API Reference Overview

This chapter is the reference for the merchant API. All business endpoints share the same encryption / signing / anti-replay protocol (see the Protocol Specification). This page summarizes the endpoint list, shared conventions, and enum values; the parameters and response fields for each endpoint are documented on their respective sub-pages.

Endpoint Overview

Group	Base URL
Business endpoints	https://api.anonypay.io/api/merchant/
Public endpoints	https://api.anonypay.io/api/common/

Endpoint	Path	Token required	Encrypted/signed request body	Description
getToken	POST /api/merchant/getToken	No (md5 auth)	No (response is still an encrypted envelope)	Exchange APP-ID + secret for an ANONY-TOKEN
createAddress	POST /api/merchant/createAddress	Yes	Yes	Create a deposit address (idempotent by userOrder)
createWithdrawOrder	POST /api/merchant/createWithdrawOrder	Yes	Yes	Create a withdrawal order (idempotent by userOrder)
merchantInfo	POST /api/merchant/merchantInfo	Yes	Yes	Query merchant info and per-currency balances
getDeposits	POST /api/merchant/getDeposits	Yes	Yes	Query deposit records with pagination
checkWithdrawOrder	POST /api/merchant/checkWithdrawOrder	Yes	Yes	Query withdrawal order status by userOrder
selfcheck	POST /api/merchant/v2/selfcheck	Yes	Yes	Go-live self-check probe; read-only, safe to call repeatedly, echoes the request back verbatim
Public endpoints	/api/common/*	No	No (plaintext)	getCurrencies / isAddress / checkTransfer / generateAddresssQrCode

Implementation details

• Tokens issued by getToken are stored server-side with a sliding expiration of 8 hours and an absolute cap of 24 hours. When you receive tokenExpired, simply fetch a new token — there is no need to refresh on a fixed schedule.
• Business endpoints also enforce a source IP whitelist on the server side. Requests from non-whitelisted IPs get a plain-text Oops response (not a JSON envelope) — see Troubleshooting.

Shared Conventions

• All endpoints use POST (the only exception is generateAddresssQrCode, which is GET).
• Except for getToken and the public endpoints, every request body is the encrypted ciphertext of the business JSON, and requests must carry the full set of signature headers (ANONY-APP-ID / ANONY-TOKEN / ANONY-TIMESTAMP / ANONY-NONCE / ANONY-SIGN). See the Protocol Specification for how to construct them.
• The platform enforces a request body size limit (128KB by default); oversized requests are rejected outright.
• The "response fields" documented for each endpoint refer to the business fields inside data after signature verification and decryption.
• Before integrating, we recommend running the go-live self-check first to confirm your encryption / signing / anti-replay pipeline works end to end.

Unified Response Envelope

Every business endpoint (including getToken) returns the same JSON envelope as the HTTP response body:

{ "code": 10000, "data": "<base64 ciphertext>", "message": "success" }

• code == 10000 means success. data is OAEP-encrypted base64 ciphertext — you must verify the signature first, then decrypt to obtain the business JSON.
• code == 9999 means failure: message carries the failure reason and data is empty. See Error Codes for the full list.
• Response headers include ANONY-TIMESTAMP / ANONY-NONCE / ANONY-SIGN. The signature verification input is the canonical string ts + "\n" + nonce + "\n" + data.
• Use a standard JSON library to parse the outer envelope: / in the response body may be escaped as \/, which standard libraries unescape automatically — do not hand-roll string splitting.

The full four-step flow for handling responses (parse envelope → check time window/nonce → verify signature → decrypt) is covered in the Protocol Specification. The SDKs wrap it as verifyResponse / verify + decrypt — see Using the SDK.

Enum Values

Address type addressType

Value	Description
trx	TRON
btc	Bitcoin (reserved / coming soon; do not expose in production checkout yet)
solana	Solana
eth_bnb	ETH / BNB
ton	TON

Implementation details

eth_bnb generates a single deposit address shared by the ETH and BNB chains; deposits on either chain trigger callbacks under their respective currencies.

Withdrawal currency currency (13 values)

trx  trx.usdt
eth  eth.usdt  eth.usdc
solana  solana.usdt  solana.usdc
bnb  bnb.usdt  bnb.usdc
ton  ton.usdt

Fee rates and minimum deposit/withdrawal amounts per currency are available via the public endpoint getCurrencies.

TRON-USDC deposits are disabled

The platform does not support USDC deposits on the TRON chain (trx.usdc). Do not send USDC to a platform-generated TRON (trx) deposit address — such transfers will not be credited and will not trigger callbacks, and the funds cannot automatically reach your merchant balance. trx.usdc is also not included in the withdrawal currency enum. Please direct your users to use USDC on the ETH / Solana / BNB chains instead.

Withdrawal type withdrawType (2 values)

Value	Description
normal	Regular withdrawal
financialConfirmation	Finance-confirmed withdrawal (executed only after confirmation by the finance side)

Implementation details

financialConfirmation requires the merchant to have a finance-audit Telegram account bound; otherwise the request fails with auditorTelegramNotBound. The platform also validates whether the withdrawType is allowed under the merchant's configured withdrawal policy. See Create Withdrawal Order for details.

Passing Amounts

We recommend sending and parsing amount fields (amount / fee / balance, etc.) as strings to avoid floating-point precision issues:

• Requests: send {"amount": "100.5"} rather than {"amount": 100.5}.
• Responses: all amount fields returned by the platform are strings. Handle them with an exact type such as decimal / BigDecimal — do not cast them to float.

Related Pages

• Keys & Credentials — the 4 values you need for integration and the key formats
• Protocol Specification — the byte-level spec for encryption / signing / anti-replay
• Callbacks — deposit-credited and withdrawal-status callbacks
• Error Codes — the message list when code=9999
• Troubleshooting

Chain & currency reference

Pass addressType from the table below when creating deposit addresses; use the corresponding symbol as currency for withdrawals.

Chain	addressType for createAddress	Deposit currencies	Withdrawal currency
TRON	trx	TRX, USDT	trx, trx.usdt
Ethereum	eth_bnb (address shared with BSC)	ETH, USDT, USDC	eth, eth.usdt, eth.usdc
BSC (BNB Chain)	eth_bnb (address shared with Ethereum)	BNB, USDT, USDC	bnb, bnb.usdt, bnb.usdc
Solana	solana	SOL, USDT, USDC	solana, solana.usdt, solana.usdc
TON	ton	TON, USDT	ton, ton.usdt
Bitcoin	btc (reserved)	Coming soon	Coming soon

More chains and currencies are being added

Fees and minimums per currency come from getCurrencies in real time; new chains are announced via announcements. Note that TON has USDT only, and USDC deposits on TRON are discontinued (see the warning at the top of this page).