TrieOH
UniventsAPISignatures

Revoke a signature

Revokes a previously fulfilled signature. Authenticated by the signature token passed as the `token` query parameter (NOT a JWT).

POST/signatures/revoke

Revokes a previously fulfilled signature. Authenticated by the signature token passed as the token query parameter (NOT a JWT).

Query Parameters

token*string

HMAC-signed signature token.

Response Body

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/signatures/revoke?token=string"
Empty
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 400,
  "title": "Validation Failed"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 401,
  "title": "Unauthenticated"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 404,
  "title": "Not Found"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 500,
  "title": "Internal Server Error"
}

Deny a signature request POST

Denies a pending signature request. Authenticated by the signature-request token passed as the `token` query parameter (NOT a JWT).

Receive a Payssage webhook delivery POST

Ingestion endpoint called by Payssage when a payment event occurs on an intent. The body is the Payssage delivery envelope (D2) — the correlation key is `intent_id`, never a provider-specific id: ```json { "intent_id": "...", "wallet_id": "...", "provider": "mercadopago", "external_id": "<provider_payment_id>", "event_type": "payment.succeeded", "status_detail": "high_risk", "payload": { "...": "raw provider payload" } } ``` Authenticated by the `X-Payssage-Signature` header — hex (HMAC-SHA256(raw body, `PAYSSAGE_WEBHOOK_SECRET`)). A signature mismatch is rejected with 400 (Payssage does not retry). Returns 200 after successful processing so Payssage stops retrying; returns non-2xx when the purchase cannot be correlated yet (card race, D3) so Payssage retries. This is the only component that confirms payment — checkout never self-approves (D3). Public: Payssage cannot send an Authorization header.