OFApay

Asian payment aggregator covering e-wallets, QR, and bank transfers (Philippines PHP, Korea KRW). The payer pays from their e-wallet (GCash, Maya, GrabPay), scans a QR (QRPH), or receives a bank payout. Deposits are processed through OFApay's hosted payment page; payouts are sent directly to the recipient's wallet/bank. Supports Pay-In and Pay-Out.

Operations: Pay-In ✓ | Pay-Out ✓ | Webhook ✓
Processing: Asynchronous - Pay-In redirects the payer to OFApay's hosted payment page (or renders a QR); final status for both flows arrives via webhook
Payment type: E-wallet / QR / Bank transfer

Account-per-method: OFApay is configured as one account per payment method. Each account carries its own scode (MID) and signature key, tagged with the method it serves (GCash, Maya, …). The paymentMethod you send on the cashier call selects which account is used. The currency and routing (paytype) are fixed per method and derived server-side - you do not send paytype.

Currency is fixed per method: GCash / Maya / GrabPay / QRPH → PHP, Bank Payouts → KRW.

Fields marked with * are required.

Payment methods

Method (`paymentMethod`)	Label	Currency	Country	Pay-In	Pay-Out
`GCASH`	GCash	PHP	PHL	✓	✓
`MAYA`	Maya	PHP	PHL	✓	✓
`GRABPAY`	GrabPay	PHP	PHL	✓	✓
`QRPH`	QRPH	PHP	PHL	✓	✓
`BANK_KRW`	Bank Payouts	KRW	KOR	-	✓

Configuration (Mozarto back office)

These fields are in the locked API Credentials section of the account's Processing Scope tab. Unlock it with your 2FA code first - see Unlock API credentials.

One configuration is created per payment method.

Field	Description
`accountName` *	Display name for this account
`paymentMethod` *	The OFApay method this account serves (GCash, Maya, GrabPay, QRPH, Bank Payouts)
`scode` *	OFApay Merchant ID (MID). Provided by OFApay per method
`apiKey` *	OFApay signature key used to sign requests and verify callbacks (MD5). Stored per brand, encrypted at rest, and masked in the back office
`siteUrl`	Default return URL - OFApay redirects the payer here after completing a Pay-In on the hosted page. Used when the transaction does not send its own `siteUrl`
`webhookUrl` *	Your HTTPS endpoint for transaction status updates
`comment`	Optional free-text note for this configuration

Pay-In

POST /v1/api/mozarto/cashier

The cashier call does not move funds directly. It creates a transaction and returns a paymentUrl (OFApay's hosted payment page). Redirect the payer to that URL, where they confirm the payment in their e-wallet or scan the QR. The final status arrives later via webhook.

Payer identity comes from the user token. firstName, lastName, and email are taken from the authenticated user (x-user-token) and must not be sent in the body.

Request body

Field	Type	Description
`pspType` *	string	Always `"OFAPAY"`
`type` *	string	Always `"PAYIN"`
`paymentMethod` *	string	Selects the OFApay account/method. Pay-In values: `"GCASH"` (GCash), `"MAYA"` (Maya), `"GRABPAY"` (GrabPay), `"QRPH"` (QRPH). `"BANK_KRW"` (Bank Payouts) is Pay-Out only
`baseamount` *	number	Amount as a number (e.g. `200`)
`currency` *	string	Currency code. Must match the method's fixed currency (e.g. `"PHP"`)
`country` *	string	Payer's country - full name, ISO 3166-1 alpha-2, or alpha-3 (e.g. `"Philippines"`, `"PH"`, `"PHL"`). See Country codes. Matched against the account's Processing Scope, and converted to alpha-3 before being sent to OFApay
`phone` *	string	Payer's phone number (digits only, e.g. `09171234567`)
`bankno`	string	Bank/channel code for methods that route directly to a bank. Optional - depends on the method
`accountno`	string	Payer's account number
`accountname`	string	Payer's name
`address`	string	Payer's address
`city`	string	Payer's city
`street`	string	Payer's street
`zipCode`	string	Payer's postal code (sent to OFApay as `zip_code`)
`merchantReference`	string	Your reference, echoed back in the response and webhook
`siteUrl`	string	Return URL the payer lands on after payment. Overrides the configured `siteUrl` for this transaction; falls back to the configured value when omitted
`webhookUrl`	string	HTTPS endpoint for the status webhook. Overrides the configured `webhookUrl` for this transaction; falls back to the configured value when omitted

