Merchants (posId / report key / CRC)
Allow-list of { merchantId, posId, apiKey, crc }. Basic auth: username = posId, password = apiKey (the report key); a miss answers the documented 401 "Incorrect authentication". The CRC key never travels on the wire — it only feeds the four SHA-384 sign recipes.
Notification target
Default urlStatus used when a register/refund request carries none (the panel-default analogue). Per-request urlStatus always wins.
Transactions
Status enum: 0 no payment, 1 advance payment (paid, unverified), 2 payment made (verified), 3 payment returned. Notifications are success-only and retried on the 3/5/15/30/60/150/450-minute ladder until the merchant verifies.
urlStatus notification deliveries
Merchant API requests
Danger zone
wipes payments, logs and every runtime override — back to configured defaults