Intended for permanent cancellation (use Pause/Unpause if you only need a temporary stop).

Endpoint

PUT https://api.payfast.co.za/subscriptions/`{{token}}`/cancel

Same host for sandbox; append ?testing=true to the request URL (do not include testing in the signature).

Path parameter

Name	Type	Description
`token`	string	Subscription token you received from PayFast notifications/ITN. Use this token for all subsequent subscription API calls.

Body parameters

No request body is required.

Required headers

Header	Type	Required	Description
`merchant-id`	integer (8 chars)	✅	Your PayFast Merchant ID.
`version`	string	✅	API version (e.g. `v1`).
`timestamp`	ISO-8601 string	✅	`YYYY-MM-DDTHH:MM:SS[+HH:MM]` (include offset).
`signature`	string (MD5)	✅	Lower-case MD5 of the canonical string (see below).

Signature scope: sign the headers (and any body fields, if present) plus your passphrase; exclude signature and (in sandbox) testing.

Signature — canonical string (copy/paste)

Headers-only (no body fields):

merchant-id=<MERCHANT_ID>&passphrase=<PASSPHRASE>&timestamp=<TIMESTAMP_ENC>&version=<VERSION>

Example with URL-encoded timestamp:

merchant-id=10000000&passphrase=•••&timestamp=2025-08-27T11%3A05%3A00%2B02%3A00&version=v1

Example request (sandbox)

curl -X PUT "https://api.payfast.co.za/subscriptions/6b9b1fcd-1793-48ca-a659-136ec66ad320/cancel?testing=true" \
  -H "merchant-id: 10000000" \
  -H "version: v1" \
  -H "timestamp: 2025-08-27T11:05:00+02:00" \
  -H "signature: c18901f7ade7c7afc54365baf3630080"

Example response

The API returns the standard envelope with result details. Handle unknown keys defensively.

{
    "code": 200,
    "status": "success",
    "data": {
        "response": true,
        "message": "Success"
    }
}

(Response shape reflects PayFast’s common envelope; exact wording may vary.)

You'll see "cancelled" displayed as the **subscription status **on the Sandbox dashboard's subscription page, with the option to Activate it again.

Notes & gotchas

Cancellation stops future billing; use Pause/Unpause for temporary suspensions.
Customers may receive a cancellation email notification.
In sandbox, append ?testing=true but do not hash it.
Path params (like {{token}}) are not included in the signature string.
Ensure timestamp includes a timezone offset and is freshly generated per call.

🔁
Need to pause instead? See Pause subscription or Unpause subscription.

🔐
New to signing? See Authentication & Signature.