{
  "openapi": "3.0.3",
  "info": {
    "title": "UniWeb Merchant API",
    "version": "2.0.0",
    "description": "Mode-scoped Merchant API. Authenticate with X-API-Key and X-API-Secret. Write requests also require Idempotency-Key."
  },
  "servers": [{ "url": "https://uniweb.co.in" }],
  "paths": {
    "/api.php": {
      "post": {
        "summary": "Merchant API",
        "parameters": [
          {
            "name": "X-API-Key",
            "in": "header",
            "required": true,
            "schema": { "type": "string" }
          },
          {
            "name": "X-API-Secret",
            "in": "header",
            "required": true,
            "schema": { "type": "string", "format": "password" }
          },
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": false,
            "description": "Required for create_payment_link and create_refund. Reuse only for an identical request.",
            "schema": { "type": "string", "maxLength": 100 }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": ["action"],
                "properties": {
                  "action": {
                    "type": "string",
                    "enum": [
                      "create_payment_link",
                      "check_status",
                      "list_transactions",
                      "get_balance",
                      "create_refund",
                      "list_refunds",
                      "list_payment_links",
                      "get_payment_link"
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": { "description": "Success" },
          "400": { "description": "Bad request" },
          "401": { "description": "Invalid API key" },
          "403": { "description": "Mode mismatch" },
          "404": { "description": "Not found" },
          "409": { "description": "Idempotency conflict" },
          "429": { "description": "Rate limit exceeded" }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      },
      "ApiSecretAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Secret"
      }
    },
    "schemas": {
      "WebhookPayload": {
        "type": "object",
        "properties": {
          "event": { "type": "string", "example": "payment.success" },
          "timestamp": { "type": "integer" },
          "data": { "type": "object" }
        }
      }
    }
  },
  "security": [{ "ApiKeyAuth": [], "ApiSecretAuth": [] }],
  "x-webhooks": {
    "payment.success": {
      "post": {
        "summary": "Outbound webhook to merchant URL",
        "description": "Queued delivery with retries. HMAC-SHA256 signature in X-UniWeb-Signature over raw JSON; X-UniWeb-Event-Id is stable across retries.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": { "$ref": "#/components/schemas/WebhookPayload" }
            }
          }
        }
      }
    }
  }
}