API Overview
Base URL
https://api-gateway.lunixi.com/api/v1The version is carried in the URL path. There are no separate regional addresses — a single base URL is used.
URL families
The platform has five roots, each for a different consumer:
| Root | Who it is for |
|---|---|
/api/v1 | Customer / integrator — the surface this documentation describes |
/api/panel/v1 | Management panel |
/api/portal/v1 | Customer portal |
/api/public/v1 | Public endpoints that need no authentication |
/api/partner/v1 | Partner flows |
This documentation covers only /api/v1. If an endpoint is not documented here it is not open for integration — do not call panel paths; they carry no contract guarantee and can change without notice.
Request format
Content-Type: application/json- Timestamps are ISO 8601
- Amounts are minor-unit integers —
250000= ₺2,500.00, never decimals - Language: the
x-langheader (orAccept-Language); defaults totr
Authentication
You sign with your Ed25519 key to mint a short-lived token and send it as Authorization: Bearer. Money-movement endpoints additionally require a signature over the request itself (Step-Up).
Idempotency
The create-payment-intent call accepts an Idempotency-Key header:
Idempotency-Key: 7f3d9c1a-4b2e-4f8a-9c6d-1e5f7a3b8d2cX-Idempotency-Keyis also accepted- Maximum 200 characters
- Repeating a call with the same key does not open a new intent
Idempotency is not a blanket mechanism for every POST. Capture, refund and void have their own durable replay protection, so you do not need this header there. Details: Payments Authentication
Response envelope
Successful responses carry the data. Error responses look like this:
{
"status": "failure",
"code": "payment.card.declined",
"message": "The card was declined.",
"details": { },
"timestamp": 1755424304118
}Branch on code, not on message. message is translatable and can change; code is part of the contract and is stable.
Per-product endpoint families
| Product | Root |
|---|---|
| Payments | /api/v1/payments |
| Wallet | /api/v1/wallet |
| Fraud | /api/v1/fraud |
| Sanctions | /api/v1/sanction |
| Identity | /api/v1/identity |
| Organization & webhook management | /api/v1/organizations |
Each product's own section carries its field-level contract.
Next
- Authentication — minting a token and Step-Up
- Quickstart — your first call
- Webhooks — receiving events