Payout Proof API

The Proof Images API allows you to retrieve proof images associated with payout transactions. This endpoint provides secure access to transaction evidence through API key authentication and request signature verification.

Base URL: https://<your-domain.com>/payout/api/proof/get_data.php

Authentication

This API uses two-layer authentication:

1. API Key Header: Include your provided API key in the request header.

X-API-KEY: your_provided_api_key

1. Request Signature: Generate a SHA256 signature using your parameters and provided secret key.

Important : Both API Key and Signature must be valid for the request to succeed.

Endpoint Details

POST payout/api/proof/get_data.php

Request Headers

Header	Type	Required	Description
Content-Type	String	Yes	Must be application/json
X-API-KEY	String	Yes	Your provided API key

Request Parameters

Parameter	Type	Required	Description
pid	String	Yes	Your provided PID (Partner ID)
order_id	String	Yes	The transaction order ID
signature	String	Yes	SHA256 signature for request verification

Signature Generation

To generate the required signature, follow these steps:

1. Concatenate: Combine pid + your_provided_secret_key + order_id

2. Hash: Apply SHA256 hashing to the concatenated string

Formula: signature = SHA256(pid + your_provided_secret_key + order_id)

Code Examples

PHP Example

$pid = "your_provided_pid"; 
$secret_key = "your_provided_secret_key"; 
$order_id = "ORDER_123456"; 

$signature = hash('sha256', $pid . $secret_key . $order_id); 

JavaScript Example

const crypto = require('crypto'); 
const pid = "your_provided_pid"; 
const secret_key = "your_provided_secret_key"; 
const order_id = "ORDER_123456"; 

const signature = crypto.createHash('sha256') 
    .update(pid + secret_key + order_id) 
    .digest('hex'); 

Python Example

import hashlib 

pid = "your_provided_pid" 
secret_key = "your_provided_secret_key" 
order_id = "ORDER_123456" 

signature = hashlib.sha256((pid + secret_key + order_id).encode('utf-8')).hexdigest() 

Request Example

cURL Example

curl -X POST https://your-domain.com/payout/api/proof/get_data.php \ -H "Content-Type: application/json" \ -H "X-API-KEY: your_provided_api_key" \ -d '{ "pid": "your_provided_pid", "order_id": "ORDER_123456", "signature": "generated_sha256_signature" }' 

JavaScript Example

const response = await fetch('https://your-domain.com/payout/api/proof/get_data.php', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-API-KEY': 'your_provided_api_key' }, body: JSON.stringify({ pid: 'your_provided_pid', order_id: 'ORDER_123456', signature: 'generated_sha256_signature' }) }); 
const data = await response.json(); 

Response Format

Success Response

{ "status": "success", "order_id": "ORDER_123456", "transaction_status": "Approved", "proof_images": [ "data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQ...", "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..." ] } 

Response Fields

Field	Type	Description
status	string	Response status ( success or error )
order_id	string	The requested order ID
transaction_status	string	The current status of the transaction
proof_images	array	Array of base64-encoded image data URIs

Note : Images are returned as base64-encoded data URIs. You can use these directly in HTML img tags like: <img src="data:image/jpeg;base64,..." /> or decode them for further processing.

Error Response

Status Code	Error Message	Description
400	Invalid request data	JSON parsing failed or malformed request
400	pid not provided	Missing or empty pid parameter
400	order_id not provided	Missing or empty order_id parameter
400	signature not provided	Missing or empty signature parameter
401	API key not provided	Missing X-API-KEY header
401	Invalid API key	Provided API key doesn't match
401	Verification failed	Signature verification failed
200	Invalid user	Partner ID not found in system
200	Transaction not found	No transaction found for given pid and order_id

Error Response Format

{ "status": "error", "message": "Error description" }

Best Practices

• Store your API key and secret key securely

• Never expose your secret key in client-side code

• Implement proper error handling for all response codes

• Cache proof images when possible to reduce API calls

• Validate the signature generation logic before making requests

Security Note: Always validate the response and handle errors gracefully. Never log sensitive information like API Keys or secret keys.