API documentation

01 Getting started

The OneSix API lets you accept payments with invoices and send withdrawals (transfers) programmatically. Requests are authorized with a project API key and an HMAC signature.

Integration takes three steps:

1. Create a project in your dashboard and confirm domain ownership (DNS).
2. Get the project API key: an id + secret pair.
3. Sign requests with the key (HMAC-SHA256) and call the API methods.

Registration → Project (pending) → Domain verification → Moderation → Project (active) → API key → API requests

Identifier formats

02 Request signing (HMAC)

Every public API request is authorized with an API key and signed with HMAC-SHA256. Sessions (cookie / Authorization: Bearer) are not used for the API.

Keys

A project has one active key (status: active). Key rotation is not available yet. The key secret is returned by GET /api/projects/{project_id}/api-keys/, keep it somewhere safe.

Request headers

The signature is required for every public API method (GET and POST).

Signing algorithm

Step 1. Build the data object:

{
  "params": "url_encoded_query_string",
  "body": {},
  "path": "/api/invoice/"
}

• params: the query string as in the URL, without ? (e.g. project_id=...&page=1). Empty string "" when there is no query.
• body: the parsed JSON request body. Empty object {} for GET requests without a body.
• path: the request path with slashes, including the /api prefix (e.g. /api/invoice/).

Step 2. Serialize the object with sorted keys:

json.dumps(data, separators=(",", ":"), sort_keys=True)

Step 3. Compute the signature:

payload   = str(timestamp) + json_string
signature = HMAC-SHA256(key=secret, message=payload).hexdigest()

Step 4. Send X-API-Key-ID, X-Timestamp and X-Signature as headers.

Important

• X-Timestamp must be within ±15 seconds of server time. If your clock drifts, sync with GET /api/-/time/.
• A signature is single-use. Reusing the same X-Signature returns 401 Signature already used!. Every request needs a fresh timestamp and signature.
• TOTP (2FA) is not required for API calls.
• If the key has an IP allowlist, requests are accepted only from those addresses.

Generating the signature

import hmac, hashlib, json, time

def sign(secret: str, timestamp: int, data: dict) -> str:
    s = json.dumps(data, separators=(",", ":"), sort_keys=True)
    payload = f"{timestamp}{s}"
    return hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()

secret     = "<key>"
api_key_id = "<uuid>"
path       = "/api/invoice/"
params     = ""
body       = {
    "name": "Order 1",
    "target_amount": 100,
    "is_termless": True,
    "is_payer_comission": True,
    "description": "",
    "private_description": "",
}

ts   = int(time.time())
data = {"params": params, "body": body, "path": path}
signature = sign(secret, ts, data)

headers = {
    "X-API-Key-ID": api_key_id,
    "X-Timestamp": str(ts),
    "X-Signature": signature,
    "Content-Type": "application/json",
}

$secret = "<key>";
$path   = "/api/invoice/";
$params = "";
$body   = [
    "name"               => "Order 1",
    "target_amount"      => 100,
    "is_termless"        => true,
    "is_payer_comission" => true,
    "description"        => "",
    "private_description"=> "",
];

$data = ["params" => $params, "body" => $body, "path" => $path];
ksort($data); // params, path, body -> sort_keys=True
$json      = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
$timestamp = time();
$signature = hash_hmac("sha256", $timestamp . $json, $secret);

const crypto = require("crypto");

function sign(secret, timestamp, data) {
  // sort top-level keys, compact JSON without spaces
  const ordered = {};
  Object.keys(data).sort().forEach((k) => (ordered[k] = data[k]));
  const s = JSON.stringify(ordered);
  return crypto.createHmac("sha256", secret).update(`${timestamp}${s}`).digest("hex");
}

const secret = "<key>";
const data = {
  params: "",
  body: { name: "Order 1", target_amount: 100, is_termless: true, is_payer_comission: true, description: "", private_description: "" },
  path: "/api/invoice/",
};
const ts = Math.floor(Date.now() / 1000);
const signature = sign(secret, ts, data);

Request examples

# params = ""  (no query)
# body   = {}  (no body)
# path   = "/api/invoice/my/<invoice_id>/"
# data   = {"body":{},"params":"","path":"/api/invoice/my/<invoice_id>/"}

curl "https://devonesite.site/api/invoice/my/<invoice_id>/" \
  -H "X-API-Key-ID: <UUID>" \
  -H "X-Timestamp: 1718659200" \
  -H "X-Signature: <hex>"

curl "https://devonesite.site/api/invoice/" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key-ID: <UUID>" \
  -H "X-Timestamp: 1718659200" \
  -H "X-Signature: <hex>" \
  -d '{"name":"Order 1","target_amount":100,"is_termless":true,"is_payer_comission":true,"description":"","private_description":""}'

Server time

Returns the current server time (unix, a number). Use it to sync X-Timestamp if the client clock may drift by more than 15 seconds.

