API Structure

Our API is based on REST principles, receiving Requests and providing Responses in the JSON format.

Authenticating

Requests are authenticated with an API (secret) key and entity ID, as shown in the following request header:

     --header 'Content-Type: application/json' \
     --header 'Accept: application/json' \
     --header 'x-reap-api-key: YOUR_API_KEY' \
     --header 'x-reap-entity-id: YOUR_ENTITY_ID' \

PAAS stands for "Payments-as-a-Service", and is the schema that applies for interacting with our Payments APIs. The API Key and entity ID is available through your Dashboard interface under "Settings" --> " PaaS API Keys". Most of the time our "Content-Type" is as shown, but occasionally we have differences like in our payments documentation endpoint. Entity ID (also known as Business ID) is unique for your Manager Account and each Managed Account - it's used to determine which business account you are passing the API request for. To learn more the differences between Manager Account and Managed Account, refer to Account Management.

IP Addresses

We require all users to whitelist the IP addresses they will use to interact with the Payments API (Production environment only). This can be done through your user dashboard in "Settings" area where you also generate your Production API keys. This requirement is to improve the security of our system, and non-whitelisted IP addresses will not be able to access the API functionalities. Note that you only need to configure the IP addresses from your Manager Account and this will be inherited by the Managed Accounts automatically.

Public-Private Key Hashing

To provide further data integrity we offer users the ability to use public-private key hashing (RSA-SHA512) in all interactions with our APIs. You can input your public key on the dashboard in “Settings” area where you also generate your Production API keys, and this is to ensure we are able to receive requests with the user's hashing. Once you configured the public key, you need to pass the signature in the header for us to authenticate your requests. While providing a public key and signing requests is optional, it is strongly encouraged to enhance request authenticity and integrity.

     --header 'x-reap-signature: SIGNATURE_GENERATED_WITH_YOUR_PRIVATE_KEY' \