NAV
cURL PHP JS

Introduction

The Pezemo API is organized around REST. Our API has predictable resource-oriented URLs, accepts form-encoded request bodies, returns JSON-encoded responses, and uses standard HTTP response codes, authentication, and verbs.

You can use the Pazemo API in test mode, which does not affect your live data or interact with the banking networks. The API key you use to authenticate the request determines whether the request is live mode or test mode.

Getting Started

Learn about Pazemo.

Pazemo and its multi-currency account features and pricing are best explained below, or you can contact us to info@pazemo.com for information.

https://pazemo.com/pricing

Sign Up

Sign up for your Pazemo account, activate your account, and complete verification. Using the product before integrating with our API will help you understand how our payment flow works. Just follow these four steps

Choose the best tool for you

You don’t necessarily need to integrate with the API to make a large number of withdraws. We have two ways you can do it:

API access

Authentication

To authorize, use this code:

# With shell, you can just pass the correct header with each request
curl "api_endpoint_here"
  -H "Authorization: bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"

Make sure to replace xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx with your API key.

Sign up for a developer account and get your personal API token for our sandbox. https://pazemo.com/register

Add your API token as header parameter to every request like this:

Authorization: Bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx

Acquiring your API token

Your API tokens section can be found at the bottom of the Settings page inside your Pazemo account. By default, you have no active tokens, You can create up to five API tokens.

Keeping your API token safe

Your API tokens should be guarded closely. They represent your identity and authorization and can be used to interact with your Pazemo account on your behalf. Whoever has access to your token can access your account details and history. In the case of a Full access token, they can also send transfers. Once you obtain an API token from us, it is on you to keep it safe.

Below is technical advise and guidance on how to protect your tokens. Not everything may apply to the application you are building and the goal is not to provide a long checklist of things to do. Rather, we attempt to provide generic guidance and best-practices, to send you in the right direction. You will have to do additional research and consider the specific technology and purpose of your application.

Source code

Don't store API tokens as plaintext files in Git

$ git clone https://github.com/mycompany/myapp.git
$ cat myapp.git/apiconfig.json
{
  "token": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
  "url": "https://api.stg.pazemo.com/"
}

A common mistake made by engineers is storing access tokens in source code, in plaintext - which is then shared in a version control system, sometimes publicly.

When an API token is stored like this, it can be accessed and used by anyone who has access to the source code. Avoid storing secrets in code.

Instead:

Limit permissions of a sensitive configuration file

$ cp .env.sample .env
$ echo .env >> .gitignore
$ chown myapp:root .env && chmod 600 .env

Token lifecycle

If you suspect that your token has leaked, revoke and rotate it. If you accidentally push a token to a remote public repository, rotate it. Quickly deleting an access token from VCS might not be enough - remember that VCS stores historical changes, is distributed and might have automation assigned to new pushes.

Revoke old tokens that you no longer need or use.

During the lifetime of an active token, limit the amount of people and systems who can access it. E-mail inboxes and chat logs are archived and not a secure place to hold tokens. Ideally, your access token would live only in Pazemo systems and your production system(s) that actually need it. You do not need to hold a backup copy of the token, as you can reveal an existing token from your profile settings page.

Encryption

Pazemo Platform API is using HTTPS with >=TLS 1.2. Non-encrypted HTTP connections are not accepted. Do not connect to our API with unencrypted HTTP, as this will transmit your access token in plaintext over the network.

Verifying certificates in client code

<?php
// Secure - this will fail when an invalid HTTPS certificate is returned.
// Such failure is not normal and most likely means there is something
// in-between you and Pazemo, intercepting communications.
$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_URL, 'https://api.stg.pazemo.com');


// Insecure - do not do this. This will not validate certificates and
// might leak your access token to an attacker.
// See https://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html
$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_URL, 'https://api.stg.pazemo.com');

Validate certificates. You should not proceed with a connection when you receive a certificate validation error from Pazemo. Make sure all parts of your application are using encryption and HTTPS and failing when certificate validation fails.

