Skip to main content
POST
Direct Integration
An API endpoint used to initiate a checkout transaction and obtain the secure payment provider redirection URL.

Request

Headers

string
required
Your unique Merchant ID assigned by CommercePay.
string
required
Your API credentials used for authentication (typically a Bearer token).
string
required
A unique security hash used to verify the integrity of the request body. See Generate Signature for how to generate this.

Body

Omitting channelId routes the customer to CommercePay’s hosted payment page instead, where they pick their own payment method. If you’d rather let CommercePay handle channel selection this way, see Hosted Session Checkout.
integer
An identifier that represents the CommercePay payment channel. Refer to the id from the response of the Get Channel List endpoint. This parameter can be omitted if you choose to utilize the CommercePay Hosted Payment Web interface.
string
An identifier that represents the specific upstream payment provider sub-channel (e.g., a bank code for online banking). This becomes mandatory if the chosen channel configuration has isProviderHostChannel: true. Obtain valid values from the Get Provider Channels endpoint.
string
required
Currency code formatted to standard 3-letter ISO 4217 specifications (e.g., MYR).
int64
required
The transaction payment value. This field exclusively accepts integer units where the final decimals are represented as whole values (e.g., an amount value of 1000 translates to 10.00 in the system backend).
string
required
The merchant-side unique order reference or invoice tracking sequence code. Maximum length: 50.
string
required
The customer’s valid IP address captured directly by the merchant server. Maximum length: 50.
string
required
The synchronous return URL where the customer’s browser is forwarded automatically after completing payment checkout steps. Maximum length: 500.
int64
required
Numeric timestamp in milliseconds representing request validation freshness (e.g., generated via new Date().getTime()).
string
Text description summarized for transaction tracing logs. Maximum length: 100.
string
Target address utilized for asynchronous host-to-host webhook payment status change push actions. Maximum length: 500.

Request Payload Sample

Payload

Response

Body

string
Currency code with a 3-letter ISO 4217 standard code (e.g., MYR). Maximum length: 3.
int64
The transaction payment value returned in pure integer units (e.g., 1000 is equivalent to 10.00 for the backend processing rules).
string
Unique CAP Transaction Number mapped internally for auditing. Maximum length: 24.
integer
The primary identity mapping identifier. Corresponds to the entry endpoints defined in Get Channel List.
integer
Defines the browser execution pathway. 1 = UrlRedirection, 2 = Script execution redirection.
string
The secure target destination link utilized to send the consumer browser to the payment selection page.
string
Customized script sequence injected onto client browsers to force payment redirection behaviors.
string
Expiration threshold deadline represented as an ISO 8601 date-time timestamp block.

Response Payload Sample

Response_2XX

Error Responses

Response_400