Endpoints
| Environment | Base URL |
|---|---|
| Sandbox (test keys) | https://api.sandbox.quatapay.com |
| Production (live keys) | https://api.quatapay.com |
Versioning
All endpoints are prefixed with /api/v1. We bump the version only on breaking changes; additive changes (new fields, new endpoints) happen in place. Deprecations get six months of notice on the changelog.
What differs in sandbox
- Wallets are pre-funded — fund/drain via the sandbox panel.
- No real money moves. Withdrawals settle to a simulated bank account.
- Webhooks fire on the same events as production, but you can replay them on demand.
TLS and IP allow-listing
We only accept TLS 1.2+ and reject HTTP. There is no IP allow-list on outbound calls to us — but you can pin our webhook source IPs (see the Webhooks doc for the current range).