000 bps = 50%
- 10000 bps = 100%
- 20000 bps = 200% (maximum)
- Slippage only applies to LKR contracts
- USDT contracts do not use slippage (rejected if provided)
- Slippage defaults to 0 if not specified for LKR contracts
- Maximum allowed slippage is 20000 bps (200%)
Payment Validation
When executing a payment:- Currency conversion: Payment amount is converted to USDT using current exchange rate
- Limit validation: Converted USDT amount must not exceed contract’s
singleUpperLimit(which includes slippage buffer for LKR contracts) - Error handling: If payment exceeds limit, request is rejected with clear error message showing the conversion
Contract Status Reference
Direct Debit contracts have the following lifecycle statuses:| Status | Description |
|---|---|
INITIATED | Contract created but not yet signed by user |
SIGNED | User has signed the contract (ready for payments) |
TERMINATED | Contract has been terminated |
EXPIRED | Contract has expired |
Webhooks
SetwebhookUrl in your contract creation request to receive real-time contract and payment status updates.
See Webhooks Guide for payload format, signature verification, and retry policy.
Error Responses
| Status | Error | Description |
|---|---|---|
| 400 | Bad Request | Invalid request body or validation error |
| 401 | Unauthorized | Invalid API key or signature |
| 403 | Forbidden | Contract belongs to another merchant |
| 404 | Not Found | Contract not found |
| 429 | Too Many Requests | Rate limit exceeded |
Related Documentation
- Quick Start - Getting started guide
- Authentication - HMAC signature details
- Webhooks - Receive payment notifications
- Rate Limits - API rate limiting
- Errors - Error codes reference