curl -X POST 'https://api-sandbox.paywithsoap.com/api/v1/device_pings' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer YOUR_CLIENT_SECRET' \
--data '{
"latitude": 37.785834,
"longitude": -122.406417,
"customer_id": "cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870"
}'
const fetch = require('node-fetch');
const options = {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': 'Bearer YOUR_CLIENT_SECRET'
},
body: JSON.stringify({
latitude: 37.785834,
longitude: -122.406417,
customer_id: 'cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870'
})
};
fetch('https://api-sandbox.paywithsoap.com/api/v1/device_pings', options)
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
{
"id": "dp_ETBkCvQztKUrzVeQUypYDB1EtUP7oUUX",
"geo_check": {
"country": "USA",
"id": "gc_8HpqVXHQ7672sFi38yLN9kCMJN1LtiMw",
"latitude": 37.785834,
"longitude": -122.406417,
"municipality": "San Francisco",
"passed": true,
"region": "CA",
"cached": false
},
"ip_check": null
}
API Endpoints
Create Device Ping
POST /api/v1/device_pings runs the geolocation/IP compliance check. Called from the customer device and authenticates with the client secret, not the API key.
POST
/
api
/
v1
/
device_pings
curl -X POST 'https://api-sandbox.paywithsoap.com/api/v1/device_pings' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer YOUR_CLIENT_SECRET' \
--data '{
"latitude": 37.785834,
"longitude": -122.406417,
"customer_id": "cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870"
}'
const fetch = require('node-fetch');
const options = {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': 'Bearer YOUR_CLIENT_SECRET'
},
body: JSON.stringify({
latitude: 37.785834,
longitude: -122.406417,
customer_id: 'cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870'
})
};
fetch('https://api-sandbox.paywithsoap.com/api/v1/device_pings', options)
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
{
"id": "dp_ETBkCvQztKUrzVeQUypYDB1EtUP7oUUX",
"geo_check": {
"country": "USA",
"id": "gc_8HpqVXHQ7672sFi38yLN9kCMJN1LtiMw",
"latitude": 37.785834,
"longitude": -122.406417,
"municipality": "San Francisco",
"passed": true,
"region": "CA",
"cached": false
},
"ip_check": null
}
Create Device Ping
Use this endpoint to record a device location ping for a customer. This endpoint helps verify a customer’s location by sending their device’s coordinates. The location data is validated and returns information about the detected geographic location, along with whether the location check passed or failed. This endpoint authenticates with your client secret, not your API key. Call it directly from the client (browser, app, etc.) rather than your server, since Soap needs to see the end user’s real IP address to complete the check.The companion endpoint Get Latest Geo Check uses your API key instead — it’s a server-side call, not a client secret call.
Authorization: Bearer YOUR_CLIENT_SECRET
secret_....
It is safe to use from a browser or mobile client, which is required here because Soap needs the end user’s real IP address.
Requests with an invalid client secret return 422 with {"error": "Client secret not found."}.
Recent checks are reused. If the customer has a geo check less than 30 minutes old, Soap returns that check instead of evaluating the coordinates you just sent, and marks it with
"cached": true. Within that window a changed location is not re-evaluated. If device pings are disabled on your account the endpoint returns 404 with a hint to contact Soap.curl -X POST 'https://api-sandbox.paywithsoap.com/api/v1/device_pings' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer YOUR_CLIENT_SECRET' \
--data '{
"latitude": 37.785834,
"longitude": -122.406417,
"customer_id": "cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870"
}'
const fetch = require('node-fetch');
const options = {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': 'Bearer YOUR_CLIENT_SECRET'
},
body: JSON.stringify({
latitude: 37.785834,
longitude: -122.406417,
customer_id: 'cus_vi57KegYgcRqcGHqip8q6UZiqtrwMT870'
})
};
fetch('https://api-sandbox.paywithsoap.com/api/v1/device_pings', options)
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
{
"id": "dp_ETBkCvQztKUrzVeQUypYDB1EtUP7oUUX",
"geo_check": {
"country": "USA",
"id": "gc_8HpqVXHQ7672sFi38yLN9kCMJN1LtiMw",
"latitude": 37.785834,
"longitude": -122.406417,
"municipality": "San Francisco",
"passed": true,
"region": "CA",
"cached": false
},
"ip_check": null
}
Authorizations
Bearer token authentication using your business client secret (secret_...), sent as Authorization: Bearer YOUR_CLIENT_SECRET. This secret is browser-safe and is used only for POST /api/v1/device_pings.
Body
application/json