Collection (Pay-in)

You create an order, the payer completes payment at the returned pay_url, and the platform notifies your callback URL when the order succeeds.

Create POST /pay/create

Business parameters (plus the common parameters):

Field	Required	Description
mch_order_no	Yes	Your order number, unique within your account
product_code	Yes	Collection product code assigned by the platform (e.g. QRPH)
amount	Yes	Amount in the currency's minor unit
currency	Yes	Currency enabled for you (e.g. PHP/THB); not-enabled returns 1001
subject	No	Order title / description
return_url	No	Page to return to after payment
expire_seconds	No	Validity in seconds, default 600
attach	No	Pass-through data echoed back verbatim (string)

Request example (see Signing & Auth for sign):

{
  "merchant_no": "M100001",
  "app_id": "app_10001",
  "key_version": 1,
  "timestamp": 1769990400,
  "nonce": "a1b2c3d4e5f6a1b2",
  "sign_type": "RSA2",
  "mch_order_no": "T20260601001",
  "product_code": "QRPH",
  "amount": 10000,
  "currency": "PHP",
  "subject": "Order 1001",
  "attach": "uid-8821",
  "sign": "BASE64_SIGNATURE"
}

Response data fields:

Field	Description
platform_order_no	Platform order number
mch_order_no	Your order number
pay_url	Hosted payment link (the payer is forwarded upstream from here)
amount / currency	Amount / currency
expire_at	Expiry (Unix seconds)
status	Order status, see Statuses

Response example:

{
  "code": "0",
  "msg": "OK",
  "data": {
    "platform_order_no": "D20260601123456abcd",
    "mch_order_no": "T20260601001",
    "pay_url": "https://{pay-domain}/pay/r/3f9c1a7e54b04d2c",
    "amount": 10000,
    "currency": "PHP",
    "expire_at": 1769991000,
    "status": "CREATED"
  }
}

Query POST /pay/query

Business parameters (plus the common parameters):

Field	Required	Description
mch_order_no	One of two	Your order number
platform_order_no	One of two	Platform order number (wins if both sent; prefer exactly one)

Request example:

{
  "merchant_no": "M100001",
  "app_id": "app_10001",
  "key_version": 1,
  "timestamp": 1769990500,
  "nonce": "b2c3d4e5f6a1b2c3",
  "sign_type": "RSA2",
  "mch_order_no": "T20260601001",
  "sign": "BASE64_SIGNATURE"
}

Response data fields:

Field	Description
platform_order_no	Platform order number
mch_order_no	Your order number
amount / currency	Amount (minor units) / currency
status	Order status, see Statuses
paid_at	Paid time (Unix seconds; present on success)
attach	Pass-through data (present if set)

Response example:

{
  "code": "0",
  "msg": "OK",
  "data": {
    "platform_order_no": "D20260601123456abcd",
    "mch_order_no": "T20260601001",
    "amount": 10000,
    "currency": "PHP",
    "status": "SUCCESS",
    "paid_at": 1769990620,
    "attach": "uid-8821"
  }
}

Async callback

When a collection order succeeds, the platform POSTs to your collection callback URL (Content-Type: application/json).

• The body carries the order result plus common signing fields, signed with the platform private key (sign_type=RSA2).
• key_version in a callback refers to the platform callback key version (not your key version) — verify with the platform public key of that version (same algorithm as signing). Platform keys rotate by version; store them per version.
• Verify first, then process idempotently by platform_order_no; on success respond HTTP 200 with the exact plain text success (lowercase).
• Without success the platform retries with increasing intervals (15s / 1m / 5m / 30m / 2h …). The same order may be notified more than once — be idempotent.
• Reconcile the callback amount against your local order before crediting.

Callback fields:

Field	Description
platform_order_no / mch_order_no	Order numbers
amount / currency	Amount (minor units) / currency
status	SUCCESS
paid_at	Paid time (Unix seconds)
attach	Pass-through data
key_version	Platform callback key version
timestamp / nonce / sign_type / sign	Platform signing fields

Callback example:

{
  "platform_order_no": "D20260601123456abcd",
  "mch_order_no": "T20260601001",
  "amount": 10000,
  "currency": "PHP",
  "status": "SUCCESS",
  "paid_at": 1769990620,
  "attach": "uid-8821",
  "key_version": 1,
  "timestamp": 1769990625,
  "nonce": "f6e5d4c3b2a1f6e5",
  "sign_type": "RSA2",
  "sign": "PLATFORM_SIGN_BASE64"
}

Reply (after successful verification and processing — HTTP 200, body exactly):

success

WARNING

Never process or reply success to a callback that fails verification. See SDKs & Samples for ready-made verification code.