Endpoint

PUT https://api.payfast.co.za/<EXACT_PATH_FROM_COLLECTION_WITH_:token>

Sandbox: append ?testing=true (do not include testing in the signature).

Path parameter

Name	Type	Description
`token`	string	Subscription token tied to the tokenization agreement.

Body

No request body is required.

Required headers

Header	Type	Required	Description
`merchant-id`	integer (8 chars)	✅	Your PayFast Merchant ID.
`version`	string	✅	API version (e.g., `v1`).
`timestamp`	ISO-8601 string	✅	`YYYY-MM-DDTHH:MM:SS[+HH:MM]` (include offset).
`signature`	string (MD5)	✅	Lower-case MD5 of canonical string.

Signature — canonical string (copy/paste)

merchant-id=<MERCHANT_ID>&passphrase=<PASSPHRASE>&timestamp=<TIMESTAMP_ENC>&version=<VERSION>

Example (sandbox)

curl -X PUT "https://api.payfast.co.za/<EXACT_PATH_FROM_COLLECTION_WITH_TOKEN>?testing=true" \
  -H "merchant-id: 10000000" \
  -H "version: v1" \
  -H "timestamp: 2025-08-27T14:10:00+02:00" \
  -H "signature: <md5-of-canonical-string>"

Response

Standard JSON envelope confirming cancellation.

{
    "code": 200,
    "status": "success",
    "data": {
        "response": true,
        "message": "Success"
    }
}

The Tokenization agreement's status is shown as CANCELLED.

🧭
See also: Ad-hoc charge