Legacy API

Deprecated

This API exists so that those who already integrate with the previous platform can move to Auryon by changing only the URL and the keys. It reproduces the old API’s routes, fields and errors.

New integrations should use the API v1. This layer will be shut down on December 31, 2026. After that date, only API v1 responds.

What changes in the migration is in the migration guide. Read it before pointing your integration here.

OpenAPI 3.1 specification: openapi-legacy.json, generated from the code.

Base and authentication

Base URL	https://api.auryon369.com.br/api/v1
Authentication	x-public-key and x-secret-key headers, as before

Create the credentials in the Auryon dashboard under Integrações → API. The permissions are the same as before: PRODUCER_DATA, PRODUCER_TRANSACTIONS, PRODUCER_WITHDRAWS and PRODUCER_CHECKOUT.

Monetary values in reais (BRL), as a JSON number ("amount": 100.50), as in the old API. Auryon reads the number exactly as written: with more than two decimals, it rounds to the nearest cent (half up).

Endpoints

Method	Route	Permission	Status
GET	/ping	—	✅ same
GET	/gateway/producer	PRODUCER_DATA	✅ same
GET	/gateway/producer/balance	PRODUCER_DATA	⚠️ BRL balance only (see below)
GET	/gateway/producer/credentials	any	✅ same
GET	/gateway/transactions?id=&clientIdentifier=	PRODUCER_TRANSACTIONS	✅ same
GET	/gateway/subscriptions?…	PRODUCER_TRANSACTIONS	✅ same
POST	/gateway/producer/refunds	PRODUCER_TRANSACTIONS	✅ full refund
POST	/gateway/pix/receive	PRODUCER_TRANSACTIONS	✅ same
POST	/gateway/boleto/receive	PRODUCER_TRANSACTIONS	✅ same
POST	/gateway/crypto/receive	PRODUCER_TRANSACTIONS	⚠️ BDM Digital only
POST	/gateway/checkout	PRODUCER_CHECKOUT	✅ this is the card path
POST	/gateway/card/receive	—	⛔ refused (see below)
POST	/gateway/card/subscription	—	⛔ refused (see below)
POST	/gateway/pix/subscription	PRODUCER_TRANSACTIONS	✅ PIX subscription
POST	/gateway/crypto/subscription	PRODUCER_TRANSACTIONS	✅ BDM subscription
POST	/gateway/pix/deposit	—	⛔ not available (501)
GET	/utils/exchange-rates?from=&to=&amount=	—	✅ same

Every route in detail: Legacy API reference.

Differences you need to know

Balance: BRL only

/gateway/producer/balance returns available, pending and fundLock for the BRL operation only. The old format has no currency field, so USD or BDM balance does not show up here. To see every currency, use the dashboard or GET /v1/balance.

• available is never negative. An amount to be offset (for example, after refunding a sale that was already withdrawn) shows in the dashboard.
• fundLock adds up the reserved and the blocked amounts.

Crypto: BDM Digital

crypto.currency must be "BDM". Other currencies are refused with 400: Auryon does not charge in a currency other than the one you asked for.

Refund

POST /gateway/producer/refunds refunds the remaining amount of the transaction. The response status is the real one: COMPLETED when the money is already back with the buyer, PENDING while in progress. A second request before the first finishes returns 422.

Subscriptions

POST /gateway/pix/subscription and /gateway/crypto/subscription work as before: the response carries the charge (the PIX or the QR) and the subscription object. Each cycle issues a new charge, and the buyer is notified to pay it.

• The subscription starts INACTIVE (the charge was issued and not paid yet) and becomes ACTIVE when the first payment comes in.
• periodicityType: DAYS is not supported. Auryon charges by WEEKS, MONTHS or YEARS.
• firstChargeIn greater than zero is not supported: the first charge is issued now (it is the one the response returns). For a trial period, use an offer with a trial in the dashboard.
• Recurring card (/gateway/card/subscription) is still refused: create a checkout for a recurring offer and redirect the buyer.

Splits

splits[].producerId is the Auryon account ID of the recipient. Each producer finds their own ID in the dashboard, under Integrações → API.

• The previous platform’s IDs are not valid here. Ask each partner for the new ID.
• The sum of the splits cannot exceed the transaction’s net amount (the amount minus the platform fee). If it does, the whole transaction is refused; no split is cut silently.
• A non-existent account returns 400 with errorCode: GATEWAY_NO_SPLIT_ACCOUNT.

identifier

Still required and unique. Repeating an identifier with the same order returns the same transaction, without creating another charge. That is what makes a retry after a timeout safe.

Repeating an identifier with a different amount or payment method is refused with 409 GATEWAY_FAILED_PRECONDITION: it is a different order with an identifier already in use, and returning the old charge would make you charge the wrong amount. Use a new identifier.

dueDate, shippingFee, extraFee, discount

Accepted, but they do not change the charge. The amount charged is amount, as the old documentation itself instructed. PIX and boleto due dates follow your account settings.

products[]

The first product’s name shows on the dashboard’s sales. The other items are not recorded individually.