Example request

{
  "pspType": "OFAPAY",
  "type": "PAYIN",
  "paymentMethod": "GCASH",
  "baseamount": 200,
  "currency": "PHP",
  "country": "PHL",
  "phone": "09171234567",
  "merchantReference": "ORDER-4821"
}

Response

{
  "isSuccess": true,
  "data": {
    "merchantReference": "ORDER-4821",
    "amount": 200,
    "transaction_status": "Pending",
    "paymentUrl": "https://www.jzc899.com/pay/deposit.aspx?u=...&v=2.0",
    "qrUrl": "",
    "qrcode": "",
    "floatingamount": ""
  },
  "statusCode": 200
}

Field	Type	Description
`isSuccess`	boolean	`true` when the transaction was set up successfully
`paymentUrl`	string	OFApay hosted payment page URL - redirect the payer here
`qrUrl`	string	QR code image URL, when the channel returns one (e.g. QRPH)
`qrcode`	string	QR code payload/key, when the channel returns one
`floatingamount`	string	Adjusted amount the payer must pay, when the channel uses floating amounts - otherwise empty
`merchantReference`	string	The merchant reference passed in the request - empty string if not set
`amount`	number	Transaction amount as a number
`transaction_status`	string	Always `"Pending"` at this point. The final outcome arrives by webhook
`statusCode`	number	HTTP status code (`200` on success)

Pay-Out

POST /v1/api/mozarto/cashier

Pay-Out is a direct API call - no hosted page and no paymentUrl. Mozarto sends the payout to the recipient's wallet or bank account. The final status arrives via webhook.

Request body

Field	Type	Description
`pspType` *	string	Always `"OFAPAY"`
`type` *	string	Always `"PAYOUT"`
`paymentMethod` *	string	Selects the OFApay account/method: `"GCASH"` (GCash), `"MAYA"` (Maya), `"GRABPAY"` (GrabPay), `"QRPH"` (QRPH), `"BANK_KRW"` (Bank Payouts)
`baseamount` *	number	Amount as a number (e.g. `200`)
`currency` *	string	Currency code. Must match the method's fixed currency (e.g. `"PHP"`, `"KRW"`)
`phone` *	string	Recipient's wallet/phone number (digits only)
`accountno` *	string	Recipient's bank/wallet account number
`accountname` *	string	Recipient's account holder name
`bankname` *	string	Bank name from OFApay's bank list
`bankno` *	string	Bank/channel code from OFApay's bank list identifying the recipient's bank or wallet
`branchname` *	string	Beneficiary bank branch name
`branchcode` *	string	Beneficiary bank branch code
`banknum`	string	IFSC code - required for INR payouts
`taxno`	string	Taxpayer identification number
`postalcode`	string	Recipient postal code
`province`	string	Recipient province
`city`	string	Recipient city
`gender`	string	`M` or `F`
`country` *	string	Recipient country - full name, ISO 3166-1 alpha-2, or alpha-3 (e.g. `"Philippines"`, `"PH"`, `"PHL"`). See Country codes. Matched against the account's Processing Scope, and converted to alpha-3 before being sent to OFApay
`address`	string	Recipient address
`idType`	string	Credential type - `1` = ID, `2` = Passport
`idNumber`	string	Credential number
`issueDate`	string	Credential issue date (`YYYY-MM-DD`)
`expireDate`	string	Credential expiry date (`YYYY-MM-DD`)
`area`	string	Country calling code, digits only (e.g. `"81"`)
`nationality`	string	Recipient nationality (2-letter, e.g. `"JP"`)
`merchantReference`	string	Your reference, echoed back in the response and webhook
`webhookUrl`	string	HTTPS endpoint for the status webhook. Overrides the configured `webhookUrl` for this transaction; falls back to the configured value when omitted

Payer name (surName/givName at OFApay) is resolved from the X-User-token (last/first name), so it is not sent in the request body.

