Developers / API reference

Payments API reference

Explore authentication, payment endpoints, request parameters and response examples from the implemented test API. Planned capabilities are labelled separately.

HTTP API v1Contract 0.1.0-local

Local/test runtime reference

The merchant integration uses Alzaf Pay keys, IDs, normalized states and signed events. Live payment processing and hosted availability are not established by this reference. No request is executed from these pages.

Alzaf Pay — Current Local Merchant APIOpenAPI 3.1.0 · version 0.1.0-local

Source-audited local runtime contract, not hosted sandbox/live acceptance or exhaustive black-box conformance. 13 implemented v1 operations; settlements absent. Target openapi.json is unchanged. Integer BDT minor units only. Laravel trims input strings and converts empty strings to null before validation; optional nullable fields may normalize, other string fields reject null. Strict JSON object mutation bodies, duplicate JSON keys rejected, 1 MiB body limit. Use Accept:application/json and server-side secret keys; no browser merchant secrets.

POST/payment-intentsCreate a local test payment

Local contractpayments:writePermalink ↗

Create a local test payment

Local/testing and test-key context only. Return URLs are optional; current validator accepts http/https URLs up to 2000 characters and does not enforce registration. Unknown fields rejected. merchant_reference is unique per project/environment (duplicate returns 409 INVALID_REQUEST). Customer is optional object, never null. No real provider dispatch.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

Idempotency-Key · headerstringRequired

Required only for create/confirm/cancel/refund. Same canonical payload and scoped operation returns stored status/body/request_id; changed payload returns 409. No retention-expiry promise is implemented.

Min length: 16
Max length: 128
Pattern: ^[A-Za-z0-9._:-]+$

JSON request body Required

Unknown fields rejected

amountintegerRequired

Minimum: 1
Maximum: 9007199254740991

currencystringRequired

Value: "BDT"

merchant_referencestringRequired

Min length: 1
Max length: 128

descriptionstring | nullOptional

When string: Max length: 500

metadataobjectOptional

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

customerobjectOptional

Unknown fields rejected

customer.namestringOptional

Max length: 150

customer.emailstringOptional

Max length: 254
Format: email

customer.phonestringOptional

Max length: 30

success_urlstring | nullOptional

When string: Max length: 2000
When string: Format: uri
When string: Pattern: ^https?://

cancel_urlstring | nullOptional

When string: Max length: 2000
When string: Format: uri
When string: Pattern: ^https?://

expires_atstringOptional

Explicit timezone; valid future timestamp at most 24 hours from server now. Default 30 minutes. Fractional seconds truncate to MySQL second precision.

Max length: 40
Format: date-time

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 21

dataobjectRequired

Unknown fields rejected

data.idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "payment_intent"

data.merchant_idstringRequired

Pattern: ^mer_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.project_idstringRequired

Pattern: ^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.environmentstringRequired

Allowed: "test", "live"

data.merchant_referencestringRequired

Max length: 128

data.amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PENDING", "PROCESSING", "SUCCEEDED", "FAILED", "CANCELLED", "EXPIRED", "PARTIALLY_REFUNDED", "REFUNDED"

data.refunded_amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.customerobject | nullRequired

When object: Unknown fields rejected

data.descriptionstring | nullRequired

When string: Max length: 500

data.metadataobjectRequired

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

data.success_urlstring | nullRequired

When string: Format: uri

data.cancel_urlstring | nullRequired

When string: Format: uri

data.expires_atstringRequired

Format: date-time

data.created_atstringRequired

Format: date-time

data.updated_atstringRequired

Format: date-time

data.checkout_urlstringRequired

Confidential checkout capability in URL fragment; creation/replay only, never general reads.

