API Reference
This section describes all common data objects and endpoints available in the API. Each endpoint definition includes its request parameters, response fields, data types, example values, and usage notes.
1. Auth APIs
Authenticate POS Account
Authenticates a POS account and returns access and refresh tokens for subsequent API requests.
Request
| Field | Type | Required | Description |
|---|---|---|---|
posId | string | Mandatory | Registered POS Account ID. |
password | string | Mandatory | Plain text password. |
Example
POST /auth/login
Content-Type: application/json
{
"posId": "fiuuPos1",
"password": "yourStrongPassword"
}
Response
| Field | Type | Description |
|---|---|---|
access.token | string | Bearer token used for subsequent API calls. |
access.expiresAt | string (ISO 8601) | Expiration timestamp of the access token. |
refresh.token | string | Token used to refresh the access token when expired. |
refresh.expiresAt | string (ISO 8601) | Expiration timestamp of the refresh token. |
Example
{
"access": {
"token": "eyJhbGciOiJIUzI1NiIsInR...",
"expiresAt": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
},
"refresh": {
"token": "eyJhbGciOiJIUzI1NiIsInR...",
"expiresAt": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
}
}
Refresh Access Token
Refreshes an expired access token using a valid refresh token.
Request
| Field | Type | Required | Description |
|---|---|---|---|
Bearer <refresh_token> | string | Mandatory | Previously issued refresh token. |
Example
POST /auth/refresh
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Response
| Field | Type | Description |
|---|---|---|
access.token | string | Bearer token used for subsequent API calls. |
access.expiresAt | string | Expiration time of the access token in ISO 8601 extended format with time zone offset. |
refresh.token | string | Token used to refresh the access token when expired. |
refresh.expiresAt | string (ISO 8601) | Expiration timestamp of the refresh token. |
Example
{
"access": {
"token": "eyJhbGciOiJIUzI1NiIsInR...",
"expiresAt": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
},
"refresh": {
"token": "eyJhbGciOiJIUzI1NiIsInR...",
"expiresAt": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
}
}
2. Bind Terminal APIs
Generate Terminal Binding Code
Generates a temporary binding key that can be used by a terminal to associate itself with a POS account.
Request
| Name | Type | Required | Description |
|---|---|---|---|
option | string | No | Specifies the response format. Use image to receive the response as an image. |
Example
Default request (without option)
GET /api/bind-terminal-key
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Request with option=image
GET /api/bind-terminal-key?option=image
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Response
Returns a response based on the specified request parameters.
| Scenario | Content-Type | Description |
|---|---|---|
| Default | application/json | Returns metadata for the bind terminal key |
option=image | image/png | Returns the bind terminal key as an image |
JSON Response Fields
| Field | Type | Description |
|---|---|---|
key | string | Generated code used by the terminal to bind. |
expiresAt | string (ISO 8601) | Expiration timestamp of the generated key. |
Register Terminals for Prebind
Registers a list of terminal unique IDs for prebinding with a POS account.
- A maximum of 10 terminals can be registered per request.
- Any excess entries will be ignored.
- Repeated requests will replace the existing prebind list.
Request
| Field | Type | Required | Description |
|---|---|---|---|
uniqueIds | string[] | Mandatory | List of terminal unique IDs to be prebound to the POS. |
Example
POST /api/prebind-terminals
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
{
"uniqueIds": ["terminalUniqueID1", "terminalUniqueID2", "terminalUniqueID3"]
}
Response
{
"code": 20000,
"message": "Operation completed successfully."
}
Retrieve Prebound Terminals
Retrieves the list of terminals currently registered for prebinding.
Request
GET /api/prebind-terminals
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Response
{
"data": ["terminalUniqueID1", "terminalUniqueID2", "terminalUniqueID3"]
}
3. Terminal Management API
Returns the list of terminals associated with the POS account and their connection status.
List POS Terminals
Request
GET /api/terminals
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Response
| Field | Type | Description |
|---|---|---|
terminalId | string | Unique ID of the terminal (assigned by Fiuu). |
connected | boolean | Connection status of the terminal to cloudECR. |
isVT | number | Terminal type flag: 1 = Fiuu VT+, 0 = other terminals. |
Example
{
"data": [
{
"terminalId": "terminalUniqueID1",
"connected": true,
"isVT": 1
},
{
"terminalId": "terminalUniqueID2",
"connected": false,
"isVT": 0
}
]
}
4. Channel API
List Supported Payment Channels
Returns the list of supported e-wallet channels and their availability status.
Request
GET /api/ewallet-channels?currency=MYR
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
Response
| Field | Type | Description |
|---|---|---|
name | string | Name of the channel. |
status | string | Channel status: 0 = inactive, 1 = active. |
currency | string[] | List of currencies supported by the channel. |
logoUrl3 | string | URL of the channel’s logo. |
Example
{
"data": [
{
"name": "channel1",
"status": 1,
"currency": ["MYR", "SGD"],
"logoUrl3": "https://sample-logo.url"
},
{
"name": "channel2",
"status": 0,
"currency": ["MYR", "USD", "SGD", "IDR", "PHP"],
"logoUrl3": "https://sample-logo.url"
}
]
}
5. Transfer API
Defines transaction request and response formats for payment operations, including sale, cash out, and void transactions.
Initiate Transfer Request
Initiates a transaction request from the POS to the terminal or payment channel.
| Parameter | Description | Type | Required | Remarks |
|---|---|---|---|---|
TransType | Transaction Type | String(32) | Mandatory | Transaction identifier. E.g.: sale |
posId | POS ID | String(24) | Mandatory | POS ID given by Fiuu |
merchantId | Merchant ID | String(100) | Mandatory | Unique merchant ID assigned by Fiuu |
deviceId | Device Identifier | String(100) | Mandatory | Single POS may have multiple Devices (uniqueId) |
referenceId | Reference ID | String(20) | Mandatory | Unique identifier per transaction, generated by POS. Used to match requests and responses. |
referenceLabel | Label to be printed on receipt | String(10) | Optional | If not provided, Terminal/Fiuu VT+ will print "POS Ref" as a default label |
transData | Transaction Data | JSONObject | Conditional | JSON object with details specific to each transaction type. Not required for some transTypes. |
apiVersion | API Version | String(3) | Mandatory | Version of cloudECR API starts with prefix "v" followed by the version number |
datetime | Time stamp | String (ISO 8601) | Mandatory | Should be in UTC, formatted as YYYYMMDDTHHMMSS for accurate event tracking. |
signature | Signature | String(64) | Mandatory | Digital signature for authenticating the request. Must be computed based on included fields. |
Common Transfer Parameters
Describes commonly used parameters and enumerations for transfer requests.
transType
Defines the type of transaction.
- sale – Standard purchase.
- cashOut – Purchase with cash out (only for MyDebit channel).
- void – Cancel a specific transaction.
- walletInquiry – Check wallet transaction when status is pending.
- getLast – Retrieve the last transaction result from Terminal/Fiuu VT+.
paymentMethod
Specifies the payment method used.
- qrCustScan – Merchant-presented QR.
- qrMerchScan – Customer-presented QR.
- bankCard – Credit, debit, or prepaid card.
paymentChannel
- Required only when using the
qrCustScanpayment method. - Use
GET /api/ewallet-channels?currency={CUR}to retrieve the list of available e-wallet channels.
entryMode
Indicates how the card data is entered.
- contact – Card inserted.
- contactless – Card tapped.
- manual – Card details entered manually.
- fallback – Alternative entry mode (used when primary method fails).
cvmType
Represents the Cardholder Verification Method (CVM).
- 00 – No CVM – No PIN or signature required.
- 01 – Signature – Signature required.
- 02 – Online PIN – PIN verified online.
- 03 – Offline PIN – PIN verified offline.
- 04 – CDCVM – Consumer Device CVM (no PIN or signature required).
printCount
Controls receipt printing behavior.
- 0 – No receipt.
- 1 – Merchant copy only.
- 2 – Merchant and customer copies.
statusCode
Possible transaction response codes.
- 00 – Success.
- 11 – Failure.
- 22 – Pending.
transData for Sale or CashOut
| Key | Description | Type | Required | Channel | Remarks |
|---|---|---|---|---|---|
transAmt | Transaction Amount | String(12) | Mandatory | All | Transaction Amount. Positive number. Always 2 decimal places with "." As a decimal point. 1.11 means 1 dollar and 11 cents |
cashAmt | Cash Out Amount | String(12) | Conditional | Bank Card | Only for CashOut. Same format as transAmt |
paymentMethod | Payment Method | String(32) | Mandatory | All | Bank Card or QR |
paymentChannel | Payment Channel | String(32) | Conditional | eWallet | Required for eWallet (merchant presented) transactions |
productIndex | Product Index | String(2) | Optional | All | For POS to categorized payment per product, up to 10 |
promoSale | Sale Promotion | String(2) | Optional | Bank Card | If card BIN is not under promo, transaction will be declined |
note | Print Note | String(128) | Optional | All | It will be printed on terminal receipt remarks area |
printCount | Number of prints | Number(1) | Optional | All | Number of receipts to be printed. If not given, default is 2 (Merchant and Customer copy) |
metadata | Custom field | String(128) | Optional | All | Use to store additional information relevant to the transaction. |
Example
- bankCard
- qrCustScan
- qrMerchScan
POST /api/transfer
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
{
"transType": "sale",
"posId": "fiuuPos1",
"merchantId": "fiuuMerch1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId1",
"referenceLabel": "Contrib ID",
"apiVersion": "v1",
"datetime": "20250115081928",
"transData": {
"transAmt": "1.00",
"paymentMethod": "bankCard",
"note": "This is a test note"
},
"signature": "1e64016959808ee62cd5f13f379314d15c0d06a776bda76d6bf2d4222d607eb2"
}
POST /api/transfer
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
{
"transType": "sale",
"posId": "fiuuPos1",
"merchantId": "fiuuMerch1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId2",
"referenceLabel": "Contrib ID",
"apiVersion": "v1",
"datetime": "20250115082437",
"transData": {
"transAmt": "1.00",
"paymentMethod": "qrCustScan",
"note": "This is a test note",
"paymentChannel": "tng"
},
"signature": "c588e84b159464d039539f9472b43942df9fd4fa73734afa04eb9b6f112a56c4"
}
POST /api/transfer
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
{
"transType": "sale",
"posId": "fiuuPos1",
"merchantId": "fiuuMerch1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId3",
"referenceLabel": "Contrib ID",
"apiVersion": "v1",
"datetime": "20250115082513",
"transData": {
"transAmt": "1.00",
"paymentMethod": "qrMerchScan",
"note": "This is a test note"
},
"signature": "ace15359c7ec896dfda03198121c47fa3d9ec926c1c79bc545e3c8be47d5d185"
}
transData for Void
| Key | Description | Type | Required | Channel | Remarks |
|---|---|---|---|---|---|
transId | Transaction ID | Number(10) | Mandatory | All | Unique identifier given by Fiuu for transaction reference purpose |
invNo | Terminal Running Numbers | String(32) | Optional | All | Main Reference is the transId |
productIndex | Product Index | String(2) | Optional | All | For POS to categorized payment per product, up to 10 |
promoSale | Sale Promotion | String(2) | Optional | Bank Card | If card BIN is not under promo, transaction will be declined |
printCount | Number of prints | Number(1) | Optional | All | Number of receipts to be printed. If not given, default is 2 (Merchant and Customer copy) |
metadata | Custom field | String(128) | Optional | All | Use to store additional information relevant to the transaction. |
Example
- bankCard
- eWallet
{
"transType": "void",
"posId": "fiuuPos1",
"merchantId": "fiuuMerch1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId1",
"referenceLabel": "Contrib ID",
"apiVersion": "v1",
"datetime": "20250115084536",
"transData": {
"transId": "1516809",
"invNo": "000001"
},
"signature": "3f1e0814fb7861739ee12ce114ebfa906cc3c76bf9e141c7ca1316b61a93c142"
}
{
"transType": "void",
"posId": "fiuuPos1",
"merchantId": "fiuuMerch1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId2",
"referenceLabel": "Contrib ID",
"apiVersion": "v1",
"datetime": "20250115084640",
"transData": {
"transId": "1516810",
"invNo": "000002"
},
"signature": "77ca6fff85096757883c507a905ecfa24e2f6a0e209a723faeae1e34bf6e61cc "
}
Transfer Response
Returns the final result of a transaction request, including status, channel response, and transaction details.
| Parameter | Description | Type | Required | Remarks |
|---|---|---|---|---|
transType | Transaction Type | String(32) | Mandatory | Transaction identifier. E.g.: sale |
posId | POS Account ID | String(24) | Mandatory | POS Account ID given by Fiuu |
deviceId | Device Identifier | String(100) | Mandatory | Single POS may have multiple Devices (uniqueId) |
referenceId | Reference ID | String(20) | Mandatory | Identical to request |
statusCode | Transaction request status | String(2) | Mandatory | 00 = Success, 11 = Failure, 22 = Pending |
responseCode | Channel Response Code | String(32) | Mandatory | Indicating the result of the transaction returned by the Channel. If statusCode is not Success (11 or 22), may refer here for exact code. |
responseText | Text to Display on POS | String(128) | Optional | Message to display on the POS screen, especially in case of errors, to help users understand the issue. |
softwareVersion | Software Version | String(40) | Mandatory | Version of the terminal or Fiuu VT+ software. |
terminalSn | Serial Number | String(40) | Mandatory | Terminal/Fiuu VT+ Serial Number |
transData | Transaction Data | JSONObject | Conditional | Contains additional data based on the transaction type. Not required for every response type. |
apiVersion | API Version | String(3) | Mandatory | Version of cloudECR API starts with prefix "v" followed by the version number. |
signature | Signature | String(64) | Mandatory | Digital signature for validating the response’s integrity. Generated based on response parameters. |
transData for Sale or CashOut
| Key | Description | Type | Required | Channel | Remarks |
|---|---|---|---|---|---|
transId | Transaction ID | Number(10) | Mandatory | All | Unique identifier given by Fiuu for transaction reference purpose |
paymentChannel | Payment Method | String(32) | Mandatory | All | visa, mastercard, upi, tng, etc. |
transAmt | Transaction Amount | String(12) | Mandatory | All | Transaction Amount. 1.11 means 1 dollar and 11 cents |
cashAmt | Cash Out Amount | String(12) | Conditional | Bank Card | Only for CashOut. Same format as transAmt |
transDateTime | Transaction completion time | datetime | Mandatory | All | yyyy-MM-ddTHH:mm:ss |
currency | Transaction Currency | String (10) | Mandatory | All | MYR, SGD, PHP |
cardNo | Card Number | String(32) | Conditional | Bank Card | Masked Card PAN (Mask with ‘x’ just show last 4 digits). Eg: 554433xxxxxx1234 |
invNo | Terminal Running Numbers | String(32) | Mandatory | All | Running numbers generated by terminal |
batchNo | Batch Number | String(32) | Optional | All | Batch Number |
tid | Terminal ID | String(32) | Mandatory | All | Terminal ID |
mid | Merchant ID | String(32) | Mandatory | All | Merchant ID |
entryMode | Entry Mode | String(32) | Conditional | Bank Card | Chip, Contactless, Magstripe, Fallback |
rrn | Retrieval Reference Number | String(32) | Conditional | Bank Card | Retrieval Reference Number |
apprCode | Authentication Number | String(32) | Conditional | Bank Card | Authentication Number |
tvr | Terminal Verification Result | String(32) | Conditional | Bank Card | EMV Terminal Verification Result |
appCrypt | Application Cryptogram | String(32) | Conditional | Bank Card | EMV Application Cryptogram |
aid | Application ID | String(32) | Conditional | Bank Card | EMV Application ID |
cvmType | CVM Type | String(2) | Conditional | Bank Card | CVM Type |
cardLabel | Card Label | String(32) | Conditional | Bank Card | Card Label |
cardHoldersName | Card Holders Name | String(32) | Optional | Bank Card | Card Holders Name |
metadata | Custom field | String(128) | Optional | All | Use to return additional information relevant to the transaction. |
Example
- bankCard
- qrCustScan
- qrMerchScan
{
"transType": "sale",
"posId": "fiuuPos1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId1",
"apiVersion": "v1",
"statusCode": "00",
"responseCode": "00",
"responseText": "Approved",
"terminalSn": "dd8455778fa848f4",
"softwareVersion": "Version 3.4.17",
"transData": {
"transId": "1516809",
"paymentChannel": "mastercard",
"transAmt": "1.00",
"transDateTime": "2025-01-15T16:20:22",
"currency": "MYR",
"cardNo": "************7364",
"invNo": "000001",
"tid": "91100033",
"mid": "603778000000001",
"entryMode": "contactless",
"rrn": "000003211036",
"apprCode": "F99136",
"tvr": "0000008001",
"appCrypt": "d52e865f3f79d1d0",
"aid": "A0000000041010",
"cvmType": "00",
"cardLabel": "Mastercard"
},
"signature": " cbf3a71dbced277381850ef9ca1eba46ed45a98d4e5e0ba54da6423e55f187ee"
}
{
"transType": "sale",
"posId": "fiuuPos1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId2",
"apiVersion": "v1",
"responseCode": "00",
"responseText": "Successfully paid with eWallet",
"terminalSn": "19775085fcfce35f",
"softwareVersion": "Version 3.4.17",
"transData": {
"paymentChannel": "tng",
"transAmt": "1.00",
"transDateTime": "2025-01-15T16:24:42",
"transId": "1516810",
"invNo": "000002",
"batchNo": "",
"tid": "91100033",
"mid": "603778000000001",
"currency": "MYR"
},
"statusCode": "00",
"signature": "98abecc5fba5cbeb0d819773aa7e7ae19f7d87d82dd83b65e5547784a859fe31"
}
{
"transType": "sale",
"posId": "fiuuPos1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId3",
"apiVersion": "v1",
"responseCode": "00",
"responseText": "Successfully paid with eWallet",
"terminalSn": "dd8455778fa848f4",
"softwareVersion": "Version 3.4.17",
"transData": {
"paymentChannel": "duitNowQr",
"transAmt": "1.00",
"transDateTime": "2025-01-15T16:25:48",
"transId": "1516811",
"invNo": "000003",
"batchNo": "",
"tid": "91100033",
"mid": "603778000000001",
"currency": "MYR"
},
"statusCode": "00",
"signature": "d560d1b4f2a186ed8f2d30ea59420c4548c493797366664e9334a47ea2939704"
}
transData for Void
| Key | Description | Type | Required | Channel | Remarks |
|---|---|---|---|---|---|
transId | Transaction ID | Number(10) | Mandatory | All | Unique identifier given by Fiuu for transaction reference purpose |
paymentChannel | Payment Method | String(32) | Mandatory | All | visa, mastercard, upi, tng, etc. |
transAmt | Transaction Amount | String(12) | Mandatory | All | Transaction Amount. 1.11 means 1 dollar and 11 cents |
cashAmt | Cash Out Amount | String(12) | Conditional | Bank Card | Only for CashOut. Same format as transAmt |
transDateTime | Transaction completion time | datetime | Mandatory | All | yyyy-MM-ddTHH:mm:ss |
currency | Transaction Currency | String (10) | Mandatory | All | MYR, SGD, PHP |
cardNo | Card Number | String(32) | Conditional | Bank Card | Masked Card PAN (Mask with ‘x’ just show last 4 digits). Eg: 554433xxxxxx1234 |
invNo | Terminal Running Numbers | String(32) | Mandatory | All | Running numbers generated by terminal |
batchNo | Batch Number | String(32) | Optional | All | Batch Number |
tid | Terminal ID | String(32) | Mandatory | All | Terminal ID |
mid | Merchant ID | String(32) | Mandatory | All | Merchant ID |
entryMode | Entry Mode | String(32) | Conditional | Bank Card | Chip, Contactless, Magstripe, Fallback |
rrn | Retrieval Reference Number | String(32) | Conditional | Bank Card | Retrieval Reference Number |
apprCode | Authentication Number | String(32) | Conditional | Bank Card | Authentication Number |
tvr | Terminal Verification Result | String(32) | Conditional | Bank Card | EMV Terminal Verification Result |
appCrypt | Application Cryptogram | String(32) | Conditional | Bank Card | EMV Application Cryptogram |
aid | Application ID | String(32) | Conditional | Bank Card | EMV Application ID |
cvmType | CVM Type | String(2) | Conditional | Bank Card | CVM Type |
cardLabel | Card Label | String(32) | Conditional | Bank Card | Card Label |
cardHoldersName | Card Holders Name | String(32) | Optional | Bank Card | Card Holders Name |
metadata | Custom field | String(128) | Optional | All | Use to return additional information relevant to the transaction. |
Example
- bankCard
- eWallet
{
"transType": "void",
"posId": "fiuuPos1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId1",
"apiVersion": "v1",
"responseCode": "00",
"responseText": "Successfully void payment",
"terminalSn": "dd8455778fa848f4",
"softwareVersion": "Version 3.4.17",
"transData": {
"cardNo": "************7364",
"entryMode": "contactless",
"rrn": "000076822649",
"apprCode": "563108",
"tvr": "8000008000",
"appCrypt": "02636923643fc3b2",
"aid": "A0000000041010",
"cvmType": "00",
"cardLabel": "Mastercard",
"paymentChannel": "mastercard",
"transAmt": "1.00",
"transDateTime": "2025-01-15T16:45:22",
"transId": "1516809",
"invNo": "000001",
"batchNo": "",
"tid": "91100033",
"mid": "603778000000001",
"currency": "MYR"
},
"statusCode": "00",
"signature": "8b06515656c8bdc0c466d16c4fa3dbe6af8c402db1ac6b064579843734c11ac8"
}
{
"transType": "void",
"posId": "fiuuPos1",
"deviceId": "fiuuDeviceId1",
"referenceId": "fiuuPosRefId2",
"apiVersion": "v1",
"responseCode": "00",
"responseText": "Successfully void payment",
"terminalSn": "529f7632fb1d5a3b",
"softwareVersion": "Version 3.4.17",
"transData": {
"paymentChannel": "tng",
"transAmt": "1.00",
"transDateTime": "2025-01-15T16:46:13",
"transId": "1516810",
"invNo": "000002",
"batchNo": "",
"tid": "91100033",
"mid": "603778000000001",
"currency": "MYR"
},
"statusCode": "00",
"signature": " b7f91ce5c32990125db5bbf60f2bb1128ab92782c23c9a6d90892763c4c36857"
}