MoonTap API docs

These endpoints use deterministic local adapters during development and guarded merchant-scoped Supabase repositories when production persistence is enabled. Public payment and refund mutations accept `Idempotency-Key` headers and sensitive actions produce audit evidence. Funded routing, automated refunds, and outbound webhook egress remain fail-closed until their separate production gates pass.

To exercise a refund safely, first create an API payment, open its returnedcheckoutUrl, and record the checkout locally. Retrieve the API payment afterward to obtain its localCheckoutPaymentId; use that confirmed ID in the refund request. Refund requests remain inert unless the production approval and execution controls are explicitly enabled.

Create payment

POST /api/v1/payments

curl http://localhost:3000/api/v1/payments \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mt_test_your_key" \
  -H "Idempotency-Key: order-1042" \
  -d '{"amount_usd":129,"description":"Order #1042"}'

Create refund

POST /api/v1/refunds

curl http://localhost:3000/api/v1/refunds \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mt_test_your_key" \
  -H "Idempotency-Key: refund-local-payment-25" \
  -d '{"payment_id":"<localCheckoutPaymentId>","amount_usd":25,"reason":"Customer request"}'

Create POS charge

POST /api/pos/charges

curl http://localhost:3000/api/pos/charges \
  -H "Content-Type: application/json" \
  -d '{"amountUsd":42,"subtotalUsd":38,"tipUsd":4}'

Webhook test receiver

POST /api/webhooks/test-receiver

curl http://localhost:3000/api/webhooks/test-receiver \
  -H "Content-Type: application/json" \
  -d '{"event":"payment.confirmed","paymentId":"pay_demo"}'

Settings action

PATCH /api/dashboard/settings

curl -X PATCH http://localhost:3000/api/dashboard/settings \
  -H "Content-Type: application/json" \
  -d '{"action":"pause_payments"}'

OpenAPI

/api/openapi.json