CONFIDENTIAL

TPID Nexus Code

API Reference & Integration Guide

Version 1.0 Base URL https://api.pocikode.web.id Updated 28 August 2026

Introduction

Dokumen ini merupakan referensi lengkap API untuk platform pembayaran TPID Payment Docs. Seluruh endpoint, format request/response, dan mekanisme autentikasi yang tercantum di sini bersifat rahasia dan hanya untuk partner resmi yang telah diotorisasi.

This document covers five microservices that compose the TPID Nexus Core Platform: Core Auth, Core Payment, Core Transfer, Core Wallet, and Core Worker.

CONFIDENTIAL — Dokumen ini tidak boleh didistribusikan ke pihak ketiga tanpa persetujuan tertulis dari TPID Payment Docs. Pelanggaran akan diproses secara hukum.

Getting Started

Base URL

Environment	Base URL
Production	`https://api.pocikode.web.id`

Service Endpoints

Core Auth

https://api.pocikode.web.id/auth

Core Payment

https://api.pocikode.web.id/payment

Core Transfer

https://api.pocikode.web.id/transfer

Core Wallet

https://api.pocikode.web.id/wallet

Core Worker

https://api.pocikode.web.id/worker

Content Type

Semua request harus menggunakan Content-Type: application/json kecuali untuk endpoint upload yang menggunakan multipart/form-data.

Integration Flow

Alur integrasi standar untuk merchant baru:

1. Register account via POST /merchant-portal/auth/register

2. Verify OTP via POST /merchant-portal/auth/otp

3. Complete registration via POST /merchant-portal/auth/verify

4. Login via POST /merchant-portal/auth/login — receive JWT access token

5. Use access token for all authenticated endpoints

Authentication

Bearer Token (JWT)

Obtained via POST /merchant-portal/auth/login. Sertakan di setiap authenticated request:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

SNAP Signature

Untuk SNAP endpoints (QRIS partner), headers berikut wajib disertakan:

Header	Description
`X-CLIENT-KEY`	Partner client key
`X-TIMESTAMP`	ISO 8601 timestamp
`X-SIGNATURE`	HMAC-SHA256 signature
`X-PARTNER-ID`	Merchant/partner ID
`X-EXTERNAL-ID`	Unique request ID
`CHANNEL-ID`	Channel identifier

Internal Signature (HMAC)

Untuk internal endpoints antar microservice:

Header	Description
`X-TIMESTAMP`	ISO 8601 timestamp
`X-SIGNATURE`	Blake3 HMAC signature

Common Response Format

Semua endpoint menggunakan format respons berikut:

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "Human-readable description",
  "message_id": "API_CALL_xxxxx",
  "message_request_datetime": "2026-08-28T13:00:00+07:00"
}

SNAP Response Format

QRIS endpoints mengikuti format SNAP:

{
  "responseCode": "2004700",
  "responseMessage": "SUCCESS",
  "partnerReferenceNo": "...",
  "referenceNo": "..."
}

Error Codes Reference

message_action	HTTP Status	Description
`SUCCESS`	200	Request berhasil diproses
`GENERAL_ERROR_REQUEST`	400	Permintaan tidak valid / invalid payload
`INVALID_CREDENTIALS`	401	Email atau password tidak cocok
`INVALID_SIGNATURE`	403	Signature tidak valid
`NOT_FOUND`	404	Resource tidak ditemukan
`DUPLICATE_EXTERNAL_ID`	409	External ID sudah ada sebelumnya
`INTERNAL_SERVER_ERROR`	500	Kesalahan server internal

HTTP Status Codes

Code	Meaning
200	Success
302	Redirect
400	Bad Request / Invalid payload
401	Unauthorized / Invalid credentials
403	Forbidden / Invalid signature
404	Not Found
405	Method Not Allowed
409	Conflict (duplicate external ID)
500	Internal Server Error

Rate Limits

Endpoint Group	Limit	Scope
Default	100 requests per 60 seconds	Per IP address
SNAP Endpoints	Subject to partner agreement	Per partner

Core Auth Service

Base URL: https://api.pocikode.web.id/auth

GET /api/v1/health

Health check endpoint. Tidak memerlukan autentikasi.

