Legacy API Overview

The UTpay-compatible API preserves the original UTpay HTTP contract. Existing integrations change only their base URL; paths, methods, headers, signing input, body fields, response envelope, statuses, timestamps, and amount units stay the same.

Who Should Use This

• Merchants with an existing live UTpay integration who have not yet migrated to V1
• Systems where changing the auth method or amount format is not immediately practical

New integrations should use the Merchant API V1.

Key Differences vs V1

Aspect	Legacy API	Merchant API V1
Base path	/api/	/v1/
Order auth	SHA-512 signature in body	X-API-Key header
Disbursement auth	RSA-SHA256 X-SIGNATURE header	X-API-Key header
Amount format	Full IDR integer	Full IDR (Rupiah)
Response envelope	{code, message, data}	{success, data}
Timestamps	WIB ("2026-06-01 10:30:45")	UTC ISO 8601
Callback format	{refCode, orderId, totalAmount, status, paidAt}	{event, ref_code, merchant_order_id, amount, ...}

Credential Setup

The compatibility API uses the same credentials already assigned in UTpay. They are deliberately separate from the native V1 API key:

Credential	How to get
clientId	Same UTpay merchant client ID
Client secret	Same UTpay merchant client secret; used only to calculate signatures
RSA public key	Same merchant public key registered in UTpay; your private key remains with you

To request Legacy API credential setup, contact your platform administrator or aggregator.

Base URL

Same as the V1 API:

https://api.flypay.asia

or for FlyPay merchants:

https://api.flypay.asia

Endpoints at a Glance

Method	Path	Description
POST	/api/order/create	Create a payment order
POST	/api/order/query	Query order status
POST	/api/disbursement/get-balance	Get wallet balance
POST	/api/disbursement/create	Create bank disbursement
POST	/api/disbursement/create-ewallet	Create e-wallet disbursement
POST	/api/disbursement/query	Query disbursement status

Response Envelope

All Legacy API responses follow the UTpay envelope format:

{
  "code": 200,
  "message": "Success",
  "data": { ... }
}

For errors:

{
  "code": 400,
  "message": "Invalid Signature",
  "data": null
}

The HTTP transport status is 200 for both success and application errors, exactly like UTpay. Inspect the JSON code: 200 means success and 400 means error.

Compatibility boundary

The contract is compatible; the processing engine is FlyPay. New records are stored in PostgreSQL using integer minor units internally, routed through FlyPay gateway orchestration, posted to the double-entry ledger, and delivered through durable jobs. These internal changes do not change the compatibility payload.

The compatibility endpoints are available only on the branded domain that owns the merchant:

• FlyPay merchant credentials: https://api.flypay.asia
• FlyPay merchant credentials: https://api.flypay.asia

Credentials are brand-isolated and are rejected on the other brand's domain.