Docs · API Reference
Endpoints, request bodies, responses, and errors.
The ArosaPay API is REST + JSON with bearer auth. All resources speak the same transaction identity model.
Resources
POST /v1/transactions — create a protected transaction. GET /v1/transactions/:id — fetch state and identifiers.
POST /v1/payment_links — generate a share-safe protected checkout link.
POST /v1/transactions/:id/confirm — buyer-side confirmation. Applies release.
POST /v1/disputes — open a dispute against a transaction. GET /v1/disputes/:id — read state and evidence.
POST /v1/refunds — refund a released or partially released transaction, per the merchant agreement.
GET /v1/payouts — list payouts. GET /v1/payouts/:id — read a single payout with its transaction lines.
Errors
Every error returns { error: { code, message, request_id } }. Log the request_id when reporting issues.
invalid_request, authentication_failed, permission_denied, not_found, conflict, rate_limited, internal_error.
Rate limits
60 requests per minute per API key by default. Contact support for higher limits.
Retry-After header indicates the seconds to wait. Back off and retry.
Idempotency
Attach merchant_reference on create.
Reposting the same merchant_reference returns the existing transaction. Never double-create.
SDK reference