Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools →
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/hitpay:hitpay-virtual-accounts-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: HitPay Virtual Accounts API
description: 'Accept PayNow, FPX, QRIS, GrabPay, cards, and 40+ payment methods with a single API. Production base URL: https://api.hit-pay.com, Sandbox: https://api.sandbox.hit-pay.com'
version: '1.0'
servers:
- url: https://api.hit-pay.com
description: Production
- url: https://api.sandbox.hit-pay.com
description: Sandbox
tags:
- name: Virtual Accounts
paths:
/v1/virtual-accounts:
get:
tags:
- Virtual Accounts
summary: Get virtual accounts
description: 'Retrieve the list of virtual accounts for a business. Results are paginated using cursor-based pagination
and ordered by creation date (newest first).'
parameters:
- name: X-BUSINESS-API-KEY
in: header
required: true
style: simple
explode: false
schema:
type: string
example: b286daabf9921b5a01a4621f026c111e046f8911feba212996c92159b98427d
- name: cursor
in: query
schema:
type:
- string
- 'null'
description: Cursor for pagination
- name: per_page
in: query
schema:
type: integer
enum:
- 5
- 10
- 20
- 25
- 50
- 100
default: 25
description: Number of results per page
- name: bank_country
in: query
schema:
type: string
description: Only return virtual accounts held in this bank country (two-letter lowercase ISO 3166-1 code, e.g. `sg`)
- name: status
in: query
schema:
type: string
enum:
- open
- closed
description: Only return open or closed virtual accounts. A closed account is one that has been closed; this is separate from the `status` field in the response, which is the provisioning status. Omit to return both.
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
description: Virtual account ID
example: 9b3f1a2c-1d4e-4f6a-8b2c-7e9d0a1b2c3d
name:
type: string
description: Display name of the virtual account
example: Acme Pte Ltd
reference:
type: string
description: Virtual account reference issued by the bank. For DBS Singapore this is the 7-digit VA number that forms the tail of `account_number`.
example: '1234567'
status:
type:
- string
- 'null'
description: 'Provisioning status of the virtual account: `pending`, `success`, or `rejected`. `pending` means the bank has acknowledged the request but has not activated the account yet.'
example: success
country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the business the virtual account belongs to
example: sg
supported_currencies:
type:
- array
- 'null'
items:
type: string
description: Uppercase currency codes that can be received into this virtual account
example:
- SGD
- USD
holder_name:
type: string
description: Account holder name, i.e. the registered name of the business
example: Acme Pte Ltd
account_number:
type: string
description: Full account number to transfer funds to. For DBS Singapore this is the VA prefix and corporate code prepended to `reference`.
example: '8854911234567'
bank_name:
type:
- string
- 'null'
description: Name of the bank holding the virtual account
example: DBS Bank
bank_swift_code:
type:
- string
- 'null'
description: SWIFT/BIC code of the bank. `null` for providers that settle without one, such as Philippine accounts on InstaPay and PESONet.
example: DBSSSGSG
bank_country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the country the bank account is held in. Can differ from `country`, e.g. a Singapore business can hold an account in `gb`.
example: sg
bank_attributes:
type:
- object
- 'null'
description: Bank details for paying into the account. `type` names the account identifier that applies (`local`, `iban`, `sort_code` or `bsb`) and the other keys depend on it. `null` while the bank is still issuing the account.
properties:
type:
type: string
example: local
account_number:
type: string
example: '8854911234567'
bank_name:
type: string
example: DBS Bank
bank_address:
type: string
swift_code:
type: string
example: DBSSSGSG
iban:
type: string
sort_code:
type: string
bsb:
type: string
bic:
type: string
transfer_types:
type: array
items:
type: string
example:
- FAST
- SWIFT
additionalProperties: true
transfer_types:
type: array
items:
type: string
description: Transfer rails the virtual account can receive funds over
example:
- FAST
- SWIFT
created_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was created
example: '2026-06-08T15:30:10+08:00'
updated_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was last updated
example: '2026-06-08T15:30:10+08:00'
links:
type: object
properties:
first:
type:
- string
- 'null'
last:
type:
- string
- 'null'
prev:
type:
- string
- 'null'
next:
type:
- string
- 'null'
meta:
type: object
properties:
path:
type: string
per_page:
type: integer
next_cursor:
type:
- string
- 'null'
prev_cursor:
type:
- string
- 'null'
'401':
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'403':
description: Forbidden
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
operationId: getV1VirtualAccounts
x-operation-id-source: derived
post:
tags:
- Virtual Accounts
summary: Create a virtual account
description: 'Create a virtual account for the business in the bank country given by `bank_country`. HitPay picks the bank that serves that location.
