PG stands for Payment Gateway. It is a service that facilitates online payment transactions between business owners/merchants and their clients/customers. This system bridges the process of creating billings or invoices that customers can use to pay for the merchant's goods or services.
Authorization for fund transfers from the customer's bank account/e-wallet to the designated merchant account will be processed through the bank/e-wallet opted by the customer.
PGA stands for Payment Gateway Aggregator. It is a system/platform that aggregates payment services from various payment service providers and then resells them on a single platform with the addition of a commission fee. The main advantage of using PGA is that merchants do not need to integrate their businesses with multiple PJPs; instead, they simply have to do a single integration with standardized methods and a centralized system of PGA.
\nPG helps merchants to receive, process, and send funds. When a customer creates a billing/invoice transaction, PG encrypts the information and sends it to a financial institution (either a bank or a non-bank PJP). Once the transaction is authorized and approved by the customer, the funds are transferred to the merchant's account in PG.
\nPG acts as an intermediary between the business owner and their customers, ensuring smooth and secure transactions. Business owners also avoid having to store customer data on their servers by using PG's services.
\nPayment Gateway = A company providing payment and money transfer services
\nPayment Gateway Aggregator = A centralized platform providing connectivity to payment service providers or payment processing companies to handle both receiving and sending transactions.
\nVendor/Provider = A company providing payment services
\nSwitching = A company providing money transfer services
\nAcceptance/Cash-in = The activity of receiving funds initiated by a customer/client through a payment service provider until they are received by the merchant.
\nDisbursement/Withdrawal/Cash-out = The activity of sending funds initiated by a merchant through a money transfer service provider until they are received by the customer/client.
\nBilling/Invoice = Type of money transfer transaction
\nPGA APIs are structured with resource-oriented URL endpoints, HTTP method verbs for the action type, using JSON encoded content type for the request and responses, and also mandatory signature parameter in payload for security validation.
\nTo be able to communicate with our PGA API, merchant will be provided:
\nmerchant_code
\nmerchant_secret
\nSignature parameter inside payload is one of PGA method to verify that request is valid and not altered by attackers alongside whitelisting merchant IP address.
\nSHA-256 HMAC is used to generate the signature with merchant_secret as the key.
\nPGA have a sandbox API server provided beside the production API server, so you can test your system integration with PGA before going production.
\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"54067835","collectionId":"497b307c-5c4b-48f8-9fae-6690582a452b","publishedId":"2sBXqJJfxj","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2026-04-30T07:59:55.000Z"},"item":[{"name":"A. Fund Acceptance","item":[{"name":"1. Get Payment Methods","item":[{"name":"/api/payment_methods","event":[{"listen":"prerequest","script":{"id":"80649cc6-6049-4260-8e7c-1a7f62648056","exec":["const merchant_code = pm.environment.get(\"merchant_code\");\r","const merchant_secret = pm.environment.get(\"merchant_secret\");\r","pm.variables.set(\"merchant_code\", merchant_code);\r","pm.variables.set(\"signature\", CryptoJS.HmacSHA256(merchant_code, merchant_secret).toString());\r",""],"type":"text/javascript","packages":{},"requests":{}}}],"id":"412b1636-cbb8-44c8-90ab-c0c4a3d05ae3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"merchant_code\": \"{{merchant_code}}\",\r\n \"signature\": \"{{signature}}\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{host}}/api/payment_methods","description":"Retrieves the list of available payment methods for a merchant.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code}
Formula: HMAC-SHA256(merchant_secret, merchant_code)
The merchant_secret is provided by PGA and is used as the HMAC-SHA256 key. Keep it confidential.
API to retrieve all available and assigned payment methods for merchant
\nSIGNATURE_PATTERN = {merchant_code}
Generates a billing or invoice for a customer transaction.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code} : {invoice_no}
Formula: HMAC-SHA256(merchant_secret, merchant_code + \":\" + invoice_no)
API to generate billing or invoice for customer
\nSIGNATURE_PATTERN = {merchant_code} : {invoice_no}
Checks the status of an existing billing or invoice transaction.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code} : {reference_no}
Formula: HMAC-SHA256(merchant_secret, merchant_code + \":\" + reference_no)
API to inquiry the status of payment of the billing.
\nSIGNATURE_PATTERN = {merchant_code} : {reference_no}
When on-boarding, merchant required to setup callback URLs in PGA dashboard for receiving success payment notification. This endpoints prefers HTTPS protocol with POST method.
