Create a PayIn deal (acquiring)

Creates a new incoming-payment deal with optional whitelist pass matching. Idempotent: duplicate `idempotency_key` returns the cached result. Returns the public `payment_url` the merchant should redirect the client to.

POST/api/v1/p2p/merchant/deals/payin

Creates a new incoming-payment deal with optional whitelist pass matching. Idempotent: duplicate idempotency_key returns the cached result. Returns the public payment_url the merchant should redirect the client to.

Authorization

MerchantToken MerchantSignature

X-Merchant-Token<token>

64-character hex public merchant token assigned during onboarding.

In: header

X-Signature<token>

Stripe-style HMAC-SHA256 signature. Format: t=<unix_seconds>,v1=<hex_hmac_sha256> where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>"). Replay window: 5 minutes (60s future drift tolerated).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

tenant_id?string

Injected from auth context; omit in client requests.

Formatuuid

merchant_id?string

Injected from auth context; omit in client requests.

Formatuuid

amount*integer

Amount in smallest currency units (e.g. kopecks for RUB).

Formatint64

currency*string

ISO 4217 currency code (e.g. RUB).

idempotency_key*string

Unique request key. Duplicate requests with the same key return the cached result instead of creating a new deal.

payment_method_id*string

REQUIRED unified method reference — the method UUID (canonical, PK fast path) or the catalog slug (sbp_rub, card_rub, ...). Both resolve to the same row via GET /api/v1/p2p/merchant/payment-methods; unknown references are rejected with HTTP 400 listing the allowed slugs. Empty is rejected (cascade routing is method-scoped). GET /banks does NOT return method identifiers — its methods field carries RequisiteType values only.

currency_id?string

Optional currency UUID; required for whitelist pass matching.

Formatuuid

client_id?string

Client (player) identifier in the merchant's system.

payer_bank?string

Optional bank-name hint for cascade routing.

description?string

Optional merchant description shown on the payment page.

callback_url?string

Per-deal callback URL override (PayIn only). Delivery hierarchy: per-deal callback_url → merchant.webhook_url; when both are empty no callback is created for the deal. PayOut requests have no per-deal override — payout webhooks always go to merchant.webhook_url.

Formaturi

is_client_commission?boolean

If true, commission is paid by the client (not the merchant).

Defaultfalse

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/api/v1/p2p/merchant/deals/payin" \  -H "Content-Type: application/json" \  -d '{    "amount": 150000,    "currency": "RUB",    "idempotency_key": "payin_order_12345",    "payment_method_id": "550e8400-e29b-41d4-a716-446655440000"  }'

{  "deal": {    "deal_id": "7ac148fe-1234-5678-9abc-def012345678",    "status": "ESCROW_LOCKED",    "amount": "150000",    "currency": "RUB",    "created_at": "2026-08-10T12:00:00Z",    "client_id": "player_42",    "deal_type": "PAYIN",    "updated_at": "2026-08-10T12:00:00Z",    "payment_url": "https://checkout.syncra.money/pay/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"  }}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}

Create a PayIn deal (acquiring)

Authorization

Request Body

Response Body

200application/json

400application/problem+json

401application/problem+json

503application/problem+json

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`