Skip to content
PachaPayPachaPayPachaPay Docs
Draft: the API is under development and may change before the first release

Overview

Pay-in, payout, refund and balance API for LATAM merchants.

PachaPay API 0.1.0-draft

Section titled “PachaPay API 0.1.0-draft”

DRAFT v0.1 (2026-10-15). First contract sketch for discussion, not final.

Conventions

  • All money amounts are integers in minor units of the currency (CLP has 0 decimals, COP/PEN/USD have 2, USDT has 6). Floats are never used.
  • Every POST requires an Idempotency-Key header. Repeating a request with the same key and the same body returns the original response and does not move money again. The same key with a different body returns 409 idempotency_conflict.
  • Every request is authenticated with a project API key (Authorization: Bearer). Request signing is not required in the MVP; webhooks are always signed.
  • Human-readable texts (message, method name) are in English. The Accept-Language header (en, es, ru) is reserved for localized texts; unsupported values fall back to English.
  • Object ids are prefixed strings: pay_, pout_, ref_, dep_, whk_.
  • Timestamps are RFC 3339 in UTC.
  • Live API keys work only for merchants with an approved KYB; otherwise 403 merchant_not_active.
  • Versioning is by major version in the path (/v1). New fields, new optional parameters, new enum values and new endpoints are non-breaking, so clients must ignore unknown fields and tolerate unknown enum values. A breaking change ships as /v2; the old version stays available at least 12 months after deprecation is announced. Deprecated items carry Deprecation and Sunset headers.
  • Rate limits apply per API key. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Exceeding the limit returns 429 with Retry-After.
  • A replayed idempotent request returns the stored response with the header Idempotent-Replay: true.

Information

  • License: Proprietary
  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
GET
/payment-methods
GET
/payments
POST
/payments
GET
/payments/{payment_id}
POST
/payments/{payment_id}/cancel
GET
/payouts
POST
/payouts
GET
/payouts/{payout_id}
POST
/payouts/{payout_id}/cancel
GET
/refunds
POST
/refunds
GET
/refunds/{refund_id}
POST
/deposit-references
GET
/deposit-references/{deposit_reference_id}
GET
/balances
GET
/webhook-endpoints
POST
/webhook-endpoints
DELETE
/webhook-endpoints/{endpoint_id}
POST
/webhook-endpoints/{endpoint_id}/rotate-secret
GET
/events
GET
/events/{event_id}
POST
Payment, payout and refund events WEBHOOK

Authentication

Section titled “Authentication”

ApiKey

Section titled “ApiKey”

Secret project API key sent as Authorization: Bearer sk_live_... or sk_test_.... Never embed it in a browser or mobile app. Keys are stored hashed; a lost key is replaced, not recovered.

Security scheme type: http