Merchants (mchid / APIv3 key / certificate serial)
Allow-list of merchants. Unknown mchid or serial_no → 401 MCH_NOT_EXISTS; a bad signature → 401 SIGN_ERROR. Empty merchantPublicKeyPem = relaxed mode (any signature accepted). The 32-byte apiV3Key wraps certificate and notification resources (AES-256-GCM).
Notification URL
Fallback notify_url for payment notifications when order placement omits one. Refund notifications go only to the notify_url passed on Submit Refund.
Transactions and refunds
Drive the payer boundary: pay / user-paying / payment-error, re-fire TRANSACTION.SUCCESS (optionally with a corrupted signature), progress refunds. Only success outcomes fire notifications — failures are poll-only, like the real API.
Notification deliveries
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults