S
docs.syncra.money
API keys
ENRU
POST/api/v1/p2p/merchant/api-keys/rotateСтейдж

Atomically replaces the existing credentials. Returns a new token and secret. Rotation grace period (confirmed behavior): the outgoing pair remains valid for a limited window (15 minutes by default, configurable by the operator via MERCHANT_KEY_GRACE_PERIOD; 0 disables it). Grace is strictly paired — during the window only the FULL old pair (old token + old secret) is accepted; mixed combinations return 401. Outbound webhooks are signed with the NEW secret immediately.

Authorization

MerchantToken MerchantSignature MerchantTimestamp
X-Merchant-Token<token>

The merchant's public token (64 hex characters), issued at onboarding.

In: header

X-Signature<token>

HMAC-SHA256 signature (a single scheme for all endpoints). Format: t=<unix_seconds>,v1=<hex_hmac_sha256> where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>"). Replay window: 5 minutes (a 60-second drift into the future is allowed).

In: header

X-Timestamp<token>

Unix time of the request in seconds. Signature window: 5 minutes back / 60 seconds forward.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

curl -X POST "https://example.com/api/v1/p2p/merchant/api-keys/rotate" \  -H "X-Merchant-Token: <MERCHANT_TOKEN>" \  -H "X-Timestamp: <UNIX_TIMESTAMP>" \  -H "X-Signature: t=<UNIX_TIMESTAMP>,v1=<HEX_HMAC_SHA256>" \  -H "Content-Type: application/json" \  -d '{}'
{  "token": "string",  "secret": "string"}
{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}

List the tenant's active currencies GET GET

The currency reference of the authenticated merchant's tenant (HMAC claims or cabinet JWT): the UUID, ISO 4217 alpha code, and display name of every ACTIVE `p2p_currencies` row. Used for formatting payout amounts and choosing the currency in CreateMerchantPayOut.

Own merchant profile, limits, and kill switch banner GET GET

Self-service read of the merchant's OWN profile: identification, the api-credentials representation, webhook URL, redirect URLs, IP whitelist, deal limits (deal_min_amount / deal_max_amount / daily_deal_amount_limit — present only when set) and the kill_switch / kill_switch_reason banner fields. Dual authentication: cabinet JWT (Authorization: Bearer, merchant role) OR the merchant HMAC pair — the scope is resolved from the presented credentials.