365xpay API Reference

Merchant integration for payments, payouts, order queries and callbacks.

Method: POST JSONSignature: MD5Encoding: UTF-8Markets: IN / BD

Overview

Send requests to the /api/pay/* endpoints on https://365xpay.com using POST with JSON. The request body is flat. Business fields and sign belong at the top level.

Request structure

Field	Type	Description
Business fields	—	Send the fields listed for the endpoint, such as `mchNo`, `mchOrderNo` and `product`.
`sign`	String	Uppercase MD5 signature. See Signature for the steps.

For order notifications, use the merchant callback URL supplied in notifyUrl. See Callback for the payload and acknowledgment.

{
  "mchNo": "M123456789",
  "mchOrderNo": "IN-10001",
  "product": "IN",
  "orderAmount": 10000,
  "sign": "REPLACE_WITH_SIGNATURE"
}

Getting started

Obtain your merchant ID and signing key.
Configure a public callback URL for order notifications.
Send order amounts as integers in minor currency units.

Signature

365xpay uses MD5 to sign requests and verify signed callbacks. Read the business fields directly from the top level of the JSON payload.

Signature steps

Collect the top-level business fields dynamically. Exclude sign and omit null or empty values.
Sort the field names in ascending ASCII order.
Format each field as key=value and join the pairs with &.
Append &key={merchantSecret} to the resulting string.
Compute the MD5 digest of the UTF-8 string and convert the hexadecimal result to uppercase.
Send the result in the top-level sign field. For a signed callback, compare the computed value with the received sign.

String to sign

[email protected]&mchNo=M123456789&mchOrderNo=3c5899ed1594442e89d93fce809ef10c¬ifyUrl=https://xxx.com/callback&orderAmount=80000&product=IN&returnUrl=https://365xpay.com&tel=9643666279&userName=Kavya Reddy&key=dsffdsadfdsasdwerwe

Expected signature

E16F8CAADC9A237F5EF4405184DAC326

SIGNATURE UTILITY (JAVA)

public static String sign(JSONObject object, String secretKey) {
    String waitSignStr = sortByASCII(object) + "&key=" + secretKey;
    return hash(waitSignStr).toUpperCase(); // MD5 then uppercase
}
// sortByASCII: skip empty values and sign, join key=value& in ascending key order

India (IN)

POSTCreate Pay-in

POST/api/pay/paymentCreate Pay-in

30-minute validity period of collection and repayment link

Request parameters

Field	Type	Required	Description
`userName`	String	Yes	Payer name
`email`	String	Yes	Email address
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`notifyUrl`	String	Yes	Callback url
`returnUrl`	String	No	returnUrl
`orderAmount`	Long	Yes	Order amount in paisa. The minimum is 10000 paisa (100 rupees).
`product`	String	Yes	Fixed: IN
`tel`	String	Yes	phone number
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "userName": "sam",
    "email": "[email protected]",
    "mchNo": "M123456789",
    "mchOrderNo": "123",
    "notifyUrl": "https://merchant.example/notify",
    "orderAmount": 44400,
    "product": "IN",
    "sign": "REPLACE_WITH_SIGNATURE",
    "tel": "9876543210",
    "returnUrl": "https://merchant.example/return"
}

Response parameters

Field	Type	Description
`code`	int	status code
`msg`	String	message
`data.amount`	Long	order amount
`data.transferId`	String	transfer Id
`data.url`	String	Repayment link address
`data.link`	String	H2H Link

Response example

{
    "code": 200,
    "data": {
        "amount": 50000,
        "link": "upi://pay?pa=754573@ikwik&am=500.00&cu=INR",
        "transferId": "P185676720997085185",
        "url": "https://upi.365xpay.com/?orderNo=U1856"
    },
    "msg": "SUCCESS"
}

