# Arbor Gateway API

Human docs: https://docs.sejaarbor.com
OpenAPI (canonical contract): https://docs.sejaarbor.com/openapi.yaml
Base URL: https://api.pay.sejaarbor.com
Dashboard: https://pay.sejaarbor.com

Do not invent endpoints, fields, or hosts. Follow the OpenAPI spec.

## Auth
POST https://api.pay.sejaarbor.com/api/auth
Authorization: Basic base64(client_id:client_secret)
No request body.
Response JSON: { "success": true, "token": "<jwt>", "tokenType": "Bearer", "expiresIn": 60000 }
expiresIn is milliseconds.
Then send Authorization: Bearer <token> on every other route.

Credentials come from pay.sejaarbor.com → Desenvolvedores → Chaves de API.
client_id = public key. client_secret = secret (shown once).
Sandbox vs production: same host, different credential pair.
Sandbox pair is self-service: Chaves de API → Sandbox tab → "Ativar ambiente sandbox".
Sandbox balance starts at 0 and is separate; webhooks must be registered again with the sandbox token.
Sandbox card (POST /api/v1/card): any card.token is paid; a token containing "decline" (e.g. ctoken_decline) is refused.

## Money
Integer cents. R$ 10.50 = 1050. Balance endpoints return strings in reais.

## PIX IN (charge)
POST /api/v1/pix/in/qrcode
JSON: { "amountInCents": 5000, "description": "optional", "postbackUrl": "optional", "trackingParameters": { "src", "sck", "utm_source", "utm_campaign", "utm_medium", "utm_content", "utm_term" }, "customer": { "documentType": "cpf"|"cnpj", "document": "digits", "name": "optional", "email": "optional" } }
trackingParameters is optional. Body values win. Missing fields are read from the Origin/Referer query string and from postbackUrl.
amountInCents min 100.
Response data.id, data.status, data.pix.emv (EMV copy-paste), data.pix.qrCode (PNG base64).
GET /api/v1/pix/in/qrcode/{transactionId}
Sandbox only (no real money): POST /api/v1/pix/in/qrcode/{transactionId}/pay

## PIX OUT
POST /api/v1/pix/out/pixkey
Requires header x-idempotency-key.
GET /api/v1/pix/out/pixkey/{transferId}
Sandbox: POST /api/v1/pix/out/pixkey/{transferId}/complete

## What exists where
API creates only PIX and international card (USD/EUR).
POST /api/v1/card without currency or with BRL returns 400. National card (BRL) is hosted checkout only.
Hosted checkout (pay.sejaarbor.com → Checkout) also offers: national card, international card, Apple Pay and Google Pay inside the international card form, SEPA (EUR), PayPal (USD/EUR), Klarna (USD/EUR), iDEAL (EUR), Bancontact (EUR), MB WAY (EUR), Amazon Pay (USD/EUR), Revolut Pay (EUR), Satispay (EUR).
No API route for those checkout-only methods.
Boleto is not available on the API or the checkout.
PIX and BRL card require a real CPF/CNPJ. International payments do not. On the API, customer.documentType and customer.document are still part of the payload; document may be empty for international card.
The platform can disable a method globally: it disappears from checkout and the API rejects that method.
Approved card funds are not immediately withdrawable.

## Card (international only — USD/EUR)
National card (BRL) is NOT available through this API — hosted checkout only.
Capture the card in the browser with a Payment Element, never raw PAN (see human docs "Capturar o cartão"). Send card.token = the ConfirmationToken id (ctoken_...); raw PAN is not accepted.
POST /api/v1/card
JSON: { "amountInCents": 1999, "currency": "USD"|"EUR" (required, no BRL), "description": "optional", "trackingParameters": { "src", "sck", "utm_source", "utm_campaign", "utm_medium", "utm_content", "utm_term" }, "card": { "holderName": "...", "token": "ctoken_xxx", "last4": "0000", "brand": "card" }, "customer": { "name", "documentType", "document", "email", "billingAddress": { "street", "number", "neighborhood", "city", "state", "zipCode" } } }
trackingParameters is the same optional object as PIX.
card.last4/card.brand are echoed as sent, not validated for this API — send placeholders if you don't have real values.
card.installments is accepted by the schema but has no effect yet for international card — always charged in full.
Approved card sales are not immediately withdrawable; they follow the account settlement delay (foreign receivable, default D+7).

## Webhooks
POST /api/v1/webhook  { "url": "https://...", "events": ["transaction_paid"] }
DELETE /api/v1/webhook/{id}
Header ArborGateway-Signature: t={unix},v1={hmacSHA256} when signatureSecret is set.
Respond HTTP 2xx quickly.
Credit event: transaction_paid.
Other events: transaction_created, transaction_refunded, transaction_updated, transfer_created, transfer_completed, transfer_canceled, transfer_updated, infraction.
# Other events (card/subscriptions, hidden): subscription_created, subscription_charged, subscription_payment_failed, subscription_canceled.

## Also
GET /api/v1/balance
# Subscriptions and plans: see OpenAPI /api/v1/subscriptions and /api/v1/plans.
Hosted checkout (no API): pay.sejaarbor.com → Checkout → Links de cobrança.