Skip to main content

Services

Merchant Service​

The Merchant Service is the core REST API that powers Group Payments customer onboarding and management capabilities. It handles onboarding workflow orchestration, status tracking, and coordination with external assessment services including credit risk evaluation and KYC verification.

Infrastructure Overview​

The service operates on a secure, scalable cloud infrastructure:

  • Hosting: Deployed on Microsoft Azure with enterprise-grade security and availability
  • API Gateway: Accessed through Azure API Management for consistent API governance and monitoring
  • Security Layer: All external traffic is routed through Cloudflare, providing DDoS protection, performance optimization, and additional security controls

Authentication​

API access is secured using Azure API Management subscription keys, which are provided during the project setup phase for your integration.

Environment Access​

You will receive separate subscription keys for each environment:

  • Demo Environment: For development and testing purposes
  • Production Environment: For live customer onboarding operations

Security Requirements​

Implement these essential security practices when working with the Merchant Service:

  • Transport Security: All API communications must use HTTPS encryption to protect data in transit.
  • Key Management: Store API keys securely using your organization's credential management system. Never embed keys in client-side code or version control systems.
  • Regular Rotation: Rotate API keys annually with a 30-day overlap period to ensure continuous service availability during transitions. This is a recommendation from PaySuite but is not enforced.
  • Access Control: Limit API key access to authorized personnel and systems only.

Integration Resources​

Ready to integrate? Visit the API Explorer for comprehensive API documentation, request examples, and testing tools.

API credentials will be provided to you by the PaySuite project team.

Webhook Service​

The Webhook Service delivers real-time event notifications about customer onboarding status changes, enabling your software to respond immediately to assessment updates and maintain seamless payment processing workflows.

Overview​

This service ensures your application stays synchronized with the Group Payments onboarding process by providing instant notifications when customer status changes occur during credit risk assessment and KYC verification.

Key Features​

  • Real-time Notifications: Receive immediate updates when customer onboarding status changes occur.
  • Reliable Delivery: Built-in retry mechanisms ensure webhook delivery even during temporary network issues or service interruptions.
  • Secure Communication: All webhook payloads are encrypted and include signature verification to ensure message integrity and authenticity.

Supported Events​

The Webhook Service currently supports customer status change events, which are triggered during these onboarding scenarios:

Assessment Status Updates​

  • Credit Risk Data Capture: Notifications when customer information collection is completed
  • Credit Risk Assessment: Updates when risk evaluation results are finalized or status changes
  • Stripe Data Capture: Alerts when required KYC documentation collection is completed or requires additional data
  • Stripe KYC Verification: Notifications when identity verification and compliance checks are completed

Security & Authentication​

Webhook Signature Verification​

Each webhook request includes an HMAC SHA-256 signature for payload verification. Your application should validate this signature to ensure webhook authenticity and prevent unauthorized requests.

Environment Configuration​

During project setup, you'll configure webhook endpoints and security credentials for both environments:

  • Demo Environment: For development and testing webhook integration
  • Production Environment: For live webhook notifications

The webhook signing secrets will be provided during the project setup process.

Implementation Requirements​

  • Endpoint Security: Ensure your webhook endpoint accepts HTTPS requests only.
  • Signature Validation: Always verify the webhook signature before processing payload data.
  • Idempotency: Implement proper handling for duplicate webhook deliveries to ensure data consistency.

Integration Guide​

Ready to implement webhook handling? Visit the API Explorer for detailed webhook schemas, payload examples, and implementation guidance.

For webhook endpoint configuration, speak to the PaySuite project team.