{"openapi":"3.1.0","info":{"title":"1Gogh Exchange Merchant Acquiring API","version":"1.0","description":"Accept crypto payments: create invoices, track payments and manage webhooks.\n\n## Getting your API key\n\nCreate your first key in the 1GOGH Business portal: log in and open [Settings \u2192 API Keys](https:\/\/business.1gogh.io\/api) to generate a key pair \u2014 a public key (`pk_live_\u2026`) and a secret used to sign requests. The secret is shown once at creation, so store it securely. Not a merchant yet? [Apply here](https:\/\/business.1gogh.io\/settings).\n\nAdditional keys can then be issued programmatically via `POST \/business\/api-keys`, signed with an existing unrestricted key. If a key has an IP whitelist, requests from other addresses are rejected.\n\nExchange API bearer tokens are a separate credential system \u2014 they cannot be used with this API (and merchant keys cannot call the Exchange API).\n\n## Authentication\n\nEvery request is HMAC-SHA256 signed. Send four headers with each call:\n\n| Header | Value |\n|---|---|\n| `X-API-Key` | your public key (`pk_live_\u2026`) |\n| `X-Timestamp` | unix seconds; accepted within \u00b130 s of server time |\n| `X-Nonce` | a unique value per request (UUID recommended) \u2014 single-use, a replayed nonce is rejected |\n| `X-Signature` | `v1=` + lowercase hex of HMAC-SHA256 over the canonical string, keyed with your secret |\n\nThe canonical string is:\n\n```\n{timestamp}.{METHOD}.{path}.{body}\n```\n\n- `{timestamp}` \u2014 the exact value sent in `X-Timestamp`.\n- `{METHOD}` \u2014 the uppercase HTTP method (`GET`, `POST`, \u2026).\n- `{path}` \u2014 the request path **with its leading slash** and the full prefix, e.g. `\/api\/v1\/business\/ping`. No query string.\n- `{body}` \u2014 the raw request body byte-for-byte as sent. For `GET` (no body) it is the empty string, so the canonical string ends with a trailing dot.\n\nA non-empty `User-Agent` header is also required (the CDN rejects an empty UA).\n\n### Worked example\n\nValidate your signer against these pinned inputs:\n\n- timestamp: `1700000000`\n- nonce: `123e4567-e89b-12d3-a456-426614174000`\n- secret: `sk_live_example_secret`\n- request: `GET \/api\/v1\/business\/ping`, empty body\n\nCanonical string (note the trailing dot):\n\n```\n1700000000.GET.\/api\/v1\/business\/ping.\n```\n\n```php\nhash_hmac('sha256', '1700000000.GET.\/api\/v1\/business\/ping.', 'sk_live_example_secret');\n\/\/ => ca76f228eb9d9cb8323c673eca5d49b1ffdaa23856fed6a4979b05ef33ad992d\n```\n\nSo the header is `X-Signature: v1=ca76f228eb9d9cb8323c673eca5d49b1ffdaa23856fed6a4979b05ef33ad992d`.\n\n### In-browser Test Request \u2014 it signs for you\n\nThe **Test Request** client in this reference works: enter your key pair in the **HMAC signing** bar at the top of the page and every Test Request is signed locally, in your browser \u2014 the exact timestamp, a single-use nonce and the `X-Signature` header are computed on the fly with WebCrypto. The secret never leaves the tab (it is kept in this tab's session storage only and requests go straight to the API, with no proxy in between). The per-endpoint **code samples** (cURL \/ Node.js \/ PHP) remain the way to integrate: each one computes the same signature itself \u2014 paste your key and secret and run.\n\n## AI & MCP\n\nThis reference is a machine-readable **OpenAPI 3.1** document: https:\/\/exchange.1gogh.io\/api-docs\/merchant.json \u2014 plug it into AI tools directly, no extra services required.\n\n**MCP** (Claude Desktop, Cursor and other MCP clients) \u2014 run any open-source OpenAPI-to-MCP bridge, for example [@ivotoby\/openapi-mcp-server](https:\/\/www.npmjs.com\/package\/@ivotoby\/openapi-mcp-server):\n\n```json\n{\n \"mcpServers\": {\n \"1gogh-exchange-merchant-api\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@ivotoby\/openapi-mcp-server\"],\n \"env\": {\n \"API_BASE_URL\": \"https:\/\/exchange.1gogh.io\/api\/v1\",\n \"OPENAPI_SPEC_PATH\": \"https:\/\/exchange.1gogh.io\/api-docs\/merchant.json\"\n }\n }\n }\n}\n```\n\n**Any LLM** \u2014 fetch the document above and pass it as context: it describes every endpoint, parameter and schema.\n\nRequests to this API are HMAC-signed, which generic bridges cannot do \u2014 use the document for exploration and as AI context, and implement the signing in your own client to execute calls."},"servers":[{"url":"https:\/\/exchange.1gogh.io\/api\/v1","description":"API server"}],"security":[{"apiKey":[]}],"paths":{"\/business\/account":{"get":{"operationId":"business.api.account","description":"Returns the merchant profile the signing key belongs to \u2014 identity, status and limits \u2014\nin the standard `{\"success\": true, \"data\": ...}` envelope. Doubles as an authenticated\nsmoke test: any correctly signed request answers 200 here.","summary":"The merchant account behind the presented API key","tags":["Account"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/MerchantResource"}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/account \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/account\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/account \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/account`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/balance":{"get":{"operationId":"business.api.balance","description":"`balances` is the per-unit set (Stage 3): one line per accounting unit with\n`available` and `reserved` derived from the stored ledger at full precision.\n`available_usd` and `pending_usd` are the legacy USD-only scalars kept for\nexisting integrators \u2014 prefer `balances`; the scalars will not gain units.\nAlso returns the lifetime, daily and monthly acquiring volume, the configured\ndaily volume limit and the headroom left under it today\n(`daily_limit_remaining_usd`, floored at 0).","summary":"Acquiring volume counters, the remaining daily limit and the account balances","tags":["Account"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"available_usd":{"type":"string"},"pending_usd":{"type":"string"},"balances":{"type":"array","items":{"$ref":"#\/components\/schemas\/MerchantUnitBalanceResource"}},"total_volume_usd":{"type":"string"},"today_volume_usd":{"type":"number"},"month_volume_usd":{"type":"number"},"daily_limit_usd":{"type":"string"},"daily_limit_remaining_usd":{"type":["object","null"]}},"required":["available_usd","pending_usd","balances","total_volume_usd","today_volume_usd","month_volume_usd","daily_limit_usd","daily_limit_remaining_usd"]}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/balance \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/balance\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/balance \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/balance`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/balances":{"get":{"operationId":"business.api.balances","description":"One line per accounting unit the merchant holds, with `available` and\n`reserved` derived from the stored ledger at full precision. An exchanger\ncalls this before quoting a client to verify its reserves in the payout\nasset; the default USD unit is always present and listed first.","summary":"Per-unit account balances","tags":["Account"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"balances":{"type":"array","items":{"$ref":"#\/components\/schemas\/MerchantUnitBalanceResource"}}},"required":["balances"]}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/balances \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/balances\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/balances \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/balances`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/api-keys":{"get":{"operationId":"business.api.api-keys.index","description":"Lists every API key issued to the merchant with its metadata (name, permissions,\nenvironment, status). Secrets are never listed back \u2014 a `secret_key` appears in exactly\none response, at creation time. The full set is returned in one page.","summary":"The merchant's keys, newest first","tags":["Account"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/ApiKeyCollection"}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/api-keys \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/api-keys\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/api-keys \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/api-keys`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]},"post":{"operationId":"business.api.api-keys.store","description":"Requires the signing key to hold the `api_keys:write` permission \u2014 an unrestricted key\nalways does; otherwise 403 `PERMISSION_DENIED`. Answers 201 with the key resource plus\n`public_key` and `secret_key`; capture the secret immediately, it is never shown again.\nAn empty `permissions` list creates an unrestricted key, and only unrestricted keys may\nsign vendor API requests.","summary":"Issue a new key pair. The plaintext secret is returned once and stored encrypted","tags":["Account"],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/CreateApiKeyRequest"}}}},"responses":{"201":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"api_key":{"$ref":"#\/components\/schemas\/ApiKeyResource"},"public_key":{"type":"string"},"secret_key":{"type":"string"}},"required":["api_key","public_key","secret_key"]},"meta":{"type":"object","properties":{"warning":{"type":"string","const":"Store the secret_key securely. It will not be shown again."}},"required":["warning"]}},"required":["success","data","meta"]}}}},"403":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"PERMISSION_DENIED"},"message":{"type":"string","const":"This API key does not have permission to create new keys"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/api-keys \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/api-keys\"\nBODY='{\"name\":\"example\"}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/api-keys \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/api-keys`;\nconst body = JSON.stringify({\"name\":\"example\"});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/api-keys\/{id}":{"delete":{"operationId":"business.api.api-keys.destroy","description":"Requires the `api_keys:write` permission (403 `PERMISSION_DENIED` otherwise). Only keys\nbelonging to the authenticated merchant are visible \u2014 any other id, malformed ids\nincluded, is a 404 `NOT_FOUND`. A key cannot revoke itself: that is rejected with 400\n`CANNOT_REVOKE_SELF`. Revocation takes effect immediately and is permanent; the revoked\nkey resource is returned. The optional `reason` is recorded for audit.","summary":"Revoke one of the merchant's keys","tags":["Account"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"reason","in":"query","schema":{"type":["string","null"],"maxLength":500}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/ApiKeyResource"}},"required":["success","data"]}}}},"400":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"CANNOT_REVOKE_SELF"},"message":{"type":"string","const":"Cannot revoke the API key being used for this request"}},"required":["code","message"]}},"required":["success","error"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"API key not found"}},"required":["code","message"]}},"required":["success","error"]}}}},"403":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"PERMISSION_DENIED"},"message":{"type":"string","const":"This API key does not have permission to revoke keys"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# DELETE \/api\/v1\/business\/api-keys\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nAPI_KEY_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/api-keys\/${API_KEY_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.DELETE.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X DELETE \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ DELETE \/api\/v1\/business\/api-keys\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst apiKeyId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/api-keys\/${apiKeyId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.DELETE.