Format: uri

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Idempotency-ReplayedstringResponse header

Allowed: "true", "false"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request POST "$ALZAF_API_BASE/payment-intents" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json' \
  --header "Idempotency-Key: $PERSISTED_OPERATION_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "merchant_reference": "ORDER-1001",
  "amount": 10050,
  "currency": "BDT"
}'

Success status

{
  "data": {
    "id": "pay_01K4XZ1Q0A0000000000000001",
    "object": "payment_intent",
    "merchant_reference": "ORDER-1001",
    "amount": 10050,
    "currency": "BDT",
    "status": "CREATED",
    "refunded_amount": 0,
    "environment": "test",
    "merchant_id": "mer_01K4XZ1Q0A0000000000000001",
    "project_id": "prj_01K4XZ1Q0A0000000000000001",
    "customer": null,
    "description": null,
    "metadata": {},
    "success_url": null,
    "cancel_url": null,
    "expires_at": "2026-10-17T12:30:00.000000Z",
    "created_at": "2026-10-17T12:00:00.000000Z",
    "updated_at": "2026-10-17T12:00:00.000000Z",
    "checkout_url": "http://127.0.0.1:3000/p/pay_01K4XZ1Q0A0000000000000001#token=EXAMPLE_ONLY"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/payment-intents/{id}Read a scoped payment

Local contractpayments:readPermalink ↗

Read a scoped payment

Both paths read the same aggregate. No checkout capability URL or raw provider data is returned. Undeclared query parameters are currently ignored.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 20

dataobjectRequired

Payment snapshot for retrieval, state transitions and webhook data. Does not disclose a checkout capability.

Unknown fields rejected

data.idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "payment_intent"

data.merchant_idstringRequired

Pattern: ^mer_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.project_idstringRequired

Pattern: ^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.environmentstringRequired

Allowed: "test", "live"

data.merchant_referencestringRequired

Max length: 128

data.amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PENDING", "PROCESSING", "SUCCEEDED", "FAILED", "CANCELLED", "EXPIRED", "PARTIALLY_REFUNDED", "REFUNDED"

data.refunded_amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.customerobject | nullRequired

When object: Unknown fields rejected

data.descriptionstring | nullRequired

When string: Max length: 500

data.metadataobjectRequired

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

data.success_urlstring | nullRequired

When string: Format: uri

data.cancel_urlstring | nullRequired

When string: Format: uri

data.expires_atstringRequired

Format: date-time

data.created_atstringRequired

Format: date-time

data.updated_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/payment-intents/<id>" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": {
    "id": "pay_01K4XZ1Q0A0000000000000001",
    "object": "payment_intent",
    "merchant_reference": "ORDER-1001",
    "amount": 10050,
    "currency": "BDT",
    "status": "CREATED",
    "refunded_amount": 0,
    "environment": "test",
    "merchant_id": "mer_01K4XZ1Q0A0000000000000001",
    "project_id": "prj_01K4XZ1Q0A0000000000000001",
    "customer": null,
    "description": null,
    "metadata": {},
    "success_url": null,
    "cancel_url": null,
    "expires_at": "2026-10-17T12:30:00.000000Z",
    "created_at": "2026-10-17T12:00:00.000000Z",
    "updated_at": "2026-10-17T12:00:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/payments/{id}Read a scoped payment

Local contractpayments:readPermalink ↗

Read a scoped payment

Both paths read the same aggregate. No checkout capability URL or raw provider data is returned. Undeclared query parameters are currently ignored.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 20

dataobjectRequired

Payment snapshot for retrieval, state transitions and webhook data. Does not disclose a checkout capability.

