TIME=$(date +%s)
BODY="{\"merchant_id\":\"AA12345678\",\"token\":\"YOUR_TOKEN\",\"time\":$TIME,\"platform_order_id\":\"ABCW20260508abc123XYZ456\"}"
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "YOUR_SECRET" | awk '{print $2}')

curl -X POST https://<your-api-domain>/withdraw/query \
  -H "Content-Type: application/json" \
  -H "X-SIGNATURE: $SIG" \
  -d "$BODY"

import crypto from 'node:crypto';

const SECRET = 'YOUR_SECRET';
const body = JSON.stringify({
  merchant_id:       'AA12345678',
  token:             'YOUR_TOKEN',
  time:             Math.floor(Date.now() / 1000),
  platform_order_id: 'ABCW20260508abc123XYZ456',
});
const sig = crypto.createHmac('sha256', SECRET).update(body).digest('hex');

const r = await fetch('https://<your-api-domain>/withdraw/query', {
  method:  'POST',
  headers: { 'Content-Type': 'application/json', 'X-SIGNATURE': sig },
  body
});
console.log(await r.json());

<?php
$secret = 'YOUR_SECRET';
$body = json_encode([
    'merchant_id'       => 'AA12345678',
    'token'             => 'YOUR_TOKEN',
    'time'              => time(),
    'platform_order_id' => 'ABCW20260508abc123XYZ456',
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$sig = hash_hmac('sha256', $body, $secret);

$ch = curl_init('https://<your-api-domain>/withdraw/query');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        "X-SIGNATURE: $sig",
    ],
]);
echo curl_exec($ch);