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": { "status": "ok" },
  "message_desc": "Request processed successfully",
  "message_id": "",
  "message_request_datetime": "2026-08-28T13:00:00+07:00"
}

POST /merchant-portal/auth/register

Request Body

{
  "email": "merchant@example.com"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "Kode OTP telah dikirim ke email Anda."
}

POST /merchant-portal/auth/otp

Verifikasi OTP yang dikirim ke email.

Request Body

{
  "email": "merchant@example.com",
  "otp": "123456"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "OTP verified successfully."
}

POST /merchant-portal/auth/verify

Lengkapi proses registrasi dengan mengatur password.

Request Body

{
  "email": "merchant@example.com",
  "password": "ChangeMe123!"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "Registration complete."
}

POST /merchant-portal/auth/login

Request Body

{
  "email": "merchant@example.com",
  "password": "ChangeMe123!"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "user_id": "uuid-here",
    "full_name": "Merchant Name",
    "email": "merchant@example.com",
    "role": "OWNER",
    "has_merchant": true,
    "access_token": "eyJhbGciOiJIUzI1NiIs..."
  },
  "message_desc": "Login berhasil."
}

Response 401 Unauthorized

{
  "message_action": "INVALID_CREDENTIALS",
  "message_data": {},
  "message_desc": "Alamat email atau kata sandi tidak cocok."
}

POST /merchant-portal/auth/forgot-password

Kirim link reset password ke email.

Request Body

{
  "email": "merchant@example.com"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "Reset link sent to email."
}

GET /merchant-portal/profile

Dapatkan profil merchant yang sedang login. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "email": "merchant@example.com",
    "full_name": "Merchant Name",
    "role": "OWNER"
  }
}

GET /merchant-portal/merchant

Daftar seluruh merchant milik user. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "items": [
      {
        "id": 3,
        "merchant_id": "00000683",
        "wallet_id": "00000683",
        "name": "Warung QRIS Coba",
        "merchant_status": "ACTIVE",
        "verification_status": "LIVE"
      }
    ],
    "pagination": {
      "limit": 10,
      "page": 1,
      "total_data": 1,
      "total_page": 1
    }
  }
}

GET /merchant-portal/settings/merchant

Dapatkan pengaturan merchant termasuk callback URLs dan document URLs.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "merchant_id": "00000683",
    "qris_callback_url": "https://your-app.com/callback",
    "document_urls": {}
  }
}

PATCH /merchant-portal/settings/merchant/callback

Perbarui URL callback QRIS untuk merchant.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Request Body

{
  "qris_callback_url": "https://your-app.com/callback"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "Callback URL updated."
}

GET /api/v1/preview/{key}

Preview file. Redirect ke presigned S3 URL. Endpoint publik.

Path Parameters

Parameter	Type	Description
`key`	string	File key identifier

Response 302 Found

Redirect ke presigned S3 URL untuk file yang diminta.

POST /api/v1/upload

Upload file. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`
`Content-Type`	`multipart/form-data`

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "File uploaded successfully."
}

DELETE /api/v1/file/{key}

Hapus file. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Path Parameters

Parameter	Type	Description
`key`	string	File key identifier

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {},
  "message_desc": "File deleted successfully."
}

POST /openapi/v1.0/access-token/b2b

Dapatkan B2B access token untuk integrasi SNAP. Memerlukan signature headers.

Headers

Header	Value
`X-CLIENT-KEY`	Partner client key
`X-TIMESTAMP`	ISO 8601 timestamp
`X-SIGNATURE`	HMAC-SHA256 signature

Request Body

{
  "grantType": "client_credentials"
}

Response 200 OK

{
  "responseCode": "2004700",
  "responseMessage": "SUCCESS",
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "tokenType": "bearer",
  "expiresIn": 86400
}

Response 400 Bad Request

{
  "responseCode": "4007302",
  "responseMessage": "Invalid Mandatory Field X-CLIENT-KEY."
}

Core Payment Service

Base URL: https://api.pocikode.web.id/payment

GET /api/v1/health

Health check endpoint. Format respons sama dengan Core Auth health.

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": { "status": "ok" },
  "message_desc": "Request processed successfully"
}

POST /openapi/v1.0/qr/qr-mpm-generate

Generate QRIS MPM (Merchant Presented Mode) via SNAP partner integration. Mengembalikan QR content yang dapat discan oleh customer.

