Refund order

POST/payment/zibapay/order/refund/:referenceAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

Request Parameters

Field	Type	Required	Description
`reference`	string	Required	transactionReferenceId from the collect response, or the order reference.

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/order/refund/:reference";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
    "Content-Type": "application/json",
};

const payload = {
  "Reason": "Customer returned the item",
  "Amount": 1000
};

try {
  const response = await axios.post(url, payload, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`status`	string	Always returned	Refund status: COMPLETED.
`refundId`	string	Always returned	Unique refund transaction reference.
`reference`	string	Always returned	Original order reference refunded.
`amount`	number	Always returned	Monetary amount refunded.
`reason`	string	Always returned	Reason provided for refund.
`refundedAt`	string	Always returned	ISO 8601 refund confirmation timestamp.

Status codes

HTTP Status	Meaning
200	Refund executed successfully.
401	No merchant session.
500	{ message: "Internal server error" }.

Notes

HTTP 200 returns the provider refund JSON (response.data).

POST/payment/zibapay/order/refund/:referenceAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Auth guide →

X-Requested-With: XMLHttpRequest

Request Parameters

Field	Type	Required	Description
`reference`	string	Required	transactionReferenceId from the collect response, or the order reference.

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/order/refund/:reference";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
    "Content-Type": "application/json",
};

const payload = {
  "Reason": "Customer returned the item",
  "Amount": 1000
};

try {
  const response = await axios.post(url, payload, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`status`	string	Always returned	Refund status: COMPLETED.
`refundId`	string	Always returned	Unique refund transaction reference.
`reference`	string	Always returned	Original order reference refunded.
`amount`	number	Always returned	Monetary amount refunded.
`reason`	string	Always returned	Reason provided for refund.
`refundedAt`	string	Always returned	ISO 8601 refund confirmation timestamp.

Status codes

HTTP Status	Meaning
200	Refund executed successfully.
401	No merchant session.
500	{ message: "Internal server error" }.

Notes

HTTP 200 returns the provider refund JSON (response.data).

Request Parameters

Response fields

Status codes

Notes

Related

Refund order

Request Parameters

Response fields

Status codes

Notes

Related