POSTCreate Payout

POST/api/pay/payoutCreate Payout

Field	Type	Required	Description
`userName`	String	Yes	User name: must be greater than 5 characters
`bankName`	String	Yes	Bank name: If there is no bank name, it can be fixed
`cardNumber`	String	Yes	Bank card
`email`	String	Yes	Email address
`ifsc`	String	Yes	ifsc
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`notifyUrl`	String	Yes	Callback url
`orderAmount`	Long	Yes	Order amount in paisa. The minimum is 10000 paisa (100 rupees).
`product`	String	Yes	Fixed: IN
`tel`	String	Yes	phone number
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "userName": "Jhonty",
    "bankName": "Bank of India",
    "cardNumber": "123456789",
    "email": "[email protected]",
    "ifsc": "DBSS0IN0811",
    "mchNo": "M1234567890",
    "mchOrderNo": "10",
    "notifyUrl": "https://xxx.com/notify",
    "orderAmount": 100,
    "product": "IN",
    "sign": "CA0ECE01A1ECCC33C2CA7A2715ACA5AD",
    "tel": "9876543210"
}

Response parameters

Field	Type	Description
`code`	int	Status code
`msg`	String	message
`data.amount`	Long	order amount
`data.transferId`	String	transfer Id

Response example

{
    "code": 200,
    "data": {
        "amount": 100,
        "transferId": "T136559533808332802"
    },
    "msg": "SUCCESS"
}

POSTQuery Order

POST/api/pay/queryOrderQuery Order

Field	Type	Required	Description
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "mchNo": "M1653394376",
    "mchOrderNo": "1234",
    "sign": "9D617731B4193D4BCAB3A8E77FEA4D80"
}

Response parameters

Field	Type	Description
`code`	int	status code
`msg`	String	message
`data.amount`	Long	order amount
`data.mchOrderNo`	String	Merchant order number
`data.orderTime`	String	order time
`data.transferId`	String	transfer Id
`data.mchNo`	String	Merchant No
`data.status`	String	Status: `10:INIT`;`20:PENDING` ;`30:SUCCESS` ;`40:FAIL` ;`50:REJECT`
`data.utr`	String	Transaction reference (UTR)

Response example

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "amount": 10000,
        "mchOrderNo": "1234",
        "orderTime": "2022-05-01 09:30:05",
        "transferId": "P136559074251026433",
        "mchNo": "M1653394376",
        "status": "20",
        "utr": "123456789012"
    }
}

POSTQuery Balance

POST/api/pay/balanceQuery Balance

Field	Type	Required	Description
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "mchNo": "M1653394376",
    "mchOrderNo": "1234",
    "sign": "9D617731B4193D4BCAB3A8E77FEA4D80"
}

Response parameters

Field	Type	Description
`code`	int	status code
`msg`	String	message
`data.balance`	Long	Available balance (unit: paisa, transfer to rupee needs to be divided by 100)

Response example

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "balance": 10000
    }
}

POSTCallback

POSTnotifyUrlCallback

Callback notes

1:The server's asynchronous notification address (notifyUrl) must be free of any characters, such as spaces and HTML tags, and can be accessed through the Internet 2:The merchant received the callback information and successfully processed the business code, which needs to be returnedsuccess. 3:orderAmount Field, when collecting Not equal to the actual order amount,For usersPaid-in amount,Write-off according to actual exchange amount

Request parameters

Field	Type	Required	Description
`status`	String	Yes	Status: `10:INIT`;`20:PENDING` ;`30:SUCCESS` ;`40:FAIL` ;`50:REJECT`
`mchOrderNo`	String	Yes	Merchant order number
`orderAmount`	String	Yes	Order amount (user paid amount)
`transferId`	String	Yes	transfer Id
`finshTime`	String	No	Final processing time(`status code 30/40/50 Will return`)
`msg`	String	Yes	message
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "msg":"success",
    "orderAmount":"10000",
    "mchOrderNo":"1234",
    "finshTime":"2022-06-14 11:01:26",
    "sign":"0eaa5c63bad92a751eef145a9437f309",
    "transferId":"P136559074251026433",
    "status":"30"
}

Error codes

err code

err code	desc
200	success
1001	Param error
5000	Merchant does not exist
5001	IP is not on the whitelist
5002	No product available
5003	Order amount not available
5004	Merchant status error
5005	Order sign error
5006	Balance is not enough
5007	No channel available
5008	Order fee error
5009	Order number already exists
5010	Order failed
5011	Order number not exists
6000	Unified encapsulated upstream error code

