Skip to main content

ISV Transaction API

Overview

This API set is designed for ISV customers to call on behalf of their end customers (merchants) after completing Onboarding. It covers transfers, payment declarations, Payout, bank account management, and other daily transaction operations. ISVs simply pass walletId when calling these APIs. OristaPay automatically enforces authorization based on the ISV ↔ merchant relationship. Transaction API fields remain unchanged.

Authentication & Signing

All endpoints require signature headers. See Authentication & Signing for details.

API Index

Wallet Payment API

1. Static Receiving Address Query

Interface Overview Query the Request Payment static receiving address of a specified wallet. Request Parameters Response Parameters StaticAddressData fields: Request Example
Response Example

2. Supported Currencies Query

Interface Overview Query the currencies, available networks, single-transaction amount range, and currency precision supported by the wallet under a specified business type by walletId + type. The caller can use this API for pre-validation before creating deposit or withdrawal orders, to avoid submitting unsupported or out-of-limit currency combinations. Request Parameters Response Parameters SupportedCurrenciesQueryData fields: Request Example
Response Example

3. Request Payment Order Declaration

Interface Overview Submit a Request Payment deposit order. Request Parameters Material fields: Response Parameters Request Example
Response Example

4. Request Payment Material Supplement

Interface Overview Supplement product and logistics materials for an existing declared order. Request Parameters Material fields are the same as those in 1. Request Payment Order Declaration. Response Parameters Request Example
Response Example
Response Example

5. Order Details

Interface Overview Query wallet order details by order number or external order number. Request Parameters Response Parameters WalletOrderDetailData fields: Request Example
Response Example

6. Order List

Interface Overview Query wallet orders by walletId with pagination. Orders can be filtered by status, currency, and creation time range. The returned order data uses the unified wallet order structure and is suitable for order list pages, pre-reconciliation queries, or polling order progress by status. Request Parameters Response Parameters Page fields: WalletOrderDetailData fields: Request Example
Response Example

7. Download Statement

Interface Overview Statements for D-1 can be downloaded from 9:00 AM every day. The time zone is Hong Kong UTC+8. Request Parameters Response Parameters WalletBillData fields: Request Example
Response Example

Bank Account API

The following APIs share the BankAccountData and FileInfo definitions.
BankAccountData fields: FileInfo fields:

8. Add Beneficiary Bank Account

Interface Overview Add a beneficiary bank account. Request Parameters Response Parameters Request Example
Response Example

9. Update Beneficiary Bank Account

Interface Overview Update non-key fields of a beneficiary bank account. accountOwnership, currency, accountType, companyName, and companyCode cannot be updated. Request Parameters Response Parameters Same as 9. Add Beneficiary Bank Account. data is BankAccountData. Request Example
Response Example Same structure as the response example in 9. Add Beneficiary Bank Account.

10. Delete Beneficiary Bank Account

Interface Overview Delete a beneficiary bank account. Request Parameters Response Parameters Request Example
Response Example

11. Enquiry Beneficiary Bank Account

Interface Overview Query beneficiary bank accounts. Request Parameters Response Parameters Request Example
Response Example

Off-ramp API

12. Payout Quote

Interface Overview Obtain the price and transfer-related information for a specified currency pair. At least one of fromAmount or toAmount must be provided. Request Parameters Response Parameters PayoutQuoteData fields: Request Example
Response Example

13. Payout Order

Interface Overview Place a payout order based on a quote ID. Request Parameters Response Parameters PayoutBookData fields: Request Example
Response Example

14. Payout Order Enquiry

Interface Overview Query payout order information by order number or quote ID. Request Parameters Response Parameters PayoutData fields: Request Example
Response Example

15. Payout Re-Settle

Interface Overview Re-initiate settlement after a refund or failed settlement. Request Parameters Response Parameters PayoutReSettleData fields: Request Example
Response Example

Callback

Callback Request Specification

Request Headers

Signature Verification

The algorithm is the same as inbound API signing and uses the same sign_secret:
  • PATH: the path part of the callback URL, excluding domain and query string.
  • BODY: the raw HTTP request body bytes.

