Skip to navigation
Lucky-Tom POS APIWalletsTop Ups

Validate top-up

View as Markdown

Does not move money. No Idempotency-Key. Check userRef, amount, currency, and partner prepaid float. Does not return player balance.

Body

FieldRequiredDescription
userRefyesLinked portal user (issued id, MSISDN, or email as agreed)
amountyesMajor units, pattern ^[0-9]+(\\.[0-9]{1,2})?$
currencyyesISO 4217, must match country
partnerReferencenoTill/shift reference

200: payable: true, echo of userRef/amount/currency, countryId, partnerPrepaidRemaining (informational).

Business errors: user-not-found, user-not-linked, amount-out-of-range, insufficient-partner-float, currency-mismatch.

Authentication (AND, not OR)

Required together on this request:

  • X-Lucky-Tom-Partner-Id = {{partnerId}}
  • Authorization: Bearer {{clientSecret}} (static client_secret, not OAuth)
  • X-Lucky-Tom-Timestamp and X-Lucky-Tom-Signature — visible as placeholders; the collection Pre-request Script overwrites them on Send using hmacSecretKey

Canonical string: {METHOD}\n{pathAndQuery}\n{timestamp}\n{sha256HexOfRawBody}. Empty body hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Skew ±5 minutes.

HTTPtypeMeaning
401unauthorizedIdentity failed
422hmac-invalidMissing/wrong signature
422hmac-skewClock off by > 5 minutes
403country-mismatch{countryId} ≠ credential country

See the Authentication folder for the worked HMAC example.

Headers

X-Lucky-Tom-Partner-IdstringOptional

Public partner id. Required (AND). Not a secret.

X-Lucky-Tom-TimestampstringOptional

Unix time in milliseconds. Required (AND). Collection Pre-request Script overwrites this on Send.

X-Lucky-Tom-SignaturestringOptional

HMAC-SHA256 hex of METHOD + pathAndQuery + timestamp + sha256(body). Required (AND). Overwritten on Send.

Request

This endpoint expects an object.
amountstringRequired
userRefstringRequired
currencystringRequired

Response

OK
amountstring
payableboolean
userRefstring
currencystring
countryIdstring
partnerPrepaidRemainingstring

Errors

401
Unauthorized Error
422
Unprocessable Entity Error