Deposit Saldo (H2H)

Endpoint Host-to-Host (H2H) untuk melakukan deposit saldo ke akun Anda secara otomatis — tanpa perlu login ke dashboard. Cocok untuk sistem yang butuh top-up saldo terjadwal/otomatis (misal sebelum menjalankan batch order).

Endpoint: POST /v1/deposit

Satu endpoint ini menangani 4 perintah lewat parameter cmd: methods, create, status, dan cancel.

Notifikasi otomatis lewat webhook

Status deposit yang berubah (success / failed / expired / cancelled) dikirim otomatis ke URL webhook Anda sebagai event deposit.updated — pakai URL webhook yang sama dengan notifikasi transaksi. Lihat Event Webhook. Anda tetap bisa polling cmd=status sebagai cadangan jika perlu.

Parameter Request

Setiap perintah tetap wajib menyertakan parameter autentikasi standar:

Parameter	Tipe	Wajib	Keterangan
`api_id`	string	✅	API ID
`timestamp`	integer	✅	Unix timestamp
`signature`	string	✅	HMAC-SHA256 — lihat cara membuat signature
`cmd`	string	✅	`methods`, `create`, `status`, atau `cancel`

Parameter tambahan berbeda-beda tergantung nilai cmd:

`cmd`	Parameter tambahan	Keterangan
`methods`	(tidak ada)	Menampilkan daftar metode deposit yang aktif
`create`	`code` (string, ✅), `amount` (integer, ✅)	Membuat deposit baru
`status`	`ref_id` (string, ✅)	Cek status deposit
`cancel`	`ref_id` (string, ✅)	Batalkan deposit yang masih `pending`

Satu deposit pending per metode

Untuk sebagian besar metode (termasuk transfer manual dan QRIS), satu akun hanya boleh punya satu deposit pending per metode dalam satu waktu. Jika Anda membuat deposit baru pada metode yang sama saat deposit sebelumnya masih pending, request ditolak dengan HTTP 409 dan code DEPOSIT_PENDING_EXISTS — ref_id deposit yang masih pending dikembalikan di errors.ref_id. Selesaikan pembayarannya, atau batalkan lewat cmd=cancel, lalu buat deposit baru. Detail ada di bagian Batasan.

1. Cek Metode Deposit — `cmd: methods`

Mengambil daftar metode deposit yang aktif beserta batas nominal dan biayanya.

<?php
header('Content-Type: application/json');

$api_id     = 'your_api_id';
$api_key    = 'your_api_key';
$secret_key = 'your_secret_key';
$timestamp  = time();

$businessParams = ['cmd' => 'methods'];
ksort($businessParams);

$canonicalBody = json_encode($businessParams, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$bodyHash      = hash('sha256', $canonicalBody);
$stringToSign  = implode('|', [$api_id, $api_key, $timestamp, $bodyHash]);
$signature     = hash_hmac('sha256', $stringToSign, $secret_key);

$payload = array_merge($businessParams, [
    'api_id'    => $api_id,
    'timestamp' => $timestamp,
    'signature' => $signature,
]);

$ch = curl_init('https://api.isikuota.com/v1/deposit');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);
// print_r($response);
echo json_encode($response, JSON_PRETTY_PRINT);

const crypto = require('crypto');

const api_id     = 'your_api_id';
const api_key    = 'your_api_key';
const secret_key = 'your_secret_key';
const timestamp  = Math.floor(Date.now() / 1000);

// Business params — urutkan A ke Z
const businessParams = { cmd: 'methods' };
const sorted = Object.fromEntries(
  Object.keys(businessParams).sort().map(k => [k, businessParams[k]])
);

const canonicalBody = JSON.stringify(sorted);
const bodyHash      = crypto.createHash('sha256').update(canonicalBody).digest('hex');
const stringToSign  = `${api_id}|${api_key}|${timestamp}|${bodyHash}`;
const signature     = crypto.createHmac('sha256', secret_key).update(stringToSign).digest('hex');

const response = await fetch('https://api.isikuota.com/v1/deposit', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...sorted, api_id, timestamp, signature }),
});
const data = await response.json();

import hmac, hashlib, time, json, requests

api_id     = 'your_api_id'
api_key    = 'your_api_key'
secret_key = 'your_secret_key'
timestamp  = int(time.time())

# Business params — urutkan A ke Z
business_params = {'cmd': 'methods'}
sorted_params   = dict(sorted(business_params.items()))

canonical_body = json.dumps(sorted_params, ensure_ascii=False, separators=(',', ':'))
body_hash      = hashlib.sha256(canonical_body.encode()).hexdigest()
string_to_sign = f'{api_id}|{api_key}|{timestamp}|{body_hash}'
signature      = hmac.new(secret_key.encode(), string_to_sign.encode(), hashlib.sha256).hexdigest()

payload = {**sorted_params, 'api_id': api_id, 'timestamp': timestamp, 'signature': signature}
response = requests.post('https://api.isikuota.com/v1/deposit', json=payload)
data = response.json()

