API Documentation

All requests to the 株式会社ITO-Japan API are sent via HTTP to our endpoints.

• HTTP Methods : GET / POST / PATCH / PUT
• Base URL : https://dev.ito-japan.jp
• Content-Type : application/json

Register as a merchant in our system. In your merchant dashboard you will find the option for API access key.

Example access key : 51a4bd18-5bc1-4eaa-97b0-c09323398883

The following example code enables you to initiate a payment,depending on how you structure it. The perameter details are also below.

            <?php
                $parameters = [
                    'custom' => 'DFU80XZIKS',
                    'currency_code' => 'USD',
                    'amount' => 280.00,
                    'details' => 'Digital Product',
                    'web_hook' => 'https://yoursite.com/web_hook.php',
                    'cancel_url' => 'https://yoursite.com/cancel_url.php',
                    'success_url' => 'https://yoursite.com/success_url.php',
                    'customer_email' => '[email protected]',
                ];
                
                $url = 'https://dev.ito-japan.jp/payment/process';
                $timestamp = time();
                $body = json_encode($parameters);
                $signature = hash_hmac('sha256', $timestamp . '.' . $body, $secret_key);
                $headers = [
                    "Accept: application/json",
                    "Authorization: Bearer access_key",
                    "X-Timestamp: $timestamp",
                    "X-Signature: $signature",
                ];

                
                
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
                curl_setopt($ch, CURLOPT_URL, $url);
                curl_setopt($ch, CURLOPT_POSTFIELDS,  http_build_query($parameters));
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                $response = curl_exec($ch);
                curl_close($ch);
            ?>
    

You can verify the payment whether it is valid or not. After successful payment transaction you will have the response where you find the Payment ID. With this payment id and your access key you need make a request to our server for verify the payment. Example code is below.

Payment verify end point : https://dev.ito-japan.jp/payment/check-validity

            <?php
                $parameters = [
                    'payment_id' => 'AIYmQIOAz0GlmsjfhgiOeu304',
                ]
                
                $url = 'https://dev.ito-japan.jp/payment/check-validity';
                
                $headers = [
                    "Accept: application/json",
                    "Authorization: Bearer access_key",
                ];
                
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
                curl_setopt($ch, CURLOPT_URL, $url);
                curl_setopt($ch, CURLOPT_POSTFIELDS,  $parameters);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                $response = curl_exec($ch);
                curl_close($ch);
            ?>
    

Use this flow for server-to-server communication from the merchant backend.
The merchant obtains an access token and uses it as Bearer token for /oauth/merchant/* endpoints.

curl -X POST "https://dev.ito-japan.jp/oauth/token" \
  -H "Accept: application/json" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_MERCHANT_CLIENT_ID" \
  -d "client_secret=YOUR_MERCHANT_CLIENT_SECRET" \
  -d "scope="

Example: Call merchant endpoints with the token:

curl -X GET "https://dev.ito-japan.jp/api/oauth/merchant/users/123/balance" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer {access_token}"

All endpoints below require a Merchant OAuth access token (client_credentials).

Security All /oauth/merchant/users/{user} routes must verify ownership by created_by_client_id == client_id.

Use this flow when the end-user authorizes access from an app.
Recommended Use PKCE (no client_secret in mobile apps).

Step 1: Redirect user to authorize

https://dev.ito-japan.jp/oauth/authorize?
response_type=code&
client_id=YOUR_PUBLIC_CLIENT_ID&
redirect_uri=YOUR_REDIRECT_URI&
scope=&
state=RANDOM_STATE&
code_challenge=CODE_CHALLENGE&
code_challenge_method=S256

Step 2: Exchange code for token

curl -X POST "https://dev.ito-japan.jp/oauth/token" \
  -H "Accept: application/json" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_PUBLIC_CLIENT_ID" \
  -d "redirect_uri=YOUR_REDIRECT_URI" \
  -d "code=AUTH_CODE_FROM_STEP1" \
  -d "code_verifier=CODE_VERIFIER"

After obtaining access_token, call /oauth/user/* endpoints using Bearer token.

All endpoints below require a User OAuth access token (auth:passport_api).

This section lists additional APIs that are safe to disclose publicly. Internal administration APIs, secret keys, card sensitive data, and private operational endpoints are intentionally not listed.

These endpoints are used before the user is fully logged in. They do not expose private wallet, card, or transaction information.

curl -X GET "https://dev.ito-japan.jp/api/tma/tenant?merchant_id=8" \
  -H "Accept: application/json"

These endpoints require a valid TMA user session token. Sensitive card number / CVV disclosure endpoints are not included in this public documentation.