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'DELETE',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'DELETE',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/deposit-wallets":{"get":{"operationId":"business.api.deposit-wallets","description":"`asset_balances` aggregates what has accumulated on the merchant's deposit addresses,\none row per currency\/network pair; assets the merchant may accept but has not received\nyet appear as zero rows. Read-only \u2014 new deposit addresses are issued through\n`acquiring\/deposit-intents`.","summary":"The merchant's deposit balances per currency and network","tags":["Catalog"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"asset_balances":{"type":"array","items":{}}},"required":["asset_balances"]}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/deposit-wallets \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/deposit-wallets\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/deposit-wallets \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/deposit-wallets`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/assets":{"get":{"operationId":"business.api.assets","description":"The merchant-specific acquiring catalog: each entry pairs a currency with a network it can\nbe received on. Use it to populate a payment-method picker before creating an invoice or a\ndeposit intent \u2014 combinations outside this list are rejected there.","summary":"Currencies and networks this merchant may accept deposits in","tags":["Catalog"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"assets":{"type":"array","items":{"type":"object","properties":{"currency_id":{"type":"integer"},"network_id":{"type":"integer"},"currency_symbol":{"type":"string"},"network_slug":{"type":"string"},"currency_name":{"type":"string"},"network_name":{"type":"string"},"available_addresses_count":{"type":"integer"}},"required":["currency_id","network_id","currency_symbol","network_slug","currency_name","network_name","available_addresses_count"]}}},"required":["assets"]}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/assets \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/assets\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/assets \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/assets`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/currencies":{"get":{"operationId":"business.api.currencies.index","description":"Pass `amount` to have an indicative rate attached to every entry.","summary":"Platform-wide currencies enabled for merchant acquiring, with limits and fees","tags":["Catalog"],"parameters":[{"name":"amount","in":"query","schema":{"type":["number","null"]}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"array","items":{"type":"object","properties":{"symbol":{"type":"string"},"name":{"type":"string"},"type":{"type":["string","null"]},"decimals":{"type":"integer"},"min_amount_usd":{"type":"string"},"max_amount_usd":{"type":"string"},"required_confirmations":{"type":"integer"},"fee_percent":{"type":"string"},"estimated_rate":{"anyOf":[{"type":"object","properties":{"available":{"type":"boolean"},"rate_usd":{"type":"string"},"amount_crypto":{"type":"string","description":"Round to precision"},"amount_crypto_display":{"type":"string","description":"Safe today only because roundCrypto() always leaves a decimal point; math_formatter\ndoes not depend on that (`rtrim(rtrim('100','0'),'.')` is '1')."},"rate_source":{"type":"string"},"estimated":{"type":"boolean"},"validity_seconds":{"type":"string"}},"required":["available","rate_usd","amount_crypto","amount_crypto_display","rate_source","estimated","validity_seconds"]},{"type":"object","properties":{"available":{"type":"boolean"},"error":{"type":"string","const":"Rate unavailable"}},"required":["available","error"]}]}},"required":["symbol","name","type","decimals","min_amount_usd","max_amount_usd","required_confirmations","fee_percent","estimated_rate"]}}},"required":["success","data"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/currencies \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/currencies\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/currencies \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/currencies`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/currencies\/{code}\/rate":{"get":{"operationId":"business.api.currencies.rate","description":"`{code}` is the currency symbol, case-insensitive. Pass `amount` (USD) to price the quote\nfor your actual amount \u2014 rates fold in an amount-sensitive component, so the default\nsample of 100 USD is indicative only. A currency that is unknown or not enabled for\nacquiring returns 404 `CURRENCY_NOT_FOUND`; when no fresh rate can be obtained the\nendpoint answers 503 `RATE_UNAVAILABLE` \u2014 retry shortly rather than caching the failure.","summary":"The current USD rate for one currency, quoted for a sample amount","tags":["Catalog"],"parameters":[{"name":"code","in":"path","required":true,"schema":{"type":"string"}},{"name":"amount","in":"query","schema":{"type":["number","null"]}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"symbol":{"type":"string"},"name":{"type":"string"},"rate_usd":{"type":"string"},"rate_source":{"type":"string"},"estimated":{"type":"boolean"},"sample_amount_usd":{"anyOf":[{"type":"string"},{"type":"integer","enum":[100]}]},"sample_amount_crypto":{"type":"string"},"rate_validity_seconds":{"type":"string"},"min_amount_usd":{"type":"string"},"max_amount_usd":{"type":"string"},"required_confirmations":{"type":"string"},"fetched_at":{"type":"string"}},"required":["symbol","name","rate_usd","rate_source","estimated","sample_amount_usd","sample_amount_crypto","rate_validity_seconds","min_amount_usd","max_amount_usd","required_confirmations","fetched_at"]}},"required":["success","data"]}}}},"503":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"RATE_UNAVAILABLE"},"message":{"type":"string","const":"Rate is temporarily unavailable"}},"required":["code","message"]}},"required":["success","error"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"CURRENCY_NOT_FOUND"},"message":{"type":"string"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/currencies\/{code}\/rate \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nCODE=\"USDT\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/currencies\/${CODE}\/rate\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/currencies\/{code}\/rate \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst code = 'USDT';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/currencies\/${code}\/rate`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/deposit-intents":{"post":{"operationId":"business.api.deposit-intents.store","description":"Creates a deposit intent for `amount` of `currency` on `network` and answers 201 with the\naddress to pay to. Send an `Idempotency-Key` header to make retries safe: replaying the\nsame key with the same body returns the originally stored response, a concurrent duplicate\ngets 409 `IDEMPOTENT_REQUEST_IN_PROGRESS`, and the same key with a different body gets 409\n`IDEMPOTENCY_KEY_REUSED`. A restricted merchant account receives 403 `MERCHANT_RESTRICTED`;\nan unsupported currency\/network combination (see `acquiring\/assets`) is a 422\n`INVALID_DEPOSIT_INTENT`.","summary":"Generate or resume a deposit address. Honours `Idempotency-Key`","tags":["Deposit Intents"],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/CreateDepositIntentRequest"}}}},"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"string"}}}},"201":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"deposit_intent":{"type":"object","properties":{"invoice_id":{"type":"string"},"status":{"type":"string"},"external_id":{"type":["string","null"]},"amount_usd":{"type":"string"},"crypto_symbol":{"type":["string","null"]},"network":{"type":["string","null"]},"deposit_address":{"type":["string","null"]},"deposit_memo":{"type":["string","null"]},"amount_crypto_expected":{"type":["string","null"]},"amount_crypto_min":{"type":["string","null"]},"amount_crypto_max":{"type":["string","null"]},"rate_usd":{"type":["string","null"]},"payment_expires_at":{"type":["string","null"]},"deposit_address_pool_status":{"type":"string"},"payment":{"type":["object","null"],"properties":{"txn_hash":{"type":"string"},"confirmations":{"type":"integer"},"required_confirmations":{"type":"integer"},"explorer_url":{"type":["string","null"]},"status":{"type":"string"}},"required":["txn_hash","confirmations","required_confirmations","explorer_url","status"]},"aml":{"type":["object","null"],"properties":{"status":{"type":"string"},"risk_score":{"type":["string","null"]},"report_url":{"type":"string"},"checked_at":{"type":"string"},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]},"payout_allowed":{"type":"boolean"},"payout_block_code":{"type":["string","null"]},"payout_block_message":{"type":["string","null"]}},"required":["status","risk_score","report_url","checked_at","phase","payout_allowed","payout_block_code","payout_block_message"]},"capabilities":{"type":"object","properties":{"payout_allowed":{"type":"boolean"},"payout_block":{"anyOf":[{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_NOT_CONFIRMED"},"message":{"type":"string","const":"Inbound deposit is not confirmed yet. Wait for payment confirmation and AML clearance before payout."},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]}},"required":["code","message","phase"]},{"type":"null"},{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_AML_BLOCKED"},"message":{"type":"string"},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]}},"required":["code","message","phase"]},{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_AML_REJECTED"},"message":{"type":"string","const":"Inbound deposit was rejected after AML review. Payout cannot continue for this order."},"phase":{"type":"string","const":"rejected"}},"required":["code","message","phase"]}]}},"required":["payout_allowed","payout_block"]}},"required":["invoice_id","status","external_id","amount_usd","crypto_symbol","network","deposit_address","deposit_memo","amount_crypto_expected","amount_crypto_min","amount_crypto_max","rate_usd","payment_expires_at","deposit_address_pool_status","payment","aml","capabilities"]}},"required":["deposit_intent"]}},"required":["success","data"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"},"403":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"MERCHANT_RESTRICTED"},"message":{"anyOf":[{"type":"string"},{"type":"string","enum":["Your merchant account is restricted."]