Checkout (/gateway/checkout)

• offer.price is in reais (BRL), like the other routes (497.00 = R$ 497.00).
• The product is created or reused by product.externalId.
• The product follows the same approval rule as those created in the dashboard. If your account approves products automatically, it is born approved and the link comes back right away. If not, the response is 409 GATEWAY_FAILED_PRECONDITION with details.productId and details.approvalStatus, and no offer is created: call again, with the same externalId, after the product is approved. Because the product is reused by externalId, approval happens only once.
• trackProps goes along in the link. customer data does not go into the URL, so personal data is not exposed in logs or browser history.
• settings.askForAddress: true creates the product as physical, which makes the checkout ask for the address. Colors and the other settings items are configured in the dashboard.

Card through the API

/gateway/card/receive and /gateway/card/subscription always respond:

{
  "statusCode": 400,
  "errorCode": "GATEWAY_FAILED_PRECONDITION",
  "message": "A Auryon não recebe dados de cartão pela API. Crie um checkout com POST /api/v1/gateway/checkout e redirecione o comprador para o checkoutUrl devolvido: o cartão é digitado na página segura da Auryon.",
  "details": { "use": "POST /api/v1/gateway/checkout" }
}

The body of these routes is not read. Receiving card number and CVV on a server would require the highest-level PCI-DSS certification. At Auryon the card is typed in the checkout and tokenized in the buyer’s browser.

How to sell by card: POST /gateway/checkout → redirect the buyer to checkoutUrl → receive TRANSACTION_PAID on your webhook.

Webhooks (legacy format)

Through callbackUrl

Send callbackUrl on a */receive route. The response carries the webhookToken, and Auryon notifies that URL about the transactions created through the API:

TRANSACTION_CREATED · TRANSACTION_PAID · TRANSACTION_CANCELED · TRANSACTION_REFUNDED · TRANSACTION_CHARGED_BACK

• Use a fixed URL and identify the order by transaction.identifier. The same URL is reused; each different URL counts towards the limit of 20 webhooks per account.
• The URL must be HTTPS.

Through the dashboard

In Integrações → Webhooks, choose the Legado (Legacy) format to receive this format. Available events: the five above, TRANSFER_CREATED, TRANSFER_COMPLETED, TRANSFER_FAILED and SESSION_ABANDONED.

Validation

As before: compare payload.token with the webhook token before processing. This format has no content signature and no replay protection. That is why it is deprecated. The V1 format signs every delivery with HMAC (see Webhooks).

Token rotation: in the legacy format the switch is immediate. The body carries a single token, so from the rotation on only the new one is sent; there is no 24-hour window as in the V1 format. Update your server right after rotating.

Payload

See the legacy body of each event in Events.

The buyer’s cpf, cnpj, phone and address are always null, and so is payoutAccount in withdrawal events. The fields exist so your parser does not break, but Auryon does not send sensitive personal data outside the platform.

Status: COMPLETED (paid, including partially refunded) · PENDING · FAILED (declined or expired) · REFUNDED · CHARGED_BACK.

Respond 2xx. Failures are retried (up to 6 attempts over about 30 hours). Health, disabling and resend rules are the same as in the V1 format (Webhooks).

TRANSACTION_CANCELED is sent when the charge ends without payment: it expired, or the buyer gave it up (for example, declined an upsell that was awaiting payment).

Errors

{
  "statusCode": 400,
  "errorCode": "GATEWAY_INVALID_DATA",
  "message": "…",
  "details": [{ "path": "amount", "error": { "message": "…" } }]
}

Messages are in Portuguese, as in the old API; rely on errorCode.

errorCode	When
GATEWAY_NO_CREDENTIALS	credential headers missing
GATEWAY_INVALID_CREDENTIALS	invalid, revoked or expired credential
GATEWAY_PERMISSION_DENIED	the credential lacks the permission
GATEWAY_INVALID_DATA	invalid body (see details), including malformed JSON (400, "JSON inválido.")
GATEWAY_NO_BODY	missing body
GATEWAY_INVALID_ARGUMENT	valid request that cannot be served (e.g. a refund already in progress)
GATEWAY_NO_SPLIT_ACCOUNT	split producerId does not exist
GATEWAY_TRANSACTION_NOT_FOUND	transaction does not exist or belongs to another account
GATEWAY_FAILED_PRECONDITION	operation refused: card through the API (400); identifier already used with another amount or method, checkout product not approved yet, account that cannot sell (409)
GATEWAY_UNIMPLEMENTED	route with no equivalent at Auryon
GATEWAY_UNAVAILABLE	service temporarily unavailable, including scheduled maintenance (503, with Retry-After)
GATEWAY_INTERNAL_SERVER_ERROR	our failure

Limit: 100 requests per minute per credential, adding up all routes (v1 included); transaction and subscription lookups have their own ceiling of 30 per minute. Above the limit, the response is 429 in the old format:

{
  "success": false,
  "error": {
    "code": "TOO_MANY_REQUESTS",
    "message": "Tentativa de polling bloqueada. Receba atualizações via webhook."
  }
}