Verification Steps

  1. Read request headers: X-Timestamp, X-Nonce, X-Signature, and X-Api-Key.
  2. Validate the timestamp window: abs(now_ms - X-Timestamp) <= 5 * 60 * 1000; otherwise reject with 401.
  3. Read the raw request body before any parsing or deserialization.
  4. Recalculate the signature using sign_secret and the raw body.
  5. Compare the calculated signature and X-Signature using constant-time comparison.
  6. Use X-Nonce as the idempotency key. If it has already been processed, return the previous result directly.

Common Pitfalls

  • The signature must be calculated over the raw bytes. JSON re-serialization, key reordering, whitespace changes, or encoding changes will cause signature mismatch.
  • PATH must match exactly. Do not add or remove a trailing slash, URL-decode it, or remove gateway prefixes.
  • X-Signature is lowercase hex. The method is fixed as uppercase POST.
  • Empty body must also be signed. SHA256_HEX("") is e3b0c442...b855.

Reference Implementations

Python
Node.js
Java
Go

Response Requirements

  • The merchant system must respond within 8 seconds.
  • HTTP 2xx status code is treated as successful delivery.
  • Non-2xx, timeout, or business error response is treated as failed delivery.
  • Recommended response body:
Success:
Failure:

Idempotency and Replay Protection

  • Idempotency key: use X-Nonce as the idempotency key and persist it. If the same key is received again, return the previous result directly.
  • Replay protection: validate that X-Timestamp is within ±5 minutes of the server time.
  • Strict signature verification: reject any request with invalid signature using 4xx and do not enter business processing.

Callback Data Types

16. Order Result Notification

Sample Data

17. Add Bank Account Result Notification

Sample Data

18. Payout Result Notification

Sample Data

19. Payout Refund Result Notification

Sample Data

20. Payout Re-Settle Result Notification

Sample Data

Appendix

Response Code

Payout Order Status

Deposit Order Status

Order Type

Field Description: amount

This field indicates the transaction amount. Its type is string. Precision requirements vary by currency type:
  • Digital Currency: generally supports up to 6 decimal places to meet on-chain transaction precision requirements.
  • Fiat Currency: generally supports up to 2 decimal places, accurate to cents.
  • Japanese Yen (JPY): JPY has no decimal places. The amount must be an integer and must not contain a decimal part.
Please strictly control the amount format according to the currency type to avoid precision errors or processing exceptions.

