Build your auction integration.

Connect your application

Base URL: https://www.panbids.com/api/v1. Environment: production.

1. Obtain an active bank partner account, approved KYB and agreement, and an active bank subscription.
2. Ask the bank to approve your source IP/CIDR, assign auction lots and permissions, and issue environment-specific client ID, key ID and signing secret.
3. Use HTTPS and a synchronized server clock. Keep signing secrets on your backend. This playground signs locally in your browser and keeps credentials only in the current page.
4. Fetch upcoming events, retrieve their lots, and submit bids only within the server-authoritative bidding window.

Requests are limited to 120 per minute. The browser's public source IP must be approved to use the playground. This page calls this deployment directly; it does not bypass authentication or IP checks.

Request authentication

Every request requires these headers: X-Client-ID, X-Key-ID, X-Timestamp (Unix seconds), X-Nonce (unique 16–128 character letters, digits, underscore or hyphen), X-Content-SHA256 and X-Signature.

Calculate a lowercase hexadecimal SHA-256 digest of the exact request body. GET requests use an empty body. Sign these six newline-separated lines using HMAC-SHA256 with the secret string as the key:

METHOD
/api/v1/path
canonical_query_string
unix_timestamp
unique_nonce
body_sha256

Use uppercase METHOD, the exact URL path and a query string sorted by parameter name with RFC 3986 percent encoding. Keep the query line empty when no query parameters are present. Send the lowercase hexadecimal HMAC as X-Signature. The permitted clock difference is five minutes. Generate a fresh nonce for every request and retry.

Lists paginate at 25 records with ?page=2. Vehicle identifiers are published auction lot IDs; bank-private inventory fields are excluded. Results expose closed lot status, not a confirmed sale or another dealer's identity.

Bid requests

Send JSON with dealer_id (your bank-issued bidding dealer reference), amount and idempotency_key (UUID). Set the same UUID in the Idempotency-Key header. Reuse that UUID only when retrying the identical bid. Buyer limits, valid EMD, auction state and channel publication must permit the bid.

Environment and access

Sandbox and Production use different credentials and configured service deployments. A Production server rejects Sandbox credentials. Only approved source IPs are accepted. Revoked keys, suspended accounts, expired agreements, repeated nonces and missing scopes are rejected. Use HTTPS in deployed environments.

Webhooks are a saved integration preference only; automated webhook delivery is not enabled.

Event endpoints

All endpoints below use catalogue:read. Replace braces with public IDs returned by the API.

Bank-created auctions publish immediately after final validation. Status is upcoming before start, live from start inclusive to close exclusive, and over at close. Timestamps include their UTC offset; timezone identifies the display zone. Cancelled auctions are excluded. Sale approval remains a separate process.

Only assigned lots within current bank permissions are returned. Withdrawn, cancelled or unavailable vehicles are excluded. Open bids expose highest_amount; closed bids hide it. own_amount and bidder_status describe the authenticated bidder; channel_status describes the channel. Platform requests without bidder_reference omit bidder-specific fields. All bid standings are provisional.

Requests and responses

Event list (200)

{"data":[{"id":"auc_EXAMPLE","name":"Bank auction","reference":"PB-123","distribution_mode":"syndicated","bid_type":"open","status":"upcoming","timezone":"Asia/Kolkata","starts_at":"2026-09-12T10:00:00+00:00","ends_at":"2026-09-13T10:00:00+00:00","bid_increment":"100.00","eligible_lots_count":1,"revision":2}],"current_page":1,"last_page":1,"total":1}

Event lot (200)

{"data":{"id":"lot_EXAMPLE","auction_id":"auc_EXAMPLE","registration_number":"XX00AA0000","make":"Example","model":"Vehicle","year":2020,"region":"North","vehicle_type":"4W","starting_price":"10000.00","public_fields":{},"own_amount":null,"bidder_status":"no_bid","channel_status":"no_bid","provisional":true,"highest_amount":null}}

POST /lots/{lot}/bids

{"dealer_id":"dealer_EXAMPLE","amount":"10100.00","idempotency_key":"00000000-0000-4000-8000-000000000001","bidder_reference":"buyer_123","client_bid_time":"2026-09-12T10:01:00Z"}

dealer_id, amount and idempotency_key are required. Amount must be positive with at most 12 integer digits and 2 decimal places. client_bid_time is optional and does not override server time. bidder_reference is for platform/aggregator bidders; direct dealers use their authenticated identity. Opening price and bid increment apply; open bids must exceed the central highest bid. A closed bid may be below the hidden leader if it meets the opening grid.

Accepted bid (201; identical replay 200)

{"success":true,"code":"BID_ACCEPTED","message":"Bid accepted; this is not a sale approval.","data":{"request_id":"req_EXAMPLE","bid_id":"bid_EXAMPLE","status":"accepted","server_received_at":"2026-09-12T10:01:00Z","lot_version":2,"effective_close_at":"2026-09-13T10:00:00Z","replayed":false,"bidder_status":"leading","channel_status":"leading","highest_amount":"10100.00"},"errors":[],"request_id":"req_EXAMPLE","timestamp":"2026-09-12T10:01:00Z"}

Catalogue /lots and /vehicles/{lot} return id, auction_id, title, category, starting_price, status and ends_at. /lots paginates with data, current_page, last_page and total. /bids returns your public_id, bidder_reference, amount, status and created_at within Laravel pagination metadata; optional bidder_reference filters your records. /results returns catalogue lot fields with data, current_page and last_page, requires results permission and contains closed auctions; it is not a sale confirmation.

Error handling

{"success":false,"code":"INVALID_SIGNATURE","message":"Invalid signature","data":null,"errors":["INVALID_SIGNATURE"],"request_id":"req_EXAMPLE","timestamp":"2026-09-12T10:01:00Z"}

401: inactive client, revoked key, expired timestamp or bad signature. 403: TLS, environment, IP, scope, bank access, KYB, agreement or buyer eligibility failure. 402: BANK_UNAVAILABLE. 404: inaccessible event, lot or media. 409: NONCE_REPLAYED or idempotency conflict. 422: validation or rejected bid (for example LOT_NOT_LIVE, BID_BELOW_MINIMUM, BID_OFF_OPENING_GRID). 429: rate limit; respect Retry-After. Validation errors can instead use Laravel's message and errors object; 404/429 may use a message-only JSON response.

On network failure, retry an identical bid with its original idempotency key and fresh timestamp, nonce and signature. Never automatically retry a rejected bid as a new bid. Poll for updated standings; webhook delivery is not enabled.

API playground

Explore every endpoint. Choose a language, inspect the signed request, and try it with your own credentials.

Requests run against https://www.panbids.com/api/v1. POST submits a real bid in this environment. No requests run until you press Send.

Live response

Ready.