The Prysym APIs are designed to enable clients to make and receive payments globally by quickly and easily integrating into their native systems without knowing how arcane payment systems work globally or even having many details about the recipient. We’ve integrated a combination of more common methods, new services as well novel techniques pioneered by the company representing the most diverse and ever expanding final-mile payment options possible. This enables the client to make an instant payment to anyone, anywhere and enables the recipient to decide the best way to access their money. (The above is subject to sanctions and regulated entity approvals).

To make API calls, include the bearer token in the Authorization header with the Bearer authentication scheme.

The value is Bearer <Your-Secret-Key>.

The URL to the API service is either:

• Sandbox. https://api.sandbox.prysym.com

• Live. https://api.prysym.com

APIs use the Status-Line part of an HTTP response message to inform clients of their request’s overarching result.

HTTP defines over 40 standard status codes that can be used to convey the results of a client’s request. The status codes are divided into the five categories presented here:

• 1xx: Informational - Communicates transfer protocol-level information
• 2xx: Success - Indicates that the client’s request was accepted successfully.
• 3xx: Redirection - Indicates that the client must take some additional action in order to complete their request.
• 4xx: Client Error - This category of error status codes points the finger at clients.
• 5xx: Server Error - The server takes responsibility for these error status codes.

Payment Instruments

Prysym's Acquiring functionality

Prysym's Transactions functionality allows you to manage transactions.

To secure Prysym webhook verification on the client side, it is essential to implement HMAC-based verification.

HMAC (Hash-based Message Authentication Code) is a cryptographic mechanism that combines a secret key with a hashing algorithm to generate a unique code for a given payload. This ensures:

• Data Integrity: The payload has not been altered in transit.

• Authentication: The message is from a trusted source.

• Security: The secret key ensures that only parties with the key can generate valid HMACs.

Prysym use HMAC-SHA256 cryptographic algorithm with a shared secret key to generate the signature, which is sent in the x-webhook-hmac header of the webhook.

Webhook Verification Steps

When receive the webhook

• Retrieve the raw payload body of the HTTP POST request

• Extract the x-webhook-hmac header from the request headers. This header contains the signature.

Generate an HMAC signature using the same secret key in different programming languages:

Info Point:

1. Algorithm: HMAC-SHA256

2. Parameter input:

Compare the X-HMAC-Signature header value with the HMAC signature you computed:

• If the signatures match, the webhook is valid and untampered.

• If they do not match, reject the webhook as potentially malicious