All API requests — both outbound calls and inbound webhooks — use the same three required headers.
Required Headers
| Header | Description |
|---|---|
| X-PARTNER-ID | Your client key provided during onboarding |
| X-TIMESTAMP | Current timestamp in ISO8601 format (e.g., 2024-12-19T17:07:05+07:00) |
| X-SIGNATURE | RSA signature generated from the request parameters (see Signature Generation) |
Signature Method
The API uses the Asymmetric Without Get Token method, following security standards established by Bank Indonesia. You do not need to make a separate token request — the signature is sent directly via X-SIGNATURE with each request.
See Signature Generation for the full algorithm and code examples.
Timestamp Rules
Requests to the API are rejected with error code 40001001 when X-TIMESTAMP does not meet these rules:
| Rule | Error message |
|---|---|
Must be ISO 8601 with an explicit offset: +07:00, +0700 or Z. Fractional seconds are allowed (e.g., 2024-12-19T10:07:05.123Z). |
Invalid X-TIMESTAMP format |
| Must be within ±5 minutes of server time. Keep your server clock synchronized (NTP). | X-TIMESTAMP outside allowed window |
Generate a fresh timestamp for every request. Do not reuse a timestamp or signature from an earlier request.
Error Responses
When a required header is missing or invalid, the API responds with HTTP 400 (not 401) and error code 40001001:
{
"error": {
"code": 40001001,
"message": "Invalid X-SIGNATURE value"
}
}
| Message | Cause |
|---|---|
Invalid X-TIMESTAMP |
X-TIMESTAMP header is missing |
Invalid X-PARTNER-ID |
X-PARTNER-ID header is missing |
Invalid X-PARTNER-ID NOT LISTED |
X-PARTNER-ID does not match a registered client key |
Invalid X-SIGNATURE |
X-SIGNATURE header is missing |
Invalid X-TIMESTAMP format |
See Timestamp Rules |
X-TIMESTAMP outside allowed window |
See Timestamp Rules |
Invalid X-SIGNATURE value |
The signature does not match the request. See Signature Generation |
Match on the HTTP status and error.code. The message wording may change.
In production, the IP whitelist check runs before these checks, so some requests are rejected earlier with a different body. See IP Whitelisting.