📘

BI-SNAP Compliance

This page describes how Midtrans implements the BI-SNAP technical standard for API architecture, data formats, HTTP methods, and URI path standardization. It serves as reference material for both developers integrating with the BI-SNAP Core API and for compliance/audit purposes.

API Architecture

Architecture Type

The BI-SNAP Core API uses a RESTful architecture over HTTPS, aligning with the ASPI standard requirement (Tipe Arsitektur API = REST). All communication between merchants and Midtrans occurs over encrypted TLS channels using standard HTTP request/response patterns with JSON payloads.

System Components & Roles

The BI-SNAP integration involves three primary roles:

Separation of Concerns

The API is organized into distinct functional groups, each with its own security scope:

Architecture Diagram

┌──────────────┐         HTTPS/TLS 1.2+         ┌──────────────────┐
│              │  ────── Access Token API ──────► │                  │
│   Merchant   │  ────── Transactional APIs ───► │     Midtrans     │
│   (Client)   │  ◄───── HTTP Notifications ──── │   (PJP Server)   │
│              │  ────── Reporting APIs ────────► │                  │
└──────────────┘                                  └────────┬─────────┘
                                                           │
                                                  ┌────────▼─────────┐
                                                  │  Payment Network │
                                                  │  (GoPay, Banks,  │
                                                  │   QRIS, etc.)    │
                                                  └──────────────────┘

Data Format & Character Encoding

All BI-SNAP Core API request and response bodies use JSON (JavaScript Object Notation) format with UTF-8 character encoding, in line with the BI-SNAP technical standard.

For detailed JSON object specifications per payment method, refer to:

• Request Body (JSON Parameter)
• JSON Objects

HTTP Methods

The BI-SNAP Core API uses a limited, well-defined set of HTTP methods. Each method is used consistently across the API according to its semantic meaning:

Endpoint Summary by HTTP Method

POST Endpoints

GET Endpoints

📘

Note

All BI-SNAP API calls require HTTPS. Plain HTTP requests are rejected. The minimum TLS version is 1.2. See Security Specification for details.

Standardized URI Path

URI Structure

BI-SNAP Core API endpoints follow a standardized URI pattern aligned with ASPI's specification:

https://{domain_api}/{version}/{service-group}/{operation}

API Base Domains

URI Examples

The following examples demonstrate how Midtrans BI-SNAP endpoints map to the ASPI URI standard /{domain_api}/{version}/{service-group}/{operation}:

Related Pages

For further details on specific security and integration topics:

• Security Specification — Encryption standards, TLS, key management, and end-customer authentication
• Signature Generation — Detailed signature formulas and examples for Access Token and Transactional APIs
• Credential Exchange — Public key exchange process and secured delivery methods
• Access Token API — OAuth 2.0 B2B token issuance
• Operational Reliability & Business Continuity — Availability, disaster recovery, and compliance controls
• BI-SNAP Overview — Migration guide and full endpoint reference