Every endpoint at a glance, grouped by area, with the capability each one needs.
All paths are relative to https://api.oropocket.com. Unless noted, every call carries a bearer token — see Authentication. The tag in parentheses is the capability your token needs; calling an endpoint you aren't enabled for returns 403 API_NOT_ALLOWED. Check your current grants with GET /partner/dashboard/me.
Auth
Endpoint
What it does
POST /partner/auth/request-otp
Start API-token issuance — sends an OTP to your registered mobile. No token required. Rate limited to 5 per 15 minutes per (IP, mobile).
POST /partner/auth/verify-otp
Exchange the OTP for a bearer token. Shown once, never again — issuing a new token in the same mode invalidates the previous one. See Authentication.
Pricing
Endpoint
What it does
GET /partner/prices
Live buy and sell rates for every supported asset. (pricing)
GET /partner/prices/:asset
Rate for a single asset — "gold" or "silver". (pricing)
Users
Endpoint
What it does
POST /partner/users/init
Create or resolve an end user. Returns a single-use user_code plus an embed_url for the hosted embed, or a persistent code for the raw API. (users or embed)
GET /partner/users
List your users. Add ?include=balances for a per-user snapshot. (users)
GET /partner/users/:user_code
A single user's profile and status. (users)
GET /partner/users/:user_code/portfolio
Holdings and valuation for one user — scoped to your sub-wallet claim. (balance)
GET /partner/users/:user_code/transactions
That user's transaction history. (transactions)
Trading
Endpoint
What it does
POST /partner/buy/quote
Lock a buy price for 10 minutes. Also where your wallet is checked — an unaffordable buy fails here with 402, not at confirm. (buy)
POST /partner/buy/confirm
Execute the quote. Debits your wallet, credits the user. Accepts Idempotency-Key. (buy)
POST /partner/sell/quote
Lock a sell price for 10 minutes. (sell)
POST /partner/sell/confirm
Execute the sell. Proceeds land in the end user's INR balance, not your wallet. Accepts Idempotency-Key. (sell)
GET /partner/trades
Your buy and sell history across all users. (transactions)
Send & gift
Endpoint
What it does
GET /partner/receiver/check
Check whether a mobile number can receive assets before you quote. (receiver)
POST /partner/send/quote
Quote a send from your own holdings to a mobile number. See Sending assets. (send)
POST /partner/send/confirm
Execute the send. Accepts Idempotency-Key. (send)
GET /partner/transactions
Your send/gift transaction history. (transactions)
GET /partner/transactions/:id
One transaction in full. (transactions)
GET /partner/balance
Your own asset and INR holdings — the pool that sends draw from. (balance)
Resend the sender's confirmation OTP for a pending gift quote. (gift)
POST /partner/users/:user_code/gift/confirm
Confirm the gift with the OTP. Accepts Idempotency-Key. (gift)
Embed
These three are called by the hosted SPA, not by your server. They take no bearer token — the single-use user_code you issued is itself the auth artifact, which is why it expires in 10 minutes and can only be exchanged once.
Endpoint
What it does
POST /partner/embed/exchange
Trade a user_code for a session, or for an OTP challenge when one is needed. See Hosted embed.
POST /partner/embed/verify-otp
Complete the OTP challenge and open the session. Sandbox OTP is always 1234.
POST /partner/embed/resend-otp
Resend the embed OTP.
KYC
All of these need the kyc capability. Full walkthrough in KYC.
Endpoint
What it does
GET /partner/users/:user_code/kyc/status
Current KYC state and which steps remain. Start here.
POST /partner/users/:user_code/kyc/email/send
Send the email verification code.
POST /partner/users/:user_code/kyc/email/verify
Verify the emailed code. Sandbox code is 123456.
POST /partner/users/:user_code/kyc/pan/verify
Verify PAN and date of birth.
POST /partner/users/:user_code/kyc/aadhaar/otp/send
Trigger the Aadhaar OTP.
POST /partner/users/:user_code/kyc/aadhaar/otp/verify
Verify the Aadhaar OTP. Completes instant KYC.
POST /partner/users/:user_code/kyc/details
Manual-KYC fallback: submit personal details.
POST /partner/users/:user_code/kyc/documents
Manual-KYC fallback: submit document URLs.
Bank & withdrawals
Endpoint
What it does
GET /partner/users/:user_code/bank-accounts
List a user's payout destinations. Account numbers are always masked. See Bank accounts & withdrawals. (bank)
POST /partner/users/:user_code/bank-accounts
Add a payout destination by IFSC or UPI ID. Bank and branch are resolved for you. (bank)
POST /partner/users/:user_code/withdrawals
Pay INR out to a registered account. ₹100–₹5,00,000 per transaction and requires approved KYC, else 403 KYC_REQUIRED. (withdraw)
GET /partner/users/:user_code/withdrawals
Withdrawal history for a user. Paginated with limit and offset. (withdraw)
Delivery
Physical coin and bar fulfilment. All of these need the delivery capability — see Physical delivery.
Endpoint
What it does
GET /partner/delivery/products
The catalogue of coins and bars you can redeem against.
GET /partner/delivery/products/:sku
One product, with making charges and current availability.
POST /partner/users/:user_code/delivery/quote
Quote a redemption, including making charges and shipping.
POST /partner/users/:user_code/delivery/otp/resend
Resend the user's confirmation OTP for a pending delivery quote.
POST /partner/users/:user_code/delivery/confirm
Confirm with the OTP and place the order. Accepts Idempotency-Key.
GET /partner/users/:user_code/delivery/orders
That user's delivery orders.
GET /partner/users/:user_code/delivery/orders/:order_id
One order, with tracking status.
Wallet & dashboard
These read your own data, so they need no extra capability beyond a valid token.
Endpoint
What it does
GET /partner/wallet
Your INR float or credit line — balance, limit, available and dues. See Wallet & ledger.
GET /partner/wallet/ledger
Append-only wallet movements with the balance after each one. Reconcile from this.
GET /partner/dashboard/me
Your partner profile, including the current allowed_apis array — the authoritative list of what your token may call.
GET /partner/dashboard/this-month
This month's volume and commission, plus lifetime totals.
Wipe your sandbox users, balances and trades and reseed the ₹1,00,000 float. Sandbox tokens only — a live token gets 400 SANDBOX_ONLY. Send {"keep_users": true} to clear activity but keep your test users. See Sandbox & test mode.
Capabilities are granted per partner, not per token, and both modes share the same grants. If an endpoint here returns 403 API_NOT_ALLOWED, compare it against allowed_apis from /partner/dashboard/me before assuming the call is malformed.
