API Documentation | Experia360

OVERVIEW

A small, deliberate merchant surface.

The stable v1 merchant API currently covers hosted collections. Your API secret never enters customer browsers. The customer receives only a hosted checkout URL; bank and provider adapters remain behind Experia360.

BASE URLhttps://api.theexperia360.com/api/v1

CONTENT TYPEapplication/json

CURRENCYINR · amount_paise

VERSIONINGURL versioned · /v1

PCI boundary: Experia360 merchant APIs do not ask for card numbers, UPI PINs or customer OTPs. Never collect or forward those values.

AUTHENTICATION

Two server-side credentials.

Generate a client under Dashboard → APIHub. The secret is displayed once. Store it in a secrets manager or protected server environment.

Header	Value	Required
`X-Experia-Client-Id`	`exc_…`	Every authenticated request
`Authorization`	`Bearer exs_…`	Every authenticated request
`Idempotency-Key`	UUID v4	Every financial create request

collections:write

Create payment orders.

collections:read

Retrieve the authoritative order status.

QUICK START

Create the first hosted payment.

1
Activate Experia Collect and APIHub
Complete onboarding and configure an approved collection route.
2
Create a scoped client
Select collections:write and collections:read.
3
Create a payment order from your backend
Persist your UUID idempotency key against the merchant order.
4
Redirect to checkout_url
Never construct or trust a payment-success URL in browser code.
5
Confirm server-side
Verify the signed callback and retrieve the order before fulfilment.

POST/merchant/payment-orderscollections:write

Create payment order

Creates one amount-bound hosted checkout. Repeating the same idempotency key returns the original order for that organization.

Field	Type	Rule
`amount_paise`	integer	Required · 100 to 10,000,000,000
`purpose`	string	Required · 3–255 characters
`merchant_order_reference`	string	Optional · max 120
`customer_name`	string	Optional · max 120
`customer_email`	email	Optional · max 190
`customer_phone`	string	Optional · Indian 10-digit mobile
`expires_in_minutes`	integer	Optional · 5–1,440; QR begins after payer details
`callback_url`	HTTPS URL	Optional; required with callback_secret
`callback_secret`	string	Optional · 32–500; required with callback_url
`return_url`	HTTPS URL	Optional; browser convenience only

cURL requestSERVER-SIDE ONLY

curl --request POST \
  --url https://api.theexperia360.com/api/v1/merchant/payment-orders \
  --header 'Authorization: Bearer exs_your_secret' \
  --header 'X-Experia-Client-Id: exc_your_client_id' \
  --header 'Idempotency-Key: 72566cd5-39bf-4f58-92a8-66a993e74f17' \
  --header 'Content-Type: application/json' \
  --data '{
    "amount_paise": 125000,
    "purpose": "Invoice INV-1042",
    "merchant_order_reference": "ORDER-1042",
    "customer_name": "Aarav Mehta",
    "customer_email": "aarav@example.com",
    "customer_phone": "9876543210",
    "expires_in_minutes": 15,
    "callback_url": "https://merchant.example/webhooks/experia360",
    "callback_secret": "use-at-least-32-random-characters",
    "return_url": "https://merchant.example/orders/ORDER-1042"
  }'

201 responseSERVER-SIDE ONLY

{
  "success": true,
  "data": {
    "id": "019...",
    "order_id": "EUPI...",
    "merchant_order_reference": "ORDER-1042",
    "amount_paise": 125000,
    "currency": "INR",
    "status": "AWAITING_CUSTOMER",
    "verification_mode": "TREXO_PAYIN_STATUS_API",
    "checkout_url": "https://experia360.com/pay/..."
  },
  "request_id": "..."
}

GET/merchant/payment-orders/{order}collections:read

Retrieve payment order

Use the Experia360 UUID or order_id. Treat this authenticated result as authoritative; browser return parameters never establish settlement.

cURL requestSERVER-SIDE ONLY

curl --request GET \
  --url https://api.theexperia360.com/api/v1/merchant/payment-orders/EUPI... \
  --header 'Authorization: Bearer exs_your_secret' \
  --header 'X-Experia-Client-Id: exc_your_client_id'

STATE MODEL

Make every outcome explicit.

AWAITING_CUSTOMER

Hosted checkout is waiting for verified payer details.

PENDING_PAYMENT

A dynamic UPI intent is active and provider confirmation is pending.

AWAITING_CONFIRMATION

A payer reference was supplied; bank/provider confirmation is pending.

PAID

Payment is confirmed and contains a bank transaction reference.

MANUALLY_CONFIRMED

An authorized operations review confirmed payment evidence.

FAILED

The provider returned a terminal failure; create a new order to retry.

EXPIRED

The payment window ended without confirmation.

CANCELLED

The merchant cancelled an open request.

REFUNDED

The confirmed collection was fully refunded after review and processing.

CALLBACK SECURITY

Verify the exact raw body.

For order-specific callbacks, sign timestamp + "." + rawBody with the callback secret supplied when the payment order was created.

Header	Purpose
`X-Experia-Event-Id`	Replay-protection identifier
`X-Experia-Timestamp`	Unix timestamp; reject stale delivery
`X-Experia-Signature`	`v1=` followed by lowercase HMAC-SHA256

callback payloadSERVER-SIDE ONLY

{
  "event": "collection.payment_confirmed",
  "event_id": "6be7b76e-...",
  "created_at": "2026-09-25T04:30:00Z",
  "data": {
    "order_id": "EUPI...",
    "merchant_order_reference": "ORDER-1042",
    "status": "PAID",
    "amount_paise": 125000,
    "currency": "INR",
    "bank_transaction_id": "RRN123456789012",
    "confirmed_at": "2026-09-25T04:29:58Z"
  }
}

PHP verifierSERVER-SIDE ONLY

$timestamp = $_SERVER['HTTP_X_EXPERIA_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_EXPERIA_SIGNATURE'] ?? '';
$rawBody = file_get_contents('php://input');

if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401); exit;
}

$expected = 'v1=' . hash_hmac(
    'sha256',
    $timestamp . '.' . $rawBody,
    getenv('EXPERIA360_CALLBACK_SECRET')
);

if (!hash_equals($expected, $signature)) {
    http_response_code(401); exit;
}

Use constant-time comparison, reject events older than five minutes, store processed event IDs, and retrieve the payment order before fulfilment.

FAILURE MODEL

Retry only when it is safe.

400 / 422Fix the request

Do not retry unchanged validation failures.

401 / 403Check credentials and scope

Rotate compromised secrets; never log them.

404Check tenant and order reference

Resources are organization-scoped.

429Back off with jitter

Respect the configured client rate limit.

5xx / timeoutRetry with the same key

Never generate a new idempotency key for an uncertain create.

error envelopeSERVER-SIDE ONLY

{
  "success": false,
  "error": {
    "code": "API_SCOPE_DENIED",
    "message": "The API client is not permitted to perform this operation.",
    "request_id": "..."
  }
}

WORDPRESS + WOOCOMMERCE

Install the supported gateway.

Version 1.1.0 creates orders server-side, redirects customers to the hosted QR checkout, verifies signed callbacks, and performs bounded authenticated status reconciliation.

Classic checkout and Checkout Blocks
WooCommerce HPOS declared compatible
AES-256-GCM encrypted saved secrets
Replay and amount mismatch protection
PHP 7.4+ and WordPress 6.4+

Download WordPress plugin

1Upload and activatePlugins → Add New → Upload Plugin.
2Create API clientAssign collection read and write scopes.
3Configure WooCommerceSettings → Payments → Experia360 UPI.
4Run a controlled orderValidate QR, callback and order reconciliation.

DOWNLOADS

Use versioned integration assets.

Complete API kitOpenAPI, Postman, verifier samples and guide

OpenAPI 3.1Machine-readable merchant API contract

Postman collectionEnvironment-ready request examples

WooCommerce pluginExperia360 UPI Collections v1.1.0

READY TO INTEGRATE?

Create a Sandbox client and make your first idempotent request.

Open APIHub

Integrate collections
without handling payment credentials.

Everything required to start.

A small, deliberate merchant surface.

Two server-side credentials.

Create the first hosted payment.

Create payment order

Retrieve payment order

Make every outcome explicit.

Verify the exact raw body.

Retry only when it is safe.

Install the supported gateway.

Use versioned integration assets.

Create a Sandbox client and make your first idempotent request.

Integrate collections without handling payment credentials.

Everything required to start.

A small, deliberate merchant surface.

Two server-side credentials.

Create the first hosted payment.

Create payment order

Retrieve payment order

Make every outcome explicit.

Verify the exact raw body.

Retry only when it is safe.

Install the supported gateway.

Use versioned integration assets.

Create a Sandbox client and make your first idempotent request.

Integrate collections
without handling payment credentials.