Application design

Secure your application against common security flaws (OWASP Top 10). Think how an attacker could leverage Unrestricted File Upload or Insecure Direct Object Reference to read the contents of your server's environment or config files.

If your application is larger, consider extracting Pazemo-specific functionality into a separate middleware or service layer. This would enable you to move API tokens there, separate from the main application.

Do not store the token in user-accessible code such as browser-side JavaScript or Android apps that can be decompiled. The token should always live server-side, exposing domain-logic via API-s.

If you need to pass the token around via HTTP requests, use HTTP headers or POST body - do not store the token in URI or query parameters. Web servers usually log the URL and browsers pass it between websites via the Referrer header.

Limiting token access by IP

You can enhance your integration security by only allowing certain IP addresses to use your API token.

Typically, you would integrate with our API from a set number of fixed IP addresses. Restricting access from all other IPs will make it harder to misuse your API token, should it ever leak. IP whitelisting does not protect against cases where several clients egress from the same whitelisted IP (shared external IP for the office network, an egress proxy in front of all of your servers).

Each token can be limited to single IP addresses, a set of IP addresses or entire IP ranges. You can do this in the API token edit view.

Please note:

If a request is being made using an IP address that is not in the whitelisted IP addresses, the server will respond with a 401 Unauthorized HTTP status code.

The option for toggling the check yourself will also be available in production as long as it is optional.

Environments

SERVER Base URL
LIVE API https://api.pazemo.com/
SANDBOX API https://api.stg.pazemo.com/

Users

Get currently logged in user

Get authenticated user details for the loged in user's. Response includes also personal user profile info.

Example Request:

curl    -X GET "http://api.stg.pazemo.com/users/me" \
        -H "Accept: application/json" \
        -H "Authorization: Bearer <your api token>" \
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'http://api.stg.pazemo.com/users/me',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
  CURLOPT_HTTPHEADER => array(
    'Authorization: Bearer'.' '.<your api token>
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Example Response:

{
  "id": "string",
  "email": "string",
  "name": "string"
}

Request

GET http://api.stg.pazemo.com/users/me

Response

Field Description Format
id User ID string
email User email email
name User name string

Get User Info by ID

Get authenticated user details by user id. Response includes also personal user profile info.

Example Request:

curl -X GET "http://api.stg.pazemo.com/users/{userid}" \
      -H "Accept: application/json" \
      -H "Authorization: Bearer <your api token>" \
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'http://api.stg.pazemo.com/users/{userid}',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
  CURLOPT_HTTPHEADER => array(
    'Authorization: Bearer'.' '.<your api token>
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Example Response:

{
  "id": "string",
  "createdTime": "1970-01-01T00:00:00.000Z",
  "updatedTime": "1970-01-01T00:00:00.000Z",
  "status": "string",
  "email": "user@example.com",
  "mobile": "string",
  "name": "string",
  "partnerId": "string",
  "roles": [
    "string"
  ],
  "configs": {}
}

Request

GET http://api.stg.pazemo.com/users/{userid}

Response

Field Description Format
id User ID string
createdTime Created Date date-time
updatedTime Updated Date date-time
status Status string
email User email email
mobile User mobile string
name User name string
partnerId Parter ID string
roles User Role string

Accounts

Create a Multy-Currency Account: Indonesian Rupiah (IDR), US Dollar (USD), Singapore Dollar (SGD), Malaysian Ringgit (MYR), Euro (EUR).

Create Account

You can create account from sidebar menu and click + New Account, then select from available currencies provided.

Example Request:

   curl -X POST 'http://api.stg.pazemo.com/users/{userId}/accounts' \
        -H "Content-Type: application/json" \
        -H "Authorization: Bearer <your api token>"
        -d '{
             "currencyId": "string",
             "number": "string"
            }'

Example Response:

{
  "id": "string",
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "currencyId": "string",
  "number": "string"
}

Request

POST http://api.stg.pazemo.com/users/{userId}/accounts

Field Description Format
userID User ID Text.
currencyId Currency ID Text.
number Account Number Text.

Response

Field Description Format
id Account ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
currencyId Currency ID Text.
number Account Number Text.