Example request

{
  "pspType": "OFAPAY",
  "type": "PAYOUT",
  "paymentMethod": "GCASH",
  "baseamount": 200,
  "currency": "PHP",
  "country": "PH",
  "phone": "09171234567",
  "accountno": "09171234567",
  "accountname": "Ban Lu",
  "bankname": "GCash",
  "bankno": "600",
  "branchname": "Main Branch",
  "branchcode": "001",
  "merchantReference": "PAYOUT-7723"
}

Response

{
  "isSuccess": true,
  "data": {
    "merchantReference": "PAYOUT-7723",
    "amount": 200,
    "transaction_status": "Processing"
  },
  "statusCode": 200
}

Field	Type	Description
`isSuccess`	boolean	`true` when the transaction was set up successfully
`merchantReference`	string	The merchant reference passed in the request - empty string if not set
`amount`	number	Transaction amount as a number
`transaction_status`	string	Always `"Processing"` at this point. The final outcome arrives by webhook
`statusCode`	number	HTTP status code (`200` on success)

Webhook

Mozarto calls your webhookUrl when the transaction reaches a final state. OFApay notifies Mozarto on its own callback URL first; Mozarto then forwards a normalized notification to you. The payload is identical for Pay-In and Pay-Out - it carries no flow indicator. Match transaction_id against the cashier call to distinguish them. Non-final statuses (e.g. still processing) are acknowledged but not forwarded.

Payload example

{
  "transaction_id": "64a1f2b3c4d5e6f7a8b9c0d1",
  "psp_transaction_id": "9f3c1a20-6c7e-4d0e-b2b1-8a1f2c3d4e5f",
  "user_id": "000000000000000000000001",
  "status": "success",
  "transaction_status": "Approved",
  "amount": 200,
  "currency": "PHP",
  "merchantReference": "ORDER-4821"
}

Field	Description
`transaction_id`	Mozarto transaction ID for this transaction. Match it against your stored `merchantReference`
`psp_transaction_id`	OFApay order ID (`orderid`) generated by Mozarto for this transaction
`user_id`	The user ID from the original transaction
`status`	Raw settlement result - `success` or `failed`. Do not use for business logic
`transaction_status`	Normalized Mozarto status - `"Approved"` or `"Failed"`. Use this for all business logic
`amount`	Transaction amount as a number
`currency`	Transaction currency
`merchantReference`	The merchant reference passed in the original request - empty string if not set

Status values

The webhook forwards only the normalized Mozarto statuses:

Settlement (`status`)	Normalized (`transaction_status`)	Meaning
`success`	`Approved`	Transaction completed successfully
`failed`	`Failed`	Transaction failed
`pending`	-	Still processing - acknowledged only, not forwarded

Payer-info webhook (Pay-In)

For some channels OFApay does not know the payer's wallet details at request time. When the payer completes the payment, OFApay calls Mozarto's payer-info endpoint with the payer's payeraccount and payername; Mozarto stores these against the transaction. This is internal to Mozarto and is not forwarded to your webhook.

Error codes

The cashier call returns an error when the transaction cannot be set up. Payment declines are reported later through the webhook with transaction_status: "Failed", not on this call.

HTTP status	Response	When
400	`message: "Missing required field: paymentMethod"`	`paymentMethod` was not sent
400	`message: "Unsupported OFApay payment method: <value>"`	`paymentMethod` is not a recognized OFApay method
400	`message: "OFApay <method> does not support Pay In"`	The selected method does not support the requested direction (e.g. Bank Payouts is Pay-Out only)
400	`message: "PSP Configuration not found. Please check you psp Configuration"`	The OFApay account for this method is missing its `scode` or `apiKey` in the back office
400	`message` carries OFApay's `respmsg` / `msg` (e.g. amount over limit, incorrect parameter)	OFApay rejected the deposit or withdrawal request

For the full list of errorCode values and retryability guidance, see Errors.

Payment methods#

Configuration (Mozarto back office)#

Pay-In#

Request body#

Example request#

Response#

Pay-Out#

Request body#

Example request#

Response#

Webhook#

Payload example#

Status values#

Payer-info webhook (Pay-In)#

Error codes#

Payment methods

Configuration (Mozarto back office)

Pay-In

Request body

Example request

Response

Pay-Out

Request body

Example request

Response

Webhook

Payload example

Status values

Payer-info webhook (Pay-In)

Error codes