Refunds
Money that went back: the payer-addressed overpayment excess, and your own refunds of paid invoices.
/v1/refundsBoth kinds. Any key kind may read; refunds are reconciliation.
Authorization
apiKey Authorization: Bearer mp<64 hex> for live, mptest<64 hex> for test.
The token is the prefix plus 64 lowercase hex characters (32 CSPRNG bytes) and nothing else ā no separators, no embedded fields ā so nothing in it needs quoting, escaping or encoding.
Send it in the Authorization header and nowhere else. Never put it in a query string: URLs reach access logs, proxy logs, browser history and Referer headers, and a key that lands in any of those is a leaked key.
A key's KIND (checkout, payout or wallet) is a property of the key, not of the string: it is chosen at creation, returned by GET /v1/ping, and decides which routes the key may reach.
The full key is shown exactly once, at creation. No endpoint can return it afterwards. Moving funds additionally requires signing to be enabled globally, for your project, and for that key ā so a read-only key is a supported configuration.
In: header
Query Parameters
1 <= value <= 10025Opaque cursor from the previous page's next_cursor.
uuidValue in
- "overpayment"
- "merchant"
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/refunds"{ "object": "list", "has_more": true, "next_cursor": "string", "data": [ { "object": "refund", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "invoice_id": "f4c4edb8-11e0-4b33-bcc1-482dc59ebb32", "kind": "overpayment", "status": "awaiting_address", "chain": "ethereum", "asset": "string", "contract": "string", "decimals": 0, "amount_atomic": "1500000000000000000", "amount": "string", "fee_atomic": "1500000000000000000", "net_atomic": "1500000000000000000", "to_address": "string", "reason": "string", "payout_id": "89e4daf5-d103-4869-b9da-3d54ecc98dfe", "tx_hash": "string", "failure_code": "string", "skip_reason": "string", "network_fee_paid_by": "payer", "created_at": "2019-08-24T14:15:22Z", "sent_at": "2019-08-24T14:15:22Z", "completed_at": "2019-08-24T14:15:22Z" } ]}/v1/refunds/{id}Authorization
apiKey Authorization: Bearer mp<64 hex> for live, mptest<64 hex> for test.
The token is the prefix plus 64 lowercase hex characters (32 CSPRNG bytes) and nothing else ā no separators, no embedded fields ā so nothing in it needs quoting, escaping or encoding.
Send it in the Authorization header and nowhere else. Never put it in a query string: URLs reach access logs, proxy logs, browser history and Referer headers, and a key that lands in any of those is a leaked key.
A key's KIND (checkout, payout or wallet) is a property of the key, not of the string: it is chosen at creation, returned by GET /v1/ping, and decides which routes the key may reach.
The full key is shown exactly once, at creation. No endpoint can return it afterwards. Moving funds additionally requires signing to be enabled globally, for your project, and for that key ā so a read-only key is a supported configuration.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/refunds/497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "object": "refund", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "invoice_id": "f4c4edb8-11e0-4b33-bcc1-482dc59ebb32", "kind": "overpayment", "status": "awaiting_address", "chain": "ethereum", "asset": "string", "contract": "string", "decimals": 0, "amount_atomic": "1500000000000000000", "amount": "string", "fee_atomic": "1500000000000000000", "net_atomic": "1500000000000000000", "to_address": "string", "reason": "string", "payout_id": "89e4daf5-d103-4869-b9da-3d54ecc98dfe", "tx_hash": "string", "failure_code": "string", "skip_reason": "string", "network_fee_paid_by": "payer", "created_at": "2019-08-24T14:15:22Z", "sent_at": "2019-08-24T14:15:22Z", "completed_at": "2019-08-24T14:15:22Z"}