# GoJek

> Gojek is Indonesia's on-demand super app (ride hailing, GoFood delivery, GoSend logistics, GoPay payments), part of GoTo Group. Its public developer surface is the GoBiz Platform - the merchant operating system - which publishes the GoBiz Partner Integration API for POS vendors, online-food aggregators and enterprise merchants. Generated by API Evangelist on 2026-08-22; Gojek publishes no llms.txt of its own (developer.gobiz.com/llms.txt and www.gojek.com/llms.txt both return 404).

## What is callable

- [GoBiz Partner Integration API](https://developer.gobiz.com/docs/api/intro/): REST over HTTPS. Production base https://api.gobiz.co.id/, sandbox base https://api.partner-sandbox.gobiz.co.id/. Covers outlet linking, GoFood catalog sync, order acceptance, promotions, QRIS payment transactions, MokaPOS reporting and webhook subscriptions.
- No OpenAPI, AsyncAPI, GraphQL, gRPC or MCP server is published. Everything below is documentation, not a machine-readable contract.

## Authentication

- [Direct Integration (OAuth 2.0 client credentials)](https://developer.gobiz.com/docs/api/auth/direct-integration/): POST to https://accounts.go-jek.com/oauth2/token (production) or https://integration-goauth.gojekapi.com/oauth2/token (sandbox) with client_id, client_secret, grant_type=client_credentials and an explicit scope. No scope requested means no scope granted.
- [Facilitator (OAuth 2.0 authorization code + OpenID Connect)](https://developer.gobiz.com/docs/api/auth/facilitator/): authorize at OAUTH_URL/oauth2/auth with response_type=code, a state of at least 8 URL-safe characters, and a registered redirect_uri. Returns an access token and an ID token.
- Every API call carries `Authorization: Bearer {access-token}` and `Content-Type: application/json`.
- 20 scopes across partner, gofood, promo, payment and mokapos namespaces plus openid/offline.

## Runtime semantics an agent needs

- Idempotency: `Idempotency-Key` is REQUIRED on Create Payment Transaction (max 32 chars; Gojek recycles keys after a month). `X-Idempotency-Key` (UUID, max 32 chars) is REQUIRED on Create Promotions.
- Tracing: `X-Request-ID` optional on request, echoed on the response, max 128 chars.
- Response envelope: `{ "success": true, "data": {...} }` on success; `{ "success": false, "errors": [ { "message_title": "...", "message": "..." } ] }` on failure. Not RFC 9457.
- Status codes in use: 200, 201, 400, 401, 404, 406, 409, 415. There is no 429 and no published rate limit.
- Versioning is per-resource path segments (v1 and v2 coexist); an unrecognised vendor Accept header returns UnsupportedAcceptType.
- Reversibility: Accept Order is reversed by Reject Order (with a cancel_reason_code); promotions can be deactivated or deleted; outlets can be unlinked; subscriptions can be deleted. NO refund/void/reversal is published for payment transactions, and no time window is stated for any reversal.

## Webhooks

- [Event list](https://developer.gobiz.com/docs/api/event-list): 11 events - gofood.order.created, awaiting_merchant_acceptance, merchant_accepted, driver_otw_pickup, driver_arrived, placed, completed, cancelled, webhook_error; gofood.catalog.menu_mapping_updated; payment.transaction.settlement.
- [Receiving notifications](https://developer.gobiz.com/docs/api/webhooks/receiving-notifications/): verify `X-Go-Signature` = HMAC-SHA256(notification_secret_key, raw request body).
- Delivery is at-least-once and unordered. 15s timeout, 5s target response, up to five retries at 2m / 10m / 30m / 1.5h / 3.5h.

## Docs

- [Developer portal](https://developer.gobiz.com/)
- [Getting started](https://developer.gobiz.com/docs/docs/getting-started/)
- [API reference (single-page)](https://app.gobiz.com/files/static/cpp/api-reference/index.html)
- [Objects glossary](https://developer.gobiz.com/docs/api/objects-glossary)
- [Troubleshooting](https://developer.gobiz.com/docs/api/troubleshooting/)
- [Contact / access request](https://developer.gobiz.com/contact-us)

## Access

- There is no self-serve signup and no published pricing. OAuth client credentials are issued by Gojek; going live requires Gojek to verify the integration through the contact form. Only the developer assigned using the owner's registered email in GoBiz may create an integration.

## Gojek open source (not API clients)

- [github.com/gojek](https://github.com/gojek) - Heimdall (Go HTTP client), Courier (MQTT clients for Go/Android/iOS/Flutter), Ziggurat (Clojure/Kafka), Weaver, Darkroom, Clickstream, Proctor.

## Optional

- [Gojek company site](https://www.gojek.com/)
- [Gojek engineering blog](https://www.gojek.io/blog)
- [GoBiz merchant help center](https://gojek.my.site.com/gobizmerchant/s/)