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.http.*;
import java.net.URI;

public class DepositMethodsExample {

    static String sha256(String input) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    static String hmacSha256(String data, String key) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String apiId     = "your_api_id";
        String apiKey    = "your_api_key";
        String secretKey = "your_secret_key";
        long   timestamp = Instant.now().getEpochSecond();

        // Business params — TreeMap otomatis urut A ke Z
        TreeMap<String, String> businessParams = new TreeMap<>();
        businessParams.put("cmd", "methods");

        ObjectMapper mapper = new ObjectMapper();
        String canonicalBody = mapper.writeValueAsString(businessParams);
        String bodyHash      = sha256(canonicalBody);
        String stringToSign  = apiId + "|" + apiKey + "|" + timestamp + "|" + bodyHash;
        String signature     = hmacSha256(stringToSign, secretKey);

        Map<String, Object> payload = new LinkedHashMap<>(businessParams);
        payload.put("api_id",    apiId);
        payload.put("timestamp", timestamp);
        payload.put("signature", signature);

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.isikuota.com/v1/deposit"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(mapper.writeValueAsString(payload)))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

class DepositMethodsExample
{
    static string Sha256(string input)
    {
        using var sha = SHA256.Create();
        var bytes = sha.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static string HmacSha256(string data, string key)
    {
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(key));
        var bytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static async Task Main()
    {
        var apiId     = "your_api_id";
        var apiKey    = "your_api_key";
        var secretKey = "your_secret_key";
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

        // Business params — SortedDictionary otomatis urut A ke Z
        var businessParams = new SortedDictionary<string, string>
        {
            { "cmd", "methods" },
        };

        var canonicalBody = JsonSerializer.Serialize(businessParams);
        var bodyHash      = Sha256(canonicalBody);
        var stringToSign  = $"{apiId}|{apiKey}|{timestamp}|{bodyHash}";
        var signature     = HmacSha256(stringToSign, secretKey);

        var payload = new Dictionary<string, object>(
            businessParams.Select(x => new KeyValuePair<string, object>(x.Key, x.Value)))
        {
            { "api_id",    apiId     },
            { "timestamp", timestamp },
            { "signature", signature },
        };

        using var client = new HttpClient();
        var json     = JsonSerializer.Serialize(payload);
        var content  = new StringContent(json, Encoding.UTF8, "application/json");
        var response = await client.PostAsync("https://api.isikuota.com/v1/deposit", content);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }
}

API_ID="your_api_id"
API_KEY="your_api_key"
SECRET="your_secret_key"
TIMESTAMP=$(date +%s)

CANONICAL_BODY='{"cmd":"methods"}'

BODY_HASH=$(echo -n "$CANONICAL_BODY" | sha256sum | awk '{print $1}')
STRING_TO_SIGN="${API_ID}|${API_KEY}|${TIMESTAMP}|${BODY_HASH}"
SIGNATURE=$(echo -n "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://api.isikuota.com/v1/deposit \
  -H "Content-Type: application/json" \
  -d "{
    \"api_id\":    \"$API_ID\",
    \"timestamp\": $TIMESTAMP,
    \"signature\": \"$SIGNATURE\",
    \"cmd\":       \"methods\"
  }"

Contoh Response

{
  "success": true,
  "code": "SUCCESS",
  "message": "Ditemukan 2 metode deposit",
  "data": [
    {
      "code": "QRIS",
      "name": "QRIS - Semua E-Wallet & Bank",
      "type": "qris",
      "fee": 0,
      "gateway_fee": 0.7,
      "gateway_fee_type": "FLAT",
      "minimal": 10000,
      "maximal": 10000000,
      "is_auto": true,
      "image_url": "https://isikuota.com/images/payment/qris.png"
    },
    {
      "code": "BCA_VA",
      "name": "BCA Virtual Account",
      "type": "virtual_account",
      "fee": 4000,
      "gateway_fee": 0,
      "gateway_fee_type": "FLAT",
      "minimal": 10000,
      "maximal": 50000000,
      "is_auto": true,
      "image_url": "https://isikuota.com/images/payment/bca.png"
    }
  ],
  "errors": null,
  "meta": null
}

Field Response

Field	Tipe	Keterangan
`code`	string	Kode metode deposit, dipakai sebagai parameter `code` saat `cmd=create`
`name`	string	Nama metode
`type`	string	Jenis metode (`qris`, `virtual_account`, `bank_transfer`, dll)
`fee`	integer	Biaya admin tetap (Rp)
`gateway_fee`	number	Biaya tambahan dari payment gateway (persen atau flat, lihat `gateway_fee_type`)
`gateway_fee_type`	string	`FLAT` atau `PERCENT`
`minimal`	integer	Nominal deposit minimum (Rp)
`maximal`	integer	Nominal deposit maksimum (Rp)
`is_auto`	boolean	`true` jika diproses otomatis via payment gateway, `false` jika transfer manual
`image_url`	string/null	URL logo metode pembayaran