Get Accounts Info

Get information from all your available multy-currency accounts.

Example Request:

   curl -X GET 'http://api.stg.pazemo.com/users/{userId}/accounts' \
        -H "Accept: application/json" \
        -H "Authorization: Bearer <your api token>"
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'http://api.stg.pazemo.com/users/{userId}/accounts',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
  CURLOPT_HTTPHEADER => array(
    'Authorization: Bearer'.' '.<your api token>
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Example Response:

[
    {
        "id": "string",
        "createdTime": "2021-06-11T03:56:25.871Z",
        "updatedTime": "2021-06-11T03:56:25.871Z",
        "userId": "string",
        "currencyId": "USD",
        "number": "112456475114",
        "balance": 0,
        "locked": 0
    },
    {
        "id": "string",
        "createdTime": "2021-06-11T03:56:17.167Z",
        "updatedTime": "2021-06-11T03:56:17.168Z",
        "userId": "string",
        "currencyId": "IDR",
        "number": "11286762273",
        "balance": 948775.42,
        "locked": -84311
    },
    {
        "id": "string",
        "createdTime": "2021-06-11T03:56:30.137Z",
        "updatedTime": "2021-06-11T03:56:30.137Z",
        "userId": "string",
        "currencyId": "SGD",
        "number": "112826187955",
        "balance": 9.1,
        "locked": 0
    }
]

Request

GET http://api.stg.pazemo.com/users/{userId}/accounts

Field Description Format
userID User ID Text.

Response

Field Description Format
id Account ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
currencyId Currency ID Text.
number Account Number Text.
balance Account Balance Number.

Get Account Info by ID

Get information from your accounts by ID

Example Request:

   curl -X GET 'http://api.stg.pazemo.com/users/{userId}/accounts/{id}' \
        -H "Accept: application/json" \
        -H "Authorization: Bearer <your api token>"
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'http://api.stg.pazemo.com/users/{userId}/accounts/{id}',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
  CURLOPT_HTTPHEADER => array(
    'Authorization: Bearer'.' '.<your api token>
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Example Response:

{
    "id": "string",
    "createdTime": "2021-06-11T03:56:25.871Z",
    "updatedTime": "2021-06-11T03:56:25.871Z",
    "userId": "string",
    "currencyId": "USD",
    "number": "112456475114",
    "balance": 0,
    "locked": 0
}

Request

GET http://api.stg.pazemo.com/users/{userId}/accounts/{id}

Field Description Format
userID User ID Text.
id Account ID Text.

Response

Field Description Format
id Account ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
currencyId Currency ID Text.
number Account Number Text.
balance Account Balance Number.

Recipients

Create Recipients

Create a Recipients to receive withdrawal. You can add recipients from our platform with 2 ways, directly from your Withdraw dashboard or create from Recipients dashboard.

Create Recipient in Withdraw Dashboard

After select account source, select New Address for your new recipient, select available Banks, then input number and name, so you next time can use it from Recipients list easily.

Create Recipient in Recipients Dashboard

Another way to create Recipients, at your main dashboard sidebar menu click Recipients, + ADD NEW RECIPIENT then select from available currencies and banks provided then fill account number and label.

Example Request:

curl  -X POST 'http://api.stg.pazemo.com/beneficiaries' \
      -H 'Content-Type: application/json' \
      -d '{
            "updatedTime": "2019-08-24T14:15:22Z",
            "accountId": "string",
            "bankId": "string",
            "address": "string",
            "email": "string",
            "label": "string",
            "type": "personal"
        }'

Example Response:

{
  "id": 0,
  "accountId": "string",
  "bankId": "string",
  "address": "string",
  "name": "string",
  "email": "string",
  "label": "string",
  "status": "pending",
  "type": "personal"
}

Create New Recipient

Request

POST http://api.stg.pazemo.com/beneficiaries

Field Description Format
updatedTime Updated Time "yyyy-mm-dd".
accountId Account ID Text.
bankId Bank ID Text.
address Address Text.
name Name Text.
email Email Text.
label Label Text.
status Status Text.
type Type Text.