The locations a business can request depend on the business''s own country:
| Business country | `bank_country` | Currencies received |
|---|---|---|
| `sg` | `sg` | SGD, USD, EUR, GBP, CAD, CHF, CNH, CNY, HKD, NOK, NZD, SEK |
| `sg` | `ph` | PHP |
| `sg` | `gb` | GBP, EUR |
| `sg` | `dk` | EUR |
| `sg` | `lu` | EUR |
| `ph` | `ph` | PHP |
| `au` | `au` | AUD |
The payment provider serving the location must have completed onboarding for the business, or the request returns 400. For `sg` and `ph` the business enables it under Settings > Payment Methods. HitPay sets up the provider for `gb`, `dk`, `lu` and `au`.
A business can hold one virtual account per location. If one already exists, the request returns 409 Conflict. The business must have payments enabled.
**Migration note:** `bank_country` is required. A request without it used to create the default virtual account for the business''s country. It now returns 422. To keep the old behaviour, send the business''s own country, for example `{"bank_country": "sg"}` for a Singapore business.'
parameters:
- name: X-BUSINESS-API-KEY
in: header
required: true
style: simple
explode: false
schema:
type: string
example: b286daabf9921b5a01a4621f026c111e046f8911feba212996c92159b98427d
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- bank_country
properties:
bank_country:
type: string
description: Two-letter lowercase ISO 3166-1 code of the country the account is held in. See the table above.
example: sg
payment_provider_method:
type: string
description: Optional. Pins the location to one payment method, e.g. `dbs_va`. Rejected with 400 if that method does not serve `bank_country`.
example: dbs_va
currency:
type: string
description: Optional. The currency to receive, e.g. `sgd`. Only needed when more than one provider serves `bank_country` for the business.
example: sgd
responses:
'201':
description: Virtual account created successfully
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
description: Virtual account ID
example: 9b3f1a2c-1d4e-4f6a-8b2c-7e9d0a1b2c3d
name:
type: string
description: Display name of the virtual account
example: Acme Pte Ltd
reference:
type: string
description: Virtual account reference issued by the bank. For DBS Singapore this is the 7-digit VA number that forms the tail of `account_number`.
example: '1234567'
status:
type:
- string
- 'null'
description: 'Provisioning status of the virtual account: `pending`, `success`, or `rejected`. `pending` means the bank has acknowledged the request but has not activated the account yet.'
example: success
country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the business the virtual account belongs to
example: sg
supported_currencies:
type:
- array
- 'null'
items:
type: string
description: Uppercase currency codes that can be received into this virtual account
example:
- SGD
- USD
holder_name:
type: string
description: Account holder name, i.e. the registered name of the business
example: Acme Pte Ltd
account_number:
type: string
description: Full account number to transfer funds to. For DBS Singapore this is the VA prefix and corporate code prepended to `reference`.
example: '8854911234567'
bank_name:
type:
- string
- 'null'
description: Name of the bank holding the virtual account
example: DBS Bank
bank_swift_code:
type:
- string
- 'null'
description: SWIFT/BIC code of the bank. `null` for providers that settle without one, such as Philippine accounts on InstaPay and PESONet.
example: DBSSSGSG
bank_country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the country the bank account is held in. Can differ from `country`, e.g. a Singapore business can hold an account in `gb`.
example: sg
bank_attributes:
type:
- object
- 'null'
description: Bank details for paying into the account. `type` names the account identifier that applies (`local`, `iban`, `sort_code` or `bsb`) and the other keys depend on it. `null` while the bank is still issuing the account.
properties:
type:
type: string
example: local
account_number:
type: string
example: '8854911234567'
bank_name:
type: string
example: DBS Bank
bank_address:
type: string
swift_code:
type: string
example: DBSSSGSG
iban:
type: string
sort_code:
type: string
bsb:
type: string
bic:
type: string
transfer_types:
type: array
items:
type: string
example:
- FAST
- SWIFT
additionalProperties: true
transfer_types:
type: array
items:
type: string
description: Transfer rails the virtual account can receive funds over
example:
- FAST
- SWIFT
created_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was created
example: '2026-06-08T15:30:10+08:00'
updated_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was last updated
example: '2026-06-08T15:30:10+08:00'
'400':
description: Bad Request — the business cannot hold a virtual account in that location, the location is ambiguous without `currency`, or its payment provider has not completed onboarding
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'401':
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'403':
description: Forbidden — business does not have payments enabled
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'409':
description: Conflict — the business already holds a virtual account in this location
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'422':
description: Unprocessable Entity — `bank_country` is missing or not a country code
content:
application/json:
schema:
type: object
properties:
message:
type: string
example: The bank country field is required.
errors:
type: object
additionalProperties:
type: array
items:
type: string
example:
bank_country:
- The bank country field is required.
operationId: postV1VirtualAccounts
x-operation-id-source: derived
/v1/virtual-accounts/{virtual_account_id}:
get:
tags:
- Virtual Accounts
summary: Get virtual account details
description: Retrieve detailed information about a specific virtual account.
parameters:
- name: X-BUSINESS-API-KEY
in: header
required: true
style: simple
explode: false
schema:
type: string
example: b286daabf9921b5a01a4621f026c111e046f8911feba212996c92159b98427d
- name: virtual_account_id
in: path
required: true
schema:
type: string
format: uuid
description: The virtual account ID
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
description: Virtual account ID
example: 9b3f1a2c-1d4e-4f6a-8b2c-7e9d0a1b2c3d
name:
type: string
description: Display name of the virtual account
example: Acme Pte Ltd
reference:
type: string
description: Virtual account reference issued by the bank. For DBS Singapore this is the 7-digit VA number that forms the tail of `account_number`.
example: '1234567'
status:
type:
- string
- 'null'
description: 'Provisioning status of the virtual account: `pending`, `success`, or `rejected`. `pending` means the bank has acknowledged the request but has not activated the account yet.'
example: success
country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the business the virtual account belongs to
example: sg
supported_currencies:
type:
- array
- 'null'
items:
type: string
description: Uppercase currency codes that can be received into this virtual account
example:
- SGD
- USD
holder_name:
type: string
description: Account holder name, i.e. the registered name of the business
example: Acme Pte Ltd
account_number:
type: string
description: Full account number to transfer funds to. For DBS Singapore this is the VA prefix and corporate code prepended to `reference`.
example: '8854911234567'
bank_name:
type:
- string
- 'null'
description: Name of the bank holding the virtual account
example: DBS Bank
bank_swift_code:
type:
- string
- 'null'
description: SWIFT/BIC code of the bank. `null` for providers that settle without one, such as Philippine accounts on InstaPay and PESONet.
example: DBSSSGSG
bank_country:
type: string
description: Two-letter lowercase ISO 3166-1 country code of the country the bank account is held in. Can differ from `country`, e.g. a Singapore business can hold an account in `gb`.
example: sg
bank_attributes:
type:
- object
- 'null'
description: Bank details for paying into the account. `type` names the account identifier that applies (`local`, `iban`, `sort_code` or `bsb`) and the other keys depend on it. `null` while the bank is still issuing the account.
properties:
type:
type: string
example: local
account_number:
type: string
example: '8854911234567'
bank_name:
type: string
example: DBS Bank
bank_address:
type: string
swift_code:
type: string
example: DBSSSGSG
iban:
type: string
sort_code:
type: string
bsb:
type: string
bic:
type: string
transfer_types:
type: array
items:
type: string
example:
- FAST
- SWIFT
additionalProperties: true
transfer_types:
type: array
items:
type: string
description: Transfer rails the virtual account can receive funds over
example:
- FAST
- SWIFT
created_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was created
example: '2026-06-08T15:30:10+08:00'
updated_at:
type: string
format: date-time
description: ISO 8601 timestamp of when the virtual account was last updated
example: '2026-06-08T15:30:10+08:00'
'401':
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'403':
description: Forbidden
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
'404':
description: Not Found
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Error message
errors:
type: array
operationId: getV1VirtualAccountsByVirtualAccountId
x-operation-id-source: derived
x-readme:
headers: []
explorer-enabled: true
proxy-enabled: true
samples-enabled: true
x-readme-fauxas: true
x-provenance:
method: harvested
publisher: HitPay
source: https://docs.hitpayapp.com/openapi.json
note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
stamped by stamp-openapi-provenance.py (roadmap#793)