Bangladesh (BD)

POSTCreate Pay-in

POST/api/pay/paymentCreate Pay-in

Field	Type	Required	Description
`userName`	String	Yes	Payer name
`email`	String	Yes	Email address
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`notifyUrl`	String	Yes	Callback url
`returnUrl`	String	No	returnUrl
`orderAmount`	Long	Yes	Order amount in minor units of BDT.
`product`	String	Yes	Fixed: BD
`tel`	String	Yes	phone number
`payType`	String	Yes	Available values depend on merchant configuration: bkash-send-money nagad-send-money
`sign`	String	Yes	Sign (need secret key)

Signature

Sort the submitted fields by ASCII field name. Omit sign, type, productId, and blank optional fields. Join the remaining pairs as key=value with &, append &key={merchantSecret}, then uppercase the MD5 hex digest.

Request example

{
    "userName": "sam",
    "email": "[email protected]",
    "mchNo": "M123456789",
    "mchOrderNo": "123",
    "notifyUrl": "http://xxx.com/notify",
    "orderAmount": 10000,
    "product": "BD",
    "sign": "REPLACE_WITH_SIGNATURE",
    "tel": "9876543210",
    "payType": "bkash-send-money",
    "returnUrl": "https://merchant.example/return"
}

Response

Field	Description
`code`	Status code
`msg`	Status message
`data.amount`	Order amount
`data.transferId`	365xpay order identifier
`data.url`	Checkout URL when returned by the channel

Response example

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "amount": 10000,
        "transferId": "P136559074251026433",
        "url": "https://checkout.example/pay/BD-10001"
    }
}

POSTCreate Payout

POST/api/pay/payoutCreate Payout

Field	Type	Required	Description
`userName`	String	Yes	User name: must be greater than 5 characters
`bankName`	String	Yes	Bank name: If there is no bank name, it can be fixed
`cardNumber`	String	Yes	Recipient wallet number
`email`	String	Yes	Email address
`ifsc`	String	Yes	ifsc
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`notifyUrl`	String	Yes	Callback url
`orderAmount`	Long	Yes	Order amount in minor units of BDT.
`product`	String	Yes	Fixed: BD
`tel`	String	Yes	phone number
`payType`	String	Yes	Available values depend on merchant configuration: bkash nagad
`sign`	String	Yes	Sign (need secret key)

Payout requires the request IP to be on the merchant allowlist.

Signature

Request example

{
    "userName": "Jhonty",
    "bankName": "Example Bank",
    "cardNumber": "01700000000",
    "email": "[email protected]",
    "ifsc": "DBSS0IN0811",
    "mchNo": "M1234567890",
    "mchOrderNo": "10",
    "notifyUrl": "https://xxx.com/notify",
    "orderAmount": 100,
    "product": "BD",
    "sign": "REPLACE_WITH_SIGNATURE",
    "tel": "9876543210",
    "payType": "bkash"
}

Response

Field	Description
`code`	Status code
`msg`	Status message
`data.amount`	Order amount
`data.transferId`	365xpay order identifier

Response example

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "amount": 10000,
        "transferId": "T136559074251026434"
    }
}

POSTQuery Order

POST/api/pay/queryOrderQuery Order

Field	Type	Required	Description
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`mchOrderNo`	String	Yes	Merchant order number
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "mchNo": "M1653394376",
    "mchOrderNo": "1234",
    "sign": "9D617731B4193D4BCAB3A8E77FEA4D80"
}

Response parameters

Field	Type	Description
`code`	int	status code
`msg`	String	message
`data.amount`	Long	order amount
`data.mchOrderNo`	String	Merchant order number
`data.orderTime`	String	order time
`data.transferId`	String	transfer Id
`data.mchNo`	String	Merchant No
`data.status`	String	Status: `10:INIT`;`20:PENDING` ;`30:SUCCESS` ;`40:FAIL` ;`50:REJECT`
`data.utr`	String	Transaction reference (UTR)