}]}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/acquiring\/deposit-intents \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/deposit-intents\"\nBODY='{\"amount\":1,\"currency\":\"example\",\"network\":\"example\"}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/acquiring\/deposit-intents \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/deposit-intents`;\nconst body = JSON.stringify({\"amount\":1,\"currency\":\"example\",\"network\":\"example\"});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/deposit-intents\/{invoice_id}":{"get":{"operationId":"business.api.deposit-intents.show","description":"`{invoice_id}` is the invoice UUID returned when the intent was created \u2014 intents carry no\nid of their own. Returns the same payload as creation, including the deposit address and\nthe current status, so it can be polled until the deposit confirms. An id that does not\nbelong to the authenticated merchant is a 404 `NOT_FOUND`.","summary":"A deposit intent and its status, addressed by the invoice it belongs to","tags":["Deposit Intents"],"parameters":[{"name":"invoice_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"invoice_id","in":"query","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"deposit_intent":{"type":"object","properties":{"invoice_id":{"type":"string"},"status":{"type":"string"},"external_id":{"type":["string","null"]},"amount_usd":{"type":"string"},"crypto_symbol":{"type":["string","null"]},"network":{"type":["string","null"]},"deposit_address":{"type":["string","null"]},"deposit_memo":{"type":["string","null"]},"amount_crypto_expected":{"type":["string","null"]},"amount_crypto_min":{"type":["string","null"]},"amount_crypto_max":{"type":["string","null"]},"rate_usd":{"type":["string","null"]},"payment_expires_at":{"type":["string","null"]},"deposit_address_pool_status":{"type":"string"},"payment":{"type":["object","null"],"properties":{"txn_hash":{"type":"string"},"confirmations":{"type":"integer"},"required_confirmations":{"type":"integer"},"explorer_url":{"type":["string","null"]},"status":{"type":"string"}},"required":["txn_hash","confirmations","required_confirmations","explorer_url","status"]},"aml":{"type":["object","null"],"properties":{"status":{"type":"string"},"risk_score":{"type":["string","null"]},"report_url":{"type":"string"},"checked_at":{"type":"string"},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]},"payout_allowed":{"type":"boolean"},"payout_block_code":{"type":["string","null"]},"payout_block_message":{"type":["string","null"]}},"required":["status","risk_score","report_url","checked_at","phase","payout_allowed","payout_block_code","payout_block_message"]},"capabilities":{"type":"object","properties":{"payout_allowed":{"type":"boolean"},"payout_block":{"anyOf":[{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_NOT_CONFIRMED"},"message":{"type":"string","const":"Inbound deposit is not confirmed yet. Wait for payment confirmation and AML clearance before payout."},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]}},"required":["code","message","phase"]},{"type":"null"},{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_AML_BLOCKED"},"message":{"type":"string"},"phase":{"type":["string","null"],"enum":["checking","cleared","hold","rejected",null]}},"required":["code","message","phase"]},{"type":"object","properties":{"code":{"type":"string","const":"DEPOSIT_AML_REJECTED"},"message":{"type":"string","const":"Inbound deposit was rejected after AML review. Payout cannot continue for this order."},"phase":{"type":"string","const":"rejected"}},"required":["code","message","phase"]}]}},"required":["payout_allowed","payout_block"]}},"required":["invoice_id","status","external_id","amount_usd","crypto_symbol","network","deposit_address","deposit_memo","amount_crypto_expected","amount_crypto_min","amount_crypto_max","rate_usd","payment_expires_at","deposit_address_pool_status","payment","aml","capabilities"]}},"required":["deposit_intent"]}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"Deposit intent not found"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/deposit-intents\/{invoice_id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nINVOICE_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/deposit-intents\/${INVOICE_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/deposit-intents\/{invoice_id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst invoiceId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/deposit-intents\/${invoiceId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/invoices":{"post":{"operationId":"business.api.invoices.store","description":"Answers 201 with the invoice resource, `checkout_url` (the hosted payment page to redirect\nthe payer to) and `widget_token` (for the embeddable checkout widget). Send an\n`Idempotency-Key` header to de-duplicate retries \u2014 a repeated key returns the invoice\ncreated first. Requires the `invoice:create` permission (an unrestricted key always\npasses); a restricted merchant account receives 403 `MERCHANT_RESTRICTED`. Amount bounds\nare per merchant, so a 422 on `amount` reflects this account's limits.","summary":"Create an invoice and return the hosted checkout URL the payer is sent to","tags":["Invoices"],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/CreateInvoiceRequest"}}}},"responses":{"201":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"invoice":{"$ref":"#\/components\/schemas\/InvoiceResource"},"checkout_url":{"type":"string"},"widget_token":{"type":"string"}},"required":["invoice","checkout_url","widget_token"]}},"required":["success","data"]}}}},"400":{"description":"Service-side rejections (asset catalog, asset minimum, volume limits) are\nuser-facing validation outcomes, not server faults. Same code\/status the\ncabinet twin already uses for the identical exception from the same\nshared createInvoice()\/createAssetInvoice() call \u2014 the two surfaces must\nagree on the error contract.","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"CREATE_FAILED"},"message":{"type":"string"}},"required":["code","message"]}},"required":["success","error"]}}}},"403":{"$ref":"#\/components\/responses\/AuthorizationException"},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/acquiring\/invoices \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\"\nBODY='{\"amount\":1}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/acquiring\/invoices \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices`;\nconst body = JSON.stringify({\"amount\":1});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]},"get":{"operationId":"business.api.invoices.index","description":"Filters: `status`, `external_id`, `customer_email`, `currency`, the `created_from` \/\n`created_to` window, `amount_min`\/`amount_max` and `environment`; sortable via `sort`\n(`created_at`, `amount_usd`, `status`, `paid_at`) and `order`. Paginate with `page` and\n`per_page` (default 20, max 100) \u2014 rows sit in `data`, the paginator counters in `meta`.\nRequires the `invoice:read` permission.","summary":"List invoices, filtered and paginated","tags":["Invoices"],"parameters":[{"name":"status","in":"query","schema":{"type":["string","null"]}},{"name":"external_id","in":"query","schema":{"type":["string","null"],"maxLength":255}},{"name":"customer_email","in":"query","schema":{"type":["string","null"],"format":"email","maxLength":255}},{"name":"currency","in":"query","schema":{"type":["string","null"],"maxLength":20}},{"name":"created_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"created_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"amount_min","in":"query","schema":{"type":["number","null"],"minimum":0}},{"name":"amount_max","in":"query","schema":{"type":["number","null"],"minimum":0}},{"name":"environment","in":"query","schema":{"type":["string","null"],"enum":["live","test"]}},{"name":"sort","in":"query","schema":{"type":["string","null"],"enum":["created_at","amount_usd","status","paid_at"]}},{"name":"order","in":"query","schema":{"type":["string","null"],"enum":["asc","desc"]}},{"name":"per_page","in":"query","schema":{"type":["integer","null"],"minimum":1,"maximum":100}},{"name":"page","in":"query","schema":{"type":["integer","null"],"minimum":1}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/InvoiceCollection"},"meta":{"type":"object","properties":{"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"required":["current_page","last_page","per_page","total"]}},"required":["success","data","meta"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"},"403":{"$ref":"#\/components\/responses\/AuthorizationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/invoices \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/invoices \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/invoices\/{id}":{"get":{"operationId":"business.api.invoices.show","description":"The full invoice resource with its detected on-chain payments and status timeline loaded.\nIds are scoped to the authenticated merchant \u2014 an unknown or foreign id returns 404\n`INVOICE_NOT_FOUND`. For high-frequency status polling prefer the lighter\n`invoices\/{id}\/status`.","summary":"A single invoice with its payments and timeline","tags":["Invoices"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/InvoiceResource"}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"INVOICE_NOT_FOUND"},"message":{"type":"string","const":"Invoice not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/invoices\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nINVOICE_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\/${INVOICE_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/invoices\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst invoiceId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices\/${invoiceId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/invoices\/{id}\/status":{"get":{"operationId":"business.api.invoices.status","description":"A compact payload built for storefront polling loops: the current status, invoiced and\nreceived amounts, confirmation progress against the required count, and the expiry\ntimestamps \u2014 no relations or line items. Unknown or foreign ids return 404\n`INVOICE_NOT_FOUND`.","summary":"Lightweight invoice status for polling","tags":["Invoices"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string"},"amount_usd":{"type":"string"},"amount_crypto":{"type":["string","null"]},"amount_received_crypto":{"type":"string"},"amount_received_usd":{"type":"string"},"confirmations":{},"required_confirmations":{"anyOf":[{"type":"string"},{"type":"integer","enum":[3]}]},"paid_at":{"type":"string"},"expires_at":{"type":"string"},"payment_expires_at":{"type":"string"}},"required":["id","status","amount_usd","amount_crypto","amount_received_crypto","amount_received_usd","confirmations","required_confirmations","paid_at","expires_at","payment_expires_at"]}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"INVOICE_NOT_FOUND"},"message":{"type":"string","const":"Invoice not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/invoices\/{id}\/status \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nINVOICE_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\/${INVOICE_ID}\/status\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/invoices\/{id}\/status \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst invoiceId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices\/${invoiceId}\/status`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/invoices\/{id}\/cancel":{"post":{"operationId":"business.api.invoices.cancel","description":"Only an invoice that is still payable can be cancelled \u2014 one that has already been paid,\nexpired or cancelled is rejected with 400 `CANCEL_FAILED` and an explanatory message.\nRequires the `invoice:cancel` permission, a distinct right from `invoice:create`. The\noptional `reason` is recorded on the invoice. Unknown or foreign ids return 404\n`INVOICE_NOT_FOUND`; the cancelled invoice resource is returned on success.","summary":"Cancel an invoice that has not been paid yet","tags":["Invoices"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/CancelInvoiceRequest"}}}},"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/InvoiceResource"},"message":{"type":"string","const":"Invoice cancelled successfully"}},"required":["success","data","message"]}}}},"400":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"CANCEL_FAILED"},"message":{"type":"string"}},"required":["code","message"]}},"required":["success","error"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"INVOICE_NOT_FOUND"},"message":{"type":"string","const":"Invoice not found"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"},"403":{"$ref":"#\/components\/responses\/AuthorizationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/acquiring\/invoices\/{id}\/cancel \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nINVOICE_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\/${INVOICE_ID}\/cancel\"\nBODY='{}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/acquiring\/invoices\/{id}\/cancel \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst invoiceId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices\/${invoiceId}\/cancel`;\nconst body = JSON.stringify({});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/invoices\/{id}\/refund":{"post":{"operationId":"business.api.invoices.refund","description":"Initiates an on-chain refund to `destination_address`; omit `amount` to refund the full\nrefundable amount. Requires the `refund:create` permission. Returns the created refund's\nid, status, type and amounts \u2014 track completion through webhooks or the invoice timeline.\nA refund the invoice state does not allow is a 422 `REFUND_INVALID` with the reason; an\ninternal fault while initiating is a 500 `REFUND_FAILED` (no details are leaked); unknown\nor foreign ids return 404 `INVOICE_NOT_FOUND`.","summary":"Refund a paid invoice back to an address the merchant nominates","tags":["Invoices"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/RefundInvoiceRequest"}}}},"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"message":{"type":"string","const":"Refund initiated successfully"},"data":{"type":"object","properties":{"invoice_id":{"type":"string"},"refund_id":{"type":"string"},"refund_status":{"type":"string"},"refund_type":{"type":"string"},"amount_crypto":{"type":"string"},"amount_usd":{"type":"string"},"destination_address":{"type":"string"}},"required":["invoice_id","refund_id","refund_status","refund_type","amount_crypto","amount_usd","destination_address"]}},"required":["success","message","data"]}}}},"500":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"REFUND_FAILED"},"message":{"type":"string","const":"Failed to initiate refund"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"INVOICE_NOT_FOUND"},"message":{"type":"string","const":"Invoice not found"}},"required":["code","message"]}},"required":["success","error"]}}}},"403":{"$ref":"#\/components\/responses\/AuthorizationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/acquiring\/invoices\/{id}\/refund \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nINVOICE_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/invoices\/${INVOICE_ID}\/refund\"\nBODY='{\"destination_address\":\"example\"}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/acquiring\/invoices\/{id}\/refund \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst invoiceId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/invoices\/${invoiceId}\/refund`;\nconst body = JSON.stringify({\"destination_address\":\"example\"});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/payments":{"get":{"operationId":"business.api.payments.index","description":"Every on-chain payment detected against the merchant's invoices, filterable by\n`invoice_id`, `status`, `txn_hash` and the `detected_from`\/`detected_to` window.\nPaginated via `per_page` (default 20, max 100) with the paginator counters in `meta`.","summary":"List payments, newest detection first","tags":["Invoices"],"parameters":[{"name":"invoice_id","in":"query","schema":{"type":["string","null"],"format":"uuid"}},{"name":"status","in":"query","schema":{"type":["string","null"],"enum":["detecting","confirming","confirmed","failed","orphaned"]}},{"name":"txn_hash","in":"query","schema":{"type":["string","null"],"maxLength":255}},{"name":"detected_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"detected_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"per_page","in":"query","schema":{"type":["integer","null"],"minimum":1,"maximum":100}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/PaymentCollection"},"meta":{"type":"object","properties":{"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"required":["current_page","last_page","per_page","total"]}},"required":["success","data","meta"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/payments \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/payments\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/payments \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/payments`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/acquiring\/payments\/{id}":{"get":{"operationId":"business.api.payments.show","description":"The payment resource with its parent invoice loaded. Ids are scoped to the authenticated\nmerchant \u2014 an unknown or foreign id returns 404 `NOT_FOUND`.","summary":"A single payment with the invoice it settled","tags":["Invoices"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/PaymentResource"}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"Payment not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/acquiring\/payments\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nPAYMENT_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/acquiring\/payments\/${PAYMENT_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/acquiring\/payments\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst paymentId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/acquiring\/payments\/${paymentId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/payouts":{"post":{"operationId":"business.api.payouts.store","description":"Honours `Idempotency-Key`, falling back to `external_id`, so a naive retry is\nde-duplicated: replaying the same key with the same body returns the originally stored\nresponse, a concurrent duplicate gets 409 `IDEMPOTENT_REQUEST_IN_PROGRESS`, and the same\nkey with a different body gets 409 `IDEMPOTENCY_KEY_REUSED`.\n\n`funding_source: \"balance\"` pays out of the merchant's USD balance and needs no\n`deposit_invoice_id`; omitting the field keeps the deployment's pass-through default,\nwhere the payout forwards one confirmed deposit. Business rejections (insufficient\nbalance, blocked account, below the minimum, ...) are 422 with a specific error code.","summary":"Send crypto from the merchant's available balance to an external address","tags":["Payouts"],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/CreatePayoutRequest"}}}},"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"anyOf":[{"type":"string"},{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"payout":{"type":"object","properties":{"id":{"type":"string"},"reference":{"type":["string","null"]},"external_id":{"type":["string","null"]},"status":{"type":"string"},"unit":{"type":"string"},"amount_usd":{"type":"string"},"amount_crypto":{"type":["string","null"]},"fee_usd":{"type":["string","null"]},"net_amount_usd":{"type":["string","null"]},"total_charge_usd":{"type":["string","null"]},"fee_amount_asset":{"type":["string","null"]},"currency":{"type":["string","null"]},"network":{"type":["string","null"]},"address":{"type":"string"},"dest_tag":{"type":["string","null"]},"txn_hash":{"type":["string","null"]},"explorer_url":{"type":["string","null"]},"error_code":{"type":["string","null"]},"error_message":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"metadata":{"type":["array","null"],"items":{}}},"required":["id","reference","external_id","status","unit","amount_usd","amount_crypto","fee_usd","net_amount_usd","total_charge_usd","fee_amount_asset","currency","network","address","dest_tag","txn_hash","explorer_url","error_code","error_message","created_at","updated_at","metadata"]}},"required":["payout"]}},"required":["success","data"]}]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/payouts \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/payouts\"\nBODY='{\"amount\":1,\"currency\":\"example\",\"address\":\"example\",\"network\":\"example\"}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/payouts \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/payouts`;\nconst body = JSON.stringify({\"amount\":1,\"currency\":\"example\",\"address\":\"example\",\"network\":\"example\"});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]},"get":{"operationId":"business.api.payouts.index","description":"Filterable by `status` and the `date_from`\/`date_to` window; fixed page size of 20 with\nthe paginator counters in `meta`. Note the shape difference from `payouts\/{id}`: list\nrows use the compact ledger shape, while a single payout carries the richer view\nincluding its trade execution metadata. Fiat payouts are listed separately under\n`fiat-payouts`.","summary":"The merchant's crypto payouts, newest first","tags":["Payouts"],"parameters":[{"name":"status","in":"query","schema":{"type":["string","null"],"enum":["pending","approved","processing","completed","rejected","cancelled","failed"]}},{"name":"date_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"date_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"page","in":"query","schema":{"type":["integer","null"],"minimum":1}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"array","items":{"$ref":"#\/components\/schemas\/MerchantPayout"}},"meta":{"type":"object","properties":{"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"required":["current_page","last_page","per_page","total"]}},"required":["success","data","meta"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/payouts \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/payouts\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/payouts \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/payouts`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/payouts\/balances":{"get":{"operationId":"business.api.payouts.balances","description":"What is available now, what is still settling, the payout minimum and the currencies and\nnetworks payouts may be sent on. Check it before creating a payout \u2014 it is the same\nledger `POST payouts` reserves against. Note that the service fee is charged on top of\nthe payout amount, so `available_usd` must cover the amount plus the fee, not the amount\nalone.","summary":"The payout ledger balances and payout constraints","tags":["Payouts"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","additionalProperties":{}}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/payouts\/balances \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/payouts\/balances\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/payouts\/balances \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/payouts\/balances`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/payouts\/trading-catalog":{"get":{"operationId":"business.api.payouts.trading-catalog","description":"`currencies` lists the assets and networks payouts may be sent on; `pairs` lists the spot\npairs the platform can auto-trade through when the payout asset differs from the funding\none. Merchant-specific \u2014 the catalog reflects what this account is allowed to use, so\nbuild payout forms from it rather than hardcoding assets.","summary":"Currencies, networks and conversion pairs a payout can be routed through","tags":["Payouts"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"currencies":{"type":"array","items":{"type":"object","properties":{"currency_id":{"type":"integer"},"symbol":{"type":"string"},"name":{"type":"string"},"decimals":{"type":"integer"},"is_stable":{"type":"boolean"},"merchant_fee_percent":{"type":["string","null"]},"merchant_min_amount_usd":{"type":["string","null"]},"merchant_max_amount_usd":{"type":["string","null"]},"merchant_confirmations":{"type":["integer","null"]},"networks":{"type":"array","items":{}}},"required":["currency_id","symbol","name","decimals","is_stable","merchant_fee_percent","merchant_min_amount_usd","merchant_max_amount_usd","merchant_confirmations","networks"]}},"pairs":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"base_currency_id":{"type":"integer"},"quote_currency_id":{"type":"integer"},"base_symbol":{"type":"string"},"quote_symbol":{"type":"string"},"base_precision":{"type":"integer"},"quote_precision":{"type":"integer"},"min_trade_size":{"type":"string"},"max_trade_size":{"type":["string","null"]},"min_trade_value":{"type":"string"},"max_trade_value":{"type":["string","null"]}},"required":["name","base_currency_id","quote_currency_id","base_symbol","quote_symbol","base_precision","quote_precision","min_trade_size","max_trade_size","min_trade_value","max_trade_value"]}}},"required":["currencies","pairs"]}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/payouts\/trading-catalog \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/payouts\/trading-catalog\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/payouts\/trading-catalog \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/payouts\/trading-catalog`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/payouts\/{id}":{"get":{"operationId":"business.api.payouts.show","description":"`{id}` is the payout UUID returned at creation. Ids are scoped to the authenticated\nmerchant \u2014 an unknown or foreign id returns 404 `NOT_FOUND`. Poll it (or subscribe to\nwebhooks) to follow the payout from creation through broadcast to its final status.","summary":"A single payout in the stable vendor shape (status, amounts, tx hash, trade metadata)","tags":["Payouts"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"id","in":"query","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9._-]+$","maxLength":128}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"payout":{"type":["object","null"],"additionalProperties":{}}},"required":["payout"]}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"Payout not found"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/payouts\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nPAYOUT_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/payouts\/${PAYOUT_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/payouts\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst payoutId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/payouts\/${payoutId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/fiat-payouts":{"post":{"operationId":"business.api.fiat-payouts.store","description":"`amount` is in USD and is converted into the selected fiat at the current rate; the\nrail-specific recipient fields go in `details` (the required keys per rail come from\n`fiat-payouts\/rails`). The amount plus fee is reserved on the USD ledger immediately, and\nthe payout resource is returned with 201. Rails on a provider-managed corridor are\ndispatched automatically; the rest await manual approval. A restricted account receives\n403 `MERCHANT_RESTRICTED`; rejections such as an unknown rail, an unavailable rate or\ninsufficient balance are 400 `PAYOUT_REQUEST_FAILED` with the reason.","summary":"Request a fiat payout on one of the rails `rails` advertises","tags":["Payouts"],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/FiatPayoutFormRequest"}}}},"responses":{"201":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/PayoutResource"}},"required":["success","data"]}}}},"400":{"description":"Only the service's own rejections are user-facing; anything else is an internal fault.","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"PAYOUT_REQUEST_FAILED"},"message":{"type":"string"}},"required":["code","message"]}},"required":["success","error"]}}}},"403":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"MERCHANT_RESTRICTED"},"message":{"anyOf":[{"type":"string"},{"type":"string","enum":["Your account is restricted from requesting payouts"]}]}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/fiat-payouts \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/fiat-payouts\"\nBODY='{\"amount\":1,\"fiat_currency_id\":1,\"rail\":\"example\",\"details\":[]}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/fiat-payouts \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/fiat-payouts`;\nconst body = JSON.stringify({\"amount\":1,\"fiat_currency_id\":1,\"rail\":\"example\",\"details\":[]});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]},"get":{"operationId":"business.api.fiat-payouts.index","description":"Filterable by `status` and the `date_from`\/`date_to` window; fixed page size of 20 with\nthe paginator counters in `meta`. Crypto payouts are listed separately under `payouts`.","summary":"The merchant's fiat payouts, newest first","tags":["Payouts"],"parameters":[{"name":"status","in":"query","schema":{"type":["string","null"],"enum":["pending","approved","processing","completed","rejected","cancelled","failed"]}},{"name":"date_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"date_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"page","in":"query","schema":{"type":["integer","null"],"minimum":1}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"array","items":{"$ref":"#\/components\/schemas\/MerchantPayout"}},"meta":{"type":"object","properties":{"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"required":["current_page","last_page","per_page","total"]}},"required":["success","data","meta"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/fiat-payouts \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/fiat-payouts\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/fiat-payouts \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/fiat-payouts`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/fiat-payouts\/rails":{"get":{"operationId":"business.api.fiat-payouts.rails","description":"Each currency lists the rails enabled for it and the recipient fields each rail requires\n\u2014 this is exactly the catalog `POST fiat-payouts` validates against, so build payout\nforms from it rather than hardcoding rails or field sets. Currencies with no rail\nenabled are not advertised.","summary":"The fiat currencies a payout can be sent in, with their rails","tags":["Payouts"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"array","items":{}}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/fiat-payouts\/rails \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/fiat-payouts\/rails\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/fiat-payouts\/rails \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/fiat-payouts\/rails`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/fiat-payouts\/quote":{"get":{"operationId":"business.api.fiat-payouts.quote","description":"Amount-aware: provider fees are amount-sensitive, so pass `amount` (USD) to price your\nactual payout \u2014 an amount-less call is indicative only. When no fresh rate can be\nobtained the endpoint answers 422 `RATE_UNAVAILABLE`; retry shortly.","summary":"Live USD\u2192fiat quote for a payout","tags":["Payouts"],"parameters":[{"name":"fiat_id","in":"query","required":true,"schema":{"type":"integer"}},{"name":"amount","in":"query","description":"Rates are amount-aware (provider quotes fold in an amount-sensitive fee),\nbut an amount-less indicative quote is still valid.","schema":{"type":["number","null"]}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":["object","null"],"properties":{"rate":{"type":"string"},"source":{"type":"string"}},"required":["rate","source"]}},"required":["success","data"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/fiat-payouts\/quote \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/fiat-payouts\/quote\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/fiat-payouts\/quote \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/fiat-payouts\/quote`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/fiat-payouts\/{id}":{"get":{"operationId":"business.api.fiat-payouts.show","description":"Ids are scoped to the authenticated merchant. A crypto payout id resolves as a miss here\n\u2014 it belongs to `payouts` \u2014 so an unknown, foreign or non-fiat id uniformly returns 404\n`PAYOUT_NOT_FOUND`.","summary":"A single fiat payout","tags":["Payouts"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/PayoutResource"}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"PAYOUT_NOT_FOUND"},"message":{"type":"string","const":"Payout not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/fiat-payouts\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nFIAT_PAYOUT_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/fiat-payouts\/${FIAT_PAYOUT_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/fiat-payouts\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst fiatPayoutId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/fiat-payouts\/${fiatPayoutId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks":{"get":{"operationId":"business.api.webhooks.index","description":"The delivery log of every webhook event emitted to the merchant's endpoint, filterable by\n`status`, `event_type`, `invoice_id` and the `created_from`\/`created_to` window.\nPaginated via `per_page` (default 20, max 100) with the paginator counters in `meta`.","summary":"The merchant's webhook deliveries, newest first","tags":["Webhooks"],"parameters":[{"name":"status","in":"query","schema":{"type":["string","null"],"enum":["pending","processing","delivered","pending_retry","failed","skipped_duplicate"]}},{"name":"event_type","in":"query","schema":{"type":["string","null"],"enum":["invoice.created","invoice.pending","invoice.payment_detecting","invoice.confirming","invoice.paid","invoice.underpaid","invoice.overpaid","invoice.settled","invoice.expired","invoice.cancelled","invoice.rejected","invoice.late_payment","invoice.aml_review","topup.received","refund.initiated","refund.completed","payout.created","payout.completed","payout.failed"]}},{"name":"invoice_id","in":"query","schema":{"type":["string","null"],"format":"uuid"}},{"name":"created_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"created_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"per_page","in":"query","schema":{"type":["integer","null"],"minimum":1,"maximum":100}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/WebhookCollection"},"meta":{"type":"object","properties":{"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"required":["current_page","last_page","per_page","total"]}},"required":["success","data","meta"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/webhooks \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/webhooks \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/webhooks`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks\/event-types":{"get":{"operationId":"business.api.webhooks.event-types","description":"A static catalog, identical for every merchant \u2014 use it to build event filters or\nsubscription UIs instead of hardcoding type strings, and to discover new event types as\nthe platform adds them.","summary":"Every event type the platform can emit, with its label, description and priority","tags":["Webhooks"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"label":{"type":"string","enum":["Invoice Created","Invoice Pending Payment","Payment Detecting","Payment Confirming","Invoice Paid","Invoice Underpaid","Invoice Overpaid","Invoice Settled","Invoice Expired","Invoice Cancelled","Invoice Rejected","Late Payment Received","Invoice Under AML Review","Standing Address Top-Up Received","Refund Initiated","Refund Completed","Payout Created","Payout Completed","Payout Failed"]},"description":{"type":"string","enum":["Sent when a new invoice is created","Sent when invoice is pending payment (currency selected)","Sent when a payment is detected in the mempool","Sent when payment is confirming on the blockchain","Sent when invoice is fully paid","Sent when invoice receives partial payment","Sent when invoice receives excess payment","Sent when payment is settled and funds transferred","Sent when invoice expires without payment","Sent when invoice is cancelled","Sent when a mispaid invoice is declined by the operator or merchant","Sent when payment received after expiry","Sent when payment is held for AML review before settlement","Sent when a transfer to a standing address is credited to the merchant balance","Sent when a refund is initiated","Sent when a refund is completed","Sent when a payout is requested and its amount is reserved","Sent when a payout is settled and funds have left the account","Sent when a payout fails, is rejected or is cancelled and the reserve returns"]},"priority":{"type":"string"}},"required":["type","label","description","priority"]}}},"required":["success","data"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/webhooks\/event-types \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\/event-types\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/webhooks\/event-types \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/webhooks\/event-types`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks\/statistics":{"get":{"operationId":"business.api.webhooks.statistics","description":"Aggregated