Purpose

Country/Region Code

Country/Region Code

Industry Code

Industry Code

Profile Error Description

The following messages are returned by profile validation and grouped by module. [Business details]
  • Industry cannot be empty!
  • Added industries exceeded limit: 3
  • Industry code cannot be empty!
  • Industry code does not exist!
  • Sales turnover of last year cannot be empty!
  • Incorrect sales turnover of last year input!
  • Year(s) in business cannot be empty!
  • Incorrect year(s) in business input!
  • Location(s) of business cannot be empty!
  • Location(s) of business exceeded limit: 3
  • Industry details cannot be empty!
  • Industry details exceeded maximum length
[Entity details]
  • We only support partnership business in Hong Kong
  • We only support sole proprietorship business in Hong Kong
  • Please enter the ciNumber.
  • Please enter the brNumber.
  • Operating place cannot be empty!
  • Operating address cannot be empty!
  • Operating address exceeded maximum length
  • Company registered place cannot be empty!
  • Company registered place not supported:[area name]
  • The operating place is not supported:[area name]
  • Company registered address cannot be empty!
  • Company registered address maximum length
  • Company registered address in English only
  • Website exceeded maximum length
  • Incorrect business type!
  • Business registration certificate number exceeded max length
  • Business registration certificate number cannot be empty
  • Certificate of incorporation number exceeded maximum length
  • Certificate of incorporation number cannot be empty
  • Name of business in English cannot be empty!
  • Name of business in Chinese cannot be empty!
  • Name of business in Chinese exceeded maximum length
  • Name of business in English exceeded maximum length
  • Not allowed option
  • Please upload a valid proof of Certificate of Incorporation
  • Please upload a valid proof of Memorandum and Articles of Association
  • Please upload a valid proof of Business Registration
  • Please upload a valid proof of Partnership Agreement
  • Please upload a valid proof of Certificate of Incumbency
  • Please upload a valid proof of KYC Files
  • Duplicated document
  • Please enter a valid business type.
  • Company incorporation date cannot be empty
  • Company incorporation date cannot be empty be greater than current date:[corresponding value]
  • Place of financial regulator cannot be empty!
  • Incorrect place of financial regulator input!
  • Name of regulator cannot be empty!
  • Name of regulator exceeded maximum length
  • Type of license cannot be empty!
  • Type of license exceeded maximum length
  • Incorrect place of incorporation!
  • Sorry, the country/region is not supported yet! ... :{placeOfIncorporation}
  • Please upload a valid proof of License/Certificate of Financial Institution
  • Place of listing cannot be empty!
  • Incorrect place of listing input!
  • Name of exchange cannot be empty!
  • Name of exchange exceeded maximum length
  • Stock code cannot be empty!
  • Stock code exceeded maximum length
  • Place of government owner cannot be empty!
  • Incorrect place of government owner input!
[Key people]
  • Email exceeded maximum length
  • Incorrect email address format
  • AreaCode exceeded maximum length
  • MobileNumber exceeded maximum length
  • Incorrect country/region of key people
  • Incorrect country/region and idType of key people
  • Incorrect idType
  • The user's idv information is incomplete
  • Last name in English exceeded maximum length
  • Last name in English and first name in English cannot have only one value
  • First name in English exceeded maximum length
  • Name in Chinese exceeded maximum length
  • idNumber exceeded maximum length
  • Incorrect gender
  • Please upload a valid proof of key people
  • Please set a valid quorum
  • Id Number[{idNumber}] was duplicate!
  • Signer must be equal or greater than quorum
  • Direct number has to be between 1 to 99
  • Partner number has to be between 2 to 6
  • Please add at least one owner
  • Please add at most one owner
  • Only limited company can create director
  • Only partnership can create partner
  • Please select at least one role for user:
  • IsOwner is only supported by sole proprietorship
[Shareholder]
  • Shareholder structure cannot be empty
  • Incorrect Level in sharesholder structure, only Zero to Ten Level
  • Last name in English exceeded maximum length
  • First name in English exceeded maximum length
  • Name in Chinese exceeded maximum length
  • Shareholder (company) name in English exceeded maximum length
  • Shareholder (company) name in Chinese exceeded maximum length
  • Shareholder (company) RegulatorName exceeded maximum length
  • Shareholder (company) ExchangeName exceeded maximum length
  • Shareholder (company) Stock code exceeded maximum length
  • Incorrect ownedSharesPercent
  • Shareholder type cannot be empty
  • Please input correct shareholder type:{type}
  • Shareholder (personal) name in English and Chinese cannot be empty at the same time!
  • Shareholder (company) name cannot be empty
  • Shareholder (company) business type cannot be empty
  • Please input correct business type for the shareholder (company):{businessType}
  • We only support sole proprietorship business in Hong Kong
  • We only support partnership business in Hong Kong
  • Shareholder (company) place of incorporate cannot be empty
  • Incorrect shareholder (company) place of incorporate
  • We only support company registered place for partnership and sole proprietorship in Hong Kong only
  • Last name in English and first name in English cannot have only one value
  • ParentId cannot be empty
  • Listed/government owner/financial regulator not support partnership business
  • Place of financial regulator cannot be empty!
  • Place of financial regulator not supported!
  • Name of regulator cannot be empty!
  • Name of regulator exceeded maximum length
  • Type of license cannot be empty!
  • Type of license exceeded maximum length
  • Listed/government owner not support sole proprietorship business
  • Place of listing cannot be empty!
  • Place of listing not supported!
  • Name of exchange cannot be empty!
  • Name of exchange exceeded maximum length
  • Stock code cannot be empty!
  • Stock code exceeded maximum length
  • Place of government owner cannot be empty!
  • Incorrect place of government owner input!
  • Corresponding shareholder type for sameId[{id}] is different
  • Corresponding shareholder name for sameId[{id}] is different
  • Incorrect parentId in sharesholder structure
  • Abnormal shareholder structure
  • Shareholder structure cannot exceed 10 layers
  • Shareholder structure is not necessary
[Others]
  • Customer type error.