Subscription APIs are used by the Mini App billing screen. Payment completion is processed server-side with duplicate protection.

{
  "ok": true,
  "subscription": {
    "status": "active",
    "billing_month": "2026-05",
    "amount_due": 1277,
    "currency": "JPY",
    "formatted_amount": "¥1,277",
    "next_billing_date": "2026-06-01"
  }
}

Mini App users can browse listings and send inquiries. Merchant management endpoints are documented separately in the Marketplace API section.

These endpoints expose public token information and user-visible token history. Private keys and signing material are never returned.

• Never publish access keys, client secrets, production webhook IDs, private keys, mnemonic phrases, or card CVV data in documentation examples.
• Public documentation should show endpoint purpose, authentication type, and safe sample payloads only.
• Card sensitive information endpoints, administrator endpoints, and internal reconciliation endpoints should remain unpublished.
• For merchant APIs, always verify that the requested user, order, listing, or settlement belongs to the authenticated merchant.
• For webhooks, verify signatures and make payment completion idempotent to prevent duplicate processing.

Following currencies are currently supported in our system. It may update furthur.

マーケットプレイスAPIを使用して、出品管理・注文管理・問い合わせ・精算履歴にアクセスできます。 全てのリクエストに Bearer Token 認証が必要です。

GET /api/merchant/listings

自分の出品一覧を取得します。per_page パラメータでページサイズを指定できます（デフォルト: 20）。

curl -X GET "https://dev.ito-japan.jp/api/merchant/listings?per_page=10" \
  -H "Authorization: Bearer {access_key}" \
  -H "Accept: application/json"

POST /api/merchant/listings — 出品作成リクエストパラメータ

curl -X POST "https://dev.ito-japan.jp/api/merchant/listings" \
  -H "Authorization: Bearer {access_key}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "title": "商品名",
    "description": "商品の説明文",
    "category_code": "digital_content_creator",
    "price": 1000,
    "currency_id": 1,
    "stock": 100
  }'

GET /api/merchant/orders

注文一覧を取得します。status・escrow_status でフィルタ可能です。

## 発送登録
curl -X POST "https://dev.ito-japan.jp/api/merchant/orders/ORD-XXXXXXXX/ship" \
  -H "Authorization: Bearer {access_key}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "tracking_number": "1234567890",
    "carrier": "DHL"
  }'

購入前の顧客からの問い合わせを管理します。 返信内容はAIによる規約違反チェックが行われます。 外部決済・銀行情報などの規約違反コンテンツはブロックされます。

## 問い合わせ返信
curl -X POST "https://dev.ito-japan.jp/api/merchant/inquiries/1/reply" \
  -H "Authorization: Bearer {access_key}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"message": "お問い合わせありがとうございます。こちらの商品は..."}'

USDTウォレットの残高・入金履歴を取得します。 秘密鍵・ニーモニック・暗号化キーはAPIで返却されません。 ガスレス送金はセキュリティ上の理由からAPIでは提供しておらず、Webインターフェースのみで行えます。

## USDT残高取得
curl -X GET "https://dev.ito-japan.jp/api/merchant/wallet/usdt-balance" \
  -H "Authorization: Bearer {access_key}" \
  -H "Accept: application/json"

## レスポンス例
{
  "code": 200,
  "status": "success",
  "data": {
    "address": "0x07fd8aba...",
    "wallet_version": 5,
    "usdt_balance": 10.50,
    "daily_transfers_remaining": 4
  }
}

GET /api/merchant/wallet/deposits — 入金履歴レスポンス項目

セキュリティを強化するために X-Timestamp と X-Signature ヘッダーを追加できます。 署名を付与する場合、タイムスタンプは5分以内のリクエストのみ受け付けます（Replay攻撃防止）。

<?php
$accessKey = 'your_access_key';
$secretKey = 'your_secret_key';
$timestamp = time();
$body      = json_encode(['tracking_number' => '1234567890', 'carrier' => 'DHL']);
$signature = hash_hmac('sha256', $timestamp . '.' . $body, $secretKey);

$response = file_get_contents('https://dev.ito-japan.jp/api/merchant/orders/ORD-XXXXXXXX/ship', false,
    stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => implode("\r\n", [
            'Content-Type: application/json',
            'Authorization: Bearer ' . $accessKey,
            'X-Timestamp: ' . $timestamp,
            'X-Signature: ' . $signature,
        ]),
        'content' => $body,
    ]])
);
echo $response;