delivery statistics for the merchant's webhooks. Bound the window with\n`date_from`\/`date_to`, or omit both to aggregate over the merchant's whole history \u2014\nuseful for monitoring endpoint health without paging through the delivery log.","summary":"Delivery success\/failure counters over an optional date window","tags":["Webhooks"],"parameters":[{"name":"date_from","in":"query","schema":{"type":["string","null"],"format":"date-time"}},{"name":"date_to","in":"query","schema":{"type":["string","null"],"format":"date-time"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"total":{"type":"integer"},"delivered":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"delivery_rate":{"type":"number"},"by_event_type":{"type":"object","additionalProperties":{}},"avg_delivery_time_ms":{"type":["number","null"]}},"required":["total","delivered","failed","pending","delivery_rate","by_event_type","avg_delivery_time_ms"]}},"required":["success","data"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/webhooks\/statistics \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\/statistics\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/webhooks\/statistics \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/webhooks\/statistics`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks\/test":{"post":{"operationId":"business.api.webhooks.test","description":"Sent synchronously (not queued) \u2014 the whole point is the immediate response code.","summary":"Deliver a signed test payload so an integrator can prove their endpoint works","tags":["Webhooks"],"requestBody":{"content":{"application\/json":{"schema":{"$ref":"#\/components\/schemas\/SendTestWebhookRequest"}}}},"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"webhook_url":{"type":"string"},"response_code":{"type":"string"},"response_successful":{"type":"string"},"payload_sent":{"type":"string"},"signature_header":{"type":"string"}},"required":["webhook_url","response_code","response_successful","payload_sent","signature_header"]}},"required":["success","data"]}}}},"502":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"DELIVERY_FAILED"},"message":{"type":"string"},"webhook_url":{"type":"string"}},"required":["code","message","webhook_url"]}},"required":["success","error"]}}}},"400":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NO_WEBHOOK_URL"},"message":{"type":"string","const":"No webhook URL provided or configured"}},"required":["code","message"]}},"required":["success","error"]}}}},"422":{"$ref":"#\/components\/responses\/ValidationException"}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/webhooks\/test \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\/test\"\nBODY='{}'\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\" \\\n -H \"Content-Type: application\/json\" \\\n --data \"${BODY}\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/webhooks\/test \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/webhooks\/test`;\nconst body = JSON.stringify({});\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n 'Content-Type': 'application\/json',\n },\n body,\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n 'Content-Type: application\/json',\n ],\n CURLOPT_POSTFIELDS => $body,\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks\/{id}":{"get":{"operationId":"business.api.webhooks.show","description":"The webhook event with every delivery attempt loaded \u2014 timestamps, response codes and\nerrors \u2014 for debugging a specific missed delivery. Ids are scoped to the authenticated\nmerchant; an unknown or foreign id returns 404 `NOT_FOUND`.","summary":"A single delivery with its attempt history","tags":["Webhooks"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"$ref":"#\/components\/schemas\/WebhookResource"}},"required":["success","data"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"Webhook not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# GET \/api\/v1\/business\/webhooks\/{id} \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nWEBHOOK_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\/${WEBHOOK_ID}\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.GET.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X GET \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ GET \/api\/v1\/business\/webhooks\/{id} \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst webhookId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/webhooks\/${webhookId}`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.GET.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'GET',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'GET',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhooks\/{id}\/retry":{"post":{"operationId":"business.api.webhooks.retry","description":"Retries the delivery synchronously and reports `immediate_success` together with the\nevent's `new_status` \u2014 a failed immediate attempt still leaves the event in the retry\nflow. An event that was already delivered is rejected with 400 `ALREADY_DELIVERED`;\nunknown or foreign ids return 404 `NOT_FOUND`.","summary":"Re-deliver a webhook that did not reach the endpoint","tags":["Webhooks"],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"webhook_id":{"type":"string"},"retry_initiated":{"type":"boolean"},"immediate_success":{"type":"boolean"},"new_status":{"type":"string"}},"required":["webhook_id","retry_initiated","immediate_success","new_status"]}},"required":["success","data"]}}}},"400":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"ALREADY_DELIVERED"},"message":{"type":"string","const":"Webhook was already delivered successfully"}},"required":["code","message"]}},"required":["success","error"]}}}},"404":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"NOT_FOUND"},"message":{"type":"string","const":"Webhook not found"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/webhooks\/{id}\/retry \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\nWEBHOOK_ID=\"123e4567-e89b-12d3-a456-426614174000\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhooks\/${WEBHOOK_ID}\/retry\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/webhooks\/{id}\/retry \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\nconst webhookId = '123e4567-e89b-12d3-a456-426614174000';\n\nconst requestPath = `\/api\/v1\/business\/webhooks\/${webhookId}\/retry`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}},"\/business\/webhook-secret\/rotate":{"post":{"operationId":"business.api.webhook-secret.rotate","description":"Requires the `settings:write` permission on the signing key (403 `PERMISSION_DENIED`\notherwise). The new secret is returned once \u2014 update your webhook handler with it\nimmediately, because every delivery from this moment on is signed with the new secret\nand signatures made with the old one will no longer verify.","summary":"Issue a new webhook signing secret. The old one stops validating immediately","tags":["Webhooks"],"responses":{"200":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"data":{"type":"object","properties":{"webhook_secret":{"type":"string"}},"required":["webhook_secret"]},"meta":{"type":"object","properties":{"warning":{"type":"string","const":"Update your webhook handler immediately. The old secret is now invalid."}},"required":["warning"]}},"required":["success","data","meta"]}}}},"403":{"description":"","content":{"application\/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"},"error":{"type":"object","properties":{"code":{"type":"string","const":"PERMISSION_DENIED"},"message":{"type":"string","const":"This API key does not have permission to modify settings"}},"required":["code","message"]}},"required":["success","error"]}}}}},"x-codeSamples":[{"lang":"Shell","label":"cURL (signed)","source":"# POST \/api\/v1\/business\/webhook-secret\/rotate \u2014 HMAC-signed request (see the Authentication guide).\n# Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nAPI_KEY=\"pk_live_YOUR_KEY\"\nAPI_SECRET=\"YOUR_SECRET\"\nBASE_URL=\"${BASE_URL:-https:\/\/exchange.1gogh.io}\"\n\nREQUEST_PATH=\"\/api\/v1\/business\/webhook-secret\/rotate\"\nBODY=''\nTIMESTAMP=\"$(date +%s)\"\nNONCE=\"$(uuidgen 2>\/dev\/null || cat \/proc\/sys\/kernel\/random\/uuid 2>\/dev\/null || openssl rand -hex 16)\"\n\n# Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nSIGNATURE=\"v1=$(printf '%s' \"${TIMESTAMP}.POST.${REQUEST_PATH}.${BODY}\" \\\n | openssl dgst -sha256 -hmac \"${API_SECRET}\" -r | cut -d' ' -f1)\"\n\ncurl -sS -X POST \"${BASE_URL}${REQUEST_PATH}\" \\\n -H \"X-API-Key: ${API_KEY}\" \\\n -H \"X-Timestamp: ${TIMESTAMP}\" \\\n -H \"X-Nonce: ${NONCE}\" \\\n -H \"X-Signature: ${SIGNATURE}\" \\\n -H \"User-Agent: my-integration\/1.0\" \\\n -H \"Accept: application\/json\"\n"},{"lang":"Node","label":"Node.js (signed)","source":"\/\/ POST \/api\/v1\/business\/webhook-secret\/rotate \u2014 HMAC-signed request (see the Authentication guide). Node 18+.\n\/\/ Replace pk_live_YOUR_KEY \/ YOUR_SECRET with the key pair issued in the 1GOGH Business portal.\nconst crypto = require('node:crypto');\n\nconst API_KEY = 'pk_live_YOUR_KEY';\nconst API_SECRET = 'YOUR_SECRET';\nconst BASE_URL = process.env.BASE_URL || 'https:\/\/exchange.1gogh.io';\n\nconst requestPath = `\/api\/v1\/business\/webhook-secret\/rotate`;\nconst body = '';\nconst timestamp = String(Math.floor(Date.now() \/ 1000));\nconst nonce = crypto.randomUUID();\n\n\/\/ Canonical string: {timestamp}.{METHOD}.{path}.{body} \u2014 leading-slash path; an empty body leaves a trailing dot.\nconst signature = 'v1=' + crypto.createHmac('sha256', API_SECRET)\n .update(`${timestamp}.POST.${requestPath}.${body}`)\n .digest('hex');\n\nfetch(BASE_URL + requestPath, {\n method: 'POST',\n headers: {\n 'X-API-Key': API_KEY,\n 'X-Timestamp': timestamp,\n 'X-Nonce': nonce,\n 'X-Signature': signature,\n 'User-Agent': 'my-integration\/1.0',\n Accept: 'application\/json',\n },\n}).then((res) => res.json()).then(console.log);\n"},{"lang":"PHP","label":"PHP (signed)","source":" true,\n CURLOPT_CUSTOMREQUEST => 'POST',\n CURLOPT_HTTPHEADER => [\n 'X-API-Key: ' . $apiKey,\n 'X-Timestamp: ' . $timestamp,\n 'X-Nonce: ' . $nonce,\n 'X-Signature: ' . $signature,\n 'User-Agent: my-integration\/1.0',\n 'Accept: application\/json',\n ],\n]);\n\necho curl_exec($curl);\n"}]}}},"components":{"securitySchemes":{"apiKey":{"type":"apiKey","description":"HMAC-SHA256 signed request. Headers: X-API-Key (pk_live_\u2026), X-Timestamp (unix seconds), X-Nonce (uuid) and X-Signature. See the Guides for the exact signing payload.","in":"header","name":"X-API-Key"}},"schemas":{"ApiKeyCollection":{"type":"array","items":{},"title":"ApiKeyCollection"},"ApiKeyResource":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"integration_type":{"type":"string","description":"The kind of integration the key was issued for (e.g. a storefront plugin); null for\nordinary acquiring keys."},"public_key":{"type":"string"},"key_prefix":{"type":"string"},"secret_key_last4":{"type":"string"},"environment":{"type":"string"},"is_active":{"type":"string"},"permissions":{"type":"string"},"ip_whitelist":{"type":"string"},"rate_limit_per_minute":{"type":"string","description":"Rate limits"},"rate_limit_per_hour":{"type":"string"},"last_used_at":{"type":"string","description":"Usage stats"},"last_used_ip":{"type":"string"},"total_requests":{"type":"string"},"created_at":{"type":"string","description":"Timestamps"},"expires_at":{"type":"string"},"revoked_at":{"type":"string"}},"required":["id","name","integration_type","public_key","key_prefix","secret_key_last4","environment","is_active","permissions","ip_whitelist","rate_limit_per_minute","rate_limit_per_hour","last_used_at","last_used_ip","total_requests","created_at","expires_at","revoked_at"],"title":"ApiKeyResource"},"CancelInvoiceRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/acquiring\/invoices\/{id}\/cancel`.