Introduction
Dokumen ini merupakan referensi lengkap API untuk platform pembayaran TPID Payment Docs. Seluruh endpoint, format request/response, dan mekanisme autentikasi bersifat rahasia dan hanya untuk partner resmi yang telah diotorisasi.
Seven components: Core Auth (31), Core Payment (17), Core Transfer (7), Core Wallet (8), Core Worker (1), Dashboard Web App (19), and Backoffice Portal (2).
Getting Started
Base URL
| Environment | Base URL |
|---|---|
| Production | https://api.pocikode.web.id |
Service Endpoints
Core Auth
https://api.pocikode.web.id/auth
Core Payment
https://api.pocikode.web.id/payment
Core Transfer
https://api.pocikode.web.id/transfer
Core Wallet
https://api.pocikode.web.id/wallet
Core Worker
https://api.pocikode.web.id/worker
Dashboard Merchant
https://dashboard-merchant.nexuscode.web.id
Backoffice
https://backoffice.nexuscode.web.id
Content Type
Semua request harus menggunakan Content-Type: application/json kecuali upload yang menggunakan multipart/form-data.
Integration Flow
1. Register via POST /merchant-portal/auth/register
2. Verify OTP via POST /merchant-portal/auth/otp
3. Complete registration via POST /merchant-portal/auth/verify
4. Login via POST /merchant-portal/auth/login — receive JWT
5. Use access token for all authenticated endpoints
Authentication
Bearer Token (JWT)
Obtained via POST /merchant-portal/auth/login:
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Cookie-Based Session (Dashboard)
Dashboard Web App uses cookie-based sessions. After login, session cookie is set automatically.
Cookie: connect.sid=s%3A...
SNAP Signature
| Header | Description |
|---|---|
X-CLIENT-KEY | Partner client key |
X-TIMESTAMP | ISO 8601 timestamp |
X-SIGNATURE | HMAC-SHA256 signature |
X-PARTNER-ID | Merchant/partner ID |
X-EXTERNAL-ID | Unique request ID |
CHANNEL-ID | Channel identifier |
Internal Signature (HMAC)
| Header | Description |
|---|---|
X-TIMESTAMP | ISO 8601 timestamp |
X-SIGNATURE | Blake3 HMAC signature |
Common Response Format
{
"message_action": "SUCCESS",
"message_data": {},
"message_desc": "Human-readable description",
"message_id": "API_CALL_xxxxx",
"message_request_datetime": "2026-08-28T13:00:00+07:00"
}
SNAP Response Format
{
"responseCode": "2004700",
"responseMessage": "SUCCESS",
"partnerReferenceNo": "...",
"referenceNo": "..."
}
Dashboard Response Format
{
"success": true,
"user": {
"access_token": "eyJhbGciOiJIUzI1NiIs..."
}
}
Error Codes Reference
| message_action | HTTP Status | Description |
|---|---|---|
SUCCESS | 200 | Request berhasil diproses |
GENERAL_ERROR_REQUEST | 400 | Permintaan tidak valid |
INVALID_CREDENTIALS | 401 | Email atau password tidak cocok |
INVALID_SIGNATURE | 403 | Signature tidak valid |
NOT_FOUND | 404 | Resource tidak ditemukan |
DUPLICATE_EXTERNAL_ID | 409 | External ID sudah ada |
INTERNAL_SERVER_ERROR | 500 | Kesalahan server internal |
HTTP Status Codes
| Code | Meaning |
|---|---|
| 200 | Success |
| 302 | Redirect |
| 400 | Bad Request |
| 401 | Unauthorized |
| 403 | Forbidden |
| 404 | Not Found |
| 405 | Method Not Allowed |
| 409 | Conflict |
| 500 | Internal Server Error |
Rate Limits
| Endpoint Group | Limit | Scope |
|---|---|---|
| Default | 100 requests/60s | Per IP |
| SNAP Endpoints | Subject to partner agreement | Per partner |
Core Auth Service — 31 endpoints
Base URL: https://api.pocikode.web.id/auth
Health check. Public.
Auth: Public
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {
"status": "ok"
},
"message_desc": "Request processed successfully"
}
Register merchant baru. OTP dikirim ke email.
Auth: Public
Request Body
{
"email": "merchant@example.com"
}
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {},
"message_desc": "Kode OTP telah dikirim ke email Anda."
}
Verifikasi OTP yang dikirim ke email.
Auth: Public
Request Body
{
"email": "merchant@example.com",
"otp": "123456"
}
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {},
"message_desc": "OTP verified successfully."
}
Lengkapi registrasi dengan mengatur password.
Auth: Public
Request Body
{
"email": "merchant@example.com",
"password": "ChangeMe123!"
}
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {},
"message_desc": "Registration complete."
}
Login merchant. Mengembalikan JWT access token.
Auth: Public
Request Body
{
"email": "merchant@example.com",
"password": "ChangeMe123!"
}
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {
"user_id": "uuid-here",
"full_name": "Merchant Name",
"email": "merchant@example.com",
"role": "OWNER",
"has_merchant": true,
"access_token": "eyJhbGciOiJIUzI1NiIs..."
},
"message_desc": "Login berhasil."
}
Response 401 Unauthorized
{
"message_action": "INVALID_CREDENTIALS",
"message_data": {},
"message_desc": "Alamat email atau kata sandi tidak cocok."
Kirim link reset password ke email.
Auth: Public
Request Body
{
"email": "merchant@example.com"
}
Response 200 OK
{
"message_action": "SUCCESS",
"message_data": {},
"message_desc": "Reset link sent to email."
}
Halaman reset password (HTML page).
Auth: Public
HTML page for password reset form.