REST API (raw HTTP) - Pulse Collect

For backends not using @pulsebyshiga/node (PHP, Python, Java, Go, …), call the engine directly over HTTPS. This is a stopgap until the OpenAPI spec is published.

This surface reflects the @pulsebyshiga/node types — the working view of the API until the canonical Pulse OpenAPI contract is published. Wire shapes (snake_case JSON, decimal-string amounts) are stable; a few fields are still being reconciled and are flagged where they appear.

Base URL: https://engine-api.shiga.io (override via the SDK baseUrl when a sandbox host is issued).

Authentication

Call type	Headers
API key (backend)	`X-API-Key: <sk_ key>` and `Authorization: Bearer <sk_ key>`
Client session (browser/embed)	`Authorization: Bearer <cs_ token>`

All requests also send Accept: application/json. Every POST includes an Idempotency-Key: <uuid> and Content-Type: application/json. Responses carry a request-id header — include it when contacting support.

Endpoints — live (engine)

Method & path	Purpose
`POST /v1/quotes`	Create a quote (also backs `rates.preview`)
`POST /v1/offramp/orders`	Create an offramp order
`GET /v1/offramp/orders/{id}`	Retrieve an offramp order
`POST /v1/onramp/orders`	Create an onramp order
`GET /v1/onramp/orders/{id}`	Retrieve an onramp order
`GET /v1/banks`	List supported banks
`POST /v1/banks/resolve`	Resolve an account number to a name

Endpoints — preview (collection product)

These are part of the preview surface — see Contract status.

Method & path	Purpose
`POST /v1/collection-sessions`	Mint a single-order collection session
`GET /v1/collection-orders/{id}`	Retrieve a collection order
`POST /v1/collection-orders/{id}/refresh_quote`	Re-lock an expired quote
`GET /v1/collection-orders`	List orders (`gate`, `status`, `user_ref`, `created_after`, `created_before`, `limit`, `cursor`)

The client-session routes the embed uses (GET /v1/client/session, POST /v1/client/session/refresh_quote, POST /v1/client/session/select, POST /v1/client/telemetry) belong to the same preview surface.

Webhook signatures (`Pulse-Signature`)

Each delivery carries a Pulse-Signature header:

Pulse-Signature: t=<unix-seconds>,v1=<hex-hmac>

Verify it before trusting the payload:

Split the header on , into k=v pairs; read t and one or more v1 values (multiple v1 values support key rotation).
Compute HMAC_SHA256(secret, "<t>.<raw-request-body>") as a lowercase hex digest — sign the raw bytes, not a re-serialized JSON object.
Constant-time compare your digest against each v1; accept if any matches.
Reject if t is outside a 300-second tolerance (replay protection).
De-duplicate on the event id — delivery is at-least-once.

@pulsebyshiga/node does all of this for you in webhooks.verifyOnce(rawBody, header).

​Authentication

​Endpoints — live (engine)

​Endpoints — preview (collection product)

​Webhook signatures (Pulse-Signature)

Authentication

Endpoints — live (engine)

Endpoints — preview (collection product)

Webhook signatures (`Pulse-Signature`)