Apaczka API v2

The Apaczka API v2: form-encoded envelope requests signed with HMAC-SHA256, POST-only pseudo-paths and HTTP status always 200 — the real outcome is in the response body.

Request envelope

Every call is an HTTP POST with Content-Type: application/x-www-form-urlencoded and exactly four fields:

Field	Description
`app_id`	Your application ID (issued in the Apaczka panel)
`request`	The method payload as a JSON-serialized string
`expires`	Unix timestamp until which the request is valid (max +15 min)
`signature`	`HMAC-SHA256(app_id + ":" + route + ":" + request + ":" + expires, app_secret)` as lowercase hex

The route in the string-to-sign is the method path including path parameters and the trailing slash, e.g. order_send/ or waybill/123456/. See the Request signing guide for a worked example.

Response envelope

Responses are JSON with HTTP status always 200. Success or failure is carried in the body:


Code
{ "status": 200, "message": "", "response": { "...": "..." } }

A non-200 value in status (with an explanatory message) means the call failed. See Error semantics — this is the single most common integration surprise.