API reference

REST v1 endpoints for merchant integrations. Prefer nested /api/v1/projects/{projectId}/ routes over deprecated flat paths.

Base URL

https://pay.andgroupco.com/api/v1

REST principles

Business units / sites. All payment resources nest under a project.

Method	Path	Auth / Permission	Notes
GET	`/api/v1/projects`	Session or API key	—
POST	`/api/v1/projects`	Session only	—
GET	`/api/v1/projects/:projectId`	Session or API key	—
POST	`/api/v1/projects/active`	Session — set active project	—
POST	`/api/v1/projects/active-environment`	Session — switch TEST/LIVE	—

Method	Path	Auth / Permission	Notes
GET	`/api/v1/merchant`	Session or API key	Whoami — verify credentials

Preferred nested routes. Flat /api/v1/orders paths are deprecated.

Method	Path	Auth / Permission	Notes
GET	`/api/v1/projects/:projectId/orders`	orders:read	—
POST	`/api/v1/projects/:projectId/orders`	orders:write	Creates order + payment link
GET	`/api/v1/projects/:projectId/orders/:id`	orders:read	—
POST	`/api/v1/projects/:projectId/orders/:id/payments`	orders:write	Initiate personal QR payment — body { gateway: wechatpay \| alipay }
POST	`/api/v1/projects/:projectId/orders/:id/voucher`	orders:write	—
POST	`/api/v1/projects/:projectId/orders/:id/payment-link`	orders:write	—
DELETE	`/api/v1/projects/:projectId/orders/:id/payment-link`	orders:write	—
POST	`/api/v1/projects/:projectId/orders/:id/simulate-payment`	orders:write	TEST only

Hosted checkout — no API key required for customer-facing routes.

Method	Path	Auth / Permission	Notes
GET	`/pay/:token`	—	Hosted checkout page
POST	`/api/public/pay/:token/initiate`	—	Start payment on hosted page
POST	`/api/public/pay/:token/voucher`	—	Upload payment proof

Method	Path	Auth / Permission	Notes
POST	`/api/v1/projects/:projectId/gateways/:slug/payments`	payments:write	—
GET	`/api/v1/projects/:projectId/gateways/:slug/payments?reference=`	payments:read	—

Session auth only. Keys are scoped to one project.

Method	Path	Auth / Permission	Notes
GET	`/api/v1/projects/:projectId/api-keys`	—	—
POST	`/api/v1/projects/:projectId/api-keys`	—	—
PATCH	`/api/v1/projects/:projectId/api-keys/:id`	—	—
DELETE	`/api/v1/projects/:projectId/api-keys/:id`	—	Revoke
POST	`/api/v1/projects/:projectId/api-keys/:id/rotate`	—	Rotate — revoke old, issue new secret

Method	Path	Auth / Permission	Notes
GET	`/api/v1/projects/:projectId/webhooks`	webhooks:read	—
POST	`/api/v1/projects/:projectId/webhooks`	webhooks:write	—
PATCH	`/api/v1/projects/:projectId/webhooks/:id`	webhooks:write	—
DELETE	`/api/v1/projects/:projectId/webhooks/:id`	webhooks:write	—
POST	`/api/v1/projects/:projectId/webhooks/:id/test`	webhooks:write	—
GET	`/api/v1/projects/:projectId/webhooks/:id/attempts`	webhooks:read	—

Personal QR receiving URLs for China channels (e.g. WeChat Pay, Alipay). Other gateways use project gateway credentials.

Method	Path	Auth / Permission	Notes
GET	`/api/v1/projects/:projectId/collection-profiles`	—	—
GET	`/api/v1/projects/:projectId/collection-profiles/:channel`	—	wechat \| alipay (personal QR channels)
PUT	`/api/v1/projects/:projectId/collection-profiles/:channel`	—	—

Collection QR image upload (server-side proxy).

Method	Path	Auth / Permission	Notes
POST	`/api/v1/projects/:projectId/assets/upload`	Session or API key	—
DELETE	`/api/v1/assets/:id`	Session or API key	—

Method	Path	Auth / Permission	Notes
GET	`/api/v1/transactions`	payments:read	—
GET	`/api/v1/wallets`	—	—

These remain outside /api/v1 by design: