Create Order

Create a new payment order using the Legacy (UTpay-compatible) API.

Endpoint

POST /api/order/create

Authentication

Authenticated via SHA-512 signature in the request body. See Authentication for the signing formula.

Request Body

Field	Type	Required	Description
clientId	string	Yes	Your legacy_client_id
orderId	string	Yes	Your unique order ID (idempotency key)
totalAmount	integer	Yes	Order amount in full IDR (NOT minor units). IDR 50,000 = 50000
paymentType	string	Yes	Payment channel: QRIS or BANK_TRANSFER
signature	string	Yes	SHA-512 signature — see Authentication
customerName	string	No	Customer's full name
customerEmail	string	No	Customer's email
customerPhone	string	No	Customer's phone number
notifyUrl	string	No	Callback URL for status updates
returnUrl	string	No	Redirect URL after payment

Amount Units

totalAmount is in full IDR. For IDR 50,000, send 50000 — not 5000000. This is the opposite of the V1 API.

Signature Computation

PHP

$signature = hash('sha512',
    $clientId . '|' . $orderId . '|' . $totalAmount . '|' . $clientSecret
);

Example

cURL

# Step 1: compute signature
SIG=$(echo -n "TEST_CLIENT_001|INV-2026-00123|50000|TEST_SECRET_001" | sha512sum | awk '{print $1}')

# Step 2: send request
curl -X POST https://api.nusio-saka.com/api/order/create \
  -H "Content-Type: application/json" \
  -d "{
    \"clientId\": \"TEST_CLIENT_001\",
    \"orderId\": \"INV-2026-00123\",
    \"totalAmount\": 50000,
    \"paymentType\": \"QRIS\",
    \"signature\": \"$SIG\",
    \"customerName\": \"Budi Santoso\",
    \"notifyUrl\": \"https://your-site.com/callbacks/payment\"
  }"

PHP

$clientId     = 'TEST_CLIENT_001';
$orderId      = 'INV-2026-00123';
$totalAmount  = 50000;
$clientSecret = 'TEST_SECRET_001';

$signature = hash('sha512', "$clientId|$orderId|$totalAmount|$clientSecret");

$payload = compact('clientId', 'orderId', 'totalAmount', 'signature') + [
    'paymentType'  => 'QRIS',
    'customerName' => 'Budi Santoso',
    'notifyUrl'    => 'https://your-site.com/callbacks/payment',
];

$ch = curl_init('https://api.nusio-saka.com/api/order/create');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);

Response

HTTP 200 OK

{
  "code": 200,
  "message": "Success",
  "data": {
    "refCode": "ORD-260601103045-A1B2",
    "transactionTime": "2026-06-01 10:30:45",
    "orderId": "INV-2026-00123",
    "totalAmount": 50000,
    "customerName": "Budi Santoso",
    "customerEmail": null,
    "customerPhone": null,
    "notifyUrl": "https://your-site.com/callbacks/payment",
    "returnUrl": null,
    "status": "PENDING",
    "paidAt": null,
    "qrString": "00020101021226..."
  }
}

Response Fields

Field	Description
refCode	PGA internal reference — use for status queries
transactionTime	WIB timestamp of order creation ("YYYY-MM-DD HH:MM:SS")
totalAmount	Full IDR integer (same value you sent)
status	PENDING on creation
qrString	QRIS data string; render as QR code in your UI
paidAt	null until paid; WIB format when filled

Idempotency

Submitting the same orderId again returns the existing order with its current status — no duplicate order is created.

Error Responses

Message	Description
Invalid Client ID	clientId not found or merchant inactive
Invalid request parameters	Missing required field or invalid value
Invalid Signature	SHA-512 hash does not match
Merchant setting is not Valid	No gateway configured for paymentType
Order ID already used	orderId exists but is not retrievable (internal conflict)