Create Payout Order

import { createHmac, randomBytes } from 'node:crypto';

function required(name) {
  const value = process.env[name]?.trim();
  if (!value) throw new Error(name + ' is required');
  return value;
}
const uid = required("UUGATE_MERCHANT_UID"), key = required("UUGATE_API_KEY");
const timestamp = String(Date.now()), nonce = randomBytes(16).toString("hex");
const method = 'POST', path = '/openapi/payout/orders';
const canonicalQuery = '', canonicalBody = "{\"amount\":\"35.50\",\"chainCode\":\"TRON\",\"deleteSourceAfterSuccess\":false,\"fromAddress\":\"TNjBrNq2a9FK2vwu4W9C1QdLKSZ42Yx5YY\",\"merchantOrderNo\":\"PO202604150001\",\"notifyUrl\":\"https://merchant.example.com/api/uugate/payout-notify\",\"toAddress\":\"TS7b7iD8G2PaPqK1TqSmLJ9nrrYH4oKX1S\",\"tokenSymbol\":\"USDT\"}";
const payload = [uid, timestamp, nonce, method, path, canonicalQuery, canonicalBody].join('\n');
const signature = createHmac('sha256', key).update(payload, 'utf8').digest('hex');
const base = (process.env.UUGATE_BASE_URL || 'https://api.uugate.com').replace(/\/+$/, '');
const response = await fetch(base + path, {
  method, redirect: 'error', signal: AbortSignal.timeout(30000),
  headers: { 'Content-Type': 'application/json', 'x-api-key': key, 'x-merchant-uid': uid,
    'x-timestamp': timestamp, 'x-nonce': nonce, 'x-signature': signature },
  ...(canonicalBody ? { body: canonicalBody } : {}),
});
const raw = await response.text();
if (!response.ok) throw new Error('HTTP ' + response.status + ': ' + (raw || 'empty response body'));
JSON.parse(raw);
console.log(raw);

import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.time.Duration;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class UUGateExample {
    static String required(String name) {
        String value = System.getenv(name);
        if (value == null || value.isBlank()) throw new IllegalArgumentException(name + " is required");
        return value.trim();
    }
    public static void main(String[] args) throws Exception {
        String uid = required("UUGATE_MERCHANT_UID"), key = required("UUGATE_API_KEY");
        String timestamp = Long.toString(System.currentTimeMillis());
        byte[] random = new byte[16]; new SecureRandom().nextBytes(random);
        String nonce = HexFormat.of().formatHex(random);
        String method = "POST", path = "/openapi/payout/orders";
        String canonicalQuery = "", canonicalBody = "{\"amount\":\"35.50\",\"chainCode\":\"TRON\",\"deleteSourceAfterSuccess\":false,\"fromAddress\":\"TNjBrNq2a9FK2vwu4W9C1QdLKSZ42Yx5YY\",\"merchantOrderNo\":\"PO202604150001\",\"notifyUrl\":\"https://merchant.example.com/api/uugate/payout-notify\",\"toAddress\":\"TS7b7iD8G2PaPqK1TqSmLJ9nrrYH4oKX1S\",\"tokenSymbol\":\"USDT\"}";
        String payload = String.join("\n", uid, timestamp, nonce, method, path, canonicalQuery, canonicalBody);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String signature = HexFormat.of().formatHex(mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));
        String base = System.getenv().getOrDefault("UUGATE_BASE_URL", "https://api.uugate.com").replaceAll("/+$", "");
        HttpRequest request = HttpRequest.newBuilder(URI.create(base + path)).timeout(Duration.ofSeconds(30))
            .header("Content-Type", "application/json").header("x-api-key", key).header("x-merchant-uid", uid)
            .header("x-timestamp", timestamp).header("x-nonce", nonce).header("x-signature", signature)
            .method(method, canonicalBody.isEmpty() ? HttpRequest.BodyPublishers.noBody()
                : HttpRequest.BodyPublishers.ofString(canonicalBody, StandardCharsets.UTF_8)).build();
        HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10))
            .followRedirects(HttpClient.Redirect.NEVER).build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
        if (response.statusCode() < 200 || response.statusCode() >= 300)
            throw new IllegalStateException("HTTP " + response.statusCode() + ": "
                + (response.body().isEmpty() ? "empty response body" : response.body()));
        if (response.body().isBlank()) throw new IllegalStateException("Empty success response");
        System.out.println(response.body());
    }
}

