GatePay Merchant REST API

{
  "response": {
    "status": {
      "code": 201,
      "message": "Payment link created successfully."
    },
    "records": {
      "code": "payment_link_created",
      "transaction_id": "01KXQBBN9Y1CN3T3NSQHZ15W4V",
      "reference": "ORDER-1001",
      "mode": "sandbox",
      "status": "PENDING",
      "amount": "100.00000000",
      "currency": "USD",
      "payment_methods": ["Stripe"],
      "payment_url": "https://gatepay.techvill.net/pay/8fK2mQ7xN4vR9cT6pL3zWa",
      "expires_at": "2026-07-21T10:30:00+00:00",
      "metadata": {"order_id": "1001"}
    }
  }
}

{
  "response": {
    "status": {
      "code": 200,
      "message": "Transaction status retrieved successfully."
    },
    "records": {
      "code": "transaction_status_retrieved",
      "trx_reference": "01KXQBBN9Y1CN3T3NSQHZ15W4V",
      "reference": "ORDER-1001",
      "status": "SUCCESS",
      "mode": "sandbox",
      "amount": "100.00000000",
      "currency": "USD",
      "payment_method": "Stripe"
    }
  }
}

{
  "id": "evt_01KX...",
  "event": "payment.status.success",
  "created_at": "2026-07-21T10:00:00+00:00",
  "data": {
    "trx_reference": "01KXQBBN9Y1CN3T3NSQHZ15W4V",
    "reference": "ORDER-1001",
    "status": "SUCCESS",
    "mode": "live",
    "amount": "100.00000000",
    "currency": "USD",
    "payment_method": "Stripe",
    "metadata": {"order_id": "1001"}
  },
  "signature": "hex_hmac_sha256"
}

$timestamp = request()->header('X-Timestamp');
abort_unless(is_string($timestamp) && ctype_digit($timestamp), 401);

$now = time();
abort_if((int) $timestamp < $now - 300 || (int) $timestamp > $now + 300, 401);

$rawBody = request()->getContent();
try {
    $event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
    abort_unless(is_array($event), 401);

    $receivedSignature = $event['signature'] ?? null;
    abort_unless(is_string($receivedSignature), 401);

    unset($event['signature']);

    $unsignedBody = json_encode(
        $event,
        JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR
    );
} catch (\JsonException) {
    abort(401);
}

$expectedSignature = hash_hmac(
    'sha256',
    $timestamp.'.'.$unsignedBody,
    config('services.merchant_api.client_secret')
);

abort_unless(hash_equals($expectedSignature, $receivedSignature), 401);

return response()->noContent();

{
  "response": {
    "status": {
      "code": 422,
      "message": "The request payload is invalid."
    },
    "records": {
      "code": "validation_error",
      "errors": {
        "currency": ["The selected currency is invalid."]
      }
    }
  }
}