{
  "openapi": "3.1.0",
  "info": {
    "title": "Merchant API",
    "version": "1.0.0",
    "description": "Server access API documentation for Merchant Transfer System."
  },
  "servers": [
    {
      "url": "https://settlement.api-payments.com"
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Api-Key",
        "description": "API key from approved Server Access credentials."
      },
      "ClientSecretAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Client-Secret",
        "description": "Client secret from approved Server Access credentials."
      },
      "TimestampAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Timestamp",
        "description": "Request timestamp used for anti-replay validation."
      },
      "SignatureAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Signature",
        "description": "HMAC-SHA256 signature of timestamp, method, path, and raw body."
      }
    }
  },
  "paths": {
    "/api/settlement": {
      "post": {
        "tags": [
          "Settlements"
        ],
        "summary": "Request or read settlement data",
        "description": "POST /api/settlements/approval creates an approval settlement client server request and submits it to the gateway for approve, decline, or not answered results. POST /api/settlement reads existing settlement data and does not create a settlement.",
        "operationId": "settlement_post",
        "security": [
          {
            "ApiKeyAuth": [],
            "ClientSecretAuth": [],
            "TimestampAuth": [],
            "SignatureAuth": []
          }
        ],
        "parameters": [
          {
            "name": "X-Timestamp",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Unix epoch seconds or ISO-8601 timestamp. Must be inside the configured replay window.",
            "example": "2026-07-15T12:00:00Z"
          },
          {
            "name": "X-Signature",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "HMAC-SHA256 over: X-Timestamp + '.' + METHOD + '.' + PATH_AND_QUERY + '.' + raw request body. During migration, Server A also accepts the previous PATH-only signature.",
            "example": "sha256=0123456789abcdef"
          },
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": false,
            "schema": {
              "type": "string",
              "maxLength": 160
            },
            "description": "Stable retry key for POST submissions. Reusing the same key returns the original review record.",
            "example": "retry-20260715-001"
          }
        ],
        "responses": {
          "200": {
            "description": "Authorized API response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": true
                    },
                    "status": {
                      "type": "string",
                      "example": "AUTHORIZED"
                    },
                    "endpoint": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "permission": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "route": {
                      "type": "string",
                      "example": "settlement"
                    },
                    "client_id": {
                      "type": "string",
                      "example": "SRV-20260628-ABC123"
                    },
                    "message": {
                      "type": "string",
                      "example": "API access authorized. Route-specific processing can continue."
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or missing server access credential",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "invalid_secret"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Server access blocked for this host, endpoint, or route",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "route_not_allowed_for_host"
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Unknown API endpoint",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "endpoint_not_allowed"
                    }
                  }
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "from_date",
                  "to_date",
                  "amount",
                  "currency",
                  "report_format"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "example": "CL-20260628-ABC123"
                  },
                  "from_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "to_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "amount": {
                    "type": "string",
                    "example": "10.00"
                  },
                  "currency": {
                    "type": "string",
                    "example": "USD"
                  },
                  "report_format": {
                    "type": "string",
                    "example": "CAMT.053"
                  }
                }
              },
              "example": {
                "client_id": "CL-20260628-ABC123",
                "from_date": "2026-09-10",
                "to_date": "2026-09-10",
                "amount": "10.00",
                "currency": "USD",
                "report_format": "CAMT.053"
              }
            }
          }
        }
      }
    },
    "/api/settlements/approval": {
      "post": {
        "tags": [
          "Settlements"
        ],
        "summary": "Request or read settlement data",
        "description": "POST /api/settlements/approval creates an approval settlement client server request and submits it to the gateway for approve, decline, or not answered results. POST /api/settlement reads existing settlement data and does not create a settlement.",
        "operationId": "settlement_post",
        "security": [
          {
            "ApiKeyAuth": [],
            "ClientSecretAuth": [],
            "TimestampAuth": [],
            "SignatureAuth": []
          }
        ],
        "parameters": [
          {
            "name": "X-Timestamp",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Unix epoch seconds or ISO-8601 timestamp. Must be inside the configured replay window.",
            "example": "2026-07-15T12:00:00Z"
          },
          {
            "name": "X-Signature",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "HMAC-SHA256 over: X-Timestamp + '.' + METHOD + '.' + PATH_AND_QUERY + '.' + raw request body. During migration, Server A also accepts the previous PATH-only signature.",
            "example": "sha256=0123456789abcdef"
          },
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": false,
            "schema": {
              "type": "string",
              "maxLength": 160
            },
            "description": "Stable retry key for POST submissions. Reusing the same key returns the original review record.",
            "example": "retry-20260715-001"
          }
        ],
        "responses": {
          "200": {
            "description": "Authorized API response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": true
                    },
                    "status": {
                      "type": "string",
                      "example": "AUTHORIZED"
                    },
                    "endpoint": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "permission": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "route": {
                      "type": "string",
                      "example": "settlement"
                    },
                    "client_id": {
                      "type": "string",
                      "example": "SRV-20260628-ABC123"
                    },
                    "message": {
                      "type": "string",
                      "example": "API access authorized. Route-specific processing can continue."