\n\n`reason` is optional free text recorded against the invoice. Cancelling requires the\n`invoice:cancel` permission \u2014 a distinct right from `invoice:create`; an unrestricted key\nalways passes.","properties":{"reason":{"type":["string","null"],"maxLength":500}},"title":"CancelInvoiceRequest"},"CreateApiKeyRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/api-keys`.\n\n`permissions` scopes what the key may do. Recognised values: `invoice:create`,\n`invoice:read`, `invoice:cancel`, `webhook:read`, `webhook:retry`, `refund:create`,\n`api_keys:write`, `settings:write`. An empty (or omitted) list creates an unrestricted key\nwith full access \u2014 and only unrestricted keys may sign Business API requests, so a key\ncreated with a non-empty list is for other 1GOGH surfaces, not this one. Send only the\nvalues listed here: unrecognised strings still restrict the key without granting anything.\n\n`environment` (`live`, the default, or `test`) selects the key prefix\n(`pk_live_`\/`sk_live_` vs `pk_test_`\/`sk_test_`). There is no separate sandbox backend \u2014 a\n`test` key authenticates against the same live API and creates real invoices; use the\nprefix to segregate keys in your own configuration.\n\n`integration_type` is a short free-form label recording what the key was issued for (e.g. a\nstorefront plugin install). Descriptive only \u2014 it grants nothing.","properties":{"name":{"type":"string","maxLength":255},"integration_type":{"type":["string","null"],"description":"Optional label describing the integration the key is issued for (e.g. a storefront plugin).","maxLength":32},"environment":{"type":["string","null"],"description":"\"live\" (the default) issues pk_live_\/sk_live_ key prefixes; \"test\" issues pk_test_\/sk_test_.","enum":["live","test"]},"permissions":{"type":["array","null"],"items":{"type":"string","maxLength":100}},"ip_whitelist":{"type":["array","null"],"items":{"type":"string","maxLength":64}}},"required":["name"],"title":"CreateApiKeyRequest"},"CreateDepositIntentRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/acquiring\/deposit-intents`.\n\nThe caller states the deposit asset outright: `currency` is the symbol (e.g. `USDT`,\ncase-insensitive) and `network` the network slug (e.g. `trc20`) \u2014 there is no server-side\ndefault; valid combinations come from `acquiring\/assets`. The `Idempotency-Key` header is\nmirrored into `idempotency_key` and makes retries safe.","properties":{"amount":{"type":"number"},"currency":{"type":"string","pattern":"^[A-Za-z0-9]+$","maxLength":32},"network":{"type":"string","pattern":"^[a-z0-9._-]+$","maxLength":64},"external_id":{"type":["string","null"],"maxLength":255},"description":{"type":["string","null"],"maxLength":500},"metadata":{"type":["array","null"],"items":{"type":"string"}},"idempotency_key":{"type":["string","null"],"maxLength":255}},"required":["amount","currency","network"],"title":"CreateDepositIntentRequest"},"CreateInvoiceRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/acquiring\/invoices`.\n\n`amount` is in USD and bounded by the merchant's per-invoice limits; `currency` currently\naccepts only `USD` and defaults to it. Customer details, `metadata`, `line_items` and the\n`redirect_url`\/`cancel_url`\/`webhook_url` overrides are all optional. Requires the\n`invoice:create` permission (an unrestricted key always passes).","properties":{"amount":{"type":"number","pattern":"^\\d+(\\.\\d+)?$"},"currency":{"type":"string","description":"USD, or an asset symbol (Stage 3) \u2014 the service validates the asset\nagainst the merchant-enabled currency catalog.","maxLength":10},"network":{"type":"string","description":"Required with an asset currency: an asset invoice is pinned to one\nnetwork at creation. Ignored for USD.","maxLength":64},"external_id":{"type":["string","null"],"maxLength":255},"description":{"type":["string","null"],"maxLength":1000},"customer_email":{"type":["string","null"],"format":"email","maxLength":255},"customer_name":{"type":["string","null"],"maxLength":255},"redirect_url":{"type":["string","null"],"format":"uri","maxLength":2000},"cancel_url":{"type":["string","null"],"format":"uri","maxLength":2000},"webhook_url":{"type":["string","null"],"format":"uri","maxLength":2000},"fee_paid_by":{"type":["string","null"],"description":"Who bears the processing fee. `payer` asks the payer for amount + fee and credits the\nmerchant in full; `merchant` (the default, and every historical invoice) asks for the\namount and credits it minus the fee.","enum":["merchant","payer"]},"expires_in":{"type":["integer","null"],"description":"How long the payer has, in minutes. Constrained to the windows the cabinet offers\nrather than left free: an arbitrary value would let a caller mint an invoice that\noutlives any rate lock, or one that expires before a payer can open the page.","enum":["15","30","60","1440","10080"]},"customer_metadata":{"type":["array","null"],"items":{"type":"string","maxLength":1000}},"metadata":{"type":["array","null"],"items":{"type":"string","maxLength":1000}},"line_items":{"type":["array","null"],"items":{"type":"object","properties":{"name":{"type":"string","maxLength":255},"quantity":{"type":"integer","minimum":1},"price":{"type":"number","minimum":0},"description":{"type":["string","null"],"maxLength":500}}},"maxItems":50}},"required":["amount"],"title":"CreateInvoiceRequest"},"CreatePayoutRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/payouts`.\n\n`amount` is denominated in `currency` and sent to `address` on `network`, with an optional\n`dest_tag` for networks that require one. `external_id` is the caller's own reference and\ndoubles as the idempotency key when no `Idempotency-Key` header is sent.","properties":{"amount":{"type":"number"},"currency":{"type":"string","maxLength":32},"address":{"type":"string","maxLength":1024},"network":{"type":"string","maxLength":64},"dest_tag":{"type":["string","null"],"maxLength":256},"external_id":{"type":["string","null"],"maxLength":255},"deposit_invoice_id":{"type":["string","null"],"format":"uuid"},"funding_source":{"type":["string","null"],"description":"\"balance\" pays out of the merchant USD balance and needs no deposit invoice;\nomitted keeps the deployment default (forwarding one confirmed deposit).","enum":["balance","deposit"]},"metadata":{"type":["array","null"],"items":{"type":"string"}},"idempotency_key":{"type":["string","null"],"maxLength":255},"unit":{"type":["string","null"],"description":"Stage 3 (GOEX-324): 'USD' (default, byte-for-byte the legacy flow \u2014 amount\nis converted to USD and debited from the USD balance) or exactly `currency`\n(the payout is debited from THAT asset's own ledger balance, no conversion\nanywhere). Any other value is rejected \u2014 cross-asset funding is not this task.","enum":["USD"],"maxLength":16}},"required":["amount","currency","address","network"],"title":"CreatePayoutRequest"},"FiatPayoutFormRequest":{"type":"object","description":"The payload of a merchant fiat payout request.\n\n`rail` selects one of the payout methods the rails catalog advertises; the recipient fields\nthat rail requires are validated as `details.{field}` keys, so the required shape of\n`details` depends on the rail chosen. `amount` is in USD.","properties":{"amount":{"type":"number","minimum":1},"fiat_currency_id":{"type":"integer"},"rail":{"type":"string"},"details":{"type":"array","items":{"type":"string"},"minItems":1},"notes":{"type":["string","null"],"maxLength":500}},"required":["amount","fiat_currency_id","rail","details"],"title":"FiatPayoutFormRequest"},"InvoiceCollection":{"type":"array","items":{},"title":"InvoiceCollection"},"InvoiceResource":{"type":"object","properties":{"id":{"type":"string"},"external_id":{"type":"string"},"status":{"type":"string"},"previous_status":{"type":"string"},"unit":{"description":"Amounts. `unit` is the invoice's accounting unit (Stage 3): 'USD' for\nthe legacy flow, the asset symbol for an asset-denominated invoice \u2014\nin which case amount_crypto is the fixed invoice amount and the USD\nfields honestly read zero. Legacy rows may carry a NULL currency \u2014\nthat is the USD flow, same coalesce as the ledger writers.","anyOf":[{"type":"string"},{"type":"string","enum":["USD"]}]},"amount_usd":{"type":"string"},"amount_crypto":{"type":["string","null"]},"amount_received_crypto":{"type":["string","null"]},"amount_received_usd":{"type":["string","null"]},"currency":{"type":"object","description":"Currency details","properties":{"code":{"type":"string"},"symbol":{"type":"string"},"name":{"type":"string"},"network":{"type":"string"},"network_slug":{"type":"string"}},"required":["code","symbol","name","network","network_slug"]},"rate_usd":{"type":["string","null"],"description":"Rate information"},"rate_source":{"type":"string"},"rate_locked_at":{"type":"string"},"rate_expires_at":{"type":"string"},"rate_extended_count":{"type":"string"},"deposit_address":{"type":"string","description":"Payment details"},"deposit_memo":{"type":"string"},"fee_percent":{"type":"string","description":"Fees"},"fee_fixed_usd":{"type":["string","null"]},"fee_paid_by":{"type":"string","description":"Which side the fee came out of. Without it an integrator cannot tell whether\n`amount_crypto` is the invoice amount or the invoice amount plus the fee."},"fee_amount_usd":{"type":["string","null"]},"fee_amount_crypto":{"type":["string","null"]},"net_amount_usd":{"type":["string","null"]},"net_amount_crypto":{"type":["string","null"]},"customer_email":{"type":"string","description":"Customer details"},"customer_name":{"type":"string"},"description":{"type":"string"},"line_items":{"type":"string","description":"Line items"},"metadata":{"type":"string","description":"Metadata"},"customer_metadata":{"type":"string"},"redirect_url":{"type":"string","description":"URLs"},"cancel_url":{"type":"string"},"webhook_url":{"type":"string"},"created_at":{"type":"string","description":"Timestamps"},"expires_at":{"type":"string"},"payment_expires_at":{"type":"string"},"currency_selected_at":{"type":"string"},"first_payment_at":{"type":"string"},"paid_at":{"type":"string"},"settled_at":{"type":"string"},"expired_at":{"type":"string"},"cancelled_at":{"type":"string"},"payment_classification":{"type":"string","description":"Payment classification"},"payment_variance_percent":{"type":"string"},"aml_stage":{"type":["string","null"],"description":"AML stage derived from the latest payment","enum":["checking","hold",null]},"payments":{"type":"array","description":"Related data","items":{"$ref":"#\/components\/schemas\/PaymentResource"}},"timeline":{"type":"array","items":{"$ref":"#\/components\/schemas\/TimelineResource"}},"environment":{"type":"string","description":"Environment"}},"required":["id","external_id","status","previous_status","unit","amount_usd","amount_crypto","amount_received_crypto","amount_received_usd","rate_usd","rate_source","rate_locked_at","rate_expires_at","rate_extended_count","deposit_address","deposit_memo","fee_percent","fee_fixed_usd","fee_paid_by","fee_amount_usd","fee_amount_crypto","net_amount_usd","net_amount_crypto","customer_email","customer_name","description","line_items","metadata","customer_metadata","redirect_url","cancel_url","webhook_url","created_at","expires_at","payment_expires_at","currency_selected_at","first_payment_at","paid_at","settled_at","expired_at","cancelled_at","payment_classification","payment_variance_percent","aml_stage","environment"],"title":"InvoiceResource"},"MerchantPayout":{"type":"object","properties":{"id":{"type":"string"},"merchant_id":{"type":"string"},"amount_usd":{"type":"string"},"fee_usd":{"type":"string"},"net_amount_usd":{"type":"string"},"currency_id":{"type":["integer","null"]},"network_id":{"type":["integer","null"]},"amount_crypto":{"type":["string","null"]},"rate_usd":{"type":["string","null"]},"payout_address":{"type":["string","null"]},"payout_memo":{"type":["string","null"]},"status":{"type":"string"},"rejection_reason":{"type":["string","null"]},"txn_hash":{"type":["string","null"]},"explorer_url":{"type":["string","null"]},"requested_by":{"type":["integer","null"]},"processed_by":{"type":["integer","null"]},"requested_at":{"type":["string","null"],"format":"date-time"},"approved_at":{"type":["string","null"],"format":"date-time"},"processed_at":{"type":["string","null"],"format":"date-time"},"completed_at":{"type":["string","null"],"format":"date-time"},"rejected_at":{"type":["string","null"],"format":"date-time"},"merchant_notes":{"type":["string","null"]},"admin_notes":{"type":["string","null"]},"reference":{"type":"string"},"created_at":{"type":["string","null"],"format":"date-time"},"updated_at":{"type":["string","null"],"format":"date-time"},"error_message":{"type":["string","null"]},"error_code":{"type":["string","null"]},"retry_count":{"type":"integer"},"last_retry_at":{"type":["string","null"],"format":"date-time"},"failed_at":{"type":["string","null"],"format":"date-time"},"payout_type":{"type":"string"},"fiat_currency_id":{"type":["integer","null"]},"fiat_amount":{"type":["string","null"]},"rate_usd_fiat":{"type":["string","null"]},"rate_source":{"type":["string","null"]},"rail":{"type":["string","null"]},"rail_details":{"type":["array","null"],"items":{}},"unit":{"type":"string"},"fee_amount_asset":{"type":["string","null"]}},"required":["id","merchant_id","amount_usd","fee_usd","net_amount_usd","currency_id","network_id","amount_crypto","rate_usd","payout_address","payout_memo","status","rejection_reason","txn_hash","explorer_url","requested_by","processed_by","requested_at","approved_at","processed_at","completed_at","rejected_at","merchant_notes","admin_notes","reference","created_at","updated_at","error_message","error_code","retry_count","last_retry_at","failed_at","payout_type","fiat_currency_id","fiat_amount","rate_usd_fiat","rate_source","rail","rail_details","unit","fee_amount_asset"],"title":"MerchantPayout"},"MerchantResource":{"type":"object","properties":{"id":{"type":"string"},"business_name":{"type":"string"},"business_email":{"type":"string"},"status":{"type":"string"},"verification_status":{"type":"string"},"default_webhook_url":{"type":"string","description":"Settings"},"webhook_events":{"type":"string"},"ip_whitelist":{"type":"string"},"fee_percent":{"type":"string","description":"Limits"},"daily_volume_limit_usd":{"type":"string"},"monthly_volume_limit_usd":{"type":"string"},"single_invoice_limit_usd":{"type":"string"},"min_invoice_amount_usd":{"type":"string"},"total_invoices":{"type":"string","description":"Statistics"},"paid_invoices":{"type":"string"},"total_volume_usd":{"type":"string"},"total_fees_usd":{"type":"string"},"features":{"type":"string","description":"Features"},"auto_payout_enabled":{"type":"string"},"auto_payout_threshold":{"type":"string"},"auto_payout_address":{"type":"string"},"website_url":{"type":"string","description":"Brand"},"logo_url":{"type":"string"},"created_at":{"type":"string","description":"Timestamps"},"verified_at":{"type":"string"}},"required":["id","business_name","business_email","status","verification_status","default_webhook_url","webhook_events","ip_whitelist","fee_percent","daily_volume_limit_usd","monthly_volume_limit_usd","single_invoice_limit_usd","min_invoice_amount_usd","total_invoices","paid_invoices","total_volume_usd","total_fees_usd","features","auto_payout_enabled","auto_payout_threshold","auto_payout_address","website_url","logo_url","created_at","verified_at"],"title":"MerchantResource"},"MerchantUnitBalanceResource":{"type":"object","properties":{"unit":{"type":"string"},"available":{"type":"string"},"reserved":{"type":"string"}},"required":["unit","available","reserved"],"title":"MerchantUnitBalanceResource"},"PaymentCollection":{"type":"array","items":{},"title":"PaymentCollection"},"PaymentResource":{"type":"object","properties":{"id":{"type":"string"},"invoice_id":{"type":"string"},"status":{"type":"string"},"txn_hash":{"type":"string","description":"Transaction details"},"block_number":{"type":"string"},"from_address":{"type":"string"},"to_address":{"type":"string"},"memo":{"type":"string"},"amount_crypto":{"type":"string","description":"Amounts"},"amount_usd":{"type":"string"},"rate_usd_at_detection":{"type":"string"},"confirmations":{"type":"string","description":"Confirmations"},"required_confirmations":{"type":"string"},"confirmation_progress":{"anyOf":[{"type":"null"},{"type":"object"},{"type":"integer","enum":[100]}]},"classification":{"type":"string","description":"Classification"},"is_late_payment":{"type":"string"},"counted_in_total":{"type":"string"},"explorer_url":{"type":"string","description":"URLs"},"detected_at":{"type":"string","description":"Timestamps"},"first_confirmation_at":{"type":"string"},"confirmed_at":{"type":"string"},"failed_at":{"type":"string"},"aml_status":{"type":"string","description":"AML fields"},"aml_risk_score":{"type":"string"},"aml_check_id":{"type":"string"},"aml_report_url":{"type":"string"},"aml_checked_at":{"type":"string"},"invoice":{"description":"Related invoice (when loaded separately)","$ref":"#\/components\/schemas\/InvoiceResource"}},"required":["id","invoice_id","status","txn_hash","block_number","from_address","to_address","memo","amount_crypto","amount_usd","rate_usd_at_detection","confirmations","required_confirmations","confirmation_progress","classification","is_late_payment","counted_in_total","explorer_url","detected_at","first_confirmation_at","confirmed_at","failed_at","aml_status","aml_risk_score","aml_check_id","aml_report_url","aml_checked_at"],"title":"PaymentResource"},"PayoutResource":{"type":"object","properties":{"id":{"type":"string"},"reference":{"type":"string"},"rail":{"type":"string","description":"Rail: how the money leaves the platform, and the concrete method inside that rail.","enum":["fiat","crypto"]},"method":{"type":"string"},"method_label":{"type":["string","null"]},"recipient":{"anyOf":[{"type":"string"},{"type":"null"}]},"unit":{"description":"Accounting unit (Stage 3, GOEX-324): 'USD' for the legacy flow, the asset\nsymbol for an asset-denominated payout \u2014 in which case the USD fields\nbelow honestly read zero and amount_crypto\/fee_amount_asset carry the\nreal figures debited from that asset's own ledger balance.","anyOf":[{"type":"string"},{"type":"string","enum":["USD"]}]},"amount_usd":{"type":"string","description":"Amounts (USD ledger). Fee is on top: total_debited_usd = amount_usd + fee_usd."},"fee_usd":{"type":"string"},"net_amount_usd":{"type":"string"},"total_debited_usd":{"type":"string"},"amount_crypto":{"type":["string","null"]},"fee_amount_asset":{"type":["string","null"]},"currency":{"type":"string"},"fiat_amount":{"type":["string","null"],"description":"Fiat leg (null on crypto payouts)."},"rate_usd_fiat":{"type":["string","null"]},"rate_source":{"type":["string","null"]},"network":{"type":["object","null"],"description":"Crypto leg (null on fiat payouts).","properties":{"name":{"type":"string"},"slug":{"type":"string"}},"required":["name","slug"]},"address":{"type":"string"},"memo":{"type":"string"},"status":{"type":"string","description":"Settlement"},"can_be_cancelled":{"type":"string"},"txn_hash":{"type":["string","null"]},"explorer_url":{"type":["string","null"]},"failure_reason":{"type":"string"},"notes":{"type":"string","description":"The merchant's own note on the request \u2014 `admin_notes` stays internal."},"requested_at":{"type":"string","description":"Timestamps \u2014 the status transitions a payout detail view walks through."},"approved_at":{"type":"string"},"processed_at":{"type":"string"},"completed_at":{"type":"string"},"rejected_at":{"type":"string"},"failed_at":{"type":"string"},"created_at":{"type":"string"},"updated_at":{"type":"string"}},"required":["id","reference","rail","method","method_label","recipient","unit","amount_usd","fee_usd","net_amount_usd","total_debited_usd","amount_crypto","fee_amount_asset","currency","fiat_amount","rate_usd_fiat","rate_source","network","address","memo","status","can_be_cancelled","txn_hash","explorer_url","failure_reason","notes","requested_at","approved_at","processed_at","completed_at","rejected_at","failed_at","created_at","updated_at"],"title":"PayoutResource"},"RefundInvoiceRequest":{"type":"object","description":"The payload of `POST api\/v1\/business\/acquiring\/invoices\/{id}\/refund`.\n\n`destination_address` is where the refund is sent on-chain; omit `amount` to refund the full\nrefundable amount. Requires the `refund:create` permission (an unrestricted key always\npasses).","properties":{"amount":{"type":["number","null"],"minimum":0},"destination_address":{"type":"string","maxLength":255},"destination_memo":{"type":["string","null"],"maxLength":255},"reason":{"type":["string","null"],"maxLength":500},"refund_type":{"type":["string","null"],"enum":["full","partial","overpayment"]}},"required":["destination_address"],"title":"RefundInvoiceRequest"},"SendTestWebhookRequest":{"type":"object","description":"The payload of the \"send test webhook\" probe.\n\n`url` is optional \u2014 when omitted the delivery goes to the merchant's configured default\nwebhook URL.","properties":{"url":{"type":["string","null"],"format":"uri","maxLength":500}},"title":"SendTestWebhookRequest"},"TimelineResource":{"type":"object","properties":{"id":{"type":"string"},"event_type":{"type":"string"},"source":{"type":"string"},"old_status":{"type":"string"},"new_status":{"type":"string"},"event_data":{"type":"string"},"actor_type":{"type":"string"},"occurred_at":{"type":"string"}},"required":["id","event_type","source","old_status","new_status","event_data","actor_type","occurred_at"],"title":"TimelineResource"},"WebhookAttemptResource":{"type":"object","properties":{"id":{"type":"string"},"attempt_number":{"type":"string"},"status":{"type":"string"},"response_code":{"type":"string"},"response_time_ms":{"type":"string"},"error_message":{"type":"string"},"error_code":{"type":"string"},"attempted_at":{"type":"string"}},"required":["id","attempt_number","status","response_code","response_time_ms","error_message","error_code","attempted_at"],"title":"WebhookAttemptResource"},"WebhookCollection":{"type":"array","items":{},"title":"WebhookCollection"},"WebhookResource":{"type":"object","properties":{"id":{"type":"string"},"invoice_id":{"type":"string"},"payout_id":{"type":"string"},"event_type":{"type":"string"},"priority":{"type":"string"},"status":{"type":"string"},"webhook_url":{"type":"string","description":"Delivery info"},"idempotency_key":{"type":"string"},"attempt_count":{"type":"string","description":"Attempts"},"max_attempts":{"type":"string"},"last_attempt_at":{"type":"string"},"next_retry_at":{"type":"string"},"last_response_code":{"type":"string","description":"Last response"},"last_response_time_ms":{"type":"string"},"last_failure_reason":{"type":"string"},"payload_hash":{"type":"string","description":"Payload (without sensitive data)"},"payload":{"type":"string"},"circuit_breaker_active":{"type":"string","description":"Circuit breaker"},"created_at":{"type":"string","description":"Timestamps"},"delivered_at":{"type":"string"},"failed_at":{"type":"string"},"attempts":{"type":"array","description":"Attempts (when loaded)","items":{"$ref":"#\/components\/schemas\/WebhookAttemptResource"}}},"required":["id","invoice_id","payout_id","event_type","priority","status","webhook_url","idempotency_key","attempt_count","max_attempts","last_attempt_at","next_retry_at","last_response_code","last_response_time_ms","last_failure_reason","payload_hash","circuit_breaker_active","created_at","delivered_at","failed_at"],"title":"WebhookResource"}},"responses":{"ValidationException":{"description":"Validation error","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Errors overview."},"errors":{"type":"object","description":"A detailed description of each field that failed validation.","additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["message","errors"]}}}},"AuthorizationException":{"description":"Authorization error","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Error overview."}},"required":["message"]}}}}}},"tags":[]}