SRGupi API Reference

Welcome to the SRGupi REST API documentation. SRGupi provides a lightweight, robust UPI-focused payment gateway engine that supports seamless UPI QR payments, UPI app intents, and manual UTR verification workflows.

Using our APIs, you can easily create checkout orders, generate dynamic payment landing links, redirect customers, verify transactions instantly, and receive real-time webhook status updates once they finish paying.

Ready for Production & Testing

Sample API keys are pre-loaded in all code snippets below. You can log into your Merchant Dashboard to view and rotate your actual live credentials.

Authentication

All REST API endpoints require secure authentication headers. Your credentials consist of a live public Key and a secret Key which you can generate inside your API Settings page.

Include the keys as custom HTTP headers with every request:

Header Name	Description	Example
X-API-Key	Your merchant environment API Key.	`pi_live_demo1234567890abcdef12`
X-API-Secret	Your merchant environment API Secret. Keep this safe!	`sk_live_demo1234567890abcdef123456`
Content-Type	Payload type indicator (must be JSON).	`application/json`

Keep Secrets Confidential

Never share your API Secret or commit it to client-side code repositories. Always trigger requests to our API endpoint servers from your backend server application.

Production API

SRGupi operates in production mode. Every created checkout can accept a real payment through the merchant account connected to the payment-link owner.

The base endpoint URL for this instance is:

Base Endpoint URL

https://imb.arraynosoftware.com/api

Create Order

POST https://imb.arraynosoftware.com/api/create-order

Creates a transaction order in our database and returns a unique, secure `payment_url`. Redirect your customer to this URL to trigger the checkout flow.

Request Body Parameters

Parameter	Type	Required	Description
amount	float	Yes	The order amount in INR. Must be greater than 0.00.
order_id	string	Yes	Your internal unique transaction identifier (e.g. `ORD_20261023_6630`).
customer_name	string	Yes	The billing customer's full name.
callback_url	string	No	Redirect destination URL once payment completes.
description	string	No	Payment remarks shown to the customer (e.g. `Pro plan renewal`).
customer_mobile	string	No	Customer's phone number.
is_reusable	boolean	No	Set to `true` if you want this link to accept multiple customer payments (default: `false`).

curl -X POST https://imb.arraynosoftware.com/api/create-order \
  -H "X-API-Key: pi_live_demo1234567890abcdef12" \
  -H "X-API-Secret: sk_live_demo1234567890abcdef123456" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "100.00",
    "order_id": "ORD_20261023_6630",
    "customer_name": "Raushan Kumar",
    "description": "Order simulation purchase",
    "callback_url": "https://imb.arraynosoftware.com/demo.php?action=callback"
  }'

<?php
$payload = [
    'amount' => '100.00',
    'order_id' => 'ORD_20261023_6630',
    'customer_name' => 'Raushan Kumar',
    'description' => 'Order simulation purchase',
    'callback_url' => 'https://imb.arraynosoftware.com/demo.php?action=callback'
];

$ch = curl_init('https://imb.arraynosoftware.com/api/create-order');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-API-Key: pi_live_demo1234567890abcdef12',
        'X-API-Secret: sk_live_demo1234567890abcdef123456'
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);
unset($ch);

if (isset($data['status']) && $data['status'] === 'success') {
    $checkoutUrl = $data['data']['payment_url'];
    // Redirect customer to $checkoutUrl
    header("Location: " . $checkoutUrl);
    exit;
} else {
    echo "Error creating order: " . ($data['error'] ?? 'Unknown error');
}
?>

const payload = {
  amount: '100.00',
  order_id: 'ORD_20261023_6630',
  customer_name: 'Raushan Kumar',
  description: 'Order simulation purchase',
  callback_url: 'https://imb.arraynosoftware.com/demo.php?action=callback'
};

fetch('https://imb.arraynosoftware.com/api/create-order', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'pi_live_demo1234567890abcdef12',
    'X-API-Secret': 'sk_live_demo1234567890abcdef123456'
  },
  body: JSON.stringify(payload)
})
.then(res => res.json())
.then(json => {
  if (json.status === 'success') {
    console.log('Redirect URL:', json.data.payment_url);
  } else {
    console.error('API Error:', json.error);
  }
})
.catch(err => console.error(err));

import requests

payload = {
    "amount": "100.00",
    "order_id": "ORD_20261023_6630",
    "customer_name": "Raushan Kumar",
    "description": "Order simulation purchase",
    "callback_url": "https://imb.arraynosoftware.com/demo.php?action=callback"
}

headers = {
    "Content-Type": "application/json",
    "X-API-Key": "pi_live_demo1234567890abcdef12",
    "X-API-Secret": "sk_live_demo1234567890abcdef123456"
}

response = requests.post("https://imb.arraynosoftware.com/api/create-order", json=payload, headers=headers)
data = response.json()

if data.get("status") == "success":
    print("Redirect user to:", data["data"]["payment_url"])
else:
    print("Error:", data.get("error"))

Success Response Schema (201 Created)

201 Created Response

{
  "status": "success",
  "message": "Order created successfully",
  "data": {
    "payment_url": "https://imb.arraynosoftware.com/pay/LRd7jTFOV2sFyhMyOBzbJLL1SQzMxe5V",
    "order_id": "ORD_20261023_6630",
    "token": "LRd7jTFOV2sFyhMyOBzbJLL1SQzMxe5V",
    "amount": 100.00,
    "currency": "INR",
    "customer_name": "Raushan Kumar",
    "expires_at": "2026-10-23 17:15:30",
    "created_at": "2026-10-23 16:15:30"
  }
}

Check Status

POST https://imb.arraynosoftware.com/api/check-status

Retrieves the details and verification status of a transaction using your unique `order_id` reference.

