Aaron's Hosted Payment Page service — the only surface on the Aaron's estate that publishes a machine-readable API contract. A Swagger 2.0 document is served anonymously at https://hpp.aarons.com/openapi.json describing 15 paths: payment-session creation, customer context, device-intelligence capture for fraud screening, card tokenization and storage, zero-dollar authorization with AVS/CVV2 verification, EZPay retry, and three inbound postback receivers for the Fiserv and Repay payment gateways. The contract self-identifies as host hpp.aarons.com, and Aaron's own customer application at myaccount.aarons.com references the same host, so ownership is established from the document itself and not from the fetch URL. Bearer-token auth; Aaron's issues no third-party credentials and publishes no documentation.
Aaron’s Hosted Payment Page (HPP) is one of 4 APIs that Aaron’s publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Payments, Tokenization, Card Vault, Webhook, and Lease-to-Own. The published artifact set on APIs.io includes an OpenAPI specification.
This API exposes
60 operations
across 15 paths,
organized into 14 resource areas,
and defines 46 schemas.
It is described by OpenAPI 2.0, at version 1.0.
Requests are made against the base URL https://hpp.aarons.com.
60 operations15 paths46 schemas15 DELETE15 GET15 POST15 PUT
Metadata
The identity and technical contract details declared by the specification.
Specification
OpenAPI 2.0
API Version
1.0
Base URL
https://hpp.aarons.com
Authentication
API Key
Resource Areas
14
Authentication & Security 1
Aaron's Hosted Payment Page (HPP) declares
1 security scheme
for authenticating requests.
An API key is passed in the header as Authorization (Bearer).
Paths & Operations 60
Across 15 paths, the API surfaces 60 operations — 15 DELETE, 15 GET, 15 POST, 15 PUT. They span 14 resource areas, including CreateSession, AuthorizeSession, CustomerData, MemoryBearerToken, MemoryTokenGuid, SaveDeviceIntelligence, CreateToken, SaveToken, and 6 more. Each is listed below with its method, path, parameters, and response codes.
The contract defines 46 schemas that model the data the API accepts and returns. The most detailed are Request (15 properties), Result (15 properties), CardVaultEventData (15 properties), SessionItem (12 properties). Each schema is shown below with its type and property counts.
Object
object
Object
CreateSession
object
CreateSession
1 property
SessionItem
object
SessionItem
12 properties
AuthorizeSession
object
AuthorizeSession
1 property
CustomerData
object
CustomerData
7 properties
MemoryBearerToken
object
MemoryBearerToken
1 property
MemoryTokenGuid
object
MemoryTokenGuid
1 property
SaveDeviceIntelligence
object
SaveDeviceIntelligence
3 properties
CreateToken
object
CreateToken
9 properties
SaveToken
object
SaveToken
2 properties
UpdateCustomerRetryNotification
object
UpdateCustomerRetryNotification
1 property
AutoPayCustomerRetry
object
AutoPayCustomerRetry
1 property
Ping
object
Ping
1 property
FiservPostback
object
FiservPostback
7 properties
Card
object
Card
11 properties
Expiration
object
Expiration
2 properties
ZeroDollarAuth
object
ZeroDollarAuth
2 properties
AVS
object
AVS
3 properties
RepayAuthPostback
object
RepayAuthPostback
2 properties
RepayAuthEventData
object
RepayAuthEventData
3 properties
Request
object
Request
15 properties
CustomFields
object
CustomFields
12 properties
Result
object
Result
15 properties
AvsResult
object
AvsResult
4 properties
EventMetaData
object
EventMetaData
2 properties
RepayCardVaultPostback
object
RepayCardVaultPostback
2 properties
CardVaultEventData
object
CardVaultEventData
15 properties
CreateSessionResponse
object
CreateSessionResponse
3 properties
AuthorizeSessionResponse
object
AuthorizeSessionResponse
5 properties
ResponseStatus
object
ResponseStatus
5 properties
ResponseError
object
ResponseError
4 properties
Dictionary_String_String_
object
Dictionary
CustomerDataResponse
object
CustomerDataResponse
8 properties
DeliveryAddress
object
DeliveryAddress
4 properties
MemoryBearerTokenResponse
object
MemoryBearerTokenResponse
3 properties
MemoryTokenGuidResponse
object
MemoryTokenGuidResponse
3 properties
SaveDeviceIntelligenceResponse
object
SaveDeviceIntelligenceResponse
1 property
CreateTokenResponse
object
CreateTokenResponse
8 properties
SaveTokenResponse
object
SaveTokenResponse
8 properties
UpdateCustomerRetryNotificationResponse
object
UpdateCustomerRetryNotificationResponse
1 property
AutoPayCustomerRetryResponse
object
AutoPayCustomerRetryResponse
2 properties
PaymentResponse
object
PaymentResponse
9 properties
PaymentStatus
object
PaymentStatus
4 properties
PingResponse
object
PingResponse
1 property
FiservPostbackResponse
object
FiservPostbackResponse
1 property
RepayPostbackResponse
object
RepayPostbackResponse
1 property
Specification
The full machine-readable OpenAPI contract behind this narrative.
Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for apis
4 tools reach this content
search_api_evangelistSearch every content type across the network at once.
find_relatedThe shared-tag relevance graph — what else covers this.
get_tagEverything one tag labels, across all content types.
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
A second provider on the same verified email joins the account you already have.
Your account
ⓘWhere this information came from
This is an independent, third-party profile of Aaron's Hosted Payment Page (HPP), published by
API Evangelist. We do not operate, host, resell, or
support these APIs, and we are not affiliated with or endorsed by the company unless stated above.
Everything here is built from publicly available information — the company's own site,
developer portal, documentation, public repositories, and the specifications it publishes for public use.
Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's
public API artifacts, scored against a published rubric. They are not certifications,
endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and
you do not need to justify the request. A removed company is recorded as unrated, never scored
zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy → On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.
