Built to be
integrated against
One documented REST API behind every surface, with a sandbox, working code samples and SDKs for the hardware in the field.
One REST API
behind every surface
Everything the portal, the terminals and the mobile apps do, your ISVs can do too — over the same documented endpoints, on the same base URL.
One versioned base URL
Every call goes to /api/v1. Sandbox runs at apisandbox.surepay.co; production is issued with your licence.
Bearer token or API key
POST /token returns a bearer token, or send a per-account key in the UserAuthorization header. Both are scoped to a merchant processor account.
Everything keyed by GUID
Objects come back with a guid you re-use to capture, void, return or retrieve — so retries stay unambiguous.
Sandbox before signature
Credentials, the full reference at the API reference and test cards, issued on the scoping call.
# 1. exchange credentials for a bearer token
curl https://apisandbox.surepay.co/api/v1/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=$USER&password=$PASS"
# 2. run the sale
curl https://apisandbox.surepay.co/api/v1/sales \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"DeviceGuid": "2101a0b0-6e0b-481b-b313-049675630c43",
"Amount": 19.74,
"TipAmount": 0.74,
"OrderNumber": "11518",
"SendReceipt": "true",
"Card": { "CardNumber": "5306764208460213",
"CardHolderName": "John Doe",
"Cvv2": "998", "ExpirationDate": "1907" }
}'
// 200 OK
{
"guid": "acd8333f-2fb7-4427-8101-6c8e22f4a537",
"status": "Transaction - Approved",
"batchStatus": "Batch - Open",
"amount": 19.74,
"authCode": "VTLMC1",
"refNumber": "13283532",
"processorStatusCode": "A0000",
"processorResponseMessage": "Success",
"wasProcessed": true
}Eighty-two endpoints,
twelve families
Card and ACH, one-off and recurring, invoices and hosted payments — all under one base URL and one credential.
/token · /accounts/* · /users/*6Issue a bearer token, register, reset a password, read the current user./sales6Sale, tip adjustment, sales by batch, timeout reversal, retrieve by GUID./AuthOnlys · /Captures5Authorize now, capture later, with timeout reversal on the auth./void · /returns5Void an unsettled sale; return with or without the original reference./Verify2Zero-dollar account verification before storing a card./tokenization2Vault a card or a bank account and transact against the token afterwards./BankClearings · …Voids · …Returns9ACH debits and credits with their own void and return paths./recurringBillings3Create, update and read a schedule./Batches3Close a batch, search batches, pull a batch with its transactions./Customers · /Invoice/*12Customer records, invoices, invoice detail lines and reminders./Search/{entity}/{exportable}/{page}/{size}27Paged, exportable search across every transaction type./HostedPaymentPageRequests2A hosted payment page and a shareable payment link.Counts are the operations published at the API reference. Search endpoints are paged: /Search/Sales/{exportable}/{pageNumber}/{pageSize}.
Four ways in,
depending on the build
From a drop-in script that keeps a merchant out of PCI scope, to full terminal control from a partner POS.
<!-- fields render into your own divs; the PAN never touches your server -->
<script
src="https://websandbox.surepay.co/assets/payment/Token.js"
id="gtwPayment"
user-api-key="7bd6c3f8-5d0f-4d58-93a0-b70a8c7b32df"
merch-device-guid="b69442d1-ab50-4f8f-b527-3b2047d72120"
merch-sys-alert="true"
merch-style-class="form-control"
sys-environment="sandbox"></script>
<div id="ccNumber"></div>
<div id="ccExpDate"></div>
<div id="cvv"></div>
// your submit handler receives the token
gatewayTokenJS.callback = onSubmit;
function onSubmit(response) { /* response.token → POST /sales */ }Payment Token JS
SurePay renders the card fields into divs you position, tokenizes in the browser and hands your callback a token. The merchant's servers never see a PAN.
Hosted payment page & links
POST /HostedPaymentPageRequests for a hosted checkout, or /PaymentLink for a shareable link — no integration project for the merchant.
Terminal SDKs
Dejapay and POSLink for driving PAX, Dejavoo and Valor hardware from a partner point of sale, against the same account.
Search and export
Twenty-seven paged search endpoints, each with an exportable flag, so reconciliation is a call rather than a screen scrape.
Declines that say
what went wrong
Approvals carry the processor status code and message through untouched. Declines carry a SurePay code on top, so an integrator can branch on it.
D0001Duplicate Request (Approved previously)Already performed and approved — check whether the same reference was submitted twice.D0004Reversal Not AllowedNot authorized for reversal: unsettled, declined, or already reversed.D0005Return Not AllowedNot authorized for return: unsettled, declined, or already returned.D0008Possible Duplicate RequestSame amount, card and service as another request less than a minute earlier.E0010Inactive Device (Terminal)The device is not registered, or is inactive.E0015Settlement in progressRetry once the batch has finished settling.E0020Inactive Merchant (Account)The merchant is not registered, or is inactive.E0030Unique ID ErrorThe terminal unique ID is invalid or not registered.An approval returns "processorStatusCode": "A0000" with wasProcessed: true. The full code list, including the backend D00xx range, is in the full API reference.
Every capability,
every platform
The complete certified feature set — filter by platform or search for the capability a merchant is asking about.
Ready to own
your gateway?
A scoping call covers your portfolio, processor mix and pricing programs. You leave knowing what ownership would cost you.