Cryptss Pay API Documentation

Everything your code needs to send invoices, hold escrow, cash out and let an AI agent pay on your behalf.

Base URL https://cryptss.com

01Overview

Cryptss Pay exposes a REST API over HTTPS. Requests and responses use JSON (UTF-8). No SDK required — any HTTP client works.

Authentication

Most endpoints require a logged-in session. Authentication is cookie-based: call POST /api/auth/signin (or /api/auth/demo) and the session cookie is set automatically. Public endpoints (pay links, tracking) need no session.

Roles

RoleDescriptionDemo account
userMerchant / freelancer / SMBdemo@cryptss.com · demo1234
clientPayer on the client portalclient@acme.com · demo1234
adminPlatform operator consoleadmin@cryptss.com · demo1234
Demo mode. Payments generate realistic transaction hashes and move demo balances — no real chain or bank is touched until live rails are connected.

02Auth & sessions

Create accounts, sign in, and manage the session.

POST/api/auth/signuppublic

Create a merchant account. Creates a default USDC wallet automatically.

FieldTypeRequiredNotes
emailstringyesUnique
namestringyesYour name or business
businessstringnoBusiness name
passwordstringyesMin 8 characters
// 201 Created
{ "ok": true, "user": { "id": 5, "email": "me@studio.com", "name": "Me", "role": "user" } }
POST/api/auth/signinpublic

Sign in with email + password. Sets the session cookie.

FieldTypeRequired
emailstringyes
passwordstringyes
// 200 OK
{ "ok": true, "user": { "id": 1, "email": "demo@cryptss.com", "name": "Layla Haddad", "role": "user" } }
POST/api/auth/demopublic

One-click demo login. Used by the sign-in page.

FieldTypeValues
rolestringuser · client · admin
GET/api/auth/meauth

Current session user. 401 when logged out.

POST/api/auth/logoutauth

Destroys the session.

POST/api/auth/forgotpublic

Always returns success (no account enumeration).

03Invoices

Create, list, filter, cancel and remind invoices. Invoice numbers are auto-incremented (INV-2044, INV-2045 …).

GET/api/invoicesauth

List invoices for the signed-in user.

QueryTypeNotes
statusstringsent · paid · escrow · overdue · cancelled · draft
qstringSearch number / client / amount
// 200 OK
{ "invoices": [ { "id": 1, "number": "INV-2041", "token": "aZ…x", "client_name": "Acme Co.",
  "client_email": "client@acme.com", "amount": "2350.00", "asset": "USDC",
  "status": "escrow", "escrow": 1, "due_date": "2026-08-17", "memo": "Brand system",
  "created_at": "…", "paid_at": "…", "pay_url": "https://cryptss.com/app#/pay/aZ…x",
  "track_url": "https://cryptss.com/app#/track/aZ…x" } ] }
POST/api/invoices/createauth

Create an invoice.

FieldTypeRequiredNotes
client_namestringyesClient or company name
client_emailstringnoAuto-linked to existing clients
amountnumberyes> 0, max 100,000,000
assetstringnoUSDC (default) · USDT · DAI
due_datestringnoYYYY-MM-DD
escrowboolnoHold funds in escrow until approved
memostringnoDescription / line item
// 201 Created
{ "ok": true, "invoice": { "number": "INV-2044", "token": "…", "status": "sent", … } }
POST/api/invoices/cancelauth

Cancel a payable invoice. 409 if already paid/escrowed.

FieldTypeRequired
idintyes
POST/api/invoices/remindauth

Logs a "reminder sent" notification for an overdue invoice.

FieldTypeRequired
idintyes

05Payments

GET/api/paymentsauth

Settled and pending payments, newest first. Optional ?q= search.

// 200 OK
{ "payments": [ { "id": 1, "invoice_id": 1, "payer": "Acme Co.", "amount": "2350.00",
  "asset": "USDC", "tx_hash": "0x…", "method": "wallet", "status": "settled", "created_at": "…" } ] }

06Escrow

Funds from escrow invoices are held until the merchant releases them or a dispute is resolved.

GET/api/escrowauth

List escrows (held · released · disputed).

POST/api/escrow/releaseauth

Release a held escrow to the merchant wallet. 409 if not held.

FieldTypeRequired
idintyes
POST/api/escrow/disputeauth

Open a dispute on a held escrow.

FieldTypeRequired
idintyes
reasonstringno

07Wallet

GET/api/walletauth

Stablecoin balances across chains.

// 200 OK
{ "wallets": [ { "chain": "base", "asset": "USDC", "address": "0x…", "balance": "8420.00" }, … ] }
POST/api/wallet/topupauth

Add demo funds to a wallet.

FieldTypeRequiredNotes
chainstringyesbase · polygon · arbitrum
amountnumberyes> 0

08Cash out

GET/api/cashoutauth

Cash-out history + KYC status.

POST/api/cashout/requestauth
FieldTypeRequiredNotes
amountnumberyesMust be ≤ wallet balance
fiatstringnoBHD (default) · AED · SAR
bank_refstringnoe.g. NBB ····4471

422 insufficient_balance / 422 kyc_required.

POST/api/cashout/kycauth

Demo KYC — approves instantly.

09Virtual card

GET/api/cardauth

Card details (last4, frozen), monthly spend vs limit, recent spends.

POST/api/card/spendauth

Purchase with the card — debits the largest wallet.

FieldTypeRequired
merchantstringyes
amountnumberyes

403 card_frozen · 422 over_card_limit · 422 insufficient_balance.

POST/api/card/freezeauth

Toggles frozen state. Returns { "ok": true, "frozen": bool }.

10Recurring billing

GET/api/recurringauth

Recurring schedules (retainers / subscriptions).

POST/api/recurring/createauth
FieldTypeRequiredNotes
client_namestringyes
amountnumberyes
assetstringnoUSDC default
intervalstringnoweekly · monthly · quarterly
next_datestringnoYYYY-MM-DD
POST/api/recurring/toggleauth

Pause / resume. Body: { id }.

POST/api/recurring/deleteauth

Delete. Body: { id }.

11Clients

GET/api/clientsauth

Clients with per-client billed totals.

POST/api/clients/createauth

Body: { name, email?, company?, allowlist? }.

POST/api/clients/toggle_allowlistauth

Add/remove a client from the agent allowlist. Body: { id }.

12x402 AI agent payments

The agent receives a machine-readable payment request and decides autonomously: settle (within policy), deny (vendor not allowlisted or over cap), or pause (over the human approval threshold).

GET/api/agent/policyauth

Current policy + month spent.

// 200 OK
{ "policy": { "agent_name": "Acme Procurement Bot", "per_payment_cap": "1000",
  "monthly_limit": "10000", "approval_threshold": "500", "allowlist_only": 1,
  "wallet_address": "0x…" }, "month_spent": 300 }
POST/api/agent/policyauth

Update policy. Any subset of: agent_name, per_payment_cap, monthly_limit, approval_threshold, allowlist_only.

POST/api/agent/payauth

Ask the agent to pay. Use an existing invoice token, or vendor + amount.

FieldTypeNotes
invoice_tokenstringPay a specific invoice
vendorstring… or synthesize an invoice for this vendor
amountnumberRequired with vendor
// Decision responses
{ "decision": "settled", "tx_hash": "0x…", "invoice": "INV-2046" }
{ "decision": "denied",  "reason": "vendor_not_allowlisted" | "over_per_payment_cap" | "over_monthly_limit", … }
{ "decision": "paused",  "reason": "over_approval_threshold", "approval_id": 12, "invoice": "INV-2047" }
POST/api/agent/approveauth

Human approves a paused payment. Body: { activity_id }. Settles the invoice.

POST/api/agent/denyauth

Human denies a paused payment. Body: { activity_id }.

GET/api/agent/activityauth

Agent decision log: request · check · settle · pause · approve · deny.

13AI copilot

POST/api/ai/chatauth

Ask the copilot anything — it answers from your live account data (balances, invoices, overdue items, cash-out timing).

FieldTypeRequired
messagestringyes
// 200 OK
{ "reply": "Your wallets hold $11,512.50 in total across Base, Polygon and Arbitrum…" }
Engine: optional NVIDIA nemotron-3-ultra-550b via NVIDIA_API_KEY; without a key a grounded local copilot answers from the live database.

14Analytics & tax

GET/api/analytics/monthlyauth

Last 12 months of settled volume.

GET/api/analytics/clientsauth

Top clients by settled volume.

GET/api/analytics/statusauth

Invoice status distribution.

GET/api/taxauth

Quarterly settled totals + platform fees for the year. Optional ?year=.

// 200 OK
{ "year": 2026, "years": ["2026","2025"], "quarters": [ { "quarter": "Q1", "total": 6080, "fees": 60.8, "n": 2 }, … ],
  "total": 20010, "fees": 200.1 }
GET/api/tax?action=exportauth

Full-year CSV download of settled payments with fees.

15Notifications

GET/api/notificationsauth

Latest 30 notifications + unread count.

// 200 OK
{ "notifications": [ { "id": 1, "title": "Payment received", "body": "INV-2039 · Acme Co. paid 3,200.00 USDC",
  "kind": "payment", "read": 0, "created_at": "…" } ], "unread": 3 }
POST/api/notifications/readauth

Mark one ({ id }) or all (empty body) as read.

16Client portal

For client-role users — the payer's view of their bills.

GET/api/client-portal/dashboardauth

Due totals, escrow held, paid totals, wallets.

GET/api/client-portal/billsauth

Invoices sent to this client.

POST/api/client-portal/payauth

Pay a bill from the client wallet.

FieldTypeRequiredNotes
invoice_idintyes
methodstringnowallet · card

422 insufficient_balance if the client wallet can't cover it.

GET/api/client-portal/historyauth

Payment history with tx hashes.

GET/api/client-portal/methodsauth

Saved payment methods.

17Admin console

Requires the admin role. All other roles get 403.

GET/api/admin/metricsadmin

Platform-wide numbers.

// 200 OK
{ "users": 3, "merchants": 1, "volume": 26960, "payments_n": 13, "fees": 269.6,
  "escrow_held": 2350, "disputes_open": 0, "cashouts_pending": 2, "agent_volume": 300 }
GET/api/admin/merchantsadmin

Merchants with volume + invoice counts.

GET/api/admin/disputesadmin

Open disputes.

POST/api/admin/resolve_disputeadmin

Body: { id, outcome: "release" | "refund" }.

GET/api/admin/kycadmin

Pending cash-outs / KYC queue.

POST/api/admin/kyc_decisionadmin

Body: { id, decision: "approved" | "rejected" }.

GET/api/admin/providersadmin

Provider health with live latency probes.

18API keys (developers)

GET/api/dev/keysauth

Key list — prefixes only. Full keys are shown once at creation.

POST/api/dev/keysauth

Create a key. Body: { label? }.

// 201 Created — full key returned ONCE
{ "ok": true, "id": 3, "key": "ck_live_…" }
POST/api/dev/revokeauth

Revoke a key. Body: { id }.

19Errors & status codes

Errors always return JSON: { "error": "machine_readable_code" }, plus optional detail fields.

CodeMeaning
200 / 201OK / Created
401Not authenticated (unauthorized, session_expired)
403Role gate (admin_only) or card_frozen
404Unknown endpoint, invoice, escrow, token
409State conflict (cannot_cancel, not_held, invoice_not_payable)
410invoice_cancelled
422Validation (invalid_amount, client_required, insufficient_balance, over_card_limit, …)
429Rate limited
500Server error
Security. Never store full API keys client-side. The ck_live_ prefix is shown, the full key is hashed (sha256) in the database.