Skip to main content
Not sure this is the right path? See Choosing Your Integration.

​
Overview

The Prava REST API is used for server-side operations — creating sessions, managing cards, retrieving payment results, and reporting status. All server-side requests are authenticated using your secret key.
Never expose your secret key in client-side code, version control, or logs. Use it only in server-to-server requests.

​
Base URLs

EnvironmentBase URLKey Prefix
Sandboxhttps://sandbox.api.prava.spacesk_test_*
Productionhttps://api.prava.spacesk_live_*
Use the sandbox URL with your sk_test_* key during development. Switch to the production URL with sk_live_* when you’re ready to go live.

​
Authentication

All API requests require a Bearer token using your secret key: 
Authorization: Bearer sk_test_xxx

​
Response Format

All responses are JSON. Every response includes an X-Response-ID header for debugging: 
X-Response-ID: resp_a1b2c3d4e5f6
Include this ID when contacting support to help trace issues.

​
Error Response Format

All errors follow a consistent structure: 
{
  "error": {
    "code": "ERROR_CODE",
    "message": "Human-readable error message",
    "details": {}
  }
}
The details field is optional and included for validation errors to specify which fields failed.

​
Common Error Codes

StatusCodeDescription
401AUTH_1001Invalid API key
401AUTH_1002Missing or invalid Authorization header
401AUTH_1003Session has been revoked
401AUTH_1004Invalid or expired session token
400VAL_2001Validation error (check details for specifics)
404NOT_FOUNDRequested resource not found
400INVALID_STATEOperation not allowed in current state

​
Endpoints

Create Session

Create a new payment session with order details

Revoke Session

Revoke an active session

List Cards

Retrieve enrolled cards for a customer

Get Payment Result

Retrieve the result of a payment

Report Status

Report payment execution status back to Prava