Request and response format

Requests

Always use HTTPS and POST, with Content-Type: application/json. The request body must be encoded in UTF-8.
The body is a JSON object. Every field value must be a JSON string, including amounts, for example "amount": "1000.00". Sending the number 1000.00 will fail (with invalid_signature or invalid_parameter).
Every request must include api_identity, timestamp, and sign (see Signature).
timestamp is the time the request is sent, in the same format as time below (UTC+8, yyyy-MM-dd HH:mm:ss). A request that differs from the ST Pay server time by more than 5 minutes (in either direction) is rejected with timestamp_expired. Enable NTP time synchronization on your servers.
Sending an empty string "" for an optional field is treated the same as not sending the field.

Responses

All APIs return the same structure:

Field	Description
`code`	`OK` on success; on failure, an English error code (see Error codes). Your program must use this field to determine the result.
`message`	A description in Traditional Chinese, intended for humans to read. Its wording may change, so do not use it to determine the result.
`data`	The response data on success; `null` on failure.

HTTP status code: 200 on success; on failure, a 4xx or 5xx code depending on the type of error (see Error codes).

{
  "code": "merchant_order_no_duplicate",
  "message": "商戶單號重複",
  "data": null
}

Data formats

Type	Format
Amount	String. In requests: greater than 0, at most 2 decimal places (counted literally, so `"1000.500"` has 3), no more than `9999999999999999.99`, and only digits and a decimal point, for example `"1000"`, `"1000.5"`, `"1000.50"`. `"1,000.00"`, `"1000.001"`, `"-5"`, and `"0"` are all invalid. Amounts in responses and Callbacks always have 2 decimal places, for example `"1000.50"`. There is no currency field.
Time	String in UTC+8, in the format `yyyy-MM-dd HH:mm:ss`, for example `"2026-10-13 10:30:05"`.
ST Pay order number `order_no`	A string generated by ST Pay. Store it as an opaque string; do not parse its contents or rely on its format.
Merchant order number `merchant_order_no`	Generated by you. 1 to 200 characters, containing only English letters, digits, underscores `_`, and hyphens `-`.

Data retention

Orders are retained for 6 months from creation and are then deleted. After deletion, an order query returns order_not_found, and the merchant order number can be used again.