AgentPay REST API
Issue capped cards, run checkouts, keep merchant logins and fund the wallet. Resource-oriented URLs, JSON in and out, standard HTTP verbs and status codes.
| Base URL | https://api.joomjoo.com |
| Version | Every endpoint is under /v1. |
| Auth | Authorization: Bearer mk_live_... on every request. See authentication. |
| Content type | application/json for every request body. |
| Amounts | US dollars as plain numbers: "amount": 20 is $20.00. Card and wallet math is exact to the cent internally. |
| Request ids | Every response carries X-Mooj-Request-Id, echoed as request_id in the body. |
The host still carries the company's older name. api.joomjoo.com is the AgentPay API, and the older Cloud Run address keeps answering for integrations written before the rename.
Endpoints
- Create a card: mint a Visa or Mastercard virtual card capped at an amount.
- Reveal a card: the full number, security code and expiry, once.
- Close a card: release the unused reserve.
- List cards: connected and issued cards on the account.
- Connect the person's own card: a one-hour link for the cardholder.
- Remove a connected card.
- Get spend status: was an issued card charged.
- Start a checkout: hand AgentPay the whole purchase.
- Get checkout status: poll a run until it ends.
- Create a connection, complete, list, get, skip the passkey password, disconnect.
- Read the wallet, top up by card or stablecoin, top up by bank transfer.
- Webhook events and signature verification.
- Errors.
Idempotency
POST /v1/checkout and POST /v1/wallet/bank-transfers take an idempotency_key, your own reference for the operation. A retry with the same key returns the same checkout or declaration instead of creating a second one. Always send one on a checkout.
Lookups never leak
A card, spend, checkout or connection that belongs to another account answers 404 with the same body as one that does not exist.
No test mode
Every call is live. A card you create is real and reserves its cap; a checkout you start buys. Use a small cap to try things, and close cards you do not use.