Crypto processing

Default 25. Out of range is never rejected: a value outside 1..100, a fraction, or a non-number is not a 400 — 0, a negative number, a non-integer or anything non-numeric falls back to the default (25); anything above 100 is capped to 100. A documented clamp, not a silent one; minimum/maximum are deliberately absent from this schema so a generated client (the MCP tool included) does not reject a value the API itself accepts.

Opaque cursor from a previous response's next_cursor.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Default 25. Out of range is never rejected: a value outside 1..100, a fraction, or a non-number is not a 400 — 0, a negative number, a non-integer or anything non-numeric falls back to the default (25); anything above 100 is capped to 100. A documented clamp, not a silent one; minimum/maximum are deliberately absent from this schema so a generated client (the MCP tool included) does not reject a value the API itself accepts.

Opaque cursor from a previous response's next_cursor.

Filters by settlement destination (CP-T1). wallet is the merchant's own Swaps Wallet (RESOURCE-MODEL §2.3): the pay-ins of links whose settlement_kind is crypto_only, which the Crypto processing Payments list reads. Applies to the page and to ?expand=summary. Any other value is 400 invalid_request with param: settlement.

Cross-product pay-in lifecycle (RESOURCE-MODEL §2.1 v2 amendment, 12 states). processing is still planned (Bridge-rail only, R19 X4). underpaid / overpaid / unmatched are AVAILABLE (CP-T3, §52.37 item 4 — RESOURCE-MODEL CP-G5's producer): the Tempo watcher (crypto_tempo/crypto_relay) writes them directly onto payment_link_attempts.status — a deposit short of the frozen total is underpaid (stays live: a later top-up can still complete it, settling paid with the SUM of every leg received, never just the last one); a match ABOVE the total settles the merchant's exact invoice as before and is overpaid, surplus published (paid to the Swaps fee wallet together with the fee, never auto-refunded — see Payment.surplus); a deposit to a closed, unpaid payment's address (expired or abandoned) makes that payment unmatched, amount_received = what was observed on it; a merchant cancel of an underpaid payment makes it unmatched too, never abandoned — the money stays held and its running total stays amount_received; Payment.unmatched_reason names which of these two made it (deposit_after_close / partial_before_cancel); a further deposit to an unmatched or already-paid payment's address never changes its status and is recorded for support, not published on /v1; a leg in a different accepted token than an underpaid payment's running total is never summed into it and is recorded for support; a deposit matching no payment at all is recorded for support. Events: payment.underpaid / payment.overpaid are live on TWO independent producers — the Bridge pay-in reducer (below) AND, as of CP-T3, the Tempo watcher, each firing at most once per payment on its own rail. The Bridge pay-in reducer emits one per payment when Bridge reports the received amount in the link's own currency and it falls outside ±1 % of the link amount; data.object carries both figures as amount_received and amount_expected (Money, link currency for the Bridge producer; the observed Tempo stablecoin for the watcher's own producer — crypto_tempo has no FX leg to convert either figure into). No verdict is published for a pay-in in another currency or on an FX-estimated figure. On the Bridge rails ONLY, payment.paid (and payment.settled) also fire for a short payment and come first, and data.object.status keeps reading paid/settled while the link stays processing: a payment.underpaid on the same pay_ id overrides them — do not fulfil on payment.paid alone. On crypto_tempo/crypto_relay this never happens: an underpaid deposit never reaches funds_received at all until it is topped up. payment.marked_sent is live — the payer's non-authoritative "I have sent it" on /pay, status still awaiting. Still catalogued, with the missing observation: payment.detected — Bridge delivers no pre-arrival state on the rails Payment links use (funds_scheduled is ACH-only, collection accounts are GBP/EUR) and the Tempo watcher settles on first sight; payment.processing — Bridge's payment_submitted follows funds_received (already paid) and in_review is only recorded on the link timeline, so no pre-paid processing step is observed. payment.unmatched is live (CP-T3, crypto_tempo/crypto_relay) once per payment, ONLY for a deposit to a closed, unpaid payment's address or a merchant cancel of an underpaid payment, its data.object.unmatched_reason naming which; a further deposit to an unmatched or paid payment and a deposit matching no payment are recorded for support and never published on /v1; a Bridge collection-account deposit with no match is still held in the operator ledger with no Payment to carry it (that half stays unproduced). A1-2 fixer round 1 (finding #2): this is the CLOSED, request-side form — payments.list's status query filter uses it directly, and an unrecognized value there is a real 400. PaymentStatusOpen (below) is the exact same list, response-side only (Payment.status, PaymentAttemptView.status, PaymentLink.latest_attempt_status); round 1 marked this schema directly instead, which leaked the open behaviour onto the query filter too (CONVENTIONS.md: mark the specific field, never the vocabulary in general).