2. Membuat Deposit — `cmd: create`

<?php
header('Content-Type: application/json');

$api_id     = 'your_api_id';
$api_key    = 'your_api_key';
$secret_key = 'your_secret_key';
$timestamp  = time();

// Business params
$businessParams = [
    'cmd'    => 'create',
    'code'   => 'QRIS',
    'amount' => 100000,
];

// Urutkan A ke Z (ksort)
ksort($businessParams);

$canonicalBody = json_encode($businessParams, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$bodyHash      = hash('sha256', $canonicalBody);
$stringToSign  = implode('|', [$api_id, $api_key, $timestamp, $bodyHash]);
$signature     = hash_hmac('sha256', $stringToSign, $secret_key);

$payload = array_merge($businessParams, [
    'api_id'    => $api_id,
    'timestamp' => $timestamp,
    'signature' => $signature,
]);

$ch = curl_init('https://api.isikuota.com/v1/deposit');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);
// print_r($response);
echo json_encode($response, JSON_PRETTY_PRINT);

const crypto = require('crypto');

const api_id     = 'your_api_id';
const api_key    = 'your_api_key';
const secret_key = 'your_secret_key';
const timestamp  = Math.floor(Date.now() / 1000);

// Business params — urutkan A ke Z
const businessParams = {
  cmd:    'create',
  code:   'QRIS',
  amount: 100000,
};
const sorted = Object.fromEntries(
  Object.keys(businessParams).sort().map(k => [k, businessParams[k]])
);

const canonicalBody = JSON.stringify(sorted);
const bodyHash      = crypto.createHash('sha256').update(canonicalBody).digest('hex');
const stringToSign  = `${api_id}|${api_key}|${timestamp}|${bodyHash}`;
const signature     = crypto.createHmac('sha256', secret_key).update(stringToSign).digest('hex');

const response = await fetch('https://api.isikuota.com/v1/deposit', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...sorted, api_id, timestamp, signature }),
});
const data = await response.json();

import hmac, hashlib, time, json, requests

api_id     = 'your_api_id'
api_key    = 'your_api_key'
secret_key = 'your_secret_key'
timestamp  = int(time.time())

# Business params — urutkan A ke Z
business_params = {
    'cmd':    'create',
    'code':   'QRIS',
    'amount': 100000,
}
sorted_params = dict(sorted(business_params.items()))

canonical_body = json.dumps(sorted_params, ensure_ascii=False, separators=(',', ':'))
body_hash      = hashlib.sha256(canonical_body.encode()).hexdigest()
string_to_sign = f'{api_id}|{api_key}|{timestamp}|{body_hash}'
signature      = hmac.new(secret_key.encode(), string_to_sign.encode(), hashlib.sha256).hexdigest()

payload = {**sorted_params, 'api_id': api_id, 'timestamp': timestamp, 'signature': signature}
response = requests.post('https://api.isikuota.com/v1/deposit', json=payload)
data = response.json()

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.http.*;
import java.net.URI;

public class DepositCreateExample {

    static String sha256(String input) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    static String hmacSha256(String data, String key) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String apiId     = "your_api_id";
        String apiKey    = "your_api_key";
        String secretKey = "your_secret_key";
        long   timestamp = Instant.now().getEpochSecond();

        // Business params — TreeMap otomatis urut A ke Z
        TreeMap<String, Object> businessParams = new TreeMap<>();
        businessParams.put("cmd",    "create");
        businessParams.put("code",   "QRIS");
        businessParams.put("amount", 100000);

        ObjectMapper mapper = new ObjectMapper();
        String canonicalBody = mapper.writeValueAsString(businessParams);
        String bodyHash      = sha256(canonicalBody);
        String stringToSign  = apiId + "|" + apiKey + "|" + timestamp + "|" + bodyHash;
        String signature     = hmacSha256(stringToSign, secretKey);

        Map<String, Object> payload = new LinkedHashMap<>(businessParams);
        payload.put("api_id",    apiId);
        payload.put("timestamp", timestamp);
        payload.put("signature", signature);

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.isikuota.com/v1/deposit"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(mapper.writeValueAsString(payload)))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

class DepositCreateExample
{
    static string Sha256(string input)
    {
        using var sha = SHA256.Create();
        var bytes = sha.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static string HmacSha256(string data, string key)
    {
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(key));
        var bytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static async Task Main()
    {
        var apiId     = "your_api_id";
        var apiKey    = "your_api_key";
        var secretKey = "your_secret_key";
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

        // Business params — SortedDictionary otomatis urut A ke Z
        var businessParams = new SortedDictionary<string, object>
        {
            { "cmd",    "create" },
            { "code",   "QRIS"   },
            { "amount", 100000   },
        };

        var canonicalBody = JsonSerializer.Serialize(businessParams);
        var bodyHash      = Sha256(canonicalBody);
        var stringToSign  = $"{apiId}|{apiKey}|{timestamp}|{bodyHash}";
        var signature     = HmacSha256(stringToSign, secretKey);

        var payload = new Dictionary<string, object>(businessParams)
        {
            { "api_id",    apiId     },
            { "timestamp", timestamp },
            { "signature", signature },
        };

        using var client = new HttpClient();
        var json     = JsonSerializer.Serialize(payload);
        var content  = new StringContent(json, Encoding.UTF8, "application/json");
        var response = await client.PostAsync("https://api.isikuota.com/v1/deposit", content);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }
}

API_ID="your_api_id"
API_KEY="your_api_key"
SECRET="your_secret_key"
TIMESTAMP=$(date +%s)

# Business params — key wajib urut A ke Z
CANONICAL_BODY='{"amount":100000,"cmd":"create","code":"QRIS"}'

BODY_HASH=$(echo -n "$CANONICAL_BODY" | sha256sum | awk '{print $1}')
STRING_TO_SIGN="${API_ID}|${API_KEY}|${TIMESTAMP}|${BODY_HASH}"
SIGNATURE=$(echo -n "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://api.isikuota.com/v1/deposit \
  -H "Content-Type: application/json" \
  -d "{
    \"api_id\":    \"$API_ID\",
    \"timestamp\": $TIMESTAMP,
    \"signature\": \"$SIGNATURE\",
    \"cmd\":       \"create\",
    \"code\":      \"QRIS\",
    \"amount\":    100000
  }"

Contoh Response

✅ Berhasil dibuat
❌ Gagal
⚠️ Masih ada deposit pending

{
  "success": true,
  "code": "CREATED",
  "message": "Deposit berhasil dibuat",
  "data": {
    "ref_id": "DP20260818103055AB12CD",
    "status": "pending",
    "status_label": "Menunggu Pembayaran",
    "payment_method": "QRIS - Semua E-Wallet & Bank",
    "amount": 100000,
    "fee": 0,
    "unique_code": 8,
    "pay_amount": 100008,
    "get_amount": 100008,
    "destination_number": null,
    "destination_name": null,
    "qr_string": "00020101021226610014ID.CO.QRIS.WWW...",
    "payment_url": null,
    "note": null,
    "expired_at": "2026-08-19 10:30:55",
    "created_at": "2026-08-18 10:30:55"
  },
  "errors": null,
  "meta": null
}

{
  "success": false,
  "code": "DEPOSIT_FAILED",
  "message": "Nominal deposit di luar batas minimal/maksimal metode ini",
  "data": null,
  "errors": null,
  "meta": null
}

HTTP 409. Terjadi jika akun masih punya deposit pending pada metode (code) yang sama. Nominal yang Anda kirim tidak berpengaruh — metode yang sama tetap ditolak.

{
  "success": false,
  "code": "DEPOSIT_PENDING_EXISTS",
  "message": "Anda masih memiliki deposit yang belum dibayar pada metode ini. Selesaikan pembayaran atau batalkan deposit tersebut terlebih dahulu.",
  "data": null,
  "errors": {
    "ref_id": "DP20260818103055AB12CD"
  },
  "meta": null
}

Gunakan errors.ref_id untuk cmd=status (tampilkan kembali instruksi pembayarannya) atau cmd=cancel (jika ingin mengganti nominal).

Field Response `data`

Field	Tipe	Keterangan
`ref_id`	string	ID referensi deposit — simpan untuk cek status/pembatalan
`status`	string	`pending` / `success` / `failed` / `expired` / `cancelled`
`status_label`	string	Label status dalam Bahasa Indonesia
`payment_method`	string	Nama metode pembayaran yang dipilih
`amount`	integer	Nominal deposit yang Anda minta (Rp) — sama dengan `amount` yang Anda kirim di request, belum termasuk biaya admin (`fee`) atau kode unik
`fee`	integer	Biaya admin tetap metode ini (Rp)
`unique_code`	integer	Kode unik yang ditambahkan ke nominal transfer untuk rekonsiliasi otomatis (Rp) — `0` jika metode ini tidak memakai kode unik
`pay_amount`	integer	Nominal final yang harus dibayar/ditransfer (Rp) = `amount` + `fee` + `unique_code`. Gunakan field ini, bukan `amount`, sebagai nominal yang harus dibayar
`get_amount`	integer	Nominal yang akan dikreditkan ke saldo Anda setelah deposit sukses (= `amount` + `unique_code`, tidak termasuk `fee`)
`destination_number`	string/null	Nomor rekening/VA tujuan (metode transfer manual/VA)
`destination_name`	string/null	Nama pemilik rekening tujuan
`qr_string`	string/null	String QRIS untuk ditampilkan sebagai kode QR (metode QRIS)
`payment_url`	string/null	URL halaman pembayaran dari payment gateway, jika ada
`note`	string/null	Catatan tambahan
`expired_at`	string/null	Batas waktu pembayaran (`Y-m-d H:i:s`) — deposit otomatis kedaluwarsa setelah 24 jam
`created_at`	string	Waktu deposit dibuat

Auto vs Manual

Untuk metode dengan is_auto: true (QRIS, Virtual Account, dll), qr_string/payment_url/destination_number diisi oleh payment gateway dan status akan otomatis berubah menjadi success setelah pembayaran diverifikasi. Untuk metode manual (is_auto: false), Anda akan menerima destination_number untuk transfer manual dan status dikonfirmasi oleh admin.

3. Cek Status Deposit — `cmd: status`

<?php
header('Content-Type: application/json');

$api_id     = 'your_api_id';
$api_key    = 'your_api_key';
$secret_key = 'your_secret_key';
$timestamp  = time();

$businessParams = ['cmd' => 'status', 'ref_id' => 'DP20260818103055AB12CD'];
ksort($businessParams);

$canonicalBody = json_encode($businessParams, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$bodyHash      = hash('sha256', $canonicalBody);
$stringToSign  = implode('|', [$api_id, $api_key, $timestamp, $bodyHash]);
$signature     = hash_hmac('sha256', $stringToSign, $secret_key);

$payload = array_merge($businessParams, [
    'api_id'    => $api_id,
    'timestamp' => $timestamp,
    'signature' => $signature,
]);

$ch = curl_init('https://api.isikuota.com/v1/deposit');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);
// print_r($response);
echo json_encode($response, JSON_PRETTY_PRINT);

const crypto = require('crypto');

const api_id     = 'your_api_id';
const api_key    = 'your_api_key';
const secret_key = 'your_secret_key';
const timestamp  = Math.floor(Date.now() / 1000);

// Business params — urutkan A ke Z
const businessParams = { cmd: 'status', ref_id: 'DP20260818103055AB12CD' };
const sorted = Object.fromEntries(
  Object.keys(businessParams).sort().map(k => [k, businessParams[k]])
);

const canonicalBody = JSON.stringify(sorted);
const bodyHash      = crypto.createHash('sha256').update(canonicalBody).digest('hex');
const stringToSign  = `${api_id}|${api_key}|${timestamp}|${bodyHash}`;
const signature     = crypto.createHmac('sha256', secret_key).update(stringToSign).digest('hex');

const response = await fetch('https://api.isikuota.com/v1/deposit', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...sorted, api_id, timestamp, signature }),
});
const data = await response.json();

import hmac, hashlib, time, json, requests

api_id     = 'your_api_id'
api_key    = 'your_api_key'
secret_key = 'your_secret_key'
timestamp  = int(time.time())

# Business params — urutkan A ke Z
business_params = {'cmd': 'status', 'ref_id': 'DP20260818103055AB12CD'}
sorted_params   = dict(sorted(business_params.items()))

canonical_body = json.dumps(sorted_params, ensure_ascii=False, separators=(',', ':'))
body_hash      = hashlib.sha256(canonical_body.encode()).hexdigest()
string_to_sign = f'{api_id}|{api_key}|{timestamp}|{body_hash}'
signature      = hmac.new(secret_key.encode(), string_to_sign.encode(), hashlib.sha256).hexdigest()

payload = {**sorted_params, 'api_id': api_id, 'timestamp': timestamp, 'signature': signature}
response = requests.post('https://api.isikuota.com/v1/deposit', json=payload)
data = response.json()

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.http.*;
import java.net.URI;

public class DepositStatusExample {

    static String sha256(String input) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    static String hmacSha256(String data, String key) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String apiId     = "your_api_id";
        String apiKey    = "your_api_key";
        String secretKey = "your_secret_key";
        long   timestamp = Instant.now().getEpochSecond();

        // Business params — TreeMap otomatis urut A ke Z
        TreeMap<String, String> businessParams = new TreeMap<>();
        businessParams.put("cmd",    "status");
        businessParams.put("ref_id", "DP20260818103055AB12CD");

        ObjectMapper mapper = new ObjectMapper();
        String canonicalBody = mapper.writeValueAsString(businessParams);
        String bodyHash      = sha256(canonicalBody);
        String stringToSign  = apiId + "|" + apiKey + "|" + timestamp + "|" + bodyHash;
        String signature     = hmacSha256(stringToSign, secretKey);

        Map<String, Object> payload = new LinkedHashMap<>(businessParams);
        payload.put("api_id",    apiId);
        payload.put("timestamp", timestamp);
        payload.put("signature", signature);

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.isikuota.com/v1/deposit"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(mapper.writeValueAsString(payload)))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

class DepositStatusExample
{
    static string Sha256(string input)
    {
        using var sha = SHA256.Create();
        var bytes = sha.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static string HmacSha256(string data, string key)
    {
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(key));
        var bytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static async Task Main()
    {
        var apiId     = "your_api_id";
        var apiKey    = "your_api_key";
        var secretKey = "your_secret_key";
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

        // Business params — SortedDictionary otomatis urut A ke Z
        var businessParams = new SortedDictionary<string, string>
        {
            { "cmd",    "status" },
            { "ref_id", "DP20260818103055AB12CD" },
        };

        var canonicalBody = JsonSerializer.Serialize(businessParams);
        var bodyHash      = Sha256(canonicalBody);
        var stringToSign  = $"{apiId}|{apiKey}|{timestamp}|{bodyHash}";
        var signature     = HmacSha256(stringToSign, secretKey);

        var payload = new Dictionary<string, object>(
            businessParams.Select(x => new KeyValuePair<string, object>(x.Key, x.Value)))
        {
            { "api_id",    apiId     },
            { "timestamp", timestamp },
            { "signature", signature },
        };

        using var client = new HttpClient();
        var json     = JsonSerializer.Serialize(payload);
        var content  = new StringContent(json, Encoding.UTF8, "application/json");
        var response = await client.PostAsync("https://api.isikuota.com/v1/deposit", content);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }
}

API_ID="your_api_id"
API_KEY="your_api_key"
SECRET="your_secret_key"
TIMESTAMP=$(date +%s)

CANONICAL_BODY='{"cmd":"status","ref_id":"DP20260818103055AB12CD"}'

BODY_HASH=$(echo -n "$CANONICAL_BODY" | sha256sum | awk '{print $1}')
STRING_TO_SIGN="${API_ID}|${API_KEY}|${TIMESTAMP}|${BODY_HASH}"
SIGNATURE=$(echo -n "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://api.isikuota.com/v1/deposit \
  -H "Content-Type: application/json" \
  -d "{
    \"api_id\":    \"$API_ID\",
    \"timestamp\": $TIMESTAMP,
    \"signature\": \"$SIGNATURE\",
    \"cmd\":       \"status\",
    \"ref_id\":    \"DP20260818103055AB12CD\"
  }"

Contoh Response

✅ Success
❌ Tidak Ditemukan

{
  "success": true,
  "code": "SUCCESS",
  "message": "Deposit ditemukan",
  "data": {
    "ref_id": "DP20260818103055AB12CD",
    "status": "success",
    "status_label": "Berhasil",
    "payment_method": "QRIS - Semua E-Wallet & Bank",
    "amount": 100000,
    "fee": 0,
    "unique_code": 8,
    "pay_amount": 100008,
    "get_amount": 100008,
    "destination_number": null,
    "destination_name": null,
    "qr_string": "00020101021226610014ID.CO.QRIS.WWW...",
    "payment_url": null,
    "note": null,
    "expired_at": "2026-08-19 10:30:55",
    "created_at": "2026-08-18 10:30:55"
  },
  "errors": null,
  "meta": null
}

{
  "success": false,
  "code": "DATA_NOT_FOUND",
  "message": "Deposit tidak ditemukan",
  "data": null,
  "errors": null,
  "meta": null
}

Struktur data sama persis dengan response cmd=create di atas.

4. Membatalkan Deposit — `cmd: cancel`

Hanya bisa membatalkan deposit dengan status pending.

<?php
header('Content-Type: application/json');

$api_id     = 'your_api_id';
$api_key    = 'your_api_key';
$secret_key = 'your_secret_key';
$timestamp  = time();

$businessParams = ['cmd' => 'cancel', 'ref_id' => 'DP20260818103055AB12CD'];
ksort($businessParams);

$canonicalBody = json_encode($businessParams, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$bodyHash      = hash('sha256', $canonicalBody);
$stringToSign  = implode('|', [$api_id, $api_key, $timestamp, $bodyHash]);
$signature     = hash_hmac('sha256', $stringToSign, $secret_key);

$payload = array_merge($businessParams, [
    'api_id'    => $api_id,
    'timestamp' => $timestamp,
    'signature' => $signature,
]);

$ch = curl_init('https://api.isikuota.com/v1/deposit');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);
$response = json_decode(curl_exec($ch), true);
// print_r($response);
echo json_encode($response, JSON_PRETTY_PRINT);

const crypto = require('crypto');

const api_id     = 'your_api_id';
const api_key    = 'your_api_key';
const secret_key = 'your_secret_key';
const timestamp  = Math.floor(Date.now() / 1000);

// Business params — urutkan A ke Z
const businessParams = { cmd: 'cancel', ref_id: 'DP20260818103055AB12CD' };
const sorted = Object.fromEntries(
  Object.keys(businessParams).sort().map(k => [k, businessParams[k]])
);

const canonicalBody = JSON.stringify(sorted);
const bodyHash      = crypto.createHash('sha256').update(canonicalBody).digest('hex');
const stringToSign  = `${api_id}|${api_key}|${timestamp}|${bodyHash}`;
const signature     = crypto.createHmac('sha256', secret_key).update(stringToSign).digest('hex');

const response = await fetch('https://api.isikuota.com/v1/deposit', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...sorted, api_id, timestamp, signature }),
});
const data = await response.json();

import hmac, hashlib, time, json, requests

api_id     = 'your_api_id'
api_key    = 'your_api_key'
secret_key = 'your_secret_key'
timestamp  = int(time.time())

# Business params — urutkan A ke Z
business_params = {'cmd': 'cancel', 'ref_id': 'DP20260818103055AB12CD'}
sorted_params   = dict(sorted(business_params.items()))

canonical_body = json.dumps(sorted_params, ensure_ascii=False, separators=(',', ':'))
body_hash      = hashlib.sha256(canonical_body.encode()).hexdigest()
string_to_sign = f'{api_id}|{api_key}|{timestamp}|{body_hash}'
signature      = hmac.new(secret_key.encode(), string_to_sign.encode(), hashlib.sha256).hexdigest()

payload = {**sorted_params, 'api_id': api_id, 'timestamp': timestamp, 'signature': signature}
response = requests.post('https://api.isikuota.com/v1/deposit', json=payload)
data = response.json()

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.http.*;
import java.net.URI;

public class DepositCancelExample {

    static String sha256(String input) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    static String hmacSha256(String data, String key) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : hash) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String apiId     = "your_api_id";
        String apiKey    = "your_api_key";
        String secretKey = "your_secret_key";
        long   timestamp = Instant.now().getEpochSecond();

        // Business params — TreeMap otomatis urut A ke Z
        TreeMap<String, String> businessParams = new TreeMap<>();
        businessParams.put("cmd",    "cancel");
        businessParams.put("ref_id", "DP20260818103055AB12CD");

        ObjectMapper mapper = new ObjectMapper();
        String canonicalBody = mapper.writeValueAsString(businessParams);
        String bodyHash      = sha256(canonicalBody);
        String stringToSign  = apiId + "|" + apiKey + "|" + timestamp + "|" + bodyHash;
        String signature     = hmacSha256(stringToSign, secretKey);

        Map<String, Object> payload = new LinkedHashMap<>(businessParams);
        payload.put("api_id",    apiId);
        payload.put("timestamp", timestamp);
        payload.put("signature", signature);

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.isikuota.com/v1/deposit"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(mapper.writeValueAsString(payload)))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

class DepositCancelExample
{
    static string Sha256(string input)
    {
        using var sha = SHA256.Create();
        var bytes = sha.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static string HmacSha256(string data, string key)
    {
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(key));
        var bytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
        return BitConverter.ToString(bytes).Replace("-", "").ToLower();
    }

    static async Task Main()
    {
        var apiId     = "your_api_id";
        var apiKey    = "your_api_key";
        var secretKey = "your_secret_key";
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

        // Business params — SortedDictionary otomatis urut A ke Z
        var businessParams = new SortedDictionary<string, string>
        {
            { "cmd",    "cancel" },
            { "ref_id", "DP20260818103055AB12CD" },
        };

        var canonicalBody = JsonSerializer.Serialize(businessParams);
        var bodyHash      = Sha256(canonicalBody);
        var stringToSign  = $"{apiId}|{apiKey}|{timestamp}|{bodyHash}";
        var signature     = HmacSha256(stringToSign, secretKey);

        var payload = new Dictionary<string, object>(
            businessParams.Select(x => new KeyValuePair<string, object>(x.Key, x.Value)))
        {
            { "api_id",    apiId     },
            { "timestamp", timestamp },
            { "signature", signature },
        };

        using var client = new HttpClient();
        var json     = JsonSerializer.Serialize(payload);
        var content  = new StringContent(json, Encoding.UTF8, "application/json");
        var response = await client.PostAsync("https://api.isikuota.com/v1/deposit", content);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }
}

API_ID="your_api_id"
API_KEY="your_api_key"
SECRET="your_secret_key"
TIMESTAMP=$(date +%s)

CANONICAL_BODY='{"cmd":"cancel","ref_id":"DP20260818103055AB12CD"}'

BODY_HASH=$(echo -n "$CANONICAL_BODY" | sha256sum | awk '{print $1}')
STRING_TO_SIGN="${API_ID}|${API_KEY}|${TIMESTAMP}|${BODY_HASH}"
SIGNATURE=$(echo -n "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://api.isikuota.com/v1/deposit \
  -H "Content-Type: application/json" \
  -d "{
    \"api_id\":    \"$API_ID\",
    \"timestamp\": $TIMESTAMP,
    \"signature\": \"$SIGNATURE\",
    \"cmd\":       \"cancel\",
    \"ref_id\":    \"DP20260818103055AB12CD\"
  }"

Contoh Response

{
  "success": true,
  "code": "SUCCESS",
  "message": "Deposit berhasil dibatalkan",
  "data": {
    "ref_id": "DP20260818103055AB12CD",
    "status": "cancelled",
    "status_label": "Dibatalkan",
    "payment_method": "QRIS - Semua E-Wallet & Bank",
    "amount": 100000,
    "fee": 0,
    "unique_code": 8,
    "pay_amount": 100008,
    "get_amount": 100008,
    "destination_number": null,
    "destination_name": null,
    "qr_string": null,
    "payment_url": null,
    "note": null,
    "expired_at": "2026-08-19 10:30:55",
    "created_at": "2026-08-18 10:30:55"
  },
  "errors": null,
  "meta": null
}

Status Deposit

Status	Keterangan	Final?
`pending`	Menunggu pembayaran	Tidak
`success`	Deposit berhasil, saldo sudah ditambahkan	Ya
`failed`	Deposit gagal	Ya
`expired`	Batas waktu pembayaran (24 jam) terlewati	Ya
`cancelled`	Dibatalkan lewat `cmd=cancel` atau oleh admin	Ya

Hanya status pending yang bisa berubah ke status lain. Keempat status lainnya bersifat final.

Kode Error Khusus Deposit

HTTP	Code	Keterangan
201	`CREATED`	Deposit berhasil dibuat
400	`INVALID_PARAMETER`	Parameter `cmd`/`code`/`amount`/`ref_id` tidak lengkap
400	`INVALID_COMMAND`	Nilai `cmd` tidak dikenal
400	`DEPOSIT_FAILED`	Gagal membuat/membatalkan deposit (metode tidak aktif, nominal di luar batas, limit harian/jam terlampaui, dll)
409	`DEPOSIT_PENDING_EXISTS`	Masih ada deposit `pending` pada metode yang sama — `ref_id`-nya ada di `errors.ref_id`
404	`DATA_NOT_FOUND`	`ref_id` tidak ditemukan atau bukan milik akun Anda
500	`SERVER_ERROR`	Kesalahan internal server

Lihat juga daftar lengkap error codes untuk error autentikasi (INVALID_SIGNATURE, SESSION_EXPIRED, IP_NOT_ALLOWED, dll) yang berlaku untuk semua endpoint.

Batasan

Satu deposit pending per metode. Pada sebagian besar metode (termasuk transfer manual dan QRIS), Anda tidak bisa membuat deposit baru selama deposit sebelumnya pada metode yang sama masih pending dan belum kedaluwarsa. Request ditolak dengan DEPOSIT_PENDING_EXISTS (HTTP 409), apa pun nominalnya. Metode yang berbeda tidak saling membatasi, dan sebagian metode (mis. Virtual Account dari payment gateway) tidak dibatasi sama sekali.
Untuk mengganti nominal pada metode yang sama, batalkan dulu deposit lama dengan cmd=cancel, lalu buat yang baru.
Jangan batalkan deposit yang sudah Anda transfer. Pembayaran dicocokkan dengan deposit yang masih pending; jika deposit dibatalkan lalu Anda tetap mentransfer nominalnya, dana tidak otomatis menambah saldo dan harus ditindaklanjuti manual oleh admin.
Batas nominal deposit harian per akun mengikuti kebijakan platform (hubungi admin jika butuh limit lebih tinggi).
amount harus berada di antara minimal dan maximal metode yang dipilih (lihat cmd=methods).
Deposit otomatis (is_auto: true) yang tidak dibayar akan kedaluwarsa dalam 24 jam sejak dibuat.

Webhook tersedia untuk deposit

Setelah membuat deposit dengan cmd=create, Anda tidak wajib polling — status final (success/failed/expired/cancelled) dikirim otomatis ke URL webhook Anda sebagai event deposit.updated. Lihat struktur payload & contoh tiap status. Polling cmd=status tetap bisa dipakai sebagai cadangan (mis. saat pertama kali setup webhook, atau untuk audit berkala).

Rekonsiliasi nominal

Sistem dapat menambahkan biaya admin (fee) dan/atau kode unik (unique_code) pada nominal transfer agar mudah direkonsiliasi — baik untuk metode manual maupun otomatis (QRIS/VA). Selalu gunakan nilai pay_amount dari response sebagai nominal yang harus dibayar/ditransfer — bukan amount (nominal yang Anda minta, belum termasuk fee/kode unik) dan bukan pula nilai amount yang Anda kirim di request. Nilai get_amount hanya untuk referensi saldo yang akan Anda terima, bukan nominal yang harus dibayar.

Parameter Request​

1. Cek Metode Deposit — cmd: methods​

Contoh Response​

Field Response​

2. Membuat Deposit — cmd: create​

Contoh Response​

Field Response data​

3. Cek Status Deposit — cmd: status​

Contoh Response​

4. Membatalkan Deposit — cmd: cancel​

Contoh Response​

Status Deposit​

Kode Error Khusus Deposit​

Batasan​

Parameter Request

1. Cek Metode Deposit — `cmd: methods`

Contoh Response

Field Response

2. Membuat Deposit — `cmd: create`

Contoh Response

Field Response `data`

3. Cek Status Deposit — `cmd: status`

Contoh Response

4. Membatalkan Deposit — `cmd: cancel`

Contoh Response

Status Deposit

Kode Error Khusus Deposit

Batasan