{
  "info": {
    "name": "Sparelane Sandbox Merchant API",
    "_postman_id": "00000000-0000-4000-8000-000000006c00",
    "description": "Merchant-facing Sparelane sandbox API collection. The controlled-pilot base URL is https://api.sandbox.sparelane.com.au/v1. Do not use real payment credentials or real customer data.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "bearer",
    "bearer": [
      {
        "key": "token",
        "value": "{{apiKey}}",
        "type": "string"
      }
    ]
  },
  "variable": [
    { "key": "baseUrl", "value": "https://api.sandbox.sparelane.com.au/v1" },
    { "key": "apiKey", "value": "placeholder" },
    { "key": "merchantId", "value": "placeholder" },
    { "key": "customerId", "value": "placeholder" },
    { "key": "authorizationId", "value": "placeholder" },
    { "key": "billId", "value": "placeholder" },
    { "key": "paymentId", "value": "placeholder" },
    { "key": "webhookEndpointId", "value": "placeholder" },
    { "key": "requestId", "value": "{{$guid}}" }
  ],
  "item": [
    {
      "name": "Merchant",
      "item": [
        {
          "name": "Get merchant profile",
          "request": {
            "method": "GET",
            "header": [{ "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/merchant",
            "description": "Returns the merchant resolved from the bearer API key."
          },
          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('request id is visible', function () { pm.expect(pm.response.headers.get('sparelane-request-id')).to.exist; });"] } }]
        }
      ]
    },
    {
      "name": "Customers",
      "item": [
        {
          "name": "List customers",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/customers?limit=50" }
        },
        {
          "name": "Create customer",
          "request": {
            "method": "POST",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/customers",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"externalCustomerId\": \"cust_demo_001\",\n  \"displayName\": \"Sarah Example\",\n  \"email\": \"sarah.customer@example.test\"\n}"
            },
            "description": "externalCustomerId is unique within the authenticated merchant."
          }
        },
        {
          "name": "Get customer",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/customers/{{customerId}}" }
        },
        {
          "name": "Update customer",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/customers/{{customerId}}",
            "body": { "mode": "raw", "raw": "{\n  \"displayName\": \"Sarah Customer\"\n}" }
          }
        }
      ]
    },
    {
      "name": "Customer link authorisations",
      "item": [
        {
          "name": "Create link authorisation",
          "request": {
            "method": "POST",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/customers/{{customerId}}/link-authorizations",
            "body": { "mode": "raw", "raw": "{\n  \"expiresInMinutes\": 30\n}" },
            "description": "Returns the invitation token once. Consumer approval is performed outside merchant API credentials."
          }
        },
        {
          "name": "Cancel link authorisation",
          "request": {
            "method": "POST",
            "header": [{ "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/customers/{{customerId}}/link-authorizations/{{authorizationId}}/cancel"
          }
        }
      ]
    },
    {
      "name": "Mandates",
      "item": [
        {
          "name": "List mandates",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/mandates?limit=50" }
        }
      ]
    },
    {
      "name": "Bills",
      "item": [
        {
          "name": "List bills",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/bills?limit=50" }
        },
        {
          "name": "Submit bill",
          "request": {
            "method": "POST",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/bills",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"externalCustomerId\": \"cust_demo_001\",\n  \"amountCents\": 4995,\n  \"currency\": \"AUD\",\n  \"dueAt\": \"2026-11-15T00:00:00.000Z\",\n  \"description\": \"Fictional monthly subscription\",\n  \"idempotencyKey\": \"bill-demo-2026-11-001\"\n}"
            },
            "description": "Repeated matching payloads with the same idempotencyKey are idempotent."
          }
        },
        {
          "name": "Get bill",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/bills/{{billId}}" }
        }
      ]
    },
    {
      "name": "Sandbox simulations",
      "item": [
        {
          "name": "Run bill payment simulation",
          "request": {
            "method": "POST",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/bills/{{billId}}/simulations",
            "body": { "mode": "raw", "raw": "{\n  \"scenario\": \"PRIMARY_DECLINE_BACKUP_SUCCESS\"\n}" },
            "description": "Sandbox-only. Supported scenarios: PRIMARY_SUCCESS, PRIMARY_DECLINE_BACKUP_SUCCESS, ALL_METHODS_DECLINE, NO_ELIGIBLE_METHOD, MANDATE_REVOKED."
          }
        }
      ]
    },
    {
      "name": "Payments",
      "item": [
        {
          "name": "List payments",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/payments?limit=50" }
        },
        {
          "name": "Get payment",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/payments/{{paymentId}}" }
        }
      ]
    },
    {
      "name": "Webhooks",
      "item": [
        {
          "name": "List webhook endpoints",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/webhooks" }
        },
        {
          "name": "Create webhook endpoint",
          "request": {
            "method": "POST",
            "header": [{ "key": "content-type", "value": "application/json" }, { "key": "x-request-id", "value": "{{requestId}}" }],
            "url": "{{baseUrl}}/webhooks",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"url\": \"https://webhooks.example.test/sparelane\",\n  \"description\": \"Sandbox webhook endpoint\",\n  \"eventTypes\": [\"payment.succeeded\", \"payment.failed\", \"payment.recovered\"]\n}"
            },
            "description": "The plaintext signing secret is returned once. Store it securely."
          }
        },
        {
          "name": "List webhook deliveries",
          "request": { "method": "GET", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/webhooks/{{webhookEndpointId}}/deliveries" }
        },
        {
          "name": "Disable webhook endpoint",
          "request": { "method": "POST", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/webhooks/{{webhookEndpointId}}/disable" }
        },
        {
          "name": "Rotate webhook signing secret",
          "request": { "method": "POST", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/webhooks/{{webhookEndpointId}}/rotate-secret" }
        },
        {
          "name": "Generate signed webhook test event",
          "request": { "method": "POST", "header": [{ "key": "x-request-id", "value": "{{requestId}}" }], "url": "{{baseUrl}}/webhooks/{{webhookEndpointId}}/test-event" }
        }
      ]
    }
  ]
}