Skip to main content

API Reference

Complete documentation for all StateSet Commerce Network APIs. All API endpoints are RESTful and return JSON responses.

🌐 Base URLs

https://api.stateset.com/v1

🔑 Authentication

All requests must include your API key in the Authorization header:
Authorization: Bearer ${STATESET_API_KEY}

📚 Core APIs

🔧 Common Parameters

Pagination

Most list endpoints support pagination:
ParameterTypeDescriptionDefault
limitintegerNumber of records to return10
starting_afterstringCursor for paginationnull
ending_beforestringCursor for reverse paginationnull
Example:
GET /v1/orders?limit=20&starting_after=ord_123

Filtering

List endpoints support filtering:
GET /v1/orders?status=pending&created[gte]=2024-01-01

Expanding Objects

Request nested objects in a single call:
GET /v1/orders/ord_123?expand[]=customer&expand[]=items.product

📨 Request Format

Headers

HeaderRequiredDescription
AuthorizationYesBearer token with your API key
Content-TypeYes*application/json for POST/PUT/PATCH
Idempotency-KeyNoUnique key for safe retries
X-Account-IdNoAct on behalf of a connected account

Request Body

All POST, PUT, and PATCH requests accept JSON:
{
  "amount": 100.00,
  "currency": "ssusd",
  "recipient": "stateset1abc...",
  "metadata": {
    "order_id": "12345",
    "customer_email": "user@example.com"
  }
}

📤 Response Format

Success Response

{
  "id": "pay_1a2b3c4d",
  "object": "payment",
  "amount": 100.00,
  "currency": "ssusd",
  "status": "succeeded",
  "created": 1640995200,
  "metadata": {
    "order_id": "12345"
  }
}

Error Response

{
  "error": {
    "type": "invalid_request_error",
    "code": "parameter_missing",
    "message": "The 'amount' parameter is required",
    "param": "amount",
    "doc_url": "https://docs.stateset.com/errors/parameter_missing"
  }
}

🔄 Idempotency

Ensure safe retries with idempotency keys:
curl -X POST https://api.stateset.com/v1/payments \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: unique-key-123" \
  -d '{...}'
Idempotency keys are valid for 24 hours.

📊 Rate Limits

PlanRequests/SecondDaily LimitBurst
Free101,00020
Starter100100,000200
Growth1,00010,000,0002,000
EnterpriseCustomCustomCustom
Rate limit headers:
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1640995200

🌍 CORS

The API supports CORS for browser-based requests:
// Browser request example
fetch('https://api.stateset.com/v1/account/balance', {
  headers: {
    'Authorization': 'Bearer pk_test_...' // Public key only
  }
})
.then(response => response.json())
.then(data => console.log(data));

🔐 Security

API Key Types

Key TypePrefixUsage
Secretsk_test_ / sk_live_Server-side only
Publicpk_test_ / pk_live_Client-side safe
Restrictedrk_test_ / rk_live_Limited permissions

Best Practices

  1. Never expose secret keys in client-side code
  2. Use HTTPS for all requests
  3. Verify webhooks with signature validation
  4. Implement retry logic with exponential backoff
  5. Monitor rate limits and implement caching

📡 Webhooks

Register webhooks to receive real-time events:
POST /v1/webhooks
{
  "url": "https://yourapp.com/webhook",
  "events": ["payment.succeeded", "order.created"]
}
Learn more about webhooks →

🧪 Testing

Test Mode

Use test API keys to simulate transactions:
  • No real money movement
  • Immediate transaction processing
  • Special test card numbers available

Test Data

ResourceTest ID FormatExample
Customercust_test_*cust_test_123
Paymentpay_test_*pay_test_456
Orderord_test_*ord_test_789

📱 SDK Support

Official SDKs available for:

Node.js

npm install @stateset/sdk

Python

pip install stateset

Go

go get github.com/stateset/stateset-go
View all SDKs →

🆘 Support Resources