{
  "info": {
    "name": "Flexepin Merchant API",
    "description": "Validate, Redeem, and transaction lookup requests with the HMAC signature computed automatically in a pre-request script (using CryptoJS, since Postman's sandbox does not include Node's native crypto module). Set api_key, secret, and pin in the collection Variables tab, then just hit Send.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "base_url",
      "value": "https://testrest.flexepin.com"
    },
    {
      "key": "api_key",
      "value": ""
    },
    {
      "key": "secret",
      "value": ""
    },
    {
      "key": "pin",
      "value": ""
    },
    {
      "key": "transaction_id",
      "value": ""
    },
    {
      "key": "trans_no",
      "value": ""
    },
    {
      "key": "past_transaction_id",
      "value": ""
    },
    {
      "key": "from_date",
      "value": "2026-01-01"
    },
    {
      "key": "to_date",
      "value": "2026-12-31"
    }
  ],
  "item": [
    {
      "name": "Status",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": []
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/status",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "status"
          ]
        }
      },
      "response": []
    },
    {
      "name": "Validate",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const apiKey = pm.collectionVariables.get('api_key');",
              "const secret = pm.collectionVariables.get('secret');",
              "const pin = pm.collectionVariables.get('pin');",
              "",
              "if (!apiKey || !secret || !pin) {",
              "    console.warn('Set api_key, secret, and pin in the collection variables (top-left, Variables tab) before sending.');",
              "}",
              "",
              "// Fresh, unique values for this one request",
              "const transactionId = 'txn_' + Date.now() + '_' + Math.floor(Math.random() * 1e6);",
              "const nonce = String(Date.now());",
              "pm.collectionVariables.set('transaction_id', transactionId); // the URL below picks this up automatically when sent",
              "",
              "// Built as a literal string matching this request's own URL exactly \u2014",
              "// deliberately NOT read from pm.request.url, which does not resolve {{variables}} in pre-request scripts.",
              "const uri = '/voucher/validate/' + pin + '/' + apiKey + '/' + transactionId;",
              "const body = ''; // GET requests never have a body",
              "",
              "const payload = 'GET' + \"\\n\" + uri + \"\\n\" + nonce + \"\\n\" + body;",
              "const signature = CryptoJS.HmacSHA256(payload, secret).toString(CryptoJS.enc.Hex);",
              "",
              "pm.request.headers.upsert({ key: 'AUTHENTICATION', value: `HMAC ${apiKey}:${signature}:${nonce}` });"
            ]
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/voucher/validate/{{pin}}/{{api_key}}/{{transaction_id}}",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "voucher",
            "validate",
            "{{pin}}",
            "{{api_key}}",
            "{{transaction_id}}"
          ]
        }
      },
      "response": []
    },
    {
      "name": "Redeem",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const apiKey = pm.collectionVariables.get('api_key');",
              "const secret = pm.collectionVariables.get('secret');",
              "const pin = pm.collectionVariables.get('pin');",
              "",
              "if (!apiKey || !secret || !pin) {",
              "    console.warn('Set api_key, secret, and pin in the collection variables (top-left, Variables tab) before sending.');",
              "}",
              "",
              "// Fresh, unique values for this one request",
              "const transactionId = 'txn_' + Date.now() + '_' + Math.floor(Math.random() * 1e6);",
              "const nonce = String(Date.now());",
              "pm.collectionVariables.set('transaction_id', transactionId); // the URL below picks this up automatically when sent",
              "",
              "// Built as a literal string matching this request's own URL exactly \u2014",
              "// deliberately NOT read from pm.request.url, which does not resolve {{variables}} in pre-request scripts.",
              "const uri = '/voucher/redeem/' + pin + '/' + apiKey + '/' + transactionId;",
              "const body = ''; // kept empty on purpose \u2014 confirmed optional for Redeem, and matches what's actually sent below",
              "",
              "const payload = 'PUT' + \"\\n\" + uri + \"\\n\" + nonce + \"\\n\" + body;",
              "const signature = CryptoJS.HmacSHA256(payload, secret).toString(CryptoJS.enc.Hex);",
              "",
              "pm.request.headers.upsert({ key: 'AUTHENTICATION', value: `HMAC ${apiKey}:${signature}:${nonce}` });"
            ]
          }
        }
      ],
      "request": {
        "method": "PUT",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/voucher/redeem/{{pin}}/{{api_key}}/{{transaction_id}}",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "voucher",
            "redeem",
            "{{pin}}",
            "{{api_key}}",
            "{{transaction_id}}"
          ]
        }
      },
      "response": []
    },
    {
      "name": "Query Transaction by trans_no",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const apiKey = pm.collectionVariables.get('api_key');",
              "const secret = pm.collectionVariables.get('secret');",
              "const pin = pm.collectionVariables.get('pin');",
              "",
              "if (!apiKey || !secret || !pin) {",
              "    console.warn('Set api_key, secret, and pin in the collection variables (top-left, Variables tab) before sending.');",
