Introduction

This document describes the API methods that Merchant uses to interact with the Momo.

Interaction happens over HTTPS using POST requests.
Each method accepts a single request stream and returns a single response stream.
Once decrypted, request and response streams are JSON formatted.

Momo needs to provide Partner with:

Base URL of the endpoints that Momo will hit
SSL Certificate
PGP public key for Merchant to encrypt the message body
Partner-code
Password (using in some module)

Merchants needs to provide the following data to Momo:

PGP public key for Momo to encrypt the message body
Server IP to add whitelist (in production environment)

Method

All APIs exposed are RESTful API’s with request and response payloads formatted as JSON.

Name	value
Content-Type	application/pgp-encrypted
Accept	application/pgp-encrypted
partner-code	Momo will provide when integrate

Payload

Common Request Parameters

Name	Type	Explanation
requestId	string	Unique identifier on Momo's side to track each request.

Common Response Parameters

Name	Type	Explanation
requestId	string	Unique identifier for the request generated by Momo. Should match the request_id from the request. For example: req_12345.
referenceId	string	Unique identifier for the request on the Provider's side. For example: ref_12345.
responseCode	int	response_code tells the status of the request
responseMessage	string	response_message returns a human readable string to identify the issue. Momo would only use response_code to distinguish whether this request succeeded or not

HTTP Status Codes and Response Code

HTTP Status Codes

Status Code	Description
200	Success
400	Malformed request
401	Unauthorized
404	Not found
500	Server error

Common Response Code

Response_code	Sample Response_message	Description
0	Success	No error
2	Decryption Fail	Cannot decrypt the request
4	Invalid wallet Id
8	Duplicate request Id
9	Invalid partner code	Fail
10	Unknown result	Check by hand, or call check status to get the final result
11	Other error	Fail

Encryption

All requests from partner will be encrypted by the Momo's public key and signed with merchant's private key.
All requests from Momo will be encrypted by the partner's public key and signed with Momo's private key.
All encrypted messages must be in ASCII-armored format.

Sample public key:

After both parties exchange the public keys, we will use a special API to test the encryption.

Our test API for encryption is simple. Our raw JSON object would contain fields input1 and input2. We would encrypt the data with the Momo's public key and sign by partner's privateKey (in case Host by Momo). Please use your private key to decrypt it and public key to verifysignature. Then concatenate two strings, encrypt the data with Momo's public key and send it back as response.

Sample request and response (in clear text mode)

// request:
POST /testing/encryption 
// request: 
BODY 
-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v2.0.22 (GNU/Linux)\n\nhQE.../UDg==\n=NEQS\n-----END PGP MESSAGE-----

this message decrypts to 
{  
    "input1": "Mo",  
    "input2": "mo"  
}  
// response: 
BODY 
-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v2.0.22 (GNU/Linux)\n\AaFE...GXg==\n=OX5S\n-----END PGP MESSAGE-----  
this message decrypts to 
{  
    "output":"Momo"  
}

Sample Codes

Java: click here
.Net: click here
Php: click here
NodeJs: click here