Get started

Make your first call

Nothing here needs a client library or a sandbox key you do not already have. Two requests, in order, and the second one tells you whether the first worked.

The shape of it

Credentials to a working call

Client id + secretIssued per environmentSandbox ≠ production
POST /sts/api/tokengrant_type: client_credentialsReturns access_token, expires_in
Any operationAuthorization: Bearer …Your channel in the body
200Token and channel are rightEmpty list is still a success

1 · Get credentials

A client id and secret are issued per environment, and a sandbox client is not a production client. Ask for a sandbox pair at Request access if you do not have one.

2 · Exchange them for a token

Client credentials, against the security token service. The response carries access_token, token_type, expires_in and scope.

POST — token

POST https://sandboxpub.cms.dgpays.com/SandBox/oAuth2/sts/api/token
Content-Type: application/json

{
  "grant_type": "client_credentials",
  "client_id": "<your client id>",
  "client_secret": "<your client secret>"
}

Cache it.

Honour expires_in rather than assuming a lifetime, refresh slightly early so a call does not fail on a token that expired in flight, and keep it server-side. Authentication has the rest, including the other grant types the endpoint accepts.

3 · Call an operation

getCardList is a good first call: it is a read, it needs no card to exist, and an empty result is a success rather than an error — so a 200 proves the token and the channel are right even on an empty sandbox.

POST — getCardList

POST https://sandboxpub.cms.dgpays.com/SandBox/IntegrationDigitalChannelCredit/credit/api/getCardList
Content-Type: application/json
Authorization: Bearer <access_token>

{
  "channel": "<your channel code>",
  "customerNumber": 1234567
}

Use your own channel code.

channel is not a formality — the platform authorises against it and some operations behave differently per channel. The codes are in Channels.

4 · Then stop typing requests by hand

Run them from your editor. Developer tools has a .http file per API — every operation, generated from the same model this site renders — plus the OpenAPI document and a Postman collection.
Send from the page. The API reference opens the request builder on any operation, with a sample body already in it.
Follow a flow rather than an endpoint. Integration journeys walk the calls in the order a real programme makes them.