Merchant API
Payment Intents

List payment intents

List payment intents for the authenticating merchant in the key's environment, ordered most-recent-first. Walk pages via `next_cursor`. Filters narrow the set; cursor and filters are independent; apply the filters again on each page request.

GET
/payment_intents

List payment intents for the authenticating merchant in the key's environment, ordered most-recent-first. Walk pages via next_cursor. Filters narrow the set; cursor and filters are independent; apply the filters again on each page request.

Authorization

apiKey
AuthorizationBasic <token>

Merchant API key pair. Send as Authorization: Basic base64(publicKey:secretKey) — username is the public key (pk_live_… / pk_test_…), password is the secret key (sk_live_… / sk_test_…). The public key prefix determines the environment of every order created by the request — there is no body, query, or header override.

In: header

Query Parameters

country?string

ISO 3166-1 alpha-2 country code, e.g. "MY".

Match^[A-Z]{2}$
created_after?string

Inclusive lower bound on createdAt, ISO-8601 with offset.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
Formatdate-time
created_before?string

Exclusive upper bound on createdAt, ISO-8601 with offset.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
Formatdate-time
currency?string

ISO 4217 currency code (e.g. "MYR", "USD") or a 3–6 letter token symbol. Uppercase.

Match^[A-Z]{3,6}$
cursor?string

Opaque pagination cursor returned by the previous page as next_cursor. Omit on the first page.

Length1 <= length
merchant_reference?string

Exact-match filter on the merchant-supplied reference. Use to look up an intent by your own id.

Length1 <= length <= 256
limit?integer

Page size, 1-100. Defaults to 25. Walk pages via next_cursor rather than raising this.

Range1 <= value <= 100
Default25
status?||array<>

Filter to one or more lifecycle states. Pass a single value or a comma-separated list (e.g. requires_action,succeeded).

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/payment_intents"
{  "data": [    {      "amount": "10000",      "captured_amount": "0",      "completed_at": null,      "country": "MY",      "created_at": "2026-05-09T12:34:00.000Z",      "currency": "MYR",      "environment": "test",      "failure_code": null,      "expires_at": "2026-05-09T12:49:00.000Z",      "id": "dord_01HZYABCDXYZ",      "merchant_reference": "order-2026-05-09-0001",      "next_action": {        "expires_at": "2026-05-09T12:49:00.000Z",        "type": "redirect_to_url",        "url": "https://api.example.com/continue/payment_123"      },      "object": "payment_intent",      "payment_method": "FPX",      "receipt": null,      "status": "requires_action",      "updated_at": "2026-05-09T12:34:02.000Z"    }  ],  "has_more": true,  "next_cursor": "eyJ0IjoiMjAyNi0wNS0wOFQyMjoxNDowMC4wMDBaIiwiaWQiOiJkb3JkXzAxSEFCQyJ9"}

Create a Hosted Checkout POST

Create a Hosted Checkout with a minimal Merchant request. Checkout collects an omitted payment method and payer details, or immediately advances a supplied `payment_method` to its authoritative Provider action. The response returns an Init-controlled `checkout_url`; `return_url` is always the Merchant's final return URL.

Get a payment intent GET

Get the current committed payment intent projection without initiating Provider work. Scoped to the authenticating merchant and the API key's Environment; intents that belong to another merchant or Environment return 404 indistinguishably from unknown ids.