              "}",
              "",
              "// Fresh, unique values for this one request",
              "const transactionId = 'txn_' + Date.now() + '_' + Math.floor(Math.random() * 1e6);",
              "const nonce = String(Date.now());",
              "pm.collectionVariables.set('transaction_id', transactionId); // the URL below picks this up automatically when sent",
              "",
              "// Built as a literal string matching this request's own URL exactly \u2014",
              "// deliberately NOT read from pm.request.url, which does not resolve {{variables}} in pre-request scripts.",
              "const uri = '/trans/trans_no/' + pm.collectionVariables.get('trans_no') + '/' + apiKey + '/' + transactionId;",
              "const body = ''; // GET requests never have a body",
              "",
              "const payload = 'GET' + \"\\n\" + uri + \"\\n\" + nonce + \"\\n\" + body;",
              "const signature = CryptoJS.HmacSHA256(payload, secret).toString(CryptoJS.enc.Hex);",
              "",
              "pm.request.headers.upsert({ key: 'AUTHENTICATION', value: `HMAC ${apiKey}:${signature}:${nonce}` });"
            ]
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/trans/trans_no/{{trans_no}}/{{api_key}}/{{transaction_id}}",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "trans",
            "trans_no",
            "{{trans_no}}",
            "{{api_key}}",
            "{{transaction_id}}"
          ]
        }
      },
      "response": []
    },
    {
      "name": "Query Transaction by trans_id",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const apiKey = pm.collectionVariables.get('api_key');",
              "const secret = pm.collectionVariables.get('secret');",
              "const pin = pm.collectionVariables.get('pin');",
              "",
              "if (!apiKey || !secret || !pin) {",
              "    console.warn('Set api_key, secret, and pin in the collection variables (top-left, Variables tab) before sending.');",
              "}",
              "",
              "// Fresh, unique values for this one request",
              "const transactionId = 'txn_' + Date.now() + '_' + Math.floor(Math.random() * 1e6);",
              "const nonce = String(Date.now());",
              "pm.collectionVariables.set('transaction_id', transactionId); // the URL below picks this up automatically when sent",
              "",
              "// Built as a literal string matching this request's own URL exactly \u2014",
              "// deliberately NOT read from pm.request.url, which does not resolve {{variables}} in pre-request scripts.",
              "const uri = '/trans/trans_id/' + pm.collectionVariables.get('past_transaction_id') + '/' + apiKey + '/' + transactionId;",
              "const body = ''; // GET requests never have a body",
              "",
              "const payload = 'GET' + \"\\n\" + uri + \"\\n\" + nonce + \"\\n\" + body;",
              "const signature = CryptoJS.HmacSHA256(payload, secret).toString(CryptoJS.enc.Hex);",
              "",
              "pm.request.headers.upsert({ key: 'AUTHENTICATION', value: `HMAC ${apiKey}:${signature}:${nonce}` });"
            ]
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/trans/trans_id/{{past_transaction_id}}/{{api_key}}/{{transaction_id}}",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "trans",
            "trans_id",
            "{{past_transaction_id}}",
            "{{api_key}}",
            "{{transaction_id}}"
          ]
        }
      },
      "response": []
    },
    {
      "name": "Query Transactions between dates",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const apiKey = pm.collectionVariables.get('api_key');",
              "const secret = pm.collectionVariables.get('secret');",
              "const pin = pm.collectionVariables.get('pin');",
              "",
              "if (!apiKey || !secret || !pin) {",
              "    console.warn('Set api_key, secret, and pin in the collection variables (top-left, Variables tab) before sending.');",
              "}",
              "",
              "// Fresh, unique values for this one request",
              "const transactionId = 'txn_' + Date.now() + '_' + Math.floor(Math.random() * 1e6);",
              "const nonce = String(Date.now());",
              "pm.collectionVariables.set('transaction_id', transactionId); // the URL below picks this up automatically when sent",
              "",
              "// Built as a literal string matching this request's own URL exactly \u2014",
              "// deliberately NOT read from pm.request.url, which does not resolve {{variables}} in pre-request scripts.",
              "const uri = '/trans/between/' + pm.collectionVariables.get('from_date') + '/' + pm.collectionVariables.get('to_date') + '/' + apiKey + '/' + transactionId;",
              "const body = ''; // GET requests never have a body",
              "",
              "const payload = 'GET' + \"\\n\" + uri + \"\\n\" + nonce + \"\\n\" + body;",
              "const signature = CryptoJS.HmacSHA256(payload, secret).toString(CryptoJS.enc.Hex);",
              "",
              "pm.request.headers.upsert({ key: 'AUTHENTICATION', value: `HMAC ${apiKey}:${signature}:${nonce}` });"
            ]
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "Accept",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{base_url}}/trans/between/{{from_date}}/{{to_date}}/{{api_key}}/{{transaction_id}}",
          "host": [
            "{{base_url}}"
          ],
          "path": [
            "trans",
            "between",
            "{{from_date}}",
            "{{to_date}}",
            "{{api_key}}",
            "{{transaction_id}}"
          ]
        }
      },
      "response": []
    }
  ]
}