Unknown fields rejected

data.idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "payment_intent"

data.merchant_idstringRequired

Pattern: ^mer_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.project_idstringRequired

Pattern: ^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.environmentstringRequired

Allowed: "test", "live"

data.merchant_referencestringRequired

Max length: 128

data.amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PENDING", "PROCESSING", "SUCCEEDED", "FAILED", "CANCELLED", "EXPIRED", "PARTIALLY_REFUNDED", "REFUNDED"

data.refunded_amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.customerobject | nullRequired

When object: Unknown fields rejected

data.descriptionstring | nullRequired

When string: Max length: 500

data.metadataobjectRequired

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

data.success_urlstring | nullRequired

When string: Format: uri

data.cancel_urlstring | nullRequired

When string: Format: uri

data.expires_atstringRequired

Format: date-time

data.created_atstringRequired

Format: date-time

data.updated_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/payments/<id>" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": {
    "id": "pay_01K4XZ1Q0A0000000000000001",
    "object": "payment_intent",
    "merchant_reference": "ORDER-1001",
    "amount": 10050,
    "currency": "BDT",
    "status": "CREATED",
    "refunded_amount": 0,
    "environment": "test",
    "merchant_id": "mer_01K4XZ1Q0A0000000000000001",
    "project_id": "prj_01K4XZ1Q0A0000000000000001",
    "customer": null,
    "description": null,
    "metadata": {},
    "success_url": null,
    "cancel_url": null,
    "expires_at": "2026-10-17T12:30:00.000000Z",
    "created_at": "2026-10-17T12:00:00.000000Z",
    "updated_at": "2026-10-17T12:00:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

POST/payment-intents/{id}/confirmConfirm using MockProvider

Local contractpayments:writePermalink ↗

Confirm using MockProvider

Only local/testing test-mode mock. SUCCESS returns SUCCEEDED; FAILED returns FAILED; PENDING/TIMEOUT/TIMEOUT_THEN_SUCCESS can return PROCESSING, all HTTP 200. Delayed resolution requires the local recovery worker; a timeout is not a definitive failure. Confirmed/unresolved replays do not launch another charge. Expired/terminal conflicts return 409.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

Idempotency-Key · headerstringRequired

Min length: 16
Max length: 128
Pattern: ^[A-Za-z0-9._:-]+$

JSON request body Required

Unknown fields rejected

payment_methodstringRequired

Value: "mock"

mock_scenariostringOptional

Allowed: "SUCCESS", "FAILED", "PENDING", "TIMEOUT", "TIMEOUT_THEN_SUCCESS"
Default: "SUCCESS"

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 20

dataobjectRequired

Payment snapshot for retrieval, state transitions and webhook data. Does not disclose a checkout capability.

Unknown fields rejected

data.idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "payment_intent"

data.merchant_idstringRequired

Pattern: ^mer_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.project_idstringRequired

Pattern: ^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.environmentstringRequired

Allowed: "test", "live"

data.merchant_referencestringRequired

Max length: 128

data.amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PENDING", "PROCESSING", "SUCCEEDED", "FAILED", "CANCELLED", "EXPIRED", "PARTIALLY_REFUNDED", "REFUNDED"

data.refunded_amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.customerobject | nullRequired

When object: Unknown fields rejected

data.descriptionstring | nullRequired

When string: Max length: 500

data.metadataobjectRequired

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

data.success_urlstring | nullRequired

When string: Format: uri

data.cancel_urlstring | nullRequired

When string: Format: uri

data.expires_atstringRequired

Format: date-time

data.created_atstringRequired

Format: date-time

data.updated_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Idempotency-ReplayedstringResponse header

Allowed: "true", "false"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request POST "$ALZAF_API_BASE/payment-intents/<id>/confirm" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json' \
  --header "Idempotency-Key: $PERSISTED_OPERATION_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "payment_method": "mock",
  "mock_scenario": "SUCCESS"
}'

Success status

{
  "data": {
    "id": "pay_01K4XZ1Q0A0000000000000001",
    "object": "payment_intent",
    "merchant_reference": "ORDER-1001",
    "amount": 10050,
    "currency": "BDT",
    "status": "SUCCEEDED",
    "refunded_amount": 0,
    "environment": "test",
    "merchant_id": "mer_01K4XZ1Q0A0000000000000001",
    "project_id": "prj_01K4XZ1Q0A0000000000000001",
    "customer": null,
    "description": null,
    "metadata": {},
    "success_url": null,
    "cancel_url": null,
    "expires_at": "2026-10-17T12:30:00.000000Z",
    "created_at": "2026-10-17T12:00:00.000000Z",
    "updated_at": "2026-10-17T12:00:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

