Provision (or rotate) the merchant TRC-20 deposit address (legacy path)
Legacy admin-impersonation alias of the canonical `POST /api/v1/p2p/merchant/wallet/deposit-address` (same handler, same response). Lets an operator act on behalf of a merchant. With HMAC authentication the path `merchant_id` MUST match the token claims; merchant-JWT callers may only target their own merchant (IDOR guard). Claims the next BIP44 derivation index, derives the address via tron-wallet-api, and persists the address + index back to the merchant row. Previously issued addresses stay in the eternal block-polling set — deposits sent to a superseded address are still detected and credited.
/api/v1/p2p/merchants/{merchant_id}/deposit-addressLegacy admin-impersonation alias of the canonical
POST /api/v1/p2p/merchant/wallet/deposit-address (same handler, same
response). Lets an operator act on behalf of a merchant. With HMAC
authentication the path merchant_id MUST match the token claims;
merchant-JWT callers may only target their own merchant (IDOR guard).
Claims the next BIP44 derivation index, derives the address via
tron-wallet-api, and persists the address + index back to the merchant
row. Previously issued addresses stay in the eternal block-polling set
— deposits sent to a superseded address are still detected and credited.
Authorization
MerchantToken MerchantSignature 64-character hex public merchant token assigned during onboarding.
In: header
Stripe-style HMAC-SHA256 signature.
Format: t=<unix_seconds>,v1=<hex_hmac_sha256>
where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>").
Replay window: 5 minutes (60s future drift tolerated).
In: header
Path Parameters
Target merchant UUID.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/problem+json
curl -X POST "https://example.com/api/v1/p2p/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/deposit-address" \ -H "Content-Type: application/json" \ -d '{}'{ "trc20_address": "TRx7Vn2a3bK8HJdZmFc4eD5q1wP9nLs6t", "wallet_derivation_index": 0}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "instance": "../dictionary", "errors": [ { "field": "amount", "message": "must be greater than 0", "code": "POSITIVE_REQUIRED" } ]}Toggle the merchant kill-switch (admin-only, no body) POST
Toggles the kill-switch state — a bodyless toggle (every call flips disabled ↔ enabled); there are NO request fields such as `active` or `reason`. Admin-only: requires a platform-operator JWT session (role `admin`/`platform_admin`); HMAC pairs and merchant cabinet sessions get 403. Admin alias: `POST /api/v1/p2p/admin/merchants/{merchant_id}/kill-switch`.
Create a PayIn deal (acquiring) POST
Creates a new incoming-payment deal with optional whitelist pass matching. Idempotent: duplicate `idempotency_key` returns the cached result. Returns the public `payment_url` the merchant should redirect the client to.