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or missing server access credential",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "invalid_secret"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Server access blocked for this host, endpoint, or route",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "route_not_allowed_for_host"
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Unknown API endpoint",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "endpoint_not_allowed"
                    }
                  }
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "from_date",
                  "to_date",
                  "amount",
                  "currency",
                  "report_format"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "example": "CL-20260628-ABC123"
                  },
                  "from_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "to_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "amount": {
                    "type": "string",
                    "example": "10.00"
                  },
                  "currency": {
                    "type": "string",
                    "example": "USD"
                  },
                  "report_format": {
                    "type": "string",
                    "example": "CAMT.053"
                  }
                }
              },
              "example": {
                "client_id": "CL-20260628-ABC123",
                "from_date": "2026-09-10",
                "to_date": "2026-09-10",
                "amount": "10.00",
                "currency": "USD",
                "report_format": "CAMT.053"
              }
            }
          }
        }
      }
    },
    "/api/settlements/read": {
      "post": {
        "tags": [
          "Settlements"
        ],
        "summary": "Request or read settlement data",
        "description": "POST /api/settlements/approval creates an approval settlement client server request and submits it to the gateway for approve, decline, or not answered results. POST /api/settlement reads existing settlement data and does not create a settlement.",
        "operationId": "settlement_post",
        "security": [
          {
            "ApiKeyAuth": [],
            "ClientSecretAuth": [],
            "TimestampAuth": [],
            "SignatureAuth": []
          }
        ],
        "parameters": [
          {
            "name": "X-Timestamp",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Unix epoch seconds or ISO-8601 timestamp. Must be inside the configured replay window.",
            "example": "2026-07-15T12:00:00Z"
          },
          {
            "name": "X-Signature",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "HMAC-SHA256 over: X-Timestamp + '.' + METHOD + '.' + PATH_AND_QUERY + '.' + raw request body. During migration, Server A also accepts the previous PATH-only signature.",
            "example": "sha256=0123456789abcdef"
          },
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": false,
            "schema": {
              "type": "string",
              "maxLength": 160
            },
            "description": "Stable retry key for POST submissions. Reusing the same key returns the original review record.",
            "example": "retry-20260715-001"
          }
        ],
        "responses": {
          "200": {
            "description": "Authorized API response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": true
                    },
                    "status": {
                      "type": "string",
                      "example": "AUTHORIZED"
                    },
                    "endpoint": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "permission": {
                      "type": "string",
                      "example": "SETTLEMENT_READ"
                    },
                    "route": {
                      "type": "string",
                      "example": "settlement"
                    },
                    "client_id": {
                      "type": "string",
                      "example": "SRV-20260628-ABC123"
                    },
                    "message": {
                      "type": "string",
                      "example": "API access authorized. Route-specific processing can continue."
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or missing server access credential",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "invalid_secret"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Server access blocked for this host, endpoint, or route",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "route_not_allowed_for_host"
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Unknown API endpoint",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "endpoint_not_allowed"
                    }
                  }
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "from_date",
                  "to_date",
                  "amount",
                  "currency",
                  "report_format"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "example": "CL-20260628-ABC123"
                  },
                  "from_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "to_date": {
                    "type": "string",
                    "example": "2026-09-10"
                  },
                  "amount": {
                    "type": "string",
                    "example": "10.00"
                  },
                  "currency": {
                    "type": "string",
                    "example": "USD"
                  },
                  "report_format": {
                    "type": "string",
                    "example": "CAMT.053"
                  }
                }
              },
              "example": {
                "client_id": "CL-20260628-ABC123",
                "from_date": "2026-09-10",
                "to_date": "2026-09-10",
                "amount": "10.00",
                "currency": "USD",
                "report_format": "CAMT.053"
              }
            }
          }
        }
      }
    }
  },
  "tags": [
    {
      "name": "Client Registration"
    },
    {
      "name": "Transfers"
    },
    {
      "name": "Confirmations"
    },
    {
      "name": "Statements"
    }
  ]
}