Response

Field Description Format
id Recipient ID Text.
accountId Account ID Text.
bankId Bank ID Text.
address Address Text.
name Name Text.
email Email Text.
label Label Text.
status Status Text.
type Type Text.

Withdraw

Pazemo can be added as a withdraw option on your site for beneficiaries to receive their withdraw through to a bank account, you can choose from your bank, from recipients list or add new recipients.

Before you can request a withdraw, make sure you have created Multy-Currency accounts and add proper recipients, for example if you want to withdraw to Indonesian Bank, you have to create IDR account or exchange from another account (USD, SGD, MYR, EUR) to IDR.

From your main dashboard, go to Withdraw dashboard from sidebar menu, select available currency accounts and recipients, fill amount, click WITHDRAW IDR button to process your withdraw.

Create Withdraw

Example Request:

curl  -X POST "http://api.stg.pazemo.com/accounts/{accountId}/withdraw" \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer <your api token>"
      -d "{
            "id": "string",
            "updatedTime": "2019-08-24T14:15:22Z",
            "accountId": "string",
            "address": "string",
            "addressName": "string",
            "amount": 0,
            "notes": "string",
            "prefix": "string",
            "beneficiaryId": 0,
            "reference": "string",
            "referenceData": {}
        }"

The above command returns JSON structured like this:

{
  "id": "string",
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "accountId": "string",
  "transactionId": 0,
  "status": "pending",
  "network": "flip",
  "address": "string",
  "addressName": "string",
  "amount": 0,
  "feeAmount": 0,
  "notes": "string",
  "prefix": "string",
  "beneficiaryId": 0,
  "reference": "string",
  "referenceData": {}
}

Request

POST http://api.stg.pazemo.com/accounts/{accountId}/withdraw

Field Description Format
accountId Account ID Text.
id Withdraw ID Text.
updatedTime Update Date "yyyy-mm-dd".
address Address Text.
adressName Address Name Text.
amount Amount Number.
notes Notes Text.
prefix Prefix Text.
beneficiaryId Beneficiary ID Number.
reference Reference Text.
referenceData Reference Data Object.

Response

Field Description Format
id Withdraw ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
accountId Account ID Text.
transactionId Transaction ID Number.
status WIthdraw Status Text.
network Network Name Text.
address Address Text.
amount Amount Number.
feeAmount Fee Amount Number.
notes Notes Text.
prefix Prefix Text.
beneficiaryId Beneficiary ID Number.
reference Reference Text.
referenceData Reference Data Object.

Confirmation

Example Request:

curl  -X POST 'http://api.stg.pazemo.com/accounts/{accountId}/withdraw/{id}/confirm' \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer <your api token>"
      -d '{
"authorizationCode": "string"
}'

Example Response:

{
  "id": "string",
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "accountId": "string",
  "transactionId": 0,
  "status": "pending",
  "network": "flip",
  "address": "string",
  "addressName": "string",
  "amount": 0,
  "feeAmount": 0,
  "notes": "string",
  "prefix": "string",
  "beneficiaryId": 0,
  "reference": "string",
  "referenceData": {}
}

Withdraw Confirmation

Request

POST http://api.stg.pazemo.com/accounts/{accountId}/withdraw/{id}/confirm

Field Description Format
accountID Account ID Text.
ID ID Text.
authorizationCode Autorization Code Text.

Response

Field Description Format
id Withdraw ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
accountId Account ID Text.
transactionId Transaction ID Number.
status WIthdraw Status Text.
network Network Name Text.
address Address Text.
amount Amount Number.
feeAmount Fee Amount Number.
notes Notes Text.
prefix Prefix Text.
beneficiaryId Beneficiary ID Number.
reference Reference Text.
referenceData Reference Data Object.

Cancellation

Example Request:

curl  -X POST 'http://api.stg.pazemo.com/accounts/{accountId}/withdraw/{id}/cancel' \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer <your api token>"
      -d '{
"authorizationCode": "string"
}'

Example Response:

{
  "id": "string",
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "accountId": "string",
  "transactionId": 0,
  "status": "pending",
  "network": "flip",
  "address": "string",
  "addressName": "string",
  "amount": 0,
  "feeAmount": 0,
  "notes": "string",
  "prefix": "string",
  "beneficiaryId": 0,
  "reference": "string",
  "referenceData": {}
}

Withdraw Cancellation

Request

POST http://api.stg.pazemo.com/accounts/{accountId}/withdraw/{id}/cancel

Field Description Format
accountID Account ID Text.
ID ID Text.
authorizationCode Autorization Code Text.

Response

Field Description Format
id Withdraw ID Text.
createdTime Creation Date "yyyy-mm-dd".
updatedTime Update Date "yyyy-mm-dd".
accountId Account ID Text.
transactionId Transaction ID Number.
status WIthdraw Status Text.
network Network Name Text.
address Address Text.
amount Amount Number.
feeAmount Fee Amount Number.
notes Notes Text.
prefix Prefix Text.
beneficiaryId Beneficiary ID Number.
reference Reference Text.
referenceData Reference Data Object.

Pings

Check

Example Request:

curl -X GET "http://api.stg.pazemo.com/check" \
     -H "Accept: application/json" \
     -H "Authorization: Bearer <your api token>" \

Example Response:

{
  "greeting": "string",
  "date": "string",
  "url": "string",
  "headers": {
    "Content-Type": "string"
  }
}

Check server

Request

GET http://api.stg.pazemo.com/check

Response

Field Description Format
greeting Greeting string
date Date date-time
url URL date-time
Content-Type Content Type string

Ping

Example Request:

curl    -X GET "http://api.stg.pazemo.com/ping" \
        -H "Accept: application/json" \
        -H "Authorization: Bearer <your api token>" 
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'http://api.stg.pazemo.com/ping',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Example Response:

Return value of PingController.ping

Ping the server and retrieve the server version.

Request

GET http://api.stg.pazemo.com/ping

Response

Return value of PingController.ping

Ping Queue

Example Request:

curl    -X GET "http://api.stg.pazemo.com/pingQueue" \
        -H "Accept: application/json" \
        -H "Authorization: Bearer <your api token>" \

Example Response:

{
  "greeting": "string",
  "date": "string",
  "url": "string",
  "headers": {
    "Content-Type": "string"
  }
}

Get Ping Queue

Request

GET http://api.stg.pazemo.com/pingQueue

Response

Field Description Format
greeting Greeting string
date Date date-time
url URL date-time
Content-Type Content Type string

Errors

HTTP Status Codes

We use common HTTP status codes included in the response header to indicate success or failure.

Error Code Meaning
200 OK -- Everything worked as expected..
400 Bad Request -- The request was unacceptable, often due to missing a required parameter.
401 Unauthorized -- Your API key is wrong.
402 Request Failed -- The parameters were valid but the request failed.
403 Forbidden -- The data requested is hidden for administrators only.
404 Not Found -- The specified data could not be found.
409 Conflict -- The request conflicts with another request (perhaps due to using the same idempotent key).
410 Gone -- The data requested has been removed from our servers.
429 Too Many Requests -- Too many requests hit the API too quickly. We recommend an exponential backoff of your requests.
500 Internal Server Error -- We had a problem with our server. Try again later.
503 Service Unavailable -- We're temporarily offline for maintenance. Please try again later.

Validation Errors

Example Validation Error:

{
    "errors": [
        {
            "code": "error.route.not.supported",
            "message": "This route is not supported",
            "arguments": [
                "CNY-EUR"
            ]
        }
    ]
}

Data validation or violation of business rules related errors. Response could contain multiple errors.

Authentication Errors

Example Authentication Error:

{
    "error": "unauthorized",
    "error_description": "Full authentication is required to access this resource"
}

Security related errors.

System Errors

Example System Error:

{
  "timestamp": "2017-02-02T13:07:39.644+0000",
  "status": 500,
  "error": "Internal Server Error",
  "exception": "java.lang.NullPointerException",
  "message": "No message available",
  "path": "/v1/quotes/0b63b0cb-2041-4bc4-b3fc-1e51a1454a1b/account-requirements"
}

Something went wrong in our side.