📘
Sandbox API URL: https://api.stage.siti.ws/api/v1/payins/
Sandbox API & Sign key: 23455432-4444-3333-8888-123456654321
Sandbox Merchant ID: 23455432-4444-3333-8888-123456654321
Production credentials: Please contact your provider to obtain your production credentials

Check transfer status

Check via transfer status endpoint

You can retrieve the latest status of a transfer by calling the transfer status endpoint: GET https://api.stage.siti.ws/api/v1/payins/{id}.

Provide the payment ID (id from the response on transfer initiation), and the endpoint returns its current state along with additional details such as currency, amount, and reference. This method is useful when you need to poll for updates or verify the final result on demand.

Check via callback

You can also receive transfer status updates automatically through a callback (webhook). Specify your callbackUrl when initiating the transfer, and our system will send a notification to that URL when the payment status changes.

Webhook body example

{
      "id": "8f4c2f3a-9b76-4c39-9e6e-2d7c4dcb1e92",
      "status": "Done",
      "orderId": "your_order_id",
      "reference": "REF-20251121-1001",
      "currency": "EUR",
      "amount": 100.00,
      "payer": {
        "name": "John Doe",
        "bankId": "BANK123456",
        "account": {
          "iban": "DE89370400440532013000"
        }
      },
      "completedDate": "2025-11-21T12:00:00.0000000Z",
      "eventId": "evt_20251121_0001",
      "eventTimestamp": 1763524800000
    }

Callback signature verification

Each webhook request includes security headers for signature validation:

signature-timestamp — Unix timestamp.
signature — HMAC_SHA256(MerchantSignatureKey, signature-timestamp + "." + RequestBodyContent)

You must verify this signature on your end to ensure authenticity. The signature-timestamp must be unique for each callback delivery attempt

🚧
Both API key and token-based authentication methods are currently supported. Token-based authentication is strongly recommended for higher security and future compatibility, as API key-only authentication will be decommissioned by the end of March 2026.
To authenticate:

When using an API key, include it in the request as an x-api-key header.

When using a token, include it as an Authorization header in the format:

Authorization: Bearer YOUR_TOKEN