Request Body Parameters

Parameter	Type	Required	Description
order_id	string	Yes	The unique order ID reference you sent during order creation.

curl -X POST https://imb.arraynosoftware.com/api/check-status \
  -H "X-API-Key: pi_live_demo1234567890abcdef12" \
  -H "X-API-Secret: sk_live_demo1234567890abcdef123456" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "ORD_20261023_101"
  }'

<?php
$payload = [
    'order_id' => 'ORD_20261023_101'
];

$ch = curl_init('https://imb.arraynosoftware.com/api/check-status');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-API-Key: pi_live_demo1234567890abcdef12',
        'X-API-Secret: sk_live_demo1234567890abcdef123456'
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);
unset($ch);

if (isset($data['status']) && $data['status'] === 'success') {
    $paymentStatus = $data['data']['payment_status']; // 'success', 'pending', or 'failed'
    echo "Transaction Status: " . strtoupper($paymentStatus);
} else {
    echo "Error checking status: " . ($data['error'] ?? 'Unknown error');
}
?>

fetch('https://imb.arraynosoftware.com/api/check-status', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'pi_live_demo1234567890abcdef12',
    'X-API-Secret': 'sk_live_demo1234567890abcdef123456'
  },
  body: JSON.stringify({ order_id: 'ORD_20261023_101' })
})
.then(res => res.json())
.then(json => console.log(json))
.catch(err => console.error(err));

Success Response Schema (200 OK)

200 OK Response

{
  "status": "success",
  "data": {
    "order_id": "ORD_20261023_101",
    "amount": 1499.00,
    "currency": "INR",
    "payment_status": "success",
    "customer_name": "Raushan Kumar",
    "customer_mobile": "9876543210",
    "utr": "615372849102",
    "payment_method": "UPI QR",
    "provider": "manual",
    "paid_at": "2026-10-23 11:16:45",
    "payment_url": "https://imb.arraynosoftware.com/pay/token_demo_101",
    "callback_url": "https://imb.arraynosoftware.com/demo.php?action=callback",
    "created_at": "2026-10-23 11:15:30"
  }
}

Webhooks

Webhooks are used to receive real-time updates directly on your server whenever a transaction is completed successfully. Instead of polling our check status API, our platform dispatches an asynchronous HTTP POST request to your configured webhook URL.

You can configure webhooks inside your Webhooks Portal.

Signature Validation

To ensure webhook payloads are authentically generated by SRGupi, every webhook request contains a custom header named `X-Lola-Pay-Signature` (and `X-PayIndia-Signature`).

This signature represents the HMAC-SHA256 hash of the raw POST body payload, signed using your unique **Webhook Secret Key**.

Sample PHP Webhook Receiver & Verification

webhook-handler.php

<?php
// Retrieve the signature header
$signature = $_SERVER['HTTP_X_LOLA_PAY_SIGNATURE'] ?? $_SERVER['HTTP_X_PAYINDIA_SIGNATURE'] ?? '';

// Get Webhook Secret from your settings
$webhookSecret = "whsec_demo1234567890abcdef12";

// Read raw POST body payload
$payload = file_get_contents('php://input');

// Calculate expected signature
$expectedSignature = hash_hmac('sha256', $payload, $webhookSecret);

// Verify match
if (hash_equals($expectedSignature, $signature)) {
    // Valid request! Parse JSON
    $data = json_decode($payload, true);
    $orderId = $data['order_id'];
    $amount = $data['amount'];
    $utr = $data['utr'];
    $status = $data['status']; // 'success'
    
    if ($data['event'] === 'payment.success') {
        // 1. Mark order as Paid in your database
        // 2. Deliver goods to customer
    }
    
    // Respond with 200 OK to acknowledge receipt
    http_response_code(200);
    echo json_encode(['received' => true]);
} else {
    // Invalid signature, ignore/fail
    http_response_code(400);
    echo "Invalid signature";
}
?>

Callbacks & Redirect

If you passed a `callback_url` when creating the order, SRGupi will automatically redirect your customer's browser to this URL immediately after checkout verification.

When redirecting, key transaction details are appended as URL query parameters:

Example Redirect URL

https://imb.arraynosoftware.com/demo.php?action=callback&status=success&order_id=ORD_20261023_6630&amount=100.00&utr=615372849102