Create Order

Create a new payment order using the Legacy (UTpay-compatible) API.

Endpoint

POST /api/order/create

Authentication

Authenticated via SHA-512 signature in the request body. See Authentication for the signing formula.

Request Body

Field	Type	Required	Description
clientId	string	Yes	Your legacy_client_id
orderId	string	Yes	Your unique order ID (idempotency key)
totalAmount	integer	Yes	Order amount in full IDR (NOT minor units). IDR 50,000 = 50000
paymentType	string	Yes	Use QRIS; this compatibility endpoint publishes QRIS pay-in
signature	string	Yes	SHA-512 signature — see Authentication
customerName	string	Yes	Customer's full name
customerEmail	string	Yes	Valid customer email
customerPhone	string	Yes	Numeric Indonesian phone beginning with 62
notifyUrl	string	No	Callback URL for status updates
returnUrl	string	No	Redirect URL after payment

Amount Units

totalAmount is in full IDR. For IDR 50,000, send 50000 — not 5000000. This is the opposite of the V1 API.

Signature Computation

PHP

$signature = hash('sha512',
    $clientId . '|' . $orderId . '|' . $totalAmount . '|' . $clientSecret
);

Example

cURL

# Step 1: compute signature
SIG=$(echo -n "TEST_CLIENT_001|INV-2026-00123|50000|TEST_SECRET_001" | sha512sum | awk '{print $1}')

# Step 2: send request
curl -X POST https://api.flypay.asia/api/order/create \
  -H "Content-Type: application/json" \
  -d "{
    \"clientId\": \"TEST_CLIENT_001\",
    \"orderId\": \"INV-2026-00123\",
    \"totalAmount\": 50000,
    \"paymentType\": \"QRIS\",
    \"signature\": \"$SIG\",
    \"customerName\": \"Budi Santoso\",
    \"notifyUrl\": \"https://your-site.com/callbacks/payment\"
  }"

PHP

$clientId     = 'TEST_CLIENT_001';
$orderId      = 'INV-2026-00123';
$totalAmount  = 50000;
$clientSecret = 'TEST_SECRET_001';

$signature = hash('sha512', "$clientId|$orderId|$totalAmount|$clientSecret");

$payload = compact('clientId', 'orderId', 'totalAmount', 'signature') + [
    'paymentType'  => 'QRIS',
    'customerName' => 'Budi Santoso',
    'notifyUrl'    => 'https://your-site.com/callbacks/payment',
];

$ch = curl_init('https://api.flypay.asia/api/order/create');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);

Response

HTTP 200 OK

{
  "code": 200,
  "message": "Success",
  "data": {
    "refCode": "ORD-260601103045-A1B2",
    "transactionTime": "2026-06-01 10:30:45",
    "orderId": "INV-2026-00123",
    "totalAmount": 50000,
    "customerName": "Budi Santoso",
    "customerEmail": "budi@example.com",
    "customerPhone": "6281234567890",
    "customerEmail": null,
    "customerPhone": null,
    "notifyUrl": "https://your-site.com/callbacks/payment",
    "returnUrl": null,
    "status": "PENDING",
    "paidAt": null,
    "qrString": "00020101021226..."
  }
}

Response Fields

Field	Description
refCode	FlyPay internal reference — use for status queries
transactionTime	WIB timestamp of order creation ("YYYY-MM-DD HH:MM:SS")
totalAmount	Full IDR integer (same value you sent)
status	PENDING on creation
qrString	QRIS data string; render as QR code in your UI
paidAt	null until paid; WIB format when filled

Idempotency

Submitting the same orderId again is rejected with code: 400 and message: "Order ID already used", exactly like UTpay. Use the query endpoint for an existing order.

Error Responses

Message	Description
Invalid Client ID	clientId not found or merchant inactive
Invalid request parameters	Missing required field or invalid value
Invalid Signature	SHA-512 hash does not match
Merchant setting is not Valid	No gateway configured for paymentType
Order ID already used	orderId already exists for the merchant