Skip to main content

Authorizations

​
Authorization
string
header
required

One API-key record may allow cs2, rust, or both. Every checkout's allowedGames must be a subset of that key's allowed games; use one key record rather than separate CS2 and Rust keys.

Headers

​
Idempotency-Key
string
required
Required string length: 16 - 255

Body

application/json
​
merchantOrderId
string
required
Required string length: 1 - 200
​
customerEmail
string<email>
required

Customer email collected on the merchant website before checkout creation. Stored privately by Skinloop and never requested or exposed on the hosted checkout.

Required string length: 3 - 320
​
amount
object
required
​
allowedGames
enum<string>[]
required
Required array length: 1 - 2 elements
Available options:
cs2,
rust
​
successUrl
string<uri>
required
​
cancelUrl
string<uri>
required
​
metadata
object
​
expiresInSeconds
integer
Required range: 300 <= x <= 86400

Response

Idempotent replay

​
id
string
required
Pattern: ^cs_[A-Za-z0-9_-]{32,}$
​
merchantOrderId
string
required
​
amount
object
required
​
allowedGames
enum<string>[]
required
Available options:
cs2,
rust
​
hostedUrl
string<uri>
required
​
successUrl
string<uri>
required
​
cancelUrl
string<uri>
required
​
metadata
object
required
​
status
enum<string>
required
Available options:
created,
initiated,
pending,
active,
hold,
completed,
canceled,
declined,
failed,
reverted,
expired,
reconciliation_required
​
expiresAt
string<date-time>
required
​
createdAt
string<date-time>
required
​
updatedAt
string<date-time>
required
​
reservationRequired
boolean
required

True when the checkout includes CS2 and the merchant order must remain reserved through completion

​
fulfillmentAllowed
boolean
required

True only after payment.completed

​
holdUntil
string<date-time> | null
required

Exact provider-supplied release timestamp for a CS2 hold; null before hold and on legacy records where AssetPay did not supply it

​
warnings
object[]
required