Payment Gateway API Quick Reference

A concise reference for all core CyoGate gateway API operations. All requests use HTTPS POST to the gateway endpoint with your Private API Key for authentication, unless otherwise noted.

Gateway Endpoints

Authentication

Include your Private API Key as a POST field in every request:

security_key=YOUR_PRIVATE_KEY

Transactions

Process payments, authorizations, captures, voids, and refunds.

Transaction Type Values

Core Request Fields

Code Examples

PHP

$post = array(
    'security_key'  => YOUR_PRIVATE_KEY,
    'type'          => 'sale',
    'amount'        => '29.99',
    'payment_token' => $_POST['payment_token'],  // From Collect.js
    'order_id'      => 'ORDER-123',
    'email'         => $customer_email,
);
$ch = curl_init('https://secure.cyogate.net/api/transact.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
$response = curl_exec($ch);
curl_close($ch);
parse_str($response, $result);
// $result['response'] == '1' means approved

Python

import requests
from urllib.parse import parse_qs

payload = {
    'security_key':  PRIVATE_KEY,
    'type':          'sale',
    'amount':        '29.99',
    'payment_token': request.POST.get('payment_token'),
    'order_id':      'ORDER-123',
}
response = requests.post(
    'https://secure.cyogate.net/api/transact.php',
    data=payload,
    timeout=30
)
result = {k: v[0] for k, v in parse_qs(response.text).items()}
# result['response'] == '1' means approved

curl

curl -X POST https://secure.cyogate.net/api/transact.php   -d "security_key=YOUR_PRIVATE_KEY"   -d "type=sale"   -d "amount=29.99"   -d "payment_token=YOUR_TOKEN"   -d "order_id=ORDER-123"

Transaction Response Fields

Common Decline Response Text

AVS Response Codes

Returned in the avsresponse field. AVS compares the billing address submitted against what the card issuer has on file.

CVV Response Codes

Returned in the cvvresponse field.

Customer Vault

Store and manage customer payment credentials on CyoGate's PCI-compliant servers for repeat billing and one-click checkout.

Vault Operations

Key Vault Fields

Code Examples

PHP — Add to Vault During Sale

$post = array(
    'security_key'      => YOUR_PRIVATE_KEY,
    'type'              => 'sale',
    'amount'            => '29.99',
    'payment_token'     => $token,
    'customer_vault'    => 'add_customer',
    'customer_vault_id' => 'CUST-' . $user_id,
);

Python — Charge a Vaulted Customer

payload = {
    'security_key':      PRIVATE_KEY,
    'type':              'sale',
    'amount':            '49.99',
    'customer_vault_id': 'CUST-12345',
    'order_id':          'ORDER-456',
}

curl — Delete a Vault Record

curl -X POST https://secure.cyogate.net/api/transact.php   -d "security_key=YOUR_PRIVATE_KEY"   -d "customer_vault=delete_customer"   -d "customer_vault_id=CUST-12345"

See also: Customer Vault Overview | Adding Customers | Credential on File Best Practices

Recurring Billing

Create and manage subscription and installment plans tied to Customer Vault records.

Subscription Operations

Subscription Fields

Code Examples

PHP — Create Monthly Subscription

$post = array(
    'security_key'      => YOUR_PRIVATE_KEY,
    'type'              => 'sale',
    'amount'            => '9.99',
    'customer_vault_id' => 'CUST-12345',
    'recurring'         => 'add_subscription',
    'plan_payments'     => '0',
    'plan_amount'       => '9.99',
    'month_frequency'   => '1',
    'day_of_month'      => '1',
    'start_date'        => date('Y-m-d', strtotime('+1 month')),
);

curl — Cancel a Subscription

curl -X POST https://secure.cyogate.net/api/transact.php   -d "security_key=YOUR_PRIVATE_KEY"   -d "recurring=delete_subscription"   -d "subscription_id=SUB-12345"

See also: Preparing Subscriptions | Vault Transactions

Query API

Retrieve transaction history, vault records, and subscription data.

Query Endpoint

https://secure.cyogate.net/api/query.php

Query Fields

Code Examples

PHP — Query Last 30 Days of Transactions

$post = array(
    'security_key' => YOUR_PRIVATE_KEY,
    'report_type'  => 'transaction',
    'start_date'   => date('Y-m-d 00:00:00', strtotime('-30 days')),
    'end_date'     => date('Y-m-d 23:59:59'),
    'result_order' => 'DESC',
);
$ch = curl_init('https://secure.cyogate.net/api/query.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$xml = curl_exec($ch);
$result = simplexml_load_string($xml);

Python — Look Up a Single Transaction

import requests

payload = {
    'security_key':   PRIVATE_KEY,
    'report_type':    'transaction',
    'transaction_id': 'TXN-12345678',
}
response = requests.post('https://secure.cyogate.net/api/query.php', data=payload)
# Response is XML — parse with xml.etree.ElementTree or xmltodict

See also: Transaction History Component | Deposit History

Webhooks & Event Notifications

CyoGate POSTs a transaction notification to a URL you configure whenever a transaction is processed — including recurring billing charges, refunds, and voids. Configure your notification URL in the Merchant Control Panel under Settings > Transaction Notifications.

Notification POST Fields

PHP Notification Handler

<?php
// Your configured notification_url endpoint
$response = $_POST['response'];
$txn_id   = $_POST['transactionid'];
$amount   = $_POST['amount'];
$order_id = $_POST['order_id'];

// Always validate amount and order_id match your records before fulfilling
if ($response == '1') {
    $order = get_order($order_id);
    if ($order && $order->amount == $amount && !$order->fulfilled) {
        fulfill_order($order_id, $txn_id);
    }
}
?>

See also: Implement Backend | Hosted Checkout Advanced

Vault & Subscription Delete

Permanently remove Customer Vault records or cancel recurring subscriptions.

PHP — Delete Vault Record

$post = array(
    'security_key'      => YOUR_PRIVATE_KEY,
    'customer_vault'    => 'delete_customer',
    'customer_vault_id' => 'CUST-12345',
);

curl — Cancel Subscription

curl -X POST https://secure.cyogate.net/api/transact.php   -d "security_key=YOUR_PRIVATE_KEY"   -d "recurring=delete_subscription"   -d "subscription_id=SUB-12345"

Response

See also: Managing Vault Entries | Credential on File Best Practices