Response example

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "amount": 10000,
        "mchOrderNo": "1234",
        "orderTime": "2022-05-01 09:30:05",
        "transferId": "P136559074251026433",
        "mchNo": "M1653394376",
        "status": "20",
        "utr": "123456789012"
    }
}

POSTQuery Balance

POST/api/pay/balanceQuery Balance

Field	Type	Required	Description
`mchNo`	String	Yes	Merchant ID: obtained or contacted by the merchant in the background
`sign`	String	Yes	Sign (need secret key)

See Signature for signing instructions. The balance endpoint returns the balance for a fixed wallet product.

Request example

{
    "mchNo": "M1653394376",
    "sign": "REPLACE_WITH_SIGNATURE"
}

Response parameters

Field	Type	Description
`code`	int	status code
`msg`	String	message
`data.balance`	Long	Available balance in minor units of the wallet currency.

Response example

The example shows the shared balance endpoint response for its fixed wallet product.

{
    "code": 200,
    "msg": "SUCCESS",
    "data": {
        "balance": 10000
    }
}

POSTCallback

POSTnotifyUrlCallback

Callback notes

Request parameters

Field	Type	Required	Description
`status`	String	Yes	Status: `10:INIT`;`20:PENDING` ;`30:SUCCESS` ;`40:FAIL` ;`50:REJECT`
`mchOrderNo`	String	Yes	Merchant order number
`orderAmount`	String	Yes	Order amount (user paid amount)
`transferId`	String	Yes	transfer Id
`finshTime`	String	No	Final processing time(`status code 30/40/50 Will return`)
`msg`	String	Yes	message
`sign`	String	Yes	Sign (need secret key)

Description

All parameters participate in signing,Null value does not participate in signature
All interfaces use MD5 calculation summary as signature data; All parameters are sorted according to the ASCII code (dictionary order) of the field name from small to large, and then spliced using the format of QueryString (i.e. key1=value1&key2=value2...). Finally, the secret key is added. The null value does not participate in the signature

Before encryption

amount=10000&[email protected]&mchOrderNo=P136553673761665025&tel=9876543210&userName=xxxx&notifyUrl=https://xxx.com/notify&key={key}

After encryption(`Capitalize after MD5`)

B66DEB15AEFC2C30C85E0C75D3938002

Request example

{
    "msg":"success",
    "orderAmount":"10000",
    "mchOrderNo":"1234",
    "finshTime":"2022-06-14 11:01:26",
    "sign":"0eaa5c63bad92a751eef145a9437f309",
    "transferId":"P136559074251026433",
    "status":"30"
}

Response example

Return the following plain-text acknowledgment after processing the callback.

success

Error codes

err code

err code	desc
200	success
1001	Param error
5000	Merchant does not exist
5001	IP is not on the whitelist
5002	No product available
5003	Order amount not available
5004	Merchant status error
5005	Order sign error
5006	Balance is not enough
5007	No channel available
5008	Order fee error
5009	Order number already exists
5010	Order failed
5011	Order number not exists
6000	Unified encapsulated upstream error code

Response example

{
    "code": 1001,
    "msg": "Param error"
}

365xpay API Reference

Overview

Request structure

Getting started

Signature

Signature steps

String to sign

Expected signature

SIGNATURE UTILITY (JAVA)

India (IN)

POSTCreate Pay-in

Request parameters

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response parameters

Response example

POSTCreate Payout

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response parameters

Response example

POSTQuery Order

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response parameters

Response example

POSTQuery Balance

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response parameters

Response example

POSTCallback

Callback notes

Request parameters

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Error codes

err code

Bangladesh (BD)

POSTCreate Pay-in

Signature

Request example

Response

Response example

POSTCreate Payout

Signature

Request example

Response

Response example

POSTQuery Order

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response parameters

Response example

POSTQuery Balance

Request example

Response parameters

Response example

POSTCallback

Callback notes

Request parameters

Description

Before encryption

After encryption(Capitalize after MD5)

Request example

Response example

Error codes

err code

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)

After encryption(`Capitalize after MD5`)