Headers

Header	Value
`Authorization`	`Bearer <snap_token>`
`X-TIMESTAMP`	ISO 8601 timestamp
`X-PARTNER-ID`	Partner ID
`X-EXTERNAL-ID`	Unique request ID
`CHANNEL-ID`	Channel identifier
`X-SIGNATURE`	HMAC-SHA256 signature

Request Body

{
  "partnerReferenceNo": "TEST-QR-001",
  "merchantId": "00000171",
  "terminalId": "T-001",
  "amount": {
    "value": "10000.00",
    "currency": "IDR"
  }
}

Response 200 OK

{
  "responseCode": "2004700",
  "responseMessage": "SUCCESS",
  "partnerReferenceNo": "TEST-QR-001",
  "referenceNo": "INV-20260828-xxx",
  "qrContent": "000201010212...",
  "merchantVisibleData": "Warung QRIS Coba"
}

POST /merchant-portal/qr/qr-mpm-generate

Generate QRIS MPM melalui Merchant Portal. Lebih sederhana dari SNAP — cukup amount dan validity period.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Request Body

{
  "amount": 25000,
  "validity_period": 15
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "reference_no": "INV-20260828-xxx",
    "qr_content": "000201010212...",
    "amount": 25000,
    "qris_type": "QRIS_DYNAMIC",
    "merchant_name": "Warung QRIS Coba",
    "validity_period": "15m"
  }
}

POST /openapi/v1.0/qr/qr-mpm-decode

Decode QRIS content yang discan oleh customer. Mengembalikan informasi merchant dan transaksi.

Headers

Sama dengan QRIS Generate SNAP headers.

Request Body

{
  "partnerReferenceNo": "TEST-DECODE-001",
  "qrContent": "000201010212...",
  "scanTime": "2026-08-28T10:00:00+07:00",
  "additionalInfo": {}
}

Response 200 OK

{
  "responseCode": "2004700",
  "responseMessage": "SUCCESS",
  "partnerReferenceNo": "TEST-DECODE-001",
  "referenceNo": "REF-xxx",
  "merchantInfo": {
    "merchantId": "00000171",
    "merchantName": "Warung QRIS Coba"
  }
}

POST /openapi/v1.0/qr/qr-mpm-query

Query status transaksi QRIS berdasarkan reference number.

Headers

Sama dengan QRIS Generate SNAP headers.

Request Body

{
  "originalReferenceNo": "REF-001",
  "serviceCode": "47",
  "merchantId": "00000171"
}

Response 200 OK

{
  "responseCode": "2004700",
  "responseMessage": "SUCCESS",
  "partnerReferenceNo": "...",
  "referenceNo": "REF-001",
  "transactionStatus": "SUCCESS",
  "amount": {
    "value": "25000.00",
    "currency": "IDR"
  }
}

GET /merchant-portal/transaction

Daftar transaksi merchant dengan filter tanggal. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Query Parameters

Parameter	Type	Required	Description
`merchant_id`	string	Yes	Merchant ID
`start_date`	string	Yes	Format: YYYY-MM-DD
`end_date`	string	Yes	Format: YYYY-MM-DD
`limit`	integer	No	Default: 10
`page`	integer	No	Default: 1

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "items": [],
    "pagination": {
      "limit": 10,
      "page": 1,
      "total_items": 0,
      "total_pages": 0
    }
  }
}

GET /merchant-portal/summary/total

Ringkasan total transaksi merchant.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Query Parameters

Parameter	Type	Description
`merchant_id`	string	Merchant ID

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "total_transactions": 150,
    "total_amount": 1500000,
    "total_fees": 15000
  }
}

GET /merchant-portal/analytics

Data analitik transaksi merchant.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Query Parameters

Parameter	Type	Description
`merchant_id`	string	Merchant ID

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {}
}

POST /secure/jsonAPI/v1/{action}

Artajasa integration endpoints. Semua request harus di-sign dengan HMAC-SHA256. Digunakan untuk interoperabilitas jaringan pembayaran.

Available Endpoints

Endpoint	Description
`POST /secure/jsonAPI/v1/echo`	Echo test endpoint
`POST /secure/jsonAPI/v1/signoff`	Sign off / end of day
`POST /secure/jsonAPI/v1/cut-over`	Cut-over processing
`POST /secure/jsonAPI/v1/paycredit`	Credit payment processing
`POST /secure/jsonAPI/v1/checkstatus`	Check transaction status

Headers

Header	Value
`Authorization`	`Bearer <access_token>`
`X-TIMESTAMP`	ISO 8601 timestamp
`X-SIGNATURE`	HMAC-SHA256 signature

Note: Semua Artajasa endpoints menggunakan HMAC-SHA256 signature. Hubungi tim integrasi untuk mendapatkan secret key.

