API Documentation

Introduction

Base URL for every endpoint:

https://pay.quraishy.app/api/public/v1

API access is granted per business account. Contact us to receive your API key and to register your webhook URL.

Authentication

Send your API key in the Authorization header of every request. Keep the key on your server — never expose it in a browser or mobile app.

Authorization: Bearer qp_live_xxxxxxxxxxxxxxxx
Content-Type: application/json

Send credit

Creates a recharge order. The operator is detected automatically from the number. Amounts are in AFN.

POST/recharges

curl -X POST https://pay.quraishy.app/api/public/v1/recharges \
  -H "Authorization: Bearer qp_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone_number": "0700000000",
    "amount": 100,
    "client_transaction_id": "your-unique-id-001"
  }'

Response

{
  "order_id": "5f9a...",
  "status": "processing",
  "phone_number": "0700000000",
  "amount": 100,
  "mno": "AWCC",
  "client_transaction_id": "your-unique-id-001"
}

client_transaction_id must be unique. Re-sending the same value returns the existing order instead of creating a duplicate.

Order status

GET/recharges/{order_id}

curl https://pay.quraishy.app/api/public/v1/recharges/5f9a... \
  -H "Authorization: Bearer qp_live_xxxxxxxxxxxxxxxx"

Statuses

• created — order received
• reserved — amount held on your wallet
• processing — sent to the operator
• success — credit delivered
• failed — not delivered, amount released

Account balance

GET/balance

{
  "currency": "AFN",
  "available_balance": 12450.50,
  "reserved_balance": 300.00
}

Webhooks

When an order reaches a final status we send a POST request to your registered webhook URL. Respond with HTTP 200 within 10 seconds; we retry failed deliveries.

POST https://your-app.com/quraishy/webhook

{
  "event": "recharge.success",
  "order_id": "5f9a...",
  "client_transaction_id": "your-unique-id-001",
  "phone_number": "0700000000",
  "amount": 100,
  "status": "success",
  "created_at": "2026-01-01T10:00:00Z"
}

Each delivery carries an X-Signature header — an HMAC-SHA256 of the raw body using your webhook secret. Always verify it before trusting the payload.

Errors

Errors use standard HTTP status codes and a consistent body.

{
  "error": {
    "code": "insufficient_balance",
    "message": "Your wallet balance is not enough for this recharge."
  }
}

• 400 — invalid request body
• 401 — missing or invalid API key
• 402 — insufficient balance
• 429 — too many requests
• 500 — temporary server error