POST/payment-intents/{id}/cancelCancel a never-captured resolvable payment

Local contractpayments:writePermalink ↗

Cancel a never-captured resolvable payment

Request body is optional: omit it and Content-Type when no reason is supplied, or send a JSON object. Idempotency-Key remains required. Allows CREATED/PENDING only when no capture exists and every existing attempt is FAILED; CANCELLED replay is successful. Captured, completed or unresolved provider attempts return 409 PAYMENT_ALREADY_COMPLETED. No provider cancellation is performed. Unlike create/confirm/refund, this service has no local-only guard; that does not establish live acceptance.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

Idempotency-Key · headerstringRequired

Min length: 16
Max length: 128
Pattern: ^[A-Za-z0-9._:-]+$

JSON request body Optional

Unknown fields rejected

reasonstringOptional

Max length: 500

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 20

dataobjectRequired

Payment snapshot for retrieval, state transitions and webhook data. Does not disclose a checkout capability.

Unknown fields rejected

data.idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "payment_intent"

data.merchant_idstringRequired

Pattern: ^mer_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.project_idstringRequired

Pattern: ^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.environmentstringRequired

Allowed: "test", "live"

data.merchant_referencestringRequired

Max length: 128

data.amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PENDING", "PROCESSING", "SUCCEEDED", "FAILED", "CANCELLED", "EXPIRED", "PARTIALLY_REFUNDED", "REFUNDED"

data.refunded_amountintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.customerobject | nullRequired

When object: Unknown fields rejected

data.descriptionstring | nullRequired

When string: Max length: 500

data.metadataobjectRequired

Non-sensitive merchant tags. Never credentials or card data.

Additional values: string

data.success_urlstring | nullRequired

When string: Format: uri

data.cancel_urlstring | nullRequired

When string: Format: uri

data.expires_atstringRequired

Format: date-time

data.created_atstringRequired

Format: date-time

data.updated_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Idempotency-ReplayedstringResponse header

Allowed: "true", "false"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request POST "$ALZAF_API_BASE/payment-intents/<id>/cancel" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json' \
  --header "Idempotency-Key: $PERSISTED_OPERATION_KEY" \
  --header 'Content-Type: application/json' \
  --data '{}'

Success status

{
  "data": {
    "id": "pay_01K4XZ1Q0A0000000000000001",
    "object": "payment_intent",
    "merchant_reference": "ORDER-1001",
    "amount": 10050,
    "currency": "BDT",
    "status": "CANCELLED",
    "refunded_amount": 0,
    "environment": "test",
    "merchant_id": "mer_01K4XZ1Q0A0000000000000001",
    "project_id": "prj_01K4XZ1Q0A0000000000000001",
    "customer": null,
    "description": null,
    "metadata": {},
    "success_url": null,
    "cancel_url": null,
    "expires_at": "2026-10-17T12:30:00.000000Z",
    "created_at": "2026-10-17T12:00:00.000000Z",
    "updated_at": "2026-10-17T12:00:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

POST/refundsRefund a locally captured mock payment

Local contractrefunds:writePermalink ↗

Refund a locally captured mock payment

Local/testing test-mode mock captures only. Current simulated refund completes synchronously: HTTP 202 data.status is SUCCEEDED. Remaining captured amount and unresolved reservations are checked under locks. Quoted capture needs a retained refund policy. State/amount conflicts return 409 REFUND_NOT_ALLOWED; real-provider refunds remain unavailable.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

Idempotency-Key · headerstringRequired

Min length: 16
Max length: 128
Pattern: ^[A-Za-z0-9._:-]+$

JSON request body Required

Unknown fields rejected

payment_idstringRequired

Existing project/environment payment identifier. Unknown or foreign IDs return 404.