Core Transfer Service

Base URL: https://api.pocikode.web.id/transfer

POST /api/v1/inquiry

Inquiry rekening tujuan sebelum melakukan transfer. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Request Body

{
  "bank_code": "002",
  "bank_account": "1234567890",
  "external_id": "TEST-INQUIRY-001"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "bank_code": "002",
    "bank_account": "1234567890",
    "account_name": "Test Recipient"
  }
}

POST /api/v1/payment

Eksekusi transfer ke rekening tujuan. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Request Body

{
  "recipient_bank": "002",
  "recipient_account": "1234567890",
  "recipient_name": "Test Recipient",
  "amount": 10000,
  "note": "Sandbox payment",
  "external_id": "TEST-PAYMENT-001",
  "merchant_id": "MCH-001"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "external_id": "TEST-PAYMENT-001",
    "status": "PENDING",
    "amount": 10000
  }
}

GET /api/v1/balance

Cek saldo tersedia untuk transfer. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "balance": 500000,
    "currency": "IDR"
  }
}

GET /api/v1/status/{external_id}

Cek status settlement berdasarkan external ID. Memerlukan autentikasi.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Path Parameters

Parameter	Type	Description
`external_id`	string	Unique external ID dari request transfer

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "external_id": "TEST-PAYMENT-001",
    "status": "SETTLED",
    "settlement_date": "2026-08-28T15:00:00+07:00"
  }
}

Core Wallet Service

Base URL: https://api.pocikode.web.id/wallet

GET /api/v1/health

Health check endpoint untuk Core Wallet service.

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": { "status": "ok" },
  "message_desc": "Request processed successfully"
}

POST /internal/wallet/balance

Cek saldo wallet. Internal endpoint — hanya dapat diakses dari microservice internal.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`

Request Body

{
  "wallet_id": "WAL-001",
  "api_call": "CALL-001"
}

Response 200 OK

{
  "message_action": "SUCCESS",
  "message_data": {
    "wallet_id": "WAL-001",
    "balance": 100000
  }
}

POST /internal/wallet/{operation}

Operasi wallet internal. Semua endpoint memerlukan HMAC signature (Blake3). Hanya dapat diakses dari microservice internal.

Headers

Header	Value
`Authorization`	`Bearer <access_token>`
`X-TIMESTAMP`	ISO 8601 timestamp
`X-SIGNATURE`	Blake3 HMAC signature

Available Operations

Endpoint	Description
`POST /internal/wallet/debit`	Debit (pengurangan) saldo wallet
`POST /internal/wallet/credit`	Credit (penambahan) saldo wallet
`POST /internal/wallet/overbooking`	Transfer antar wallet
`POST /internal/wallet/validate`	Validasi wallet
`POST /internal/wallet/status`	Cek status wallet
`POST /internal/wallet/detail`	Detail informasi wallet

Debit Example

{
  "wallet_id": "WAL-001",
  "amount": 5000,
  "api_call": "CALL-002"
}

Credit Example

{
  "wallet_id": "WAL-001",
  "amount": 10000,
  "api_call": "CALL-003"
}

Internal Only — Wallet endpoints hanya boleh diakses dari microservice internal yang telah terdaftar. Akses dari eksternal akan ditolak.

Core Worker Service

Base URL: https://api.pocikode.web.id/worker

GET /health

Health check untuk Core Worker. Mengembalikan status setiap dependency.

Response 200 OK

{
  "service": "core-worker",
  "services": {
    "postgres": "not connected",
    "redis": "healthy"
  },
  "status": "ok",
  "uptime": "2h15m"
}

Support

Channel	Details
Email	`api-support@nexuscode.web.id`
Dashboard	https://backoffice.nexuscode.web.id

Postman Collection — Postman collection lengkap untuk seluruh endpoint tersedia upon request. Hubungi api-support@nexuscode.web.id untuk mendapatkan file collection.

Sandbox Access — Untuk environment testing/sandbox, gunakan base URL yang sama. Seluruh data di sandbox bersifat simulasi.