Legacy API Overview

The Legacy API provides full backward compatibility with the original UTpay payment gateway API. If your application was integrated with UTpay, it will work against this API without any code changes.

Who Should Use This

• Merchants with an existing live UTpay integration who have not yet migrated to V1
• Systems where changing the auth method or amount format is not immediately practical

New integrations should use the Merchant API V1.

Key Differences vs V1

Aspect	Legacy API	Merchant API V1
Base path	/api/	/v1/
Order auth	SHA-512 signature in body	X-API-Key header
Disbursement auth	RSA-SHA256 X-SIGNATURE header	X-API-Key header
Amount format	Full IDR integer	Minor units (÷100)
Response envelope	{code, message, data}	{success, data}
Timestamps	WIB ("2026-06-01 10:30:45")	UTC ISO 8601
Callback format	{refCode, orderId, totalAmount, status, paidAt}	{event, ref_code, merchant_order_id, amount_minor, ...}

Credential Setup

Your Legacy API credentials are different from your V1 API key:

Credential	How to get
legacy_client_id	Set by your platform administrator
legacy_client_secret	Set by your platform administrator
RSA public key	You generate the key pair; upload your public key via the Admin Dashboard

To request Legacy API credential setup, contact your platform administrator or aggregator.

Base URL

Same as the V1 API:

https://api.nusio-saka.com

or for Flypay merchants:

https://api.flypay.asia

Endpoints at a Glance

Method	Path	Description
POST	/api/order/create	Create a payment order
POST	/api/order/query	Query order status
POST	/api/disbursement/get-balance	Get wallet balance
POST	/api/disbursement/create	Create bank disbursement
POST	/api/disbursement/create-ewallet	Create e-wallet disbursement
POST	/api/disbursement/query	Query disbursement status

Response Envelope

All Legacy API responses follow the UTpay envelope format:

{
  "code": 200,
  "message": "Success",
  "data": { ... }
}

For errors:

{
  "code": 400,
  "message": "Invalid Signature",
  "data": null
}

The code field mirrors the HTTP status code.