API Conventions

Core integration conventions from Transafe technical documentation:

1. All POST requests use Content-Type: application/json.
2. Character encoding is UTF-8.
3. Request and response payloads are JSON.
4. Signature algorithm is OPENSSL_ALGO_SHA256 (merchant private key signs; platform public key verifies).
5. Evaluate protocol fields first, then business fields, then transaction status.
6. Amount unit is yuan/local major unit as documented per market; do not force trailing .00 style values when unnecessary.
7. All API responses include a status field; non-200 means failure. Do not expose raw msg directly to end users.
8. Submitted data must not contain Chinese characters.
9. Collection/payout platform callbacks must return HTTP 200; otherwise retries occur within 12 hours (up to 5 times).
10. Add your server IP to the merchant console allowlist, and allowlist platform callback IPs on your side.

See also:

• Introduction
• Signature & Verification
• Status Codes
• Collection Status
• Payout Status