Min length: 1

amountintegerRequired

Minimum: 1
Maximum: 9007199254740991

reasonstring | nullOptional

When string: Max length: 500

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 10

dataobjectRequired

Unknown fields rejected

data.idstringRequired

Pattern: ^ref_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "refund"

data.payment_idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.amountintegerRequired

Minimum: 1
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Value: "SUCCEEDED"

data.reasonstring | nullRequired

When string: Max length: 500

data.created_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Idempotency-ReplayedstringResponse header

Allowed: "true", "false"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request POST "$ALZAF_API_BASE/refunds" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json' \
  --header "Idempotency-Key: $PERSISTED_OPERATION_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "payment_id": "pay_01K4XZ1Q0A0000000000000001",
  "amount": 1000
}'

Success status

{
  "data": {
    "id": "ref_01K4XZ1Q0A0000000000000001",
    "object": "refund",
    "payment_id": "pay_01K4XZ1Q0A0000000000000001",
    "amount": 1000,
    "currency": "BDT",
    "status": "SUCCEEDED",
    "reason": null,
    "created_at": "2026-10-17T12:05:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/refunds/{id}Read a scoped refund

Local contractrefunds:readPermalink ↗

Read a scoped refund

Scoped lookup. Optional reason is nullable. Does not execute or retry a refund. Unknown query parameters are currently ignored.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 10

dataobjectRequired

Unknown fields rejected

data.idstringRequired

Pattern: ^ref_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.objectstringRequired

Value: "refund"

data.payment_idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.amountintegerRequired

Minimum: 1
Maximum: 9007199254740991

data.currencystringRequired

Value: "BDT"

data.statusstringRequired

Allowed: "CREATED", "PROCESSING", "UNKNOWN", "SUCCEEDED", "FAILED"

data.reasonstring | nullRequired

When string: Max length: 500

data.created_atstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/refunds/<id>" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": {
    "id": "ref_01K4XZ1Q0A0000000000000001",
    "object": "refund",
    "payment_id": "pay_01K4XZ1Q0A0000000000000001",
    "amount": 1000,
    "currency": "BDT",
    "status": "SUCCEEDED",
    "reason": null,
    "created_at": "2026-10-17T12:05:00.000000Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/payment-methodsList current normalized method availability

Local contractpayments:readPermalink ↗

List current normalized method availability

Only mock is listed. All availability/refund flags are true only in local/testing with test context, otherwise false. No provider names or real-provider availability are advertised. Unknown query parameters are currently ignored.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

No structured fields declared in this schema.

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 7

dataobject[]Required

data[].codestringRequired

Value: "mock"

data[].display_namestringRequired

Value: "Test payment"

data[].availablebooleanRequired

data[].supports_refundbooleanRequired

data[].supports_partial_refundbooleanRequired

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/payment-methods" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": [
    {
      "code": "mock",
      "display_name": "Test payment",
      "available": true,
      "supports_refund": true,
      "supports_partial_refund": true
    }
  ],
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/transactionsList posted capture/refund transactions

Local contracttransactions:readPermalink ↗

List posted capture/refund transactions

Only cursor/limit queries accepted. Newest(created_at,id) first; opaque cursor binds scope, resource and limit, expires 15 minutes after first page. Amount is original capture/refund gross, not summed journal debits. Only PAYMENT/REFUND emitted; settlement_id is null. No settlement operations.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

cursor · querystringOptional

Opaque encrypted cursor. Reuse unchanged with same limit; invalid/expired scope binding returns422.

