مستندات API همکاری

curl https://api.cubepass.ir/v1/ping \
  -H "Authorization: Bearer YOUR_TOKEN"

$ch = curl_init('https://api.cubepass.ir/v1/ping');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'GET',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN'],
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.get(
    "https://api.cubepass.ir/v1/ping",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/ping', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
  },
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.cubepass.ir/v1/ping", nil)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

{
  "success": true,
  "data": {
    "partner_id": 12,
    "your_ip": "203.0.113.10",
    "discount_percent": 10.0,
    "webhook_set": true
  }
}

{
  "success": false,
  "error": {
    "code": "insufficient_balance",
    "message": "موجودی کیف پول برای این سفارش کافی نیست.",
    "required": 450000,
    "balance": 120000
  }
}

curl https://api.cubepass.ir/v1/wallet \
  -H "Authorization: Bearer YOUR_TOKEN"

$ch = curl_init('https://api.cubepass.ir/v1/wallet');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'GET',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN'],
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.get(
    "https://api.cubepass.ir/v1/wallet",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/wallet', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
  },
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.cubepass.ir/v1/wallet", nil)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

{
  "success": true,
  "data": { "balance": 1250000, "currency": "IRT" }
}

{
  "success": true,
  "data": {
    "page": 1,
    "transactions": [
      {
        "id": 81,
        "amount": -450000,
        "balance_after": 800000,
        "kind": "order",
        "reason": "خرید Game Pass Ultimate 1 ماهه × 1 — سفارش CP-9F21A07C3D (ORD-1042)",
        "order_id": "CP-9F21A07C3D",
        "created_at": "2026-11-01T10:12:05+00:00"
      }
    ]
  }
}

curl https://api.cubepass.ir/v1/products?page=1&limit=100 \
  -H "Authorization: Bearer YOUR_TOKEN"

$ch = curl_init('https://api.cubepass.ir/v1/products?page=1&limit=100');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'GET',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN'],
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.get(
    "https://api.cubepass.ir/v1/products?page=1&limit=100",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/products?page=1&limit=100', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
  },
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.cubepass.ir/v1/products?page=1&limit=100", nil)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

{
  "success": true,
  "data": {
    "page": 1,
    "total": 2,
    "products": [
      {
        "id": 17,
        "name": "Game Pass Ultimate",
        "available": true,
        "category": "gamepass",
        "brand": "Xbox",
        "variants": [
          {
            "id": 41,
            "name": "1 ماهه",
            "available": true,
            "price": 450000,
            "site_price": 500000,
            "delivery": "account",
            "in_stock": true,
            "required_fields": []
          }
        ]
      },
      {
        "id": 23,
        "name": "PS Plus",
        "available": false,
        "unavailable_reason": "out_of_stock"
      }
    ]
  }
}

curl -X POST https://api.cubepass.ir/v1/holds \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      {
        "product_id": 17,
        "variant_id": 41,
        "quantity": 14
      }
    ]
  }'

$ch = curl_init('https://api.cubepass.ir/v1/holds');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => '{"items": [{"product_id": 17, "variant_id": 41, "quantity": 14}]}',
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.post(
    "https://api.cubepass.ir/v1/holds",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    json={"items": [{"product_id": 17, "variant_id": 41, "quantity": 14}]},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/holds', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"items": [{"product_id": 17, "variant_id": 41, "quantity": 14}]}),
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{"items": [{"product_id": 17, "variant_id": 41, "quantity": 14}]}`)
	req, _ := http.NewRequest("POST", "https://api.cubepass.ir/v1/holds", body)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

curl -X POST https://api.cubepass.ir/v1/orders \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "client_order_id": "ORD-1042",
    "items": [
      {
        "product_id": 17,
        "variant_id": 41,
        "quantity": 1
      }
    ],
    "expected_total": 450000
  }'

$ch = curl_init('https://api.cubepass.ir/v1/orders');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => '{"client_order_id": "ORD-1042", "items": [{"product_id": 17, "variant_id": 41, "quantity": 1}], "expected_total": 450000}',
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.post(
    "https://api.cubepass.ir/v1/orders",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    json={"client_order_id": "ORD-1042", "items": [{"product_id": 17, "variant_id": 41, "quantity": 1}], "expected_total": 450000},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/orders', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"client_order_id": "ORD-1042", "items": [{"product_id": 17, "variant_id": 41, "quantity": 1}], "expected_total": 450000}),
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{"client_order_id": "ORD-1042", "items": [{"product_id": 17, "variant_id": 41, "quantity": 1}], "expected_total": 450000}`)
	req, _ := http.NewRequest("POST", "https://api.cubepass.ir/v1/orders", body)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