Which methods accept an API key

Signing and authorization errors

03 Invoices

An invoice is a request to pay a fixed amount. Once created, it returns a payment address and a payment page. The amount is set in fiat (target_amount), payment arrives in USDT at the current rate (rate_pair: USDT_RUB, rate is in the response).

POST /api/invoice/

Request body (InvoiceCreateDTO)

Response (MyInvoiceDTO)

GET /api/invoice/my/{invoice_id}/

Returns your invoice (MyInvoiceDTO, with private_description). With a key an extra filter applies: only invoices of the key’s project are available.

GET /api/invoice/{invoice_id}/

Public invoice page, no authorization. Returns PublicInvoiceDTO: same as MyInvoiceDTO but without private_description and project_id. Used for the payment page.

Invoice statuses

04 Withdrawals (Transfer)

Create a withdrawal to an external blockchain address.

POST /api/gw/transfer/

Request body (WithdrawalCreateDTO)

Response: a JSON object of the withdrawal transaction (type, status, operation ID).

05 Reference data

Public methods without authorization that are useful for integration.

GET /api/gw/currencies/

Supported currencies. Use the symbol field as symbol_id when creating a withdrawal.

Query: search - filter. The response is paginated (data[], pages_count, current_page, total).

Each item (CurrencyDTO):

GET /api/gw/fees/

Fees and minimum amounts per symbol (GwFeeDTO[]):

GET /api/gw/fees/calculate/

Fee calculation for a specific amount.

Query (all required): amount, operation_type (deposit / withdrawal / swap), symbol_id.

Response (GwServiceFeeCalculationDTO): symbol_id, operation_type, amount, fee_amount, net_amount, gross_amount.

GET /api/gw/currencies/rates/

Currency pair rates (CurrencyRateDTO[]):

06 Project management

Projects

POST /api/projects/ (ProjectCreateDTO)

PATCH /api/projects/{project_id}/ (ProjectUpdateDTO): category, description, logo_img_id (encoded id of your image), brand_color (# + 6 hex). The logo must belong to you.

Project details (ProjectDTO)

{
  "id": "uuid",
  "public_id": "aabbccddeeff",
  "name": "Shop",
  "status": "pending",
  "category": "goods",
  "site_url": "https://shop.example.com",
  "contact_telegram": "@shop",
  "description": null,
  "logo_img_id": null,
  "brand_color": null,
  "is_site_verified": false,
  "verify_method": null,
  "verify_token": null,
  "verified_at": null,
  "rejected_reason": null,
  "created_at": "...",
  "updated_at": "..."
}

status: pending → active (after verification and moderator approval) / rejected / disabled.

Domain verification (DNS)

POST /verification/: body {"method": "dns"}. Response:

{
  "method": "dns",
  "verify_token": "<hex>",
  "instruction": "Add a TXT record for shop.example.com with value j1ulwfmkyj0-site-verification=<token>"
}

Tell the user to add a TXT record on the site_url host with the value j1ulwfmkyj0-site-verification=<verify_token>.

POST /verification/check/: if the TXT record is found, is_site_verified=true and verified_at is set, the status stays pending (awaiting moderation). If already verified, returns 200 without an error. If there is no TXT record, returns 400 Site verification failed.

Project API keys

[
  {
    "id": "key uuid, this is X-API-Key-ID",
    "key": "hex secret, 64 chars",
    "status": "active",
    "created_at": "...",
    "archived_at": null
  }
]

status: active / archived. A project has one active key. Rotation is not available yet.

Project operations and conversions

Pagination: page starts at 1, per_page defaults to 10. The response has current_page = page - 1 (zero-based), pages_count, total, data[].

Operation (ProjectAdminTransactionDTO): id, type, subject (usdt/rub), symbol_id, is_incoming, amount, state (created/pending/dirty_lock/executed/cancelled), tx_hash, description, executed_at, created_at, project_id.

Conversion (SwapOrderResponseDTO): id, from_symbol_id, to_symbol_id, from_amount, to_amount, rate, status (created/processing/executed/cancelled/failed), created_at, project_id, user.

Dashboard lists filtered by project

GET /api/invoice/?project_id=<uuid>
GET /api/transaction/?project_id=<uuid>
GET /api/gw/swap_order/?project_id=<uuid>

07 Error codes

Projects and verification (400)

Authorization and signature (401)

Not found (404)