API reference

Everything a secret key can reach, plus the two public checkout routes. Generated from the API contract, so a field name here is the field name the server sends.

#Base URL

https://api.paymonetra.com/v1

An older path still answers so nothing already built breaks. It is not the one to build against.

#Getting started

#Customer accounts

#Money

#Payments

#Test mode

#Checkout

#The error shape

A developer reads an error to find out what to change, so it names the field where there is one. There is no success flag: the HTTP status is the answer.

{
  "error": {
    "type": "invalid_request",
    "message": "customer_reference is required. It is your own id for this customer and we hand it back on every payment.",
    "field": "customer_reference"
  }
}

type is one of unauthorized, account_inactive, not_verified, invalid_request, not_found, conflict, provider_error, not_test_mode, validation.

not_test_mode is returned 403 by the sandbox routes when a live key is used. It is the one guard between simulated money and real money, so it refuses loudly rather than doing nothing.

Every code, and what to show a person: errors.

#Rate limits

The app's API throttles on the IP because there the thing being abused is a password guess. Here the caller is a server that legitimately makes every request from one address, so an IP limit would be a limit on the merchant's whole business.

Account creation is tightest because it reaches our bank partner, who rate limit by IP across all of us, so one merchant's loop is everybody's outage. 300 an hour is a merchant onboarding five users a minute all day.