API UranoPag

Authorization: Bearer up_live_SUA_CHAVE
Content-Type: application/json

Idempotency-Key: 2f1c9a7e-5b8d-4c3a-9e21-7d6f0b4a1c55

POST /v1/charges

curl -X POST "https://api.uranopag.app/v1/charges" \
  -H "Authorization: Bearer up_live_SUA_CHAVE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 2f1c9a7e-5b8d-4c3a-9e21-7d6f0b4a1c55" \
  -d '{
    "amount_cents": 15000,
    "external_id": "pedido-8842",
    "description": "Pedido 8842",
    "payer": { "name": "Maria da Silva", "document": "529.982.247-25", "email": "maria@email.com" }
  }'

{
  "id": "3b0d7c1e-9f8a-4a52-8d3e-1c2b4a5f6e70",
  "object": "charge",
  "external_id": "pedido-8842",
  "amount_cents": 15000,
  "fee_cents": 449,
  "net_cents": 14551,
  "status": "pending",
  "pix_copy_paste": "00020101021226...6304ABCD",
  "end_to_end_id": null,
  "expires_at": "2026-10-19T03:30:00.000Z",
  "paid_at": null,
  "created_at": "2026-10-18T03:30:00.000Z"
}

GET /v1/charges/{id}
GET /v1/charges?page=1&limit=20&status=paid&external_id=pedido-8842

{ "data": [ { "id": "3b0d7c1e-...", "object": "charge", "status": "paid", "end_to_end_id": "E18236120202610180331s0123456789", "...": "..." } ], "page": 1, "limit": 20, "has_more": false }

GET /v1/balance

{ "object": "balance", "available_cents": 125000, "blocked_cents": 0, "updated_at": "2026-10-18T03:31:00.000Z" }

POST /v1/withdrawals

curl -X POST "https://api.uranopag.app/v1/withdrawals" \
  -H "Authorization: Bearer up_live_SUA_CHAVE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 7d6f0b4a-1c55-4c3a-9e21-2f1c9a7e5b8d" \
  -d '{ "amount_cents": 50000, "pix_key_type": "email", "pix_key": "financeiro@empresa.com" }'

{
  "id": "9c1e2a4b-...",
  "object": "withdrawal",
  "amount_cents": 50000,
  "fee_cents": 200,
  "net_cents": 49800,
  "status": "pending",
  "pix_key": "financeiro@empresa.com",
  "pix_key_type": "email",
  "end_to_end_id": null,
  "failure_reason": null,
  "created_at": "2026-10-18T03:40:00.000Z",
  "processed_at": null
}

GET /v1/withdrawals/{id}
GET /v1/withdrawals?page=1&limit=20

{
  "id": "payment.paid:3b0d7c1e-9f8a-4a52-8d3e-1c2b4a5f6e70",
  "event": "payment.paid",
  "created_at": "2026-10-18T03:31:02.000Z",
  "data": {
    "object": "charge",
    "id": "3b0d7c1e-9f8a-4a52-8d3e-1c2b4a5f6e70",
    "external_id": "pedido-8842",
    "amount_cents": 15000,
    "fee_cents": 449,
    "net_cents": 14551,
    "status": "paid",
    "end_to_end_id": "E18236120202610180331s0123456789",
    "paid_at": "2026-10-18T03:31:00.000Z",
    "created_at": "2026-10-18T03:30:00.000Z"
  }
}

import crypto from "node:crypto";

app.post("/webhooks/uranopag", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.get("X-UranoPag-Timestamp") ?? "";
  const got = req.get("X-UranoPag-Signature") ?? "";
  const raw = req.body.toString("utf8");
  const expected = "sha256=" + crypto.createHmac("sha256", process.env.URANOPAG_WEBHOOK_SECRET).update(`${ts}.${raw}`).digest("hex");
  const ok = got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(401);
  const event = JSON.parse(raw);
  // processe de forma idempotente usando event.id
  res.sendStatus(200);
});

<?php
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_URANOPAG_TIMESTAMP'] ?? '';
$got = $_SERVER['HTTP_X_URANOPAG_SIGNATURE'] ?? '';
$exp = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, getenv('URANOPAG_WEBHOOK_SECRET'));
if (!hash_equals($exp, $got) || abs(time() - (int)$ts) > 300) { http_response_code(401); exit; }
$event = json_decode($raw, true);
http_response_code(200);

import hmac, hashlib, os, time
raw = request.get_data()
ts = request.headers.get("X-UranoPag-Timestamp", "")
exp = "sha256=" + hmac.new(os.environ["URANOPAG_WEBHOOK_SECRET"].encode(), f"{ts}.".encode() + raw, hashlib.sha256).hexdigest()
if not hmac.compare_digest(exp, request.headers.get("X-UranoPag-Signature", "")) or abs(time.time() - int(ts or 0)) > 300:
    abort(401)

{ "error": { "code": "validation_error", "message": "Dados inválidos.", "fields": ["payer.document"] } }

const res = await fetch("https://api.uranopag.app/v1/charges", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.URANOPAG_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({ amount_cents: 15000, external_id: "pedido-8842", payer: { name: "Maria da Silva", document: "52998224725" } }),
});
const charge = await res.json();
if (!res.ok) throw new Error(charge.error.code);
console.log(charge.pix_copy_paste);

<?php
$ch = curl_init('https://api.uranopag.app/v1/charges');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer ' . getenv('URANOPAG_API_KEY'),
    'Content-Type: application/json',
    'Idempotency-Key: ' . bin2hex(random_bytes(16)),
  ],
  CURLOPT_POSTFIELDS => json_encode(['amount_cents' => 15000, 'payer' => ['name' => 'Maria da Silva', 'document' => '52998224725']]),
]);
$charge = json_decode(curl_exec($ch), true);

import os, uuid, requests
r = requests.post("https://api.uranopag.app/v1/charges",
    headers={"Authorization": f"Bearer {os.environ['URANOPAG_API_KEY']}", "Idempotency-Key": str(uuid.uuid4())},
    json={"amount_cents": 15000, "payer": {"name": "Maria da Silva", "document": "52998224725"}}, timeout=20)
r.raise_for_status()
print(r.json()["pix_copy_paste"])