{
  "success": true,
  "data": {
    "order_id": "CP-9F21A07C3D",
    "client_order_id": "ORD-1042",
    "status": "completed",
    "status_label": "تحویل شده",
    "total": 450000,
    "created_at": "2026-11-01T10:12:05+00:00",
    "items": [
      {
        "product_id": 17,
        "variant_id": 41,
        "name": "Game Pass Ultimate",
        "variant": "1 ماهه",
        "quantity": 1,
        "unit_price": 450000,
        "delivery": "account",
        "accounts": [
          { "kind": "account", "login": "user@example.com", "password": "S3cret" }
        ]
      }
    ]
  }
}

{ "kind": "account",  "login": "...", "password": "..." }
{ "kind": "link",     "link": "https://..." }
{ "kind": "code",     "code": "XXXX-XXXX" }
{ "kind": "customer", "note": "..." }

{
  "product_id": 30,
  "variant_id": 0,
  "quantity": 1,
  "inputs": [{ "email": "customer@example.com", "password": "..." }]
}

curl -X POST https://api.cubepass.ir/v1/orders/CP-9F21A07C3D/cancel \
  -H "Authorization: Bearer YOUR_TOKEN"

$ch = curl_init('https://api.cubepass.ir/v1/orders/CP-9F21A07C3D/cancel');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_TOKEN'],
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

import requests

response = requests.post(
    "https://api.cubepass.ir/v1/orders/CP-9F21A07C3D/cancel",
    headers={"Authorization": "Bearer YOUR_TOKEN"},
    timeout=30,
)
print(response.json())

const response = await fetch('https://api.cubepass.ir/v1/orders/CP-9F21A07C3D/cancel', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_TOKEN',
  },
});

console.log(await response.json());

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.cubepass.ir/v1/orders/CP-9F21A07C3D/cancel", nil)
	req.Header.Set("Authorization", "Bearer YOUR_TOKEN")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

{
  "id": "evt_5b1c9e2f7a",
  "event": "order.completed",
  "created_at": 1793500000,
  "data": {
    "order_id": "CP-9F21A07C3D",
    "client_order_id": "ORD-1042",
    "status": "completed",
    "items": []
  }
}

$body = file_get_contents('php://input');
$ts   = $_SERVER['HTTP_X_CUBE_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_CUBE_SIGNATURE'] ?? '';
$good = hash_hmac('sha256', $ts . '.' . $body, getenv('CUBE_WEBHOOK_SECRET'));

if (!hash_equals($good, $sig) || abs(time() - (int) $ts) > 300) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);
http_response_code(200);

import hashlib, hmac, time

def is_valid(body: bytes, ts: str, sig: str, secret: str) -> bool:
    good = hmac.new(secret.encode(), ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(good, sig) and abs(time.time() - int(ts)) <= 300

const crypto = require('crypto');

function isValid(rawBody, ts, sig, secret) {
  const good = crypto.createHmac('sha256', secret).update(ts + '.' + rawBody).digest('hex');
  const same = good.length === sig.length && crypto.timingSafeEqual(Buffer.from(good), Buffer.from(sig));
  return same && Math.abs(Date.now() / 1000 - Number(ts)) <= 300;
}

func isValid(body []byte, ts, sig, secret string) bool {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(ts + "."))
	mac.Write(body)
	good := hex.EncodeToString(mac.Sum(nil))
	sent, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sent)) > 300 {
		return false
	}
	return hmac.Equal([]byte(good), []byte(sig))
}

import uuid
import requests

API = "https://api.cubepass.ir/v1"
HEADERS = {"Authorization": "Bearer YOUR_TOKEN"}

hold = requests.post(f"{API}/holds", headers=HEADERS, timeout=20, json={
    "items": [{"product_id": 17, "variant_id": 41, "quantity": 14}],
}).json()["data"]

if not hold["available"]:
    print("Not available")
elif not hold["wallet_sufficient"]:
    requests.delete(f"{API}/holds/{hold['hold_id']}", headers=HEADERS, timeout=20)
    print("Insufficient balance")
else:
    order = requests.post(f"{API}/orders", headers=HEADERS, timeout=30, json={
        "client_order_id": str(uuid.uuid4()),
        "hold_id": hold["hold_id"],
    }).json()["data"]
    print(order["status"], order["items"])

const API = 'https://api.cubepass.ir/v1';
const headers = { Authorization: 'Bearer YOUR_TOKEN', 'Content-Type': 'application/json' };

const post = async (path, body) =>
  (await (await fetch(API + path, { method: 'POST', headers, body: JSON.stringify(body) })).json()).data;

const hold = await post('/holds', { items: [{ product_id: 17, variant_id: 41, quantity: 14 }] });

if (!hold.available) {
  console.log('Not available');
} else if (!hold.wallet_sufficient) {
  await fetch(`${API}/holds/${hold.hold_id}`, { method: 'DELETE', headers });
  console.log('Insufficient balance');
} else {
  const order = await post('/orders', { client_order_id: crypto.randomUUID(), hold_id: hold.hold_id });
  console.log(order.status, order.items);
}