GlobePay365
Talk to sales →
SolutionsDevelopersCompanyContactMerchant loginTalk to sales →
Developers

A clean API surface for payments, payouts and transaction status.

This documentation page is a polished front-end template. Endpoint paths, authentication and request fields below are illustrative until they are replaced with GlobePay365's real production specification.

REST APIJSONWebhooksSignaturesRequery

Quick start

Integrate by creating a server-to-server request, storing the GlobePay365 transaction identifier, and listening for asynchronous webhook updates.

Important: URLs, headers, payloads and codes on this page are demo content for the website design. Replace them with your approved API specification before giving this page to merchants.

Authentication

Use a credential model appropriate for your production environment. A typical pattern is an API key or merchant identifier combined with a request signature.

HEADERAuthorization: Bearer YOUR_API_KEY
Content-Type: application/json
X-Merchant-Id: merchant_12345
X-Timestamp: 1723819210
X-Signature: <generated-signature>

Create payment

POST/v1/payments
{
  "amount": "100.00",
  "currency": "MYR",
  "payment_method": "bank_transfer",
  "merchant_reference": "ORDER-1028",
  "return_url": "https://merchant.example/return",
  "callback_url": "https://merchant.example/webhooks/payment"
}
FieldTypeDescription
amountstringTransaction amount in the requested currency format.
currencystringCurrency code supported by your real production configuration.
merchant_referencestringYour unique order or payment reference.
callback_urlstringServer endpoint for asynchronous status updates.

Query payment

GET/v1/payments/{transaction_id}
{
  "transaction_id": "GP365-20260817-001928",
  "merchant_reference": "ORDER-1028",
  "status": "success",
  "amount": "100.00",
  "currency": "MYR"
}

Create payout

POST/v1/payouts
{
  "amount": "250.00",
  "currency": "MYR",
  "merchant_reference": "WD-88321",
  "beneficiary": {
    "name": "Example Beneficiary",
    "bank_code": "EXAMPLE_BANK",
    "account_number": "1234567890"
  },
  "callback_url": "https://merchant.example/webhooks/payout"
}

Webhooks

Webhooks should be authenticated, idempotent and safe to retry. Store the transaction identifier and your merchant reference so repeated callbacks do not create duplicated downstream actions.

POSTYour callback URL
{
  "event": "payment.updated",
  "transaction_id": "GP365-20260817-001928",
  "merchant_reference": "ORDER-1028",
  "status": "success",
  "signature": "..."
}

API security

  • Keep API secrets server-side; never expose them in client JavaScript.
  • Use HTTPS for every API and webhook request.
  • Validate timestamps and signatures if they are part of your approved signing scheme.
  • Allow-list callback destinations or source IPs only if this matches your actual infrastructure.
  • Rotate credentials and preserve audit logs according to your internal security policy.

Error handling

ERRORExample response
{
  "success": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "A required field is missing."
  }
}

Production error codes should be documented with whether each error is retryable, which fields are affected, and whether support intervention is required.