// payment gateway API · from Universal Processing

Payments infrastructure your software can build on.

One REST API for online, phone and in-person payments, with hosted pages that keep you out of PCI scope, tokens that work across locations, and routing that fails over to a second processor.

Docs are machine-readable too: llms.txt and every page as Markdown, so coding agents can read them.

Latest v2026.10.808 · Oct 20, 2026 · 11 breaking · Changelog →
hosted-checkout
# 1. Open a session for one payment (page created once, in advance)
curl -X POST "$UPG_BASE_URL/api/hostedpaymentpages/sessions" \
  -H "api-key: $UPG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hostedPageId": "{hostedPageId}",
    "label": "Order 1042",
    "amountMode": "Locked",
    "prefilledFields": { "base_amount": "10.00" },
    "expirySeconds": 900
  }'

# 2. Ask for the payment link, redirect the payer to it
curl "$UPG_BASE_URL/api/hostedpaymentpages/sessions/{sessionId}/payment-link" \
  -H "api-key: $UPG_API_KEY"

# 3. Confirm the result from the signed webhook, not the redirect
// choose how the card is collected

Three ways to take a card online. Pick by PCI burden.

Where the card fields live decides how much you build and what you prove every year. The docs walk you through the decision.

POST /api/hostedpaymentpages/sessions

Hosted payment page

Least code

Redirect or iframe to a branded page we serve. Typically eligible for SAQ A.

Embedded payments SDK

Your checkout, our fields

Your layout

Keep your own checkout design. The card fields themselves are served by the gateway.

POST /api/transactions

Direct API

Full control

For phone orders and terminal apps where the card reaches your systems. Card-present reads use the same endpoint.

PCI eligibility is guidance, not a compliance determination. Confirm with your QSA or acquirer.

// platform

What's in the API

Payments

Sale, authorize then capture, refund, void, reversal and partial approvals. Cards, ACH, Apple Pay, 3-D Secure, Level 2/3 data, EBT fields.

Stored credentials

Tokens instead of card numbers. Charge again with or without the customer present, and optionally share tokens across merchants under one reseller.

Billing

Customers, contracts, recurring billing runs, invoices with payable links, and a virtual terminal in the portal.

Routing & failover

Partner platforms can assign multiple processor profiles per merchant. A rules pipeline picks one per transaction and fails over once if the first didn't process, never on an ambiguous result.

Webhooks

Signed event delivery as the durable record of every payment, built to be verified and safely replayed.

Operate at scale

Resellers, private-label branding, merchants, roles, audit log, reports, surcharging with per-state rules, and rate limits reported in headers.

// sandbox

A sandbox that does what you tell it

The sandbox processor answers from a fixed table, so every case is repeatable: declines, AVS and CVV results, partial approvals, ACH returns, processor latency and failover.

  • Amount triggers: the cents pick the outcome
  • Control fields for cases no amount can produce
  • Blueprints you can run end to end against a sandbox merchant
  • Sandbox keys can't reach production, by design
Testing guide → Changelog →
sandbox outcomes
# Blueprints in the docs
accept-your-first-payment
authorize-now-capture-later
save-a-card-and-charge-it-later
bill-a-customer-on-a-schedule
invoice-a-customer-and-get-paid
retry-a-payment-safely
exercise-processor-failover
simulate-a-card-decline
simulate-an-ach-return
trigger-a-partial-approval
// ecosystem

Production-proven on uLite POS and uLite Online

uLite POS and uLite Online run on UP Gateways in production—powering in-person terminals, mobile POS and online ordering for restaurant and retail businesses across the U.S.

Runs on UP Gateways

uLite POS & uLiteAI

Cloud-based terminal, mobile POS and 24/7 multilingual AI phone ordering built on UP Gateways. ulite.com

Runs on UP Gateways

uLite Online

Commission-free online ordering on the restaurant's own site, processing online payments through UP Gateways. uliteonline.com

35,000+ SMBs

Universal Processing

Acquiring, merchant processing and 24/7 multilingual client support nationwide. letsgoup.com

// security

Built for the assessor's questions

Field-level encryption

Cardholder data encrypted with AES-256-GCM under a managed key vault; primary account numbers masked wherever displayed.

Never stored

CVV, PINs and full magnetic stripe or chip data are never stored.

PCI DSS v4.0

PCI DSS v4.0 compliant gateway: cardholder data handled to the v4.0 standard. Security details →

Trust library

Security, privacy, terms, subprocessors and compliance materials published at docs.upgateways.com.

Build your first payment today

Request sandbox credentials and connect with our integrations team.