Contract status
The current API is an implementation-led private preview. UWAY provisions the tenant base URL, credentials, enabled operations, callback configuration, and production contract during onboarding.
Examples in this documentation describe the draft contract used for integration planning. They must not be treated as confirmation that a public self-service endpoint is available.
Protocol conventions
| Convention | Current preview approach |
|---|---|
| Transport | HTTPS |
| Payload | JSON |
| Time | ISO 8601 in UTC |
| Authentication | Tenant Bearer credential |
| Idempotency | Stable key per logical write request |
| Traceability | UWAY reference plus customer transaction or case ID |
| Errors | HTTP status plus structured error object |
Authentication
Keep credentials in a server-side secret manager. Do not expose them in browser code, mobile applications, client-side analytics, source control, or screenshots.
Authorization: Bearer YOUR_TENANT_KEY
Content-Type: application/json
Idempotency-Key: txn_8f72b1c4e5d9Idempotency
Use the same idempotency key when retrying one logical request after a timeout or uncertain response. Generate a new key only when the business operation itself is new.
Persist the idempotency key, UWAY reference, and business transaction or case identifier together.
Evidence and logging
Log request time, tenant, operation, business reference, response status, UWAY reference, configuration version, and error code. Do not place raw credentials or unnecessary sensitive customer data in application logs.
Next steps
- Review Screen a transaction.
- Configure Webhook events.
- Select a deployment model.
Related UWAY Insights
Use these operating guides to connect the product workflow to its wider APAC compliance context.