API Reference
Base URL: https://quatapay.com/api/v1
All requests must include Content-Type: application/json. All responses follow the envelope format:
{ "data": { … } }
Error responses:
{ "error": "Validation failed", "code": "VALIDATION_ERROR", "details": { … } }
Authentication
API key (merchant gateway)
Pass your secret API key as a Bearer token:
Authorization: Bearer qpay_live_…
User JWT (checkout flows)
After a user logs in, pass their access token:
Authorization: Bearer eyJ…
Gateway payments
Create a payment intent
POST /gateway/payments
Auth: API key
Body:
Response: 201 Created
{
"data": {
"payment": { "id": "…", "slug": "…", "status": "requested", … },
"checkout_url": "https://quatapay.com/checkout/…"
}
}
Get a payment intent
GET /gateway/payments/{payment_id}
Auth: API key (must be the creating merchant's key)
List payment intents
GET /gateway/payments?status=succeeded&limit=50
Auth: API key
Hosted checkout — preview
GET /gateway/checkout/{slug}
Auth: None (public)
Returns the intent summary for the checkout UI to display.
Hosted checkout — pay
POST /gateway/checkout/{slug}/pay
Auth: User JWT
Body:
Hosted checkout — cancel
POST /gateway/checkout/{slug}/cancel
Auth: None
Payment intent statuses
Idempotency
Supply idempotency_key on mutating requests. Replaying the same key within 24 hours returns the cached response instead of creating a duplicate transaction.
Rate limits
Exceeding limits returns 429 Too Many Requests.