Min length: 1
Max length: 2048

limit · queryintegerOptional

Minimum: 1
Maximum: 100
Default: 20

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 13

dataobject[]Required

data[].idstringRequired

Pattern: ^txn_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data[].payment_idstringRequired

Pattern: ^pay_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data[].refund_idstring | nullRequired

When string: Pattern: ^ref_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data[].settlement_idnullRequired

data[].typestringRequired

Allowed: "PAYMENT", "REFUND"

data[].amountintegerRequired

Minimum: 1
Maximum: 9007199254740991

data[].currencystringRequired

Value: "BDT"

data[].created_atstringRequired

Format: date-time

pageobjectRequired

Unknown fields rejected

page.next_cursorstring | nullRequired

page.has_morebooleanRequired

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/transactions" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": [
    {
      "id": "txn_01K4XZ1Q0A0000000000000001",
      "payment_id": "pay_01K4XZ1Q0A0000000000000001",
      "refund_id": null,
      "settlement_id": null,
      "type": "PAYMENT",
      "amount": 10050,
      "currency": "BDT",
      "created_at": "2026-10-17T12:00:00Z"
    }
  ],
  "page": {
    "next_cursor": null,
    "has_more": false
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/balanceRead an audited pending ledger balance

Local contractbalance:readPermalink ↗

Read an audited pending ledger balance

No query parameters accepted. Audits complete scoped ledger history in a consistent snapshot. pending is MERCHANT_PENDING credit minus debit; available/reserved remain 0 because release/settlement postings are not implemented. Integrity/out-of-range failures return503. This informational view cannot authorize spending and is not provider/bank reconciliation.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

No structured fields declared in this schema.

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 7

dataobjectRequired

Unknown fields rejected

data.currencystringRequired

Value: "BDT"

data.pendingintegerRequired

Integer BDT minor units (poisha). 10050 means BDT 100.50. Never a decimal or float.

Minimum: 0
Maximum: 9007199254740991

data.availableintegerRequired

Value: 0

data.reservedintegerRequired

Value: 0

data.as_ofstringRequired

Format: date-time

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/balance" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": {
    "currency": "BDT",
    "pending": 10050,
    "available": 0,
    "reserved": 0,
    "as_of": "2026-10-17T12:00:00Z"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

POST/webhook-endpointsRegister a scoped webhook endpoint

Local contractwebhooks:writePermalink ↗

Register a scoped webhook endpoint

Requires url and unique nonempty events. Local receiver is allowlisted only in local/testing test context with matching configuration. Public HTTPS is separately disabled by default and requires egress acceptance. No Idempotency-Key support for registration; replay may return duplicate 409, and the signing secret is not returned by listing.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

No structured fields declared in this schema.

JSON request body Required

Unknown fields rejected

urlstringRequired

Default disabled-public-egress baseline accepts only the configured exact local receiver http://127.0.0.1:9001/webhooks/alzaf-pay in test mode. Public HTTPS needs separate enablement and DNS/address validation; this contract does not enable it.

Max length: 2000
Format: uri
Pattern: ^https?://

eventsstring[]Required

Settlement names are accepted subscriptions only; no settlement producer or API is implemented.

Min items: 1
Max items: 10

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 8

dataobjectRequired

Unknown fields rejected

data.idstringRequired

Pattern: ^whe_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.urlstringRequired

Format: uri

data.eventsstring[]Required

Settlement names are accepted subscriptions only; no settlement producer or API is implemented.

Min items: 1
Max items: 10

data.enabledbooleanRequired

data.created_atstringRequired

Format: date-time

data.signing_secretstringRequired

Shown once. Server-side secret; never returned by listing.

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request POST "$ALZAF_API_BASE/webhook-endpoints" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "http://127.0.0.1:9001/webhooks/alzaf-pay",
  "events": [
    "payment.succeeded",
    "refund.succeeded"
  ]
}'

Success status

{
  "data": {
    "id": "whe_01K4XZ1Q0A0000000000000001",
    "url": "http://127.0.0.1:9001/webhooks/alzaf-pay",
    "events": [
      "payment.succeeded",
      "refund.succeeded"
    ],
    "enabled": true,
    "created_at": "2026-10-17T12:00:00.000000Z",
    "signing_secret": "whsec_EXAMPLE_ONLY"
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

GET/webhook-endpointsList registered webhook endpoints

Local contractwebhooks:readPermalink ↗

List registered webhook endpoints

Only cursor/limit accepted. Descending id order; cursor binds resource, scope and limit for 15 minutes. Includes disabled endpoints; never returns signing secrets.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

cursor · querystringOptional

Opaque encrypted cursor. Reuse unchanged with same limit; invalid/expired scope binding returns422.

