# Public API Integration
URL: /docs/public-api

Order, payment, product and reporting integration with the PlusPay Public API.

The PlusPay **Public API** exposes REST endpoints for creating orders, collecting payments via physical POS and EFT/POS, managing products/categories and reporting. All responses are `application/json`.

## Environments

| Ortam / Env | Base URL                                        |
| ----------- | ----------------------------------------------- |
| Production  | `https://public-api-live.paymentapi.com.tr/`    |
| Staging     | `https://public-api-staging.paymentapi.com.tr/` |
| Development | `https://public-api-dev.paymentapi.com.tr/`     |

## Authentication

The `api_key`, `secret_key` and `merchant_id` are provided **by the PlusPay team / via the admin panel**. Call `POST /v1/auth` with them and send the returned `access_token` as the `Authorization: Bearer <access_token>` header on every subsequent request. The token lifetime is returned in `expires_in`; call `/v1/auth` again when it expires.

## Common conventions

All authenticated endpoints optionally accept the `lang` (`tr` / `en`) and `branch_code` (branch code) **headers**. These are not repeated in each endpoint.

## Error body

Errors return a standard body:

```json
{
  "error_code": "VALIDATION_ERROR",
  "message": "..."
}
```

| HTTP  | `error_code`       |
| ----- | ------------------ |
| `400` | `BAD_REQUEST`      |
| `401` | `UNAUTHORIZED`     |
| `403` | `FORBIDDEN`        |
| `404` | `NOT_FOUND`        |
| `409` | `DUPLICATE`        |
| `422` | `VALIDATION_ERROR` |

## Rate limit

The `POST /v1/transactions-last-update` endpoint is limited to **max 20 requests per minute**.