{
  "version": "local-2026-09-15",
  "excluded": [
    {
      "path": "/static/*",
      "methods": [
        "MOUNT"
      ],
      "reason": "Static admin, checkout, and brand assets; not an API contract."
    }
  ],
  "routes": [
    {
      "method": "GET",
      "path": "/",
      "visibility": "public",
      "auth": "none",
      "summary": "Minimal RockPay homepage; links only to the protected admin entry."
    },
    {
      "method": "GET",
      "path": "/docs",
      "visibility": "public",
      "auth": "none",
      "summary": "Public developer documentation site backed by reviewed static documents."
    },
    {
      "method": "GET",
      "path": "/admin",
      "visibility": "public shell",
      "auth": "login required for data",
      "summary": "Admin application shell; API data uses Cookie session after sign-in."
    },
    {
      "method": "GET",
      "path": "/healthz",
      "visibility": "public",
      "auth": "none",
      "summary": "Process liveness."
    },
    {
      "method": "GET",
      "path": "/readyz",
      "visibility": "public",
      "auth": "none",
      "summary": "Database readiness."
    },
    {
      "method": "POST",
      "path": "/admin/auth/login",
      "visibility": "admin",
      "auth": "configured key + exact Origin",
      "summary": "Creates revocable HttpOnly admin Cookie session."
    },
    {
      "method": "GET",
      "path": "/admin/auth/session",
      "visibility": "admin",
      "auth": "admin Cookie",
      "summary": "Returns current browser session metadata and CSRF token."
    },
    {
      "method": "POST",
      "path": "/admin/auth/logout",
      "visibility": "admin",
      "auth": "admin Cookie + Origin + CSRF",
      "summary": "Revokes session and clears Cookie."
    },
    {
      "method": "GET",
      "path": "/v1/docs",
      "visibility": "public documentation",
      "auth": "none",
      "summary": "Reviewed Markdown, JSON catalog, or integration skill selected only from a static allowlist; no secrets."
    },
    {
      "method": "GET",
      "path": "/v1/merchants",
      "visibility": "authenticated",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Authorized merchant directory."
    },
    {
      "method": "POST",
      "path": "/v1/merchants",
      "visibility": "admin",
      "auth": "platform Bearer or Cookie + CSRF",
      "summary": "Creates merchant directory record."
    },
    {
      "method": "GET",
      "path": "/v1/sites",
      "visibility": "authenticated",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Authorized site directory and shared channel status."
    },
    {
      "method": "POST",
      "path": "/v1/sites",
      "visibility": "admin",
      "auth": "platform Bearer or Cookie + CSRF",
      "summary": "Creates a site and generates credentials."
    },
    {
      "method": "POST",
      "path": "/v1/sites/{site_id}/credentials",
      "visibility": "sensitive admin",
      "auth": "platform/merchant Bearer or Cookie + CSRF",
      "summary": "Explicitly reveals site API key and webhook secret."
    },
    {
      "method": "POST",
      "path": "/management/customers",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Creates or resolves a site customer."
    },
    {
      "method": "GET",
      "path": "/management/customers",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Looks up customer by required external_customer_id."
    },
    {
      "method": "GET",
      "path": "/management/customers/{customer_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Reads one authorized customer."
    },
    {
      "method": "PATCH",
      "path": "/management/customers/{customer_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Updates customer email and/or billing address."
    },
    {
      "method": "POST",
      "path": "/management/checkout-sessions",
      "visibility": "private management",
      "auth": "Bearer scoped key + Idempotency-Key",
      "summary": "Creates/replays one payment checkout session."
    },
    {
      "method": "GET",
      "path": "/management/checkout-sessions/{session_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Reads one checkout session and snapshot associations."
    },
    {
      "method": "POST",
      "path": "/management/checkout-sessions/{session_id}/access",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Renews a checkout capability after merchant verifies order ownership."
    },
    {
      "method": "POST",
      "path": "/management/checkout-sessions/{session_id}/embedded",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Creates/replays embedded provider paySession; browser must not call it."
    },
    {
      "method": "GET",
      "path": "/management/payments",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Lists authorized payments with offset pagination."
    },
    {
      "method": "GET",
      "path": "/management/payments/{payment_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Reads one authorized payment."
    },
    {
      "method": "POST",
      "path": "/management/payments/{payment_id}/reconcile",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie + CSRF",
      "summary": "Queries original provider payment; finality is configuration-gated."
    },
    {
      "method": "GET",
      "path": "/management/payments/{payment_id}/refunds",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Lists refunds for a payment."
    },
    {
      "method": "POST",
      "path": "/management/refunds",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie + CSRF + Idempotency-Key",
      "summary": "Creates/replays a refund request; explicit approval required."
    },
    {
      "method": "GET",
      "path": "/management/refunds/{refund_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Reads one authorized refund."
    },
    {
      "method": "POST",
      "path": "/management/refunds/{refund_id}/reconcile",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie + CSRF",
      "summary": "Queries original provider refund; finality is configuration-gated."
