{
  "openapi": "3.1.0",
  "info": {
    "title": "Merchant API",
    "version": "1.0.0",
    "description": "Server access API documentation for Merchant Transfer System."
  },
  "servers": [
    {
      "url": "https://status.api-payments.com"
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Api-Key",
        "description": "API key from approved Server Access credentials."
      },
      "ClientSecretAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Client-Secret",
        "description": "Client secret from approved Server Access credentials."
      },
      "TimestampAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Timestamp",
        "description": "Request timestamp used for anti-replay validation."
      },
      "SignatureAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Signature",
        "description": "HMAC-SHA256 signature of timestamp, method, path, and raw body."
      }
    }
  },
  "paths": {
    "/api/transfers/status": {
      "get": {
        "tags": [
          "Transfers"
        ],
        "summary": "Read transfer status",
        "description": "Read current transfer status by reference.",
        "operationId": "transfer_status_get",
        "security": [
          {
            "ApiKeyAuth": [],
            "ClientSecretAuth": [],
            "TimestampAuth": [],
            "SignatureAuth": []
          }
        ],
        "parameters": [
          {
            "name": "X-Timestamp",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Unix epoch seconds or ISO-8601 timestamp. Must be inside the configured replay window.",
            "example": "2026-07-15T12:00:00Z"
          },
          {
            "name": "X-Signature",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "HMAC-SHA256 over: X-Timestamp + '.' + METHOD + '.' + PATH_AND_QUERY + '.' + raw request body. During migration, Server A also accepts the previous PATH-only signature.",
            "example": "sha256=0123456789abcdef"
          },
          {
            "name": "reference",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "example": "TRN-20260628-ABC123"
          }
        ],
        "responses": {
          "200": {
            "description": "Authorized API response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": true
                    },
                    "status": {
                      "type": "string",
                      "example": "AUTHORIZED"
                    },
                    "endpoint": {
                      "type": "string",
                      "example": "TRANSFER_STATUS"
                    },
                    "permission": {
                      "type": "string",
                      "example": "TRANSFER_STATUS"
                    },
                    "route": {
                      "type": "string",
                      "example": "transfer_status"
                    },
                    "client_id": {
                      "type": "string",
                      "example": "SRV-20260628-ABC123"
                    },
                    "message": {
                      "type": "string",
                      "example": "API access authorized. Route-specific processing can continue."
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or missing server access credential",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "invalid_secret"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Server access blocked for this host, endpoint, or route",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "route_not_allowed_for_host"
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Unknown API endpoint",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "example": false
                    },
                    "reason": {
                      "type": "string",
                      "example": "endpoint_not_allowed"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "tags": [
    {
      "name": "Client Registration"
    },
    {
      "name": "Transfers"
    },
    {
      "name": "Confirmations"
    },
    {
      "name": "Statements"
    }
  ]
}