{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"aab7e829-5d6e-4491-9e02-7f73b59e75a2","name":"QwantiFi Integrated Applications Self-Service API","description":"# **Intended Audience**\n\n**This document is intended to support an application developer (hands on technical programmer) during their integration with Magensa services.**\n\nThe integrating developer should be familiar with the concepts of Restful APIs and have a good understanding of payment device communications.\n\nThis set of examples is designed to get a developer up and running quickly. It is not designed to be exhaustive of all possible integration scenarios. For more advanced integrations and other cases not covered here, please contact your assigned solutions architect for information.\n\nIn order to fully benefit from the examples provided, the integrating developer should have a Postman account where the collection can be copied to. Create a new Postman account here: [https://www.postman.com](https://www.postman.com)\n\n# Overview\n\n**Integrated Applications credentials are provisioned for you.** Onboarding is a portal / server-to-server operation and is not part of this API — an Integrated Application cannot mint itself a credential or a new refresh token. If you have no credentials, or your refresh token has expired, contact whoever onboarded you.\n\n### RMS Device Management for QwantiFi Cloud\n\nPlease see this collection for the RMS device management for QwantiFi Cloud: [QwantiFi Cloud Management](https://rmsv2.developer.magtek.com/#919d6207-be9d-41b6-942b-c9dadb1aa66a)\n\n## Authentication\n\nEvery request in this collection carries **two factors**, and both must pass.\n\n**1\\.** **`Authorization: Bearer`** — your current Integrated Applications access token. This is `mqttConfig.password` from your last issuance or refresh: the same token you place in the MQTT `CONNECT` password field. It is not a separate API key. It is configured once as collection-level Bearer auth, so every request inherits it — you do not add the header yourself.\n\n**2\\.** **`username`** **and** **`refreshToken`** **in the request body** — your Integrated Application username and the opaque refresh token you received at onboarding. The refresh token is verified against a stored salted hash; the platform never holds the plaintext, and it cannot be recovered if you lose it.\n\n**Your access token must be unexpired — except on refresh.** `pos-credentials/refresh` accepts an expired token, because replacing an expired credential is exactly what it is for. The three read-only requests reject one with `401`. If yours has lapsed, refresh first and retry with the token that comes back.\n\n**Keep your last access token even after it expires** — it is what you present to refresh. Losing it means you cannot refresh, and there is no self-service way back.\n\nA request is rejected when the token's signature does not verify, when its `username` claim does not match the `username` in the body, when it has expired (on the three read-only requests), when it was issued more than the refresh-token lifetime ago (90 days by default — this one applies everywhere, including refresh), or when the refresh token is invalid, expired, or revoked. Any failure of either factor returns a single generic `401` with the body `{ \"error\": \"Unauthorized.\" }` and no further detail, by design.\n\n## Quickstart Guide\n\n1. Set `posUsername`, `posRefreshToken`, and `posAccessToken` from the payload you received at onboarding.\n    \n2. Set `baseUrl` for your environment. To test against the MagTek DEV environment, use `https://devgw.magensa.dev/MagensaMQTT`.\n    \n3. Run **Refresh Access Token** first. Its test script writes the new token back into `posAccessToken`, so the three read-only requests work immediately afterward.\n    \n\nThe saved example responses throughout this collection show the MagTek DEV environment. Broker coordinates, reseller and customer ids, and device serials all differ per environment and per account.\n\n## Notes\n\n- **Only refresh mints anything.** The three **Device Discovery** requests are strictly read-only: no token is issued and your refresh token is never rotated.\n    \n- **Refresh does not rotate your refresh token.** `refreshToken` comes back `null` on the refresh response — keep using the one you already have. Refreshing on schedule does slide its expiry forward, so an actively-refreshing Integrated Application is never forced back through onboarding.\n    \n- **Your scope is inferred server-side** from your stored Integrated Application record — either reseller-wide or a single customer/merchant. You never name a reseller or customer in a request body, and you can only ever see your own devices.\n    \n- Errors are always shaped `{ \"error\": \"...\" }`. `400` means a required field is missing, `401` an authentication failure, `404` a device you do not own or that does not exist, and `503` that the service is temporarily unavailable — retry that one with backoff.","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":false,"owner":"33729815","team":6083045,"collectionId":"aab7e829-5d6e-4491-9e02-7f73b59e75a2","publishedId":"2sBYB1MTR2","public":true,"publicUrl":"https://qwantifi-apps.developer.magtek.com","privateUrl":"https://go.postman.co/documentation/33729815-aab7e829-5d6e-4491-9e02-7f73b59e75a2","customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"documentationLayout":"classic-single-column","customisation":{"metaTags":[{"name":"description","value":""},{"name":"title","value":"QwantiFi Cloud POS integration"}],"appearance":{"default":"light","themes":[{"name":"dark","logo":null,"colors":{"top-bar":"212121","right-sidebar":"303030","highlight":"FF6C37"}},{"name":"light","logo":null,"colors":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"}}]}},"version":"8.12.6","publishDate":"2026-09-16T21:40:52.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"QwantiFi Cloud POS integration","description":""},"logos":{"logoLight":null,"logoDark":null}},"statusCode":200},"environments":[],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/54710abbcbe0595b52ebedcdb464cfaf3ee177ca1c5a5d0850c1dc24c3508caf","favicon":"https://res.cloudinary.com/postman/image/upload/v1741199418/team/2b0e542073ba9f727998a67f8bd10fe7.ico"},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"}],"canonicalUrl":"https://qwantifi-apps.developer.magtek.com/view/metadata/2sBYB1MTR2"}