Min length: 1
Max length: 2048

limit · queryintegerOptional

Minimum: 1
Maximum: 100
Default: 20

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 10

dataobject[]Required

data[].idstringRequired

Pattern: ^whe_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data[].urlstringRequired

Format: uri

data[].eventsstring[]Required

Settlement names are accepted subscriptions only; no settlement producer or API is implemented.

Min items: 1
Max items: 10

data[].enabledbooleanRequired

data[].created_atstringRequired

Format: date-time

pageobjectRequired

Unknown fields rejected

page.next_cursorstring | nullRequired

page.has_morebooleanRequired

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request GET "$ALZAF_API_BASE/webhook-endpoints" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": [
    {
      "id": "whe_01K4XZ1Q0A0000000000000001",
      "url": "http://127.0.0.1:9001/webhooks/alzaf-pay",
      "events": [
        "payment.succeeded",
        "refund.succeeded"
      ],
      "enabled": true,
      "created_at": "2026-10-17T12:00:00.000000Z"
    }
  ],
  "page": {
    "next_cursor": null,
    "has_more": false
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

DELETE/webhook-endpoints/{id}Disable an endpoint without deleting its history

Local contractwebhooks:writePermalink ↗

Disable an endpoint without deleting its history

No request body is required. Repeated disable returns 200 for an owned endpoint. Existing in-flight requests may finish. No financial transition and no Idempotency-Key requirement. Nonempty supplied bodies still pass global JSON syntax/type checks but endpoint-specific fields are ignored.

Authentication

Server-side bearer secret with the scopes above. The key determines merchant, project and environment. Never call this API with a merchant secret from a browser.

Headers and URL parameters

id · pathstringRequired

Existing identifier in the authenticated key scope; unknown/foreign identifiers return 404.

Min length: 1

No JSON body is declared for this operation.

Response

Successful local response.

An accepted HTTP status is not payment success. Match your stored order before fulfillment.

Response schema fields 4

dataobjectRequired

Unknown fields rejected

data.idstringRequired

Pattern: ^whe_[0-7][0-9A-HJKMNP-TV-Z]{25}$

data.deletedbooleanRequired

Value: true

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Response headers

X-Request-IdstringResponse header

Support reference; exact successful idempotent replay preserves the original response reference.

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Cache-ControlstringResponse header

Value: "no-store"

Error schema fields

errorobjectRequired

Unknown fields rejected

error.codestringRequired

error.messagestringRequired

error.detailsunknown[] | objectRequired

When unknown[]: Max items: 0
When object: Additional values: string[]

request_idstringRequired

Pattern: ^req_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Synthetic local documentation example. Replace path placeholders and supply private server configuration. Do not run in a browser or generate a new operation key during retries.

curl --fail-with-body --request DELETE "$ALZAF_API_BASE/webhook-endpoints/<id>" \
  --header "Authorization: Bearer $ALZAF_SECRET_KEY" \
  --header 'Accept: application/json'

Success status

{
  "data": {
    "id": "whe_01K4XZ1Q0A0000000000000001",
    "deleted": true
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Error status

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Input validation failed.",
    "details": []
  },
  "request_id": "req_01K4XZ1Q0A0000000000000001"
}

Looking for settlements or payouts?

These remain planned workflows and are not listed as implemented operations. The target contract download includes planned design; use this local runtime reference for installed endpoint shapes.

Review environment and activation requirements →