Search transactions

GET

/api/transactions

curl -s "https://services.sandbox.payplug-elements.msem.tech/api/transactions?limit=20&status=pending" \
  -H "authorization: Bearer $ACCESS_TOKEN"

The runbook’s grep at its native grain: every PSP operation, each carrying the session, attempt and order that give it meaning. Same filters as the other searches; from/to ride the TRANSACTION’s own createdAt, providerRef matches the row itself.

Authorizations

• apiToken

Parameters

Query Parameters

orderId

string

>= 1 characters

The merchant’s own order reference.

providerRef

string

>= 1 characters

A PSP’s reference, as their dashboard shows it.

merchantId

string

>= 1 characters

Narrow to one merchant (an admin’s filter). Intersects with the caller’s own scope: asking for someone else’s yields an empty page, never an error.

from

integer

Epoch ms, inclusive — on the entity’s own createdAt.

to

integer

Epoch ms, exclusive — [from, to).

limit

integer

default: 20 >= 1 <= 100

Page size (max 100).

cursor

string

The previous page’s nextCursor, verbatim.

status

string

Allowed values: pending succeeded failed cancelled

Where the operation stands. pending means the verdict is still due — it always arrives out-of-band.

Responses

200

The matching transactions, newest first — one keyset page, each with its context.

Media typeapplication/json

object

transactions

required

The matching operations, newest first.

Array<object>

The transaction, with the home that gives it meaning — session, order, attempt.

object

sessionId

required

The session this belongs to.

string format: uuid

merchantId

required

The merchant it belongs to.

string

orderId

required

Their own order reference.

string

attemptId

required

The attempt it belongs to.

string format: uuid

method

required

What the attempt behind this operation was paid with — card, paypal, wero… An operation alone does not say it, and reading a list of PSP operations without it means opening each one.

string

cardScheme

The card network that attempt ran on, when the PSP named one we could place — see the same field on an attempt.

string

cardCode

The card as the PSP masked it — see the same field on an attempt.

string

cardCountry

The country of the card’s issuer — see the same field on an attempt.

string

provider

required

The PSP adapter that served the attempt (D-051) — whose dashboard the references live in.

string

transaction

required

The operation itself.

object

transactionId

required

Our handle for this PSP operation — what a refund door addresses.

string format: uuid

createdAt

required

When the operation was opened — epoch milliseconds (Q13).

integer

updatedAt

required

The last event that touched it — for a terminal transaction, its verdict’s instant.

integer

type

required

What this operation asked the PSP: hold the money, take it in one go, capture a hold, release a hold, send money back, or debit the registered card later.

string

Allowed values: authorization payment capture void refund debit

amount

required

What this operation moved, in minor units.

object

amount

required

Amount in the MINOR unit of the currency — 1000_00 is one thousand euros, never 1000.

integer

currency

required

ISO 4217 code, uppercase. One currency per session.

string

/^[A-Z]{3}$/

providerRef

The PSP’s reference — what their dashboard greps (D-047).

string

status

required

The VERDICT facet: what the PSP finally decided about this operation — as opposed to the ack facet below, which is what the driving call answered on the spot.

object

kind

required

Where the operation stands. pending means the verdict is still due — it always arrives out-of-band.

string

Allowed values: pending succeeded failed cancelled

statusCode

The PSP’s own code, split at the source — successes carry theirs too.

string

statusMessage

The PSP’s own sentence, as they said it — never glued to the code.

string

category

What a refusal means, when the PSP’s answer could be read.

string

Allowed values: bank-refusal insufficient-funds invalid-card-data authentication-failed expired method-unavailable

ackCode

What the driving call answered (the ack facet).

string

ackMessage

What the driving call said — a transport failure’s raw cause included.

string

ackHttpStatus

Absent beside a present ackMessage = no HTTP response ever came.

integer

ackTraceId

The PSP’s own reference for the driving call’s exchange, when it named one — what its support asks for.

string

extraData

The caller’s reconciliation tag, on refunds only (lot 5) — echoed verbatim.

string

replayOf

The refused operation this one replays — asked again by an administrator.

string

refundOf

On a refund: the later debit it gives back — absent, the attempt’s own taking.

string

nextCursor

Opaque keyset cursor — pass back as cursor for the next page; absent = last page.

string

Example

{
  "transactions": [
    {
      "method": "card",
      "cardScheme": "visa",
      "cardCode": "497010XXXXXX0007",
      "cardCountry": "FR",
      "provider": "dalenys",
      "transaction": {
        "type": "authorization",
        "status": {
          "kind": "pending",
          "category": "bank-refusal"
        }
      }
    }
  ]
}

400

InvalidRequest — the request could not be read: a missing or malformed field, a bad pattern, or a property this door does not declare (the message names it). Every door with a schema can answer this, before any business rule is consulted. Most often here: a cursor that cannot be decoded — the ONE 400 this API raises itself, after validation has passed.

Media typeapplication/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "InvalidRequest",
  "message": "unreadable cursor"
}

401

Unauthorized — the only code this response carries: no usable access token (absent, malformed, expired). One answer for every failure shape, so nothing can be learned by watching which one comes back.

Media typeapplication/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "Unauthorized",
  "message": "a valid access token is required"
}