/api/v1/p2p/merchant/currenciesСтейджThe currency reference of the authenticated merchant's tenant
(HMAC claims or cabinet JWT): the UUID, ISO 4217 alpha code, and
display name of every ACTIVE p2p_currencies row. Used for
formatting payout amounts and choosing the currency in
CreateMerchantPayOut.
Authorization
MerchantToken MerchantSignature MerchantTimestamp The merchant's public token (64 hex characters), issued at onboarding.
In: header
HMAC-SHA256 signature (a single scheme for all endpoints).
Format: t=<unix_seconds>,v1=<hex_hmac_sha256>
where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>").
Replay window: 5 minutes (a 60-second drift into the future is allowed).
In: header
Unix time of the request in seconds. Signature window: 5 minutes back / 60 seconds forward.
In: header
Response Body
application/json
application/problem+json
curl -X GET "https://example.com/api/v1/p2p/merchant/currencies" \ -H "X-Merchant-Token: <MERCHANT_TOKEN>" \ -H "X-Timestamp: <UNIX_TIMESTAMP>" \ -H "X-Signature: t=<UNIX_TIMESTAMP>,v1=<HEX_HMAC_SHA256>"{ "data": [ { "id": "9a3f1c2e-1234-4abc-9def-56789abcdef0", "code": "RUB", "name": "Russian ruble", "status": "ACTIVE" }, { "id": "4ac148fe-19a3-45bb-b992-019fac55b72c", "code": "TRY", "name": "Türk lirası", "status": "ACTIVE" } ]}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "instance": "../dictionary", "errors": [ { "field": "amount", "message": "must be greater than 0", "code": "POSITIVE_REQUIRED" } ]}List the tenant's active payment methods GET GET
Returns payment methods in the ACTIVE status configured for the authenticated merchant's tenant: `id` (UUID), `slug`, `name`, `requisite_types`, `currency_code`, and `status`. This is the **canonical method catalog**: a single method reference — a UUID (`id`) or a slug (`slug`) — is accepted by both `POST /deals/payin` (`payment_method_id`) and `POST /deals/payout` (`payment_method`); both formats resolve to the same row. The method currency must match the deal currency (PayOut rejects a mismatch with HTTP 400). `GET /banks` does NOT return method identifiers — its `methods` field contains only `RequisiteType` values.
Rotate API keys POST POST
Atomically replaces the existing credentials. Returns a new token and secret. Rotation grace period (confirmed behavior): the outgoing pair remains valid for a limited window (15 minutes by default, configurable by the operator via `MERCHANT_KEY_GRACE_PERIOD`; `0` disables it). Grace is strictly paired — during the window only the FULL old pair (old token + old secret) is accepted; mixed combinations return 401. Outbound webhooks are signed with the NEW secret immediately.