Integrate with VR Benefícios
The APIs behind sales, card issuing, capture and merchant operations — documented, with a sandbox and a clear path to production.
What is already published in this portal
The numbers below come from what is published in this portal right now.
- 292registered API versionsEach version the gateway publishes, with its own spec.
- 51documented APIsA page with description, endpoints per environment and reference.
- 60published documentsGuides, standards, return codes and examples.
- 4business familiesSales, Core-Issuing, Acquiring and Common.
- 3environmentsMock · Staging · Production
Who integrates with VR Benefícios
Four audiences, four API families. The portal is the same; each path starts somewhere different.
Sales channel
External sellers, lead prospecting and online simulation and purchase: the Sales APIs cover the channel from first contact to order.
Client company's HR
Orders, cards and beneficiaries through the Core-Issuing API, in the flow HR already knows.
Merchant and AceitaVR
Transaction capture, holds and refunds, the merchant's financial operations and the card wallet for online payment, through the Acquiring APIs.
From account to production, in five steps
The same path the VR dev portal publishes today. Two approvals and three environments: knowing that up front shortens the integration.
- 01
Create your account
API documentation requires a developer account. Once approved, you get the link to set your password.
- 02
Create your development APP
The APP holds the credentials for the call. It also goes through VR approval.
- 03
Test in sandbox
Fixed, fictional data — enough to build the integration and learn the responses.
Your first call, with the access token
Once your APP is approved, every call to the VR APIs carries two values in the header: the APP's client_id and an OAuth 2.0 access token. The token comes from two requests to VR's authentication endpoints.
- 01
Request the grant code
POST to /oauth/grant-code with your APP's client_id and the redirect_uri. The response returns the redirect_uri with the authorization code in the code parameter.
- 02
Exchange the code for the access token
POST to /oauth/access-token with Authorization: Basic and client_id:client_secret in Base64. You get back the access_token, the refresh_token and expires_in (3600 seconds).
- 03
Call the API
Send client_id and access_token in the header of every call; without either, the response is 401. When the token expires, the refresh_token renews access in a single request.
curl -X POST https://api.vr.com.br/oauth/grant-code \
-H "Content-Type: application/json" \
-d '{"client_id": "<client_id>", "redirect_uri": "http://localhost/"}'
curl -X POST https://api.vr.com.br/oauth/access-token \
-H "Content-Type: application/json" \
-H "Authorization: Basic <base64(client_id:client_secret)>" \
-d '{"grant_type": "authorization_code", "code": "<code>"}'
# toda chamada às APIs da VR
-H "client_id: <client_id>" -H "access_token: <access_token>"Tracks and articles to integrate
VR's content as study material: tracks with lessons and quizzes for those who prefer to be guided, and short articles for those already integrating who just need an answer.
Articles
The four API families
It is the organisation VR's dev portal already uses. The number on each card is how many APIs of that family are documented and visible to you right now.
- After sign-inSales APIs
This family's APIs become available after you sign in, as in the current portal.
- After sign-in
Help and contact
The guide VR publishes: answers without a generic form.
First Steps
VR's guide, from sign-up to the production APP, with the text the dev portal publishes today.