This page is for resellers — parties that buy point-card inventory from Waffo Point Topup through an API against a prepaid balance. It is not part of the merchant payment APIs, and it is not the supplier-side Mode A/B/C integration in Point Topup integration overview.
code / msg / data envelope and the RSA key exchange are shared with the rest of Point Topup — see Point Topup API common specifications.
Which endpoints can I call?
All six arePOST with a JSON body. The sandbox and production base URLs are issued during onboarding.
How is reseller authentication different from order/create?
Same transport — X-API-KEY plus an X-SIGNATURE over the raw body, verified with the public key you exchanged at onboarding, and a signed response to verify in return. Three things differ:
A
resellerId that does not match the key is a parameter error; an endpoint outside the key’s scope returns A0004.
How do I pull the catalogue, and what is priceStrategy?
products returns the items active on your reseller contract. Pass itemId to narrow to one item, omit it for everything; an unknown or inactive itemId gives an empty list, not an error.
balance then returns one entry per currency with the currently available balance. Match it to the SKU’s currency: an order is charged in the SKU’s own currency.
What does create require?
Two behaviours to know:
buyerInfo.userEmail is always replaced with the e-mail on your reseller account, so your customer’s address there has no effect; and the available balance in the order currency is checked before the order is accepted, so an underfunded account fails fast with A0009 instead of producing an order.
Why does create always come back IN_PROGRESS?
Because acceptance and fulfillment are separate. create returns resellerRequestId, the Waffo orderId and status IN_PROGRESS; the debit and the supply run afterwards, and the outcome arrives at your notifyUrl or from inquiry. Never read the create response as a purchase result.
A repeat of the same resellerRequestId is deduplicated on resellerId + resellerRequestId: you get the original orderId back, again as IN_PROGRESS, even if that order already finished — so follow a duplicate with an inquiry. No second order is created and the repeat’s other fields are ignored. Two identical requests racing in parallel return A0010; retry after a moment.
How do I query one order, or many?
inquiry takes orderId or resellerRequestId — at least one, and the order must be yours. Set returnGameCard to true for gameCardList: serials, passwords where the SKU uses them, expiryType (FROM_PURCHASE or FROM_REDEMPTION) and expiry. Cards appear only once the order is SUCCESS.
orders-inquiry is the paged form. page, pageSize, startTime and endTime are all required; the window filters on requestedAt — the time you sent — in the same ISO 8601 format, and is meant to stay within 6 months. resellerRequestId, orderId and status narrow it further. records come wrapped in total, size, current and pages, each shaped like a single inquiry but with no card serials.
What do the order statuses and amounts mean?
totalAmount is the list price of what you bought, totalAmountAfterDiscount is what your contract charges, and currency applies to both. completedTime appears once the order is final.
fulfillment-inquiry belongs to the direct-fulfillment (Mode C) flow, not the purchase flow, which is why its shape differs: the caller identifies itself as supplierId, the order as salesOrderId or payOrderId (at least one), and the answer is a fulfillmentStatus — IN_PROGRESS, SUCCESS, PAY_SUCCESS, PAY_SUCCESS_SUPPLY_FAILED or PAYMENT_FAILED — not the four values above. See
Mode C: direct fulfillment.
What arrives at my notifyUrl?
Once an order is final, Waffo posts a signed JSON body:
result is the full inquiry payload, card serials included. Verify X-SIGNATURE against Waffo’s public key, then acknowledge with exactly {"message": "success"} — any other body, or a non-2xx response, counts as a failed delivery and is retried. Retries do not continue forever, so keep a reconciliation poll against inquiry as the source of truth.
Which error codes do these endpoints return?
Something not matching? Contact support with your
resellerId and either the orderId or the resellerRequestId.