Introduction

The API has predictable, resource-oriented URLs, returns JSON-encoded responses, and uses standard HTTP verbs and response codes.

Account Setup

Before interacting with the API, ensure your merchant account is configured with the following:

Each request to the Recurring Billing API may be restricted to an IP address whitelist.

If set, the IP address of the server making the request must be included in the whitelist.
Requests from IPs not in the list will be rejected.
You can manage this setting under your merchant account:
- Navigate to Recurring Billing → Edit IP Whitelist.
This is an optional security measure.

GET https://api.payfast.co.za/ping?testing=true

PayFast’s API uses the same base host for both environments; sandbox behavior is enabled via **testing=true** (and sandbox creds).

💡
It’s recommended to create your own Sandbox account to test your integration before going live.

PayFast returns JSON-formatted responses.

{
  "code": 200,
  "status": "success",
  "data": {}
}

Field	Description
`code`	The HTTP status code for the result.
`status`	A descriptive message about the result.
`data`	Contains the response payload (boolean values, objects, or error details).

Data can be sent via headers or body. Two content types are supported:

application/x-www-form-urlencoded

frequency=3&cycles=12

application/json

{
  "frequency": 3,
  "cycles": 12
}

Each request must include an ISO-8601 formatted timestamp in the request body, alongside the signature.

If the time zone offset is not provided, GMT+2 is assumed.