Dokumentasi API

GET /v1/balance HTTP/1.1
X-API-Key: dk_live_xxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json

{
  "success": true,
  "data": { ... }
}

{
  "success": false,
  "error": {
    "code": "insufficient_balance",
    "message": "Saldo tidak mencukupi. Silakan deposit terlebih dahulu."
  }
}

curl https://ditopup.com/api/v1/balance \
  -H "X-API-Key: $API_KEY"

{
  "success": true,
  "data": {
    "balance": 500000,
    "currency": "IDR",
    "tier": "reseller",
    "reseller_until": "2026-11-23T03:00:00+00:00"
  }
}

curl "https://ditopup.com/api/v1/products?category=Game" \
  -H "X-API-Key: $API_KEY"

{
  "success": true,
  "data": [
    {
      "code": "MLB5",
      "product": "Mobile Legends",
      "name": "86 Diamonds",
      "category": "Game",
      "price": 19500,
      "normal_price": 19500,
      "promo": false,
      "status": "available",
      "stock": null,
      "max_qty": 1,
      "fields": [
        { "key": "target", "label": "User ID", "required": true },
        { "key": "zone", "label": "Server / Zone ID", "required": true }
      ],
      "validate": true,
      "image": null
    }
  ]
}

curl -X POST https://ditopup.com/api/v1/validate \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"product":"MLB5","target":"12345678","zone":"1234"}'

{
  "success": true,
  "data": { "product": "MLB5", "target": "12345678", "zone": "1234", "name": "NamaPemain" }
}

curl -X POST https://ditopup.com/api/v1/order \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ref_id":"INV-20261024-0001","product":"MLB5","target":"12345678","zone":"1234"}'

{
  "success": true,
  "data": {
    "ref_id": "INV-20261024-0001",
    "trx_id": "TS2610241030451234",
    "product": "MLB5",
    "product_name": "Mobile Legends 86 Diamonds",
    "item_name": "86 Diamonds",
    "qty": 1,
    "target": "12345678",
    "zone": "1234",
    "price": 19500,
    "total": 19500,
    "refunded": 0,
    "status": "processing",
    "message": "",
    "sn": null,
    "data": [],
    "note": null,
    "created_at": "2026-10-24T03:30:45+00:00",
    "updated_at": "2026-10-24T03:30:46+00:00",
    "balance": 480500
  }
}

curl https://ditopup.com/api/v1/order/INV-20261024-0001 \
  -H "X-API-Key: $API_KEY"

curl https://ditopup.com/api/v1/deposit/channels \
  -H "X-API-Key: $API_KEY"

{
  "success": true,
  "data": [
    { "code": "QRIS", "name": "QRIS", "type": "qris", "min": 1000, "max": 10000000, "fee_flat": 0, "fee_percent": 0.7 }
  ]
}

curl -X POST https://ditopup.com/api/v1/deposit \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ref_id":"QR-20261108-0001","amount":25000,"channel":"QRIS"}'

{
  "success": true,
  "data": {
    "ref_id": "QR-20261108-0001",
    "deposit_id": "TSD2611081030451234",
    "channel": "QRIS",
    "channel_name": "QRIS",
    "amount": 25000,
    "fee": 175,
    "pay_amount": 25175,
    "credit": 0,
    "status": "pending",
    "qr_link": "https://.../qr/abc123.png",
    "pay_url": "https://.../pay/abc123",
    "expired_at": "2026-11-08T04:00:00+00:00",
    "created_at": "2026-11-08T03:30:45+00:00",
    "updated_at": "2026-11-08T03:30:46+00:00"
  }
}

curl https://ditopup.com/api/v1/deposit/QR-20261108-0001 \
  -H "X-API-Key: $API_KEY"

POST /callback HTTP/1.1
Content-Type: application/json
X-Event: order.updated
X-Timestamp: 1761276650
X-Signature: 5f2b...c91e

{
  "event": "order.updated",
  "data": { ...sama dengan respons /order/{ref_id}... }
}

{
  "event": "deposit.updated",
  "data": { ...sama dengan respons /deposit/{ref_id}, plus "balance" saat success... }
}

<?php
$secret = 'whsec_xxxxxxxxxxxxxxxx';
$raw    = file_get_contents('php://input');
$sig    = $_SERVER['HTTP_X_SIGNATURE'] ?? '';

if (!hash_equals(hash_hmac('sha256', $raw, $secret), $sig)) {
    http_response_code(401);
    exit('invalid signature');
}
$event = json_decode($raw, true);
if ($event['event'] === 'order.updated') {
    $o = $event['data'];
    // update transaksi $o['ref_id'] di database kamu menjadi $o['status']
}
http_response_code(200);
echo 'OK';

const crypto = require('crypto');
app.post('/callback', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = crypto.createHmac('sha256', process.env.CALLBACK_SECRET).update(req.body).digest('hex');
  if (sig !== req.get('X-Signature')) return res.status(401).send('invalid signature');
  const event = JSON.parse(req.body);
  // proses event.data.ref_id & event.data.status
  res.send('OK');
});

<?php
function api($method, $path, $body = null) {
    $ch = curl_init('https://ditopup.com/api/v1' . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_TIMEOUT        => 60,
        CURLOPT_HTTPHEADER     => ['X-API-Key: ' . getenv('API_KEY'), 'Content-Type: application/json'],
    ]);
    if ($body) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    $res = json_decode(curl_exec($ch), true);
    curl_close($ch);
    return $res;
}

$order = api('POST', '/order', [
    'ref_id'  => 'INV-' . time(),
    'product' => 'MLB5',
    'target'  => '12345678',
    'zone'    => '1234',
]);
if ($order['success']) {
    echo $order['data']['status'];
} else {
    echo $order['error']['code'] . ': ' . $order['error']['message'];
}

const BASE = 'https://ditopup.com/api/v1';
async function api(method, path, body) {
  const r = await fetch(BASE + path, {
    method,
    headers: { 'X-API-Key': process.env.API_KEY, 'Content-Type': 'application/json' },
    body: body ? JSON.stringify(body) : undefined,
  });
  return r.json();
}

const order = await api('POST', '/order', {
  ref_id: 'INV-' + Date.now(),
  product: 'MLB5',
  target: '12345678',
  zone: '1234',
});
console.log(order.success ? order.data.status : order.error);

import os, time, requests
BASE = 'https://ditopup.com/api/v1'
H = {'X-API-Key': os.environ['API_KEY']}

r = requests.post(BASE + '/order', headers=H, timeout=60, json={
    'ref_id': f'INV-{int(time.time())}',
    'product': 'MLB5',
    'target': '12345678',
    'zone': '1234',
}).json()
print(r['data']['status'] if r['success'] else r['error'])

curl --http1.1 https://ditopup.com/api/v1/balance \
  -H "X-API-Key: $API_KEY"

curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);

r = requests.get('https://ditopup.com/api/v1/balance', headers={'X-API-Key': API_KEY}, timeout=30)

const https = require('https');
const agent = new https.Agent({ keepAlive: false });
// fetch/axios: kirim { agent } agar tiap request memakai koneksi baru