{
  "openapi": "3.1.0",
  "info": {
    "title": "PaySwitch API",
    "version": "1.0.0",
    "description": "Payment orchestration: one API + one webhook across many payment gateways. All requests are HMAC-signed (see the Signature guide)."
  },
  "servers": [
    { "url": "https://api.payswitch.efolusi.com", "description": "Production" },
    { "url": "https://sandbox.api.payswitch.efolusi.com", "description": "Sandbox (test mode)" }
  ],
  "components": {
    "securitySchemes": {
      "productSignature": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Signature",
        "description": "hex HMAC-SHA256(webhook_secret, \"<X-Timestamp>.<METHOD>.<path>.<rawBody>\"). Also send X-Product-Id and X-Timestamp (unix seconds)."
      }
    },
    "schemas": {
      "ChargeRequest": {
        "type": "object",
        "required": ["amount", "currency"],
        "properties": {
          "amount": { "type": "integer", "description": "Amount in minor units (e.g. 10000 = Rp 10.000)." },
          "currency": { "type": "string", "example": "IDR" },
          "method": { "type": "string", "example": "va", "description": "Optional preferred method; routing picks a provider." },
          "metadata": { "type": "object", "additionalProperties": true }
        }
      },
      "Charge": {
        "type": "object",
        "properties": {
          "id": { "type": "string" },
          "status": { "type": "string", "enum": ["created", "pending", "paid", "settled", "failed", "expired", "refunded"] },
          "amount": { "type": "integer" },
          "currency": { "type": "string" },
          "checkout_url": { "type": "string", "nullable": true }
        }
      }
    }
  },
  "security": [{ "productSignature": [] }],
  "paths": {
    "/v1/charges": {
      "post": {
        "summary": "Create a charge",
        "description": "Idempotent via the Idempotency-Key header. Returns a checkout URL / VA / token depending on the routed provider.",
        "parameters": [
          { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string" }, "description": "Client-generated key; repeated keys return the same charge." },
          { "name": "X-Product-Id", "in": "header", "required": true, "schema": { "type": "string" } },
          { "name": "X-Timestamp", "in": "header", "required": true, "schema": { "type": "string" }, "description": "Unix seconds." }
        ],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChargeRequest" } } }
        },
        "responses": {
          "201": { "description": "Charge created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Charge" } } } },
          "200": { "description": "Idempotent replay of an existing charge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Charge" } } } },
          "401": { "description": "Signature invalid or stale" },
          "429": { "description": "Rate limit exceeded" }
        }
      }
    },
    "/webhooks/{provider}": {
      "post": {
        "summary": "Gateway webhook ingest (called by the gateway, not by products)",
        "description": "PaySwitch verifies the provider signature, dedupes, then dispatches a uniform PaySwitch-signed webhook to the product's callback URL.",
        "security": [],
        "parameters": [
          { "name": "provider", "in": "path", "required": true, "schema": { "type": "string", "example": "midtrans" } }
        ],
        "responses": { "200": { "description": "Acknowledged" } }
      }
    }
  }
}