Crypto Pay by Bitpanda (1.0.0)

Download OpenAPI specification:Download

Authentication

We use authentication based on the OAuth 2.0 standard.

As a Partner, you will receive client_id and client_secret from Bitpanda. To make the exchange secure, we will ask you to share a public GPG/PGP key with Bitpanda, as well as an email address for future technical communication. Bitpanda will send back your client_id and client_secret, which is encrypted with the key, shared in the previous step.

With the provided client_id and client_secret you can issue one or more initial Refresh tokens.

Refresh tokens can not be used to call the endpoints. They can be used only for requesting a short-lived Access Token and a new Refresh Token.

For the API authorization you will need an active Access Token, which can be issued by using a valid Refresh token.

Each White Label API request must contain an authorization header (in the format below) to make a call: Authorization: Bearer [YourAccessTokenHere].

Access tokens have a limited lifetime (currently set to 10 minutes). If your application needs access to a Whitelabel API beyond the lifetime of a single access token, it can obtain a new Access token by using a valid Refresh token.

To get a new Access Token you will need a valid Refresh token. When a new Access Token is claimed, it will be provided along with a new Refresh Token. When you receive the new set consisting of access - refresh token:

  • the Refresh token, which you used in the request, will be invalidated.
  • The “old” Access token will not be invalidated when you receive the new one. It will become inactive only after its TTL lapses. In this way you can have a smooth transition between the old and the new access token, when doing API requests

Refresh tokens also have a relatively short lifespan, currently set to 24h.

A refresh token will become invalid either

  • 24h after its issuing
  • when an access token is renewed by using an active refresh token
  • In case you initiate refresh token revocation

OAuth 2.0

Obtain a Refresh and Access Tokens

This endpoint supports two key operations:

  • Obtain an initial Refresh Token by passing grant_type: "client_credentials" together with your client_id and client_secret. The response will contain the initial Refresh Token and an Access Token.
  • Renew Access Token by passing grant_type: refresh_token using a valid Refresh Token next to your client_id. The Refresh token, used in the request, will be invalidated.
Request
Request Body schema: application/json

Request Access Token

grant_type
required
string
Enum: "client_credentials" "refresh_token"
client_id
required
string
client_secret
string

required if the grant_type is client_credentials

refresh_token
string

required if the grant_type is refresh_token. Pass a valid Refresh token.

Responses
200

Success Response

Response Schema: application/json
expires_in
integer

TTL of the Access token, determining how many seconds the token will be valid.

access_token
string

Used when making API requests. Each request must contain an authorization header in the following format: Authorization: Bearer [YourAccessTokenHere].

refresh_token
string

The Refresh token, which you can use the next time you do a request for issuing a new Access token. Bear in mind that the Refresh token, used in the request, will be invalidated as soon as you receive the new one.

413

Error

Response Schema: application/json
Array of objects
422

Error

Response Schema: application/json
Array of objects
429

Too Many Requests

Response Schema: application/json
Array of objects
500

Error

Response Schema: application/json
Array of objects
post/v1/oauth/token
Request samples
application/json
{
  • "grant_type": "client_credentials",
  • "client_id": "partner",
  • "client_secret": "secret12345",
  • "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbGllbnRJZCI6Imx5ZGlhIiwiZXhwIjoxNjY0MDIzMzkyLCJuYmYiOjE2NjM5MzY5OTIsImlhdCI6MTY2MzkzNjk5MiwianRpIjoiY2UxZmFjMDEtNDhjZC00NWE4LWI3YjQtYTA2NDQxZTUwZWE4In0.ZYafj15LT5hrFXzWjtzZci1yvL9INKyv85FeGxUaRfE"
}
Response samples
application/json
{
  • "expires_in": 600,
  • "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbGllbnRJZCI6Imx5ZGlhIiwiZXhwIjoxNjYzOTM3NTkyLCJuYmYiOjE2NjM5MzY5OTIsImlhdCI6MTY2MzkzNjk5MiwianRpIjoiMTc2NzM0Y2ItYjVmOC00OGFkLTlhMDMtYzRkYjYxZjQwM2I1In0.e-exoz0u-xyE7wN8I3vQwnXSP98Jekh3-7Fo_UrzDKqw9bfZ38kbLndsZXbXpdgqT1eziOg_TVx27St8f3EeBKUg_vCPfJrlPFMXJCVjWwEXg2E1a1cQJWbgdY4PudBF68R4bUUTHpstjD6zufxj5rRERG-6iDhc-xNuBw-IdFaYeJO8-upWJEtt-p23FlpiH4RkflXoxqpP-oWc22aGyAJdMWWY_IIOPCFn3w4f7LhBhh8AWpAbwnTl1ZgFCH1kq3QncBvbRHuqN7UYPlpon_ygBpae6xhYbsBtmfDNnZacZ7-HABLwe3rTJlGw5ltAl_OeB3sq_wAmrJuF4L56OA",
  • "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbGllbnRJZCI6Imx5ZGlhIiwiZXhwIjoxNjY0MDIzMzkyLCJuYmYiOjE2NjM5MzY5OTIsImlhdCI6MTY2MzkzNjk5MiwianRpIjoiY2UxZmFjMDEtNDhjZC00NWE4LWI3YjQtYTA2NDQxZTUwZWE4In0.ZYafj15LT5hrFXzWjtzZci1yvL9INKyv85FeGxUaRfE"
}

Revoke a Refresh Token

Use this endpoint to revoke a Refresh Token if you suspect it has been compromised, effectively preventing its further use for authentication.

Request
Request Body schema: application/json

Revoke Refresh Token

client_id
required
string
client_secret
required
string
refresh_token
required
string

The refresh token which you want to invalidate

Responses
200

Success Response

422

Error

Response Schema: application/json
Array of objects
429

Too Many Requests

Response Schema: application/json
Array of objects
500

Error

Response Schema: application/json
Array of objects
post/v1/oauth/revoke
Request samples
application/json
{
  • "client_id": "partner",
  • "client_secret": "secret12345",
  • "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbGllbnRJZCI6Imx5ZGlhIiwiZXhwIjoxNjY0MDIzMzkyLCJuYmYiOjE2NjM5MzY5OTIsImlhdCI6MTY2MzkzNjk5MiwianRpIjoiY2UxZmFjMDEtNDhjZC00NWE4LWI3YjQtYTA2NDQxZTUwZWE4In0.ZYafj15LT5hrFXzWjtzZci1yvL9INKyv85FeGxUaRfE"
}
Response samples
application/json
{
  • "errors": [
    ]
}

Get transactions details

Retrieve transactions. This endpoint allows partners to fetch the transactions, using pagination.

SecuritybearerAuth
Request
query Parameters
cursor
string <uuid>

Cursor - Transaction ID - transactions before or after this ID

Example: cursor=01989e23-2827-7f5f-b286-112d5be2cf65
page_size
integer [ 1 .. 100 ]

Number of elements to be displayed on a page

Example: page_size=10
direction
string

Direction of the query (default after)

Enum: "before" "after"
Example: direction=after
sort
string

Sort direction

Enum: "newest" "oldest"
Example: sort=newest
status
Array of any <string>

Filter transactions by status

Items Enum: "created" "authorized" "completed" "processing" "failed" "cancelled"
Example: status=completed
fiat_id
Array of any <uuid>

Fiat ID

Example: fiat_id=01989e23-2827-7f5f-b286-112d5be2cf65
start_time
string <date-time>

Start time for filtering transactions

Example: start_time=2023-10-18T23:35:24+00:00
end_time
string <date-time>

End time for filtering transactions

Example: end_time=2024-10-18T23:35:24+00:00
Responses
200

Get transactions details

Response Schema: application/json
Array of objects (getTransactionResponse)
401

Unauthorized

Response Schema: application/json
Array of objects
422

Validation error

Response Schema: application/json
Array of objects
500

Internal Server Error

Response Schema: application/json
Array of objects
get/pay/v1/transactions
Request samples
Response samples
application/json
{
  • "data": [
    ]
}

Get transaction details

Retrieve details of a specific transaction. This endpoint allows partners to fetch the details of a transaction by providing the transaction ID.

