# API request format


Interaction with the 1Payment API uses **HTTP requests** to `https://api.1payment.com/<method_name>`. The exact URL and field set are on each operation page in the payment acceptance and payout sections.

Successful and error responses are **JSON**.

## Parameter delivery methods

| Method | How to send | Headers |
| --- | --- | --- |
| **GET** | Parameters in the query string. Used in examples by default. | — |
| **POST** | Body `application/x-www-form-urlencoded` with the same fields as GET query. | `Content-Type: application/x-www-form-urlencoded` |
| **POST JSON** | Body `application/json` with the same field set. | `Content-Type: application/json` |

Documentation often shows parameters for **GET**, but for the same method you may use **GET**, **POST**, or **POST JSON** — choose what fits your server.

## Request signature (`sign`)

Protected methods require the `sign` parameter — MD5, lowercase (hex) of the string:

```text
<method_name> + <parameters_without_sign_in_A-Z_order_joined_by_&> + <API_KEY>
```

**Example** (method `init_form`; the project key value is appended at the end):

```text
init_formamount=100.00&partner_id=123&project_id=456&shop_url=myshop.ru&user_data=order_777secret_key
```

- Only **actually sent** fields are included in the signature, except `sign`.
- `API_KEY` is the **project** key (not the partner global key).
- The method prefix (`init_form`, `init_payment`, `status_payment`, etc.) matches the operation documentation.
- Parameter values in the signature string are **as sent**, without URL encoding. In PHP, **do not** use `http_build_query()` to build the signature string (it encodes `:` and other characters); `http_build_query()` is fine separately for the HTTP body or query string when sending the request.

Method pages include a signature verification widget. Signature verification failure — `error_code` = `2`; see [Error codes (API)](./error-codes-api.md).

## Callbacks (notifications)

1Payment sends the final payment status as **POST** JSON to your `notify_url`. Callback signature **without** the method name prefix: `md5(<parameters_in_A-Z_order_joined_by_&> + <API_KEY>)`. Your server must respond with **HTTP 200 OK**.

The full callback field list and method-specific details are on operation pages in the "Status notifications (callbacks)" sections.

## Related sections

- [Error codes (API)](./error-codes-api.md)
- [Payment types](./payment-types.md)
- [Payout types](./payout-types.md)
- [Transaction statuses](./transaction-statuses.md)