Developers
One API. Honestly, just one. REST, JSON, webhooks, sandbox.
Our complexity stays on our side of the API. Integrate once; every rail we add later is our work, not yours.
REST API
Payment intents, checkout sessions, payment links, refunds, disputes, payouts, balances, events, webhooks, traces. Cursor pagination, expandable objects, idempotency keys, typed errors with a request_log_url.
Hosted checkout
Hosted page, two-line embedded overlay, payment links with QR, and a direct server-to-server API for merchants with the entitlement. Card fields are always hosted by the licensed provider.
Webhooks
Signed with rotating secrets and a 30-day dual-signature grace window. Per-endpoint delivery logs, one-click retry, resendable events.
Sandbox
Test cards for approvals, declines, 3DS challenges, async failures, disputes and gateway refusals, plus magic amounts for the failure modes that only show up at 2am.
Three calls.
One trace.
Copy, paste,
ship
// 1. Create a checkout session. Routing, rescue, trace: ours.
const session = await sr.checkoutSessions.create({
amount: '4800', // base units, string, never float
currency: 'EUR',
success_url: 'https://shop.example/thanks',
customer: { email: 'buyer@example.com', country: 'DE' },
metadata: { order: '1042' },
}, { idempotencyKey: 'order_1042' });
// 2. Send the buyer to the hosted page, or mount the overlay.
redirect(session.url); // pay.settlerock.com/c/cs_01JD…
// 3. Verify the signature, then trust the event.
const event = sr.webhooks.construct(req.rawBody, req.headers['sr-signature'], SECRET);
switch (event.type) {
case 'payment_intent.succeeded':
// event.data.routing = { rail: 'rail_b', hops: 2, rescued: true }
fulfil(event.data.metadata.order); break;
case 'dispute.created':
// evidence_due_by: ISO timestamp. Countdown starts now.
break;
}// GET /v1/payment_intents/pi_01JD3K8F/trace
{
"eligible": ["rail_a", "rail_b", "rail_c"],
"segment": "sca.lt50.visa.prefer_3ds",
"scores": [
{ "rail": "rail_b", "score": "0.59", "attempts": 29 },
{ "rail": "rail_c", "score": "0.41", "attempts": 17 },
{ "rail": "rail_a", "score": "0.23", "attempts": 30 }
],
"explored": false,
"hops": [
{ "rail": "rail_a", "outcome": "gateway_refusal", "ms": 786 },
{ "rail": "rail_b", "outcome": "approved", "ms": 707 }
],
"explain_url": "https://app.settlerock.com/payments/pi_01JD3K8F#explain"
}
or
For your checkout
Hosted checkout gets you live fastest: five locales, express wallet row, trust row. Direct API gives full control for merchants with the entitlement.
For your back office
One feed, one file. Every state change pushed to you, every money movement in an append-only ledger you can export.
Developer
questions.
Answered by
people who ship
What does the API look like?
REST, JSON, cursor pagination, expandable objects, idempotency keys on every money-moving call, typed errors with a request_log_url. Stripe-shaped on purpose, so your team already knows it.
Do I need to handle card data?
No. Card inputs are the provider’s hosted fields or a full redirect, so your integration stays SAQ A eligible. Merchants with a current PCI DSS attestation may use the direct API, where card data is transmit-only.
How are webhooks secured?
Signed with rotating secrets and a 30-day dual-signature grace window, sent from a transactional outbox written inside the money-moving transaction. Per-endpoint delivery logs with one-click retry.
Can I test declines and cascades?
Yes. Test cards cover approvals, declines, 3DS challenges, async failures, disputes and gateway refusals, plus magic amounts for the failure modes that only show up in production at 2am.
How does outcome routing decide?
Eligibility is static: scope, currency, country, scheme, entitlement and the compliance layer decide which terminals may see a payment. Among the survivors, the observed approval rate for that payment’s segment decides who goes first.
The score is (approved + 2) / (attempts + 4) over seven days, with the last 24 hours counted twice. Not a model. Not a mystery.
What is same-call rescue?
When a gateway refuses a card before any issuer saw it (a country rule, a BIN block, a terminal policy), the payment hops to the next eligible terminal inside the same request. Depth cap two. Issuer declines and fraud verdicts are never retried.
Nine rails, one contract
Ready to
integrate?
A sandbox key is instant. Live keys follow a human review.