Comma-separated. summary (LIST-SUMMARY-1) adds summary: counts computed server-side over EVERY row matching this request's filters, not over the returned page, so a client never adds up a paginated page and calls it a total. limit/cursor never change it. An unrecognised value is ignored rather than rejected (the GET /account expand rule).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Default 25. Out of range is never rejected: a value outside 1..100, a fraction, or a non-number is not a 400 — 0, a negative number, a non-integer or anything non-numeric falls back to the default (25); anything above 100 is capped to 100. A documented clamp, not a silent one; minimum/maximum are deliberately absent from this schema so a generated client (the MCP tool included) does not reject a value the API itself accepts.

Opaque cursor from a previous response's next_cursor.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Default 25. Out of range is never rejected: a value outside 1..100, a fraction, or a non-number is not a 400 — 0, a negative number, a non-integer or anything non-numeric falls back to the default (25); anything above 100 is capped to 100. A documented clamp, not a silent one; minimum/maximum are deliberately absent from this schema so a generated client (the MCP tool included) does not reject a value the API itself accepts.

Opaque cursor from a previous response's next_cursor.

Comma-separated. summary (LIST-SUMMARY-1) adds summary: counts computed server-side over EVERY row matching this request's filters, not over the returned page, so a client never adds up a paginated page and calls it a total. limit/cursor never change it. An unrecognised value is ignored rather than rejected (the GET /account expand rule).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Caller-generated, 16-128 characters of [A-Za-z0-9_-] (a UUID or a base64url token both qualify). The value is part of a primary key, so the shape is enforced, not advisory: outside it the request is 400 invalid_request/idempotency_key_invalid. A replay within 24 hours returns the stored response; a different body under the same key is idempotency_error; a replay of a request that failed after it may have taken effect is 409 idempotency_failed — reconcile, then retry under a NEW key. After 24 hours the key is forgotten and the request is new (D-108).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Caller-generated, 16-128 characters of [A-Za-z0-9_-] (a UUID or a base64url token both qualify). The value is part of a primary key, so the shape is enforced, not advisory: outside it the request is 400 invalid_request/idempotency_key_invalid. A replay within 24 hours returns the stored response; a different body under the same key is idempotency_error; a replay of a request that failed after it may have taken effect is 409 idempotency_failed — reconcile, then retry under a NEW key. After 24 hours the key is forgotten and the request is new (D-108).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Caller-generated, 16-128 characters of [A-Za-z0-9_-] (a UUID or a base64url token both qualify). The value is part of a primary key, so the shape is enforced, not advisory: outside it the request is 400 invalid_request/idempotency_key_invalid. A replay within 24 hours returns the stored response; a different body under the same key is idempotency_error; a replay of a request that failed after it may have taken effect is 409 idempotency_failed — reconcile, then retry under a NEW key. After 24 hours the key is forgotten and the request is new (D-108).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Caller-generated, 16-128 characters of [A-Za-z0-9_-] (a UUID or a base64url token both qualify). The value is part of a primary key, so the shape is enforced, not advisory: outside it the request is 400 invalid_request/idempotency_key_invalid. A replay within 24 hours returns the stored response; a different body under the same key is idempotency_error; a replay of a request that failed after it may have taken effect is 409 idempotency_failed — reconcile, then retry under a NEW key. After 24 hours the key is forgotten and the request is new (D-108).

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Default 25. Out of range is never rejected: a value outside 1..100, a fraction, or a non-number is not a 400 — 0, a negative number, a non-integer or anything non-numeric falls back to the default (25); anything above 100 is capped to 100. A documented clamp, not a silent one; minimum/maximum are deliberately absent from this schema so a generated client (the MCP tool included) does not reject a value the API itself accepts.

Opaque cursor from a previous response's next_cursor.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.

Pins behaviour within /v1 to a dated version; defaults to the key's version; echoed on every response.

A1-2. Selects which of the caller's account memberships this request acts on, by Account.id (acct_…), when the credential can reach more than one; the caller's default account otherwise (D-109, supabase/functions/api-v1/auth.ts). Declared on every operation a dashboard session can call (#3561: the runtime caller class, not the formal security list, which names only businessKey on operations both credential classes reach). A value the session is not a member of answers 404 not_found. A business key already resolves to exactly one account (its own) and ignores this header.