SecuritybearerAuth
Request
path Parameters
id
required
string <uuid>

Transaction ID

Example: 01989e23-2827-7f5f-b286-112d5be2cf65
Responses
200

Get transaction details

Response Schema: application/json
object (getTransactionResponse)
401

Unauthorized

Response Schema: application/json
Array of objects
404

Not Found

Response Schema: application/json
Array of objects
422

Validation error

Response Schema: application/json
Array of objects
500

Internal Server Error

Response Schema: application/json
Array of objects
get/pay/v1/transactions/{id}
Request samples
Response samples
application/json
{
  • "data": {
    }
}

Transactions

Create a new transaction

Create a new transaction for a user. This endpoint allows partners to initiate a transaction on behalf of a user, such as a withdrawal. The request must include the user's full name, date of birth, and the amount to be processed. Once the transaction is created, the user will be redirected to Bitpanda Pay to complete the transaction.

SecuritybearerAuth
Request
Request Body schema: application/json
amount
required
string <double> [ 10 .. 10000 ]

The amount of fiat currency to be processed in the transaction.

fiat_id
required
string <uuid>

Unique identifier for the fiat currency to be used in the transaction.

full_name
required
string

Full name of the user in "FirstName LastName" format.

date_of_birth
required
string <date>

The date of birth of the user in ISO 8601 format (YYYY-MM-DD).

type
required
string

The type of transaction being created. Currently, only "withdrawal" is supported.

Value: "withdrawal"
partner_redirect_url
required
string <uri> ^https://

A URL to redirect the user back to the partner's application.

Responses
201

Transaction created successfully

Response Schema: application/json
object
400

Bad Request (fiat below threshold)

Response Schema: application/json
Array of objects
401

Unauthorized

Response Schema: application/json
Array of objects
403

Forbidden

Response Schema: application/json
Array of objects
404

Fiat not found

Response Schema: application/json
Array of objects
422

Validation error

Response Schema: application/json
Array of objects
500

Internal Server Error

Response Schema: application/json
Array of objects
post/pay/v1/transactions
Request samples
application/json
{
  • "amount": "100.00",
  • "fiat_id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
  • "full_name": "John Doe",
  • "date_of_birth": "1990-05-10",
  • "type": "withdrawal",
  • "partner_redirect_url": "https://partner.domain.com"
}
Response samples
application/json
{}

Transaction Update NotificationsWebhook

These notifications allow you to receive real-time updates regarding the status of transactions. It ensures seamless communication and timely updates enabling you to take necessary actions promptly, like notifying further your users. The events include the following statuses:

  • completed - Indicates that a transaction has been successfully.
  • failed - Indicates that transaction has failed due to any processing error.
  • cancelled - Indicates that a transaction been cancelled.

Examples

Transaction completed

{
  "params": {
    "id": "6c568238-11f0-4120-9ca0-c5dac1640793",
    "status": "completed",
    "type": "withdrawal",
    "fiat": {
      "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
      "amount": "100.00"
    },
    "credited_at": "2025-08-07T15:04:05Z",
    "errors": []
  }
}

Transaction failed

{
  "params": {
    "id": "6c568238-11f0-4120-9ca0-c5dac1640793",
    "status": "failed",
    "type": "withdrawal",
    "fiat": {
      "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
      "amount": "100.00"
    },
    "credited_at": null,
    "errors": [
      {
        "code": "transaction.expired",
        "title": "Transaction expired"
      }
    ]
  }
}
Request
Request Body schema: application/json
object
Responses
200

Return a 200, 201, 202 or 204 status to indicate that the data was received successfully

Request samples
application/json
{
  • "params": {
    }
}

Fiats

Get list of fiat currencies

This endpoint retrieves a list of available fiat currencies supported by Crypto Pay by Bitpanda. The response includes the currency ID, symbol, and whether it is the default currency. Partners can use this information to display available fiat options to users during transactions.

SecuritybearerAuth
Responses
200

A list of fiat currencies

Response Schema: application/json
Array of objects
401

Unauthorized

Response Schema: application/json
Array of objects
500

Internal Server Error

Response Schema: application/json
Array of objects
get/pay/v1/fiats
Request samples
Response samples
application/json
{
  • "data": [
    ]
}

Settlement

Settlement Update NotificationsWebhook

This webhook notifies partners when a money transfer from our platform to their account has been initiated successfully. It gives partners timely updates about fund transfers that affect their accounts.

Request
Request Body schema: application/json
object
Responses
200

Return a 200, 201, 202 or 204 status to indicate that the data was received successfully

Request samples
application/json
{
  • "params": {
    }
}