# Set credentials (see /api/authentication for the signing helper)
export SALESOS_API_KEY="sk_live_YOUR_API_KEY"
export SALESOS_API_SECRET="YOUR_API_KEY_SECRET"
export SALESOS_URL="https://api.play2sell.com/functions/v1/payments"

# 1. Issue an invoice (BR PIX charge with auto NFS-e)
curl -s -X POST "$SALESOS_URL/invoices" \
  -H "Authorization: P2S-SIGN-V1 API_KEY:TIMESTAMP:SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "customer": { "country": "BR", "tax_id": "12345678000190", "name": "Acme Corp", "email": "billing@acme.com" },
    "amount": 12345, "currency": "BRL",
    "description": "Consulting — April/2026",
    "payment_method": { "type": "pix", "expires_in_seconds": 3600 },
    "tax_document": { "auto_issue": true, "type": "nfse", "service_code": "01.05" },
    "cost_center": "CC-OPERATIONS", "contractor_reference": "PO-9981"
  }' | jq .

# 2. Pay a prize via PIX
curl -s -X POST "$SALESOS_URL/payouts" \
  -H "Authorization: P2S-SIGN-V1 API_KEY:TIMESTAMP:SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "beneficiary": {
      "name": "Maria Santos", "document": "12345678901", "phone": "+5511999000111", "email": "maria@example.com",
      "bank_account": { "type": "pix", "key_type": "cpf", "key": "12345678901" }
    },
    "amount": 50000, "currency": "BRL", "purpose": "prize",
    "cost_center": "CC-AWARDS", "contractor_reference": "EVENT-Q2-WINNER-12"
  }' | jq .

# 3. Read the statement for the cost center
curl -s -X GET "$SALESOS_URL/balance-transactions?cost_center=CC-AWARDS&created[gte]=2026-04-01&limit=100" \
  -H "Authorization: P2S-SIGN-V1 API_KEY:TIMESTAMP:SIGNATURE" | jq .

import { randomUUID } from 'node:crypto';

const API_URL = 'https://api.play2sell.com/functions/v1/payments';
const API_KEY = process.env.SALESOS_API_KEY;

async function call(path, { method = 'GET', body } = {}) {
  const headers = {
    // P2S-SIGN-V1 — see signedRequest() in /api/authentication
    'Authorization': await signedHeader(method, path, body),
    'Content-Type': 'application/json',
  };
  if (method === 'POST') headers['Idempotency-Key'] = randomUUID();

  const res = await fetch(`${API_URL}${path}`, {
    method,
    headers,
    body: body ? JSON.stringify(body) : undefined,
  });

  if (!res.ok) {
    const problem = await res.json();
    throw new Error(`${problem.code}: ${problem.detail || problem.title}`);
  }
  return res.json();
}

// Issue an invoice (BR PIX charge with auto NFS-e), pay a prize, read the statement
const invoice = await call('/invoices', {
  method: 'POST',
  body: {
    customer: { country: 'BR', tax_id: '12345678000190', name: 'Acme Corp', email: 'billing@acme.com' },
    amount: 12345,
    currency: 'BRL',
    description: 'Consulting — April/2026',
    payment_method: { type: 'pix', expires_in_seconds: 3600 },
    tax_document: { auto_issue: true, type: 'nfse', service_code: '01.05' },
    cost_center: 'CC-OPERATIONS',
    contractor_reference: 'PO-9981',
  },
});
console.log(`Invoice issued: ${invoice.id} (our_number: ${invoice.our_number}, pix qr: ${invoice.payment_method.pix.qr_code})`);

const payout = await call('/payouts', {
  method: 'POST',
  body: {
    beneficiary: {
      name: 'Maria Santos',
      document: '12345678901',
      phone: '+5511999000111',
      email: 'maria@example.com',
      bank_account: { type: 'pix', key_type: 'cpf', key: '12345678901' },
    },
    amount: 50000,
    currency: 'BRL',
    purpose: 'prize',
    cost_center: 'CC-AWARDS',
    contractor_reference: 'EVENT-Q2-WINNER-12',
  },
});
console.log(`Payout sent: ${payout.id} (${payout.status}, our_number: ${payout.our_number})`);

const statement = await call(
  '/balance-transactions?cost_center=CC-AWARDS&created[gte]=2026-04-01&limit=100',
);
console.log(`Statement: ${statement.data.length} entries`);

import os
import uuid
import requests

API_URL = 'https://api.play2sell.com/functions/v1/payments'
API_KEY = os.environ['SALESOS_API_KEY']

def call(path: str, method: str = 'GET', body: dict | None = None) -> dict:
    headers = {
        'Authorization': f'Bearer {API_KEY}',
        'Content-Type': 'application/json',
    }
    if method == 'POST':
        headers['Idempotency-Key'] = str(uuid.uuid4())

    r = requests.request(method, f'{API_URL}{path}', json=body, headers=headers, timeout=30)
    if not r.ok:
        problem = r.json()
        raise Exception(f"{problem.get('code')}: {problem.get('detail') or problem.get('title')}")
    return r.json()


# Issue an invoice (BR PIX charge with auto NFS-e)
invoice = call('/invoices', 'POST', {
    'customer': {'country': 'BR', 'tax_id': '12345678000190', 'name': 'Acme Corp', 'email': 'billing@acme.com'},
    'amount': 12345,
    'currency': 'BRL',
    'description': 'Consulting — April/2026',
    'payment_method': {'type': 'pix', 'expires_in_seconds': 3600},
    'tax_document': {'auto_issue': True, 'type': 'nfse', 'service_code': '01.05'},
    'cost_center': 'CC-OPERATIONS',
    'contractor_reference': 'PO-9981',
})
print(f"Invoice issued: {invoice['id']} (our_number: {invoice['our_number']})")
print(f"PIX QR code: {invoice['payment_method']['pix']['qr_code']}")

# Pay a prize
payout = call('/payouts', 'POST', {
    'beneficiary': {
        'name': 'Maria Santos',
        'document': '12345678901',
        'phone': '+5511999000111',
        'email': 'maria@example.com',
        'bank_account': {'type': 'pix', 'key_type': 'cpf', 'key': '12345678901'},
    },
    'amount': 50000,
    'currency': 'BRL',
    'purpose': 'prize',
    'cost_center': 'CC-AWARDS',
    'contractor_reference': 'EVENT-Q2-WINNER-12',
})
print(f"Payout sent: {payout['id']} ({payout['status']}, our_number: {payout['our_number']})")

# Read statement
statement = call('/balance-transactions?cost_center=CC-AWARDS&created[gte]=2026-04-01&limit=100')
print(f"Statement: {len(statement['data'])} entries")

<?php

$apiUrl       = 'https://api.play2sell.com/functions/v1/payments';
$apiKey       = getenv('SALESOS_API_KEY');
$apiKeySecret = getenv('SALESOS_API_SECRET');

// Build the P2S-SIGN-V1 Authorization header. Note: PHP's hash_hmac()
// takes (data, key) — opposite of Node/Python — so the args look reversed.
function p2sSignedHeader(string $method, string $fullPath, string $body): string {
    global $apiKey, $apiKeySecret;
    $ts          = (string) time();
    $payloadHash = hash('sha256', $body);
    $k1  = hash_hmac('sha256', $apiKey,      $apiKeySecret, true);
    $k2  = hash_hmac('sha256', $ts,          $k1,           true);
    $k3  = hash_hmac('sha256', $method,      $k2,           true);
    $k4  = hash_hmac('sha256', $fullPath,    $k3,           true);
    $sig = hash_hmac('sha256', $payloadHash, $k4);  // hex
    return "P2S-SIGN-V1 {$apiKey}:{$ts}:{$sig}";
}

function call(string $path, string $method = 'GET', ?array $body = null): array {
    global $apiUrl;
    $bodyStr  = $body ? json_encode($body) : '';
    $fullPath = parse_url($apiUrl, PHP_URL_PATH) . $path;

    $headers = [
        'Authorization: ' . p2sSignedHeader($method, $fullPath, $bodyStr),
        'Content-Type: application/json',
    ];
    if ($method === 'POST') {
        $headers[] = 'Idempotency-Key: ' . bin2hex(random_bytes(16));
    }

    $ch = curl_init($apiUrl . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_POSTFIELDS => $bodyStr ?: null,
        CURLOPT_TIMEOUT => 30,
    ]);

    $res = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    $json = json_decode($res, true);

    if ($code >= 400) {
        throw new Exception(($json['code'] ?? 'error') . ': ' . ($json['detail'] ?? $json['title'] ?? 'unknown'));
    }
    return $json;
}

// Issue an invoice (BR PIX charge with auto NFS-e)
$invoice = call('/invoices', 'POST', [
    'customer' => ['country' => 'BR', 'tax_id' => '12345678000190', 'name' => 'Acme Corp', 'email' => 'billing@acme.com'],
    'amount' => 12345,
    'currency' => 'BRL',
    'description' => 'Consulting — April/2026',
    'payment_method' => ['type' => 'pix', 'expires_in_seconds' => 3600],
    'tax_document' => ['auto_issue' => true, 'type' => 'nfse', 'service_code' => '01.05'],
    'cost_center' => 'CC-OPERATIONS',
    'contractor_reference' => 'PO-9981',
]);
echo "Invoice issued: {$invoice['id']} (our_number: {$invoice['our_number']})\n";
echo "PIX QR: {$invoice['payment_method']['pix']['qr_code']}\n";

// Pay a prize
$payout = call('/payouts', 'POST', [
    'beneficiary' => [
        'name' => 'Maria Santos',
        'document' => '12345678901',
        'phone' => '+5511999000111',
        'email' => 'maria@example.com',
        'bank_account' => ['type' => 'pix', 'key_type' => 'cpf', 'key' => '12345678901'],
    ],
    'amount' => 50000,
    'currency' => 'BRL',
    'purpose' => 'prize',
    'cost_center' => 'CC-AWARDS',
    'contractor_reference' => 'EVENT-Q2-WINNER-12',
]);
echo "Payout sent: {$payout['id']} ({$payout['status']}, our_number: {$payout['our_number']})\n";