Resuming payments is as simple as providing the subscription's token.

Endpoint

PUT https://api.payfast.co.za/subscriptions/{{token}}/unpause

Use the same host for sandbox; append ?testing=true to the request URL (do not include testing in the signature).

Path parameter

Name	Type	Description
`token`	string	Subscription token you received from PayFast (via ITN/notification) and must use for all subsequent subscription API calls.

Body parameters

No request body is required to unpause.

Required headers

Header	Type	Required	Description
`merchant-id`	integer (8 chars)	✅	Your PayFast Merchant ID.
`version`	string	✅	API version (e.g. `v1`).
`timestamp`	ISO-8601 string	✅	`YYYY-MM-DDTHH:MM:SS[+HH:MM]` (include offset).
`signature`	string (MD5)	✅	Lower-case MD5 of the canonical string (see below).

Signature scope: sign the headers (and any body fields if present) plus your passphrase; exclude signature and (in sandbox) testing. Guidance is consistent with PayFast’s API authentication rules.

Signature — canonical string (copy/paste)

Headers-only (no body fields):

merchant-id=<MERCHANT_ID>&passphrase=<PASSPHRASE>&timestamp=<TIMESTAMP_ENC>&version=<VERSION>

Example with URL-encoded timestamp:

merchant-id=10000000&passphrase=•••&timestamp=2025-08-27T10%3A15%3A00%2B02%3A00&version=v1

Example request (sandbox)

curl -X PUT "https://api.payfast.co.za/subscriptions/6b9b1fcd-1793-48ca-a659-136ec66ad320/unpause?testing=true" \
  -H "merchant-id: 10000000" \
  -H "version: v1" \
  -H "timestamp: 2025-08-27T10:15:00+02:00" \
  -H "signature: ae9467a91e5ce13951ec2e3b77a00484"

A similar example is shown in PayFast’s public Postman documentation.

Example response

Returns a JSON object indicating result and current subscription state.

{
    "code": 200,
    "status": "success",
    "data": {
        "response": true,
        "message": "Success"
    }
}

You'll see "active" displayed as the **subscription status **on the Sandbox dashboard's subscription page.

Notes & gotchas

Ensure your timestamp is fresh and includes a timezone offset.
In sandbox, append ?testing=true but do not hash it.
Path params (like {{token}}) are not included in the signature string.
If you receive 401 Merchant authorisation failed, re-check passphrase, timestamp, and URL-encoding in your canonical string.

⏸️
Need to pause again? See Pause subscription.

🔐
New to signing? See Authentication & Signature.