    },
    {
      "method": "GET",
      "path": "/management/invoices/{invoice_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Reads paid invoice metadata/body."
    },
    {
      "method": "GET",
      "path": "/management/invoices/{invoice_id}/html",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Returns sandboxed invoice HTML."
    },
    {
      "method": "GET",
      "path": "/management/invoices/{invoice_id}/pdf",
      "visibility": "private management",
      "auth": "Bearer scoped key or limited admin Cookie",
      "summary": "Returns PDF or 202 with Retry-After while pending."
    },
    {
      "method": "GET",
      "path": "/management/events/{event_id}",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Reads known event ID; no event list endpoint."
    },
    {
      "method": "GET",
      "path": "/management/events/{event_id}/delivery",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Reads worker delivery state."
    },
    {
      "method": "POST",
      "path": "/management/events/{event_id}/retry",
      "visibility": "private management",
      "auth": "Bearer scoped key",
      "summary": "Requeues undelivered event only."
    },
    {
      "method": "GET",
      "path": "/checkout/{session_id}",
      "visibility": "capability",
      "auth": "checkout token query",
      "summary": "Hosted checkout view with configured iframe origins."
    },
    {
      "method": "GET",
      "path": "/checkout-api/{session_id}",
      "visibility": "capability",
      "auth": "checkout token query",
      "summary": "Safe checkout display object."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/pay",
      "visibility": "payment write",
      "auth": "checkout token query",
      "summary": "Starts exactly one configured provider attempt."
    },
    {
      "method": "GET",
      "path": "/checkout-api/{session_id}/qr",
      "visibility": "capability",
      "auth": "checkout token query",
      "summary": "Locally generated QR SVG when action is qrcode."
    },
    {
      "method": "GET",
      "path": "/embed.js",
      "visibility": "public",
      "auth": "none",
      "summary": "Browser checkout modal helper."
    },
    {
      "method": "POST",
      "path": "/v1/customers",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Create customer; pinned 2025-03-31.basil subset."
    },
    {
      "method": "POST",
      "path": "/v1/customers/{customer_id}",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Update customer; pinned 2025-03-31.basil subset."
    },
    {
      "method": "GET",
      "path": "/v1/customers/{customer_id}",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Retrieve customer; pinned 2025-03-31.basil subset."
    },
    {
      "method": "POST",
      "path": "/v1/checkout/sessions",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Create session; pinned 2025-03-31.basil subset."
    },
    {
      "method": "GET",
      "path": "/v1/checkout/sessions/{session_id}",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Retrieve session; pinned 2025-03-31.basil subset."
    },
    {
      "method": "GET",
      "path": "/v1/checkout/sessions/{session_id}/line_items",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Line items; pinned 2025-03-31.basil subset."
    },
    {
      "method": "POST",
      "path": "/v1/checkout/sessions/{session_id}/expire",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Expire session; pinned 2025-03-31.basil subset."
    },
    {
      "method": "GET",
      "path": "/v1/payment_intents/{intent_id}",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Retrieve intent; pinned 2025-03-31.basil subset."
    },
    {
      "method": "POST",
      "path": "/v1/refunds",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Create refund; pinned 2025-03-31.basil subset."
    },
    {
      "method": "GET",
      "path": "/v1/refunds/{refund_id}",
      "visibility": "public RockPay API",
      "auth": "single-site Bearer key",
      "summary": "Retrieve refund; pinned 2025-03-31.basil subset."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/prepare",
      "auth": "Session capability token",
      "visibility": "hosted checkout",
      "summary": "Reserve/reuse one card attempt and return paySession. Development embedded mode accepts os_type only, without buyer collection; legacy mode freezes supplied buyer details."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/activity",
      "visibility": "hosted checkout",
      "auth": "session capability and exact checkout Origin",
      "summary": "Bounded idempotent submission and SDK observations; never changes authoritative payment state or creates provider orders."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/embedded-buyer",
      "visibility": "hosted checkout",
      "auth": "session capability and exact same-origin Origin",
      "summary": "Development sandbox only: save/freeze buyer on the existing embedded attempt before SDK confirm; never accepts card fields or creates a new provider order."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/pay-card",
      "visibility": "checkout",
      "auth": "session capability and exact same-origin Origin",
      "summary": "Reserve one Direct Card attempt and buyer snapshot; return allowlisted status and trusted authentication redirect."
    },
    {
      "method": "GET",
      "path": "/v1/account",
      "visibility": "public business",
      "auth": "Site Bearer",
      "summary": "Stable site account identity; settlement capability flags unknown."
    },
    {
      "method": "GET",
      "path": "/v1/charges",
      "visibility": "public business",
      "auth": "Site Bearer",
      "summary": "Confirmed payment charges with verified paid time, created filters and bidirectional cursor pagination."
    },
    {
      "method": "GET",
      "path": "/v1/events",
      "visibