Endpoint
Authentication
This endpoint uses your Mizaniya Pay API key, passed as a header:not_found.
Path Parameters
string
required
The product reference you returned from your Product Information API. Non-empty, maximum 255 characters. URL-encode it if it contains reserved characters.
Rate Limit
60 requests per minute.How to Decide at a Glance
Branch onlocked first. If you need to distinguish “sold” from “never paid”, also read paid.
Response Envelope
Every successful call returns HTTP 200 with this envelope:Response Fields
The fields below are the contents ofdata. All timestamps are UTC ISO-8601.
string
The product reference you queried, echoed back.
enum
One of
locked, paid, released, refunded, not_found. Branch on this field for business logic.boolean
true only while Mizaniya Pay is actively holding this reference. The single field to check for a one-shot branch.boolean
true once a payment for this reference has succeeded.string | null
UTC ISO-8601 timestamp at which the lock expires.
null when nothing is locked, and also null when the locking attempt carries no expiry (the lock is still considered held).string | null
Identifier of the attempt that decided the
stage. Matches the paymentId on VTPE webhooks. null only when stage is not_found.string
Always
AGENCY, matching the channel field on the payment.success webhook.string
Currency of the deciding attempt. Defaults to
DZD when stage is not_found.number | null
Amount of the deciding attempt.
null only when stage is not_found.object | null
Detail of the deciding attempt.
null only when stage is not_found.Response Examples
- locked
- paid
- released
- refunded
- not_found
A payment attempt is in progress. Keep the product reserved. Do not sell or release it until the lock expires or you receive a final webhook.Variant 1: Lock with a recorded expiryVariant 2: Lock with no recorded expiryA payment attempt is in progress but carries no expiry timestamp. Because the lock expiry cannot be proved, it is still reported as held. Treat this exactly like variant 1.
Error Responses
Errors carry a stableerrorCode to branch on. The human-readable message may change. On any error, do not release the lock. Retry or fall back to your existing reconciliation process.
401 — Missing or unrecognized API key
401 — Missing or unrecognized API key
The
x-api-key header was absent, empty, sent more than once, or does not match any active key. Also returned when the merchant behind the key no longer exists.403 — Merchant account is not active
403 — Merchant account is not active
The key is valid but the merchant account is not in an active state. Contact Mizaniya Pay support.
400 — Invalid reference
400 — Invalid reference
The reference failed validation. It must be a non-empty string of at most 255 characters.
429 — Rate limit exceeded
429 — Rate limit exceeded
You exceeded 60 requests per minute. Back off and retry. This endpoint is safe to call again at any time.
Code Examples
Integration Notes
This endpoint is a safety net, not a replacement for webhooks. Keep handling
payment.success and payment.fail as your primary signal.- Branch on
stageorlocked, never onpayment.status. The internal status set may grow;stageis the contract. - A single reference can have multiple payment attempts. Mizaniya Pay always resolves them and returns the one that decides the outcome.
- A successful payment always wins over an in-flight attempt. If
stageispaid, the product is sold even if another attempt is still processing. not_foundreturns HTTP 200, not 404. It is a business answer, not an error.- Do not poll in a tight loop. Call when you need a decision, or at most once every few seconds for a given reference.