<?php
function required(string $name): string {
    $value = trim((string) getenv($name));
    if ($value === '') throw new RuntimeException($name . ' is required');
    return $value;
}
$uid = required("UUGATE_MERCHANT_UID"); $key = required("UUGATE_API_KEY");
$timestamp = (string) (int) floor(microtime(true) * 1000);
$nonce = bin2hex(random_bytes(16));
$method = 'POST'; $path = '/openapi/payout/orders';
$canonicalQuery = ''; $canonicalBody = '{"amount":"35.50","chainCode":"TRON","deleteSourceAfterSuccess":false,"fromAddress":"TNjBrNq2a9FK2vwu4W9C1QdLKSZ42Yx5YY","merchantOrderNo":"PO202604150001","notifyUrl":"https://merchant.example.com/api/uugate/payout-notify","toAddress":"TS7b7iD8G2PaPqK1TqSmLJ9nrrYH4oKX1S","tokenSymbol":"USDT"}';
$payload = implode("\n", [$uid, $timestamp, $nonce, $method, $path, $canonicalQuery, $canonicalBody]);
$signature = hash_hmac('sha256', $payload, $key);
$base = rtrim(getenv('UUGATE_BASE_URL') ?: 'https://api.uugate.com', '/');
$curl = curl_init($base . $path);
curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 10, CURLOPT_TIMEOUT => 30, CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'x-api-key: ' . $key,
        'x-merchant-uid: ' . $uid, 'x-timestamp: ' . $timestamp,
        'x-nonce: ' . $nonce, 'x-signature: ' . $signature],
]);
if ($canonicalBody !== '') curl_setopt($curl, CURLOPT_POSTFIELDS, $canonicalBody);
$raw = curl_exec($curl);
if ($raw === false) throw new RuntimeException('Transport error: ' . curl_error($curl));
$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
if ($status < 200 || $status >= 300)
    throw new RuntimeException('HTTP ' . $status . ': ' . ($raw === '' ? 'empty response body' : $raw));
json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
echo $raw, PHP_EOL;

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "crypto/rand"
    "encoding/hex"
    "fmt"
    "encoding/json"
    "io"
    "net/http"
    "time"
    "os"
    "strings"
)

func required(name string) string {
    value := strings.TrimSpace(os.Getenv(name))
    if value == "" { panic(name + " is required") }
    return value
}
func main() {
    uid, key := required("UUGATE_MERCHANT_UID"), required("UUGATE_API_KEY")
    timestamp := fmt.Sprint(time.Now().UnixMilli())
    random := make([]byte, 16); if _, err := rand.Read(random); err != nil { panic(err) }
    nonce := hex.EncodeToString(random)
    method, path := "POST", "/openapi/payout/orders"
    canonicalQuery, canonicalBody := "", "{\"amount\":\"35.50\",\"chainCode\":\"TRON\",\"deleteSourceAfterSuccess\":false,\"fromAddress\":\"TNjBrNq2a9FK2vwu4W9C1QdLKSZ42Yx5YY\",\"merchantOrderNo\":\"PO202604150001\",\"notifyUrl\":\"https://merchant.example.com/api/uugate/payout-notify\",\"toAddress\":\"TS7b7iD8G2PaPqK1TqSmLJ9nrrYH4oKX1S\",\"tokenSymbol\":\"USDT\"}"
    payload := strings.Join([]string{uid, timestamp, nonce, method, path, canonicalQuery, canonicalBody}, "\n")
    mac := hmac.New(sha256.New, []byte(key)); mac.Write([]byte(payload))
    signature := hex.EncodeToString(mac.Sum(nil))
    base := strings.TrimRight(os.Getenv("UUGATE_BASE_URL"), "/")
    if base == "" { base = "https://api.uugate.com" }
    request, err := http.NewRequest(method, base + path, strings.NewReader(canonicalBody))
    if err != nil { panic(err) }
    for key, value := range map[string]string{"Content-Type": "application/json", "x-api-key": key,
        "x-merchant-uid": uid, "x-timestamp": timestamp, "x-nonce": nonce, "x-signature": signature} {
        request.Header.Set(key, value)
    }
    client := &http.Client{Timeout: 30 * time.Second,
        CheckRedirect: func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse }}
    response, err := client.Do(request); if err != nil { panic(err) }
    defer response.Body.Close()
    raw, err := io.ReadAll(response.Body); if err != nil { panic(err) }
    if response.StatusCode < 200 || response.StatusCode >= 300 {
        detail := string(raw); if detail == "" { detail = "empty response body" }
        panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, detail))
    }
    if !json.Valid(raw) { panic("Invalid JSON success response") }
    fmt.Println(string(raw))
}