\nCallback URLs for billing should be 2 URL:
\n {\n \"merchant_code\": \"PGASANDBOX\",\n \"invoice_no\": \"BILLING223644516\",\n \"invoice_amount\": \"20873\",\n \"customer_name\": \"TESTER\",\n \"payment_method\": \"QRIS Payment\",\n \"payment_method_code\": \"QRIS\",\n \"reference_no\": \"BILLING223644516\",\n \"paid_description\": \"PENDING\",\n \"created_at\": \"2026-04-28 18:34:11\",\n \"form_url\": \"https:\\/\\/sandbox.sec2pay.com\\/secure\\/inv\\/2026042850a1838129f0a\"\n}\n\n{\n \"signature\": \"ed9771b22cdb043b8c195098343c\",\n \"merchant_code\": \"PGASANDBOX\",\n \"reference_no\": \"BILLING223644516\",\n \"invoice_no\": \"BILLING223644516\",\n \"customer_name\": \"TESTER\",\n \"customer_phone\": \"081212121314\",\n \"customer_email\": \"tester@gmail.com\",\n \"paid_status\": \"1\",\n \"paid_description\": \"PAID\",\n \"net_amount\": \"20873\",\n \"surcharge\": \"0\",\n \"surcharge_to\": \"MERC\",\n \"amount\": 20873,\n \"payment_method\": \"QRIS Payment\",\n \"payment_method_code\": \"QRIS\",\n \"pay_code\": \"\",\n \"pay_qrcode\": \"https:\\/\\/sandbox.sec2pay.com\\/qrcodes\\/2026\\/04\\/28\\/qris_BILLING223644516.png\",\n \"currency\": \"IDR\",\n \"description\": \"Payment of BILLING223644516\",\n \"transaction_description\": \"Deposit from TESTER\",\n \"created_at\": \"2026-04-28 18:34:11\",\n \"paid_at\": \"2026-04-28 18:36:43\",\n \"settlement_time\": \"2026-04-29 12:00:00\"\n}\n\nFund acceptance is activity initiated by customer as they:
\nopens the merchant's page listed with many payment methods,
\nselected the favored payment method along with inputting the transaction amount,
\nthen submitting the form to generate the billing/invoice,
\nand finally preview the invoice page contains the QR code or Virtual Account Number or E-wallet QR so they can authorize the payment using their bank/e-wallet application.
\nRetrieves the list of supported banks available for disbursement transactions.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code}
Formula: HMAC-SHA256(merchant_secret, merchant_code
Success (status: \"000\"):
Returns an array of supported banks under the data field.
API to retrieve available bank list for fund transfer.
\nSIGNATURE_PATTERN = {merchant_code}
Validates and retrieves the account holder's name for a given bank account number, confirming the account is valid before initiating a disbursement.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code} : {bank_code} : {bank_account_number}
Formula: HMAC-SHA256(merchant_secret, merchant_code + \":\" + bank_code+ \":\" + bank_account_number)
Success (status: \"000\"):
Returns the account details under the data field.
API to validate fund transfer beneficiary account.
\nSIGNATURE_PATTERN = {merchant_code} : {bank_code} : {bank_account_number}
Initiates a disbursement (payout) transaction to a specified bank account. This endpoint transfers funds from the merchant's balance to the recipient's bank account.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code} : {unique_id } : {bank_code } : {bank_account_number} : {amount}
Formula: HMAC-SHA256(merchant_code + \":\" + unique_id + \":\" + bank_code + \":\" + bank_account_number + \":\" + amount, merchant_secret)
A successful response returns status 000 with the disbursement details:
API to create fund transfer.
\nSIGNATURE_PATTERN = {merchant_code} : {unique_id} : {bank_code} : {bank_account_number} : {amount}
Retrieves the current status and details of a previously submitted disbursement transaction using its reference number.
\nThis endpoint uses HMAC-SHA256 signature-based authentication.
\nSignature pattern: {merchant_code} : {reference_no}
Formula: HMAC-SHA256(merchant_code + \":\" + reference_no, merchant_secret)
A successful response returns status 000 with the disbursement details:
API to inquiry fund transfer status
\nSIGNATURE_PATTERN = {merchant_code} : {reference_num}
To enable disbursement feature, merchant required to provide callback URL for receiving success tranfer notification. This endpoints prefers HTTPS protocol with POST method.
\nCallback URLs for billing should be 2 URL:
\nCallback of successfully sent transfer:
\n{\n \"signature\": \"38b8adc71ead6af1e6b5130ef183bada9f0abe\",\n \"reference_no\": \"TF_260429Q4G6071PNKX0ZYYF\",\n \"unique_id\": \"UNIQUE1777480611112\",\n \"amount\": \"87000.00\",\n \"fee\": \"0.00\",\n \"merchant_surcharge_rate\": \"0.00\",\n \"charge_to\": \"MERC\",\n \"payout_amount\": \"87000.00\",\n \"disbursement_status\": 1,\n \"disbursement_description\": \"SUCCESS\",\n \"payout_at\": \"2026-04-29 23:54:52\",\n \"created_at\": \"2026-04-29 23:54:44\",\n \"bank\": {\n \"code\": \"014\",\n \"name\": \"BANK CENTRAL ASIA\",\n \"account_number\": \"1234567890\",\n \"account_name\": \"Tester\"\n },\n \"failure_reason\": \"success\"\n}\n\nFund transfer is normally processed in following sequences:
\ncheck if beneficiary bank is supported by PGA for transfer,
\ninquiry the beneficiary bank account number to check if it is valid or not,
\nperform the fund transfer,
\nawait for incoming disbursement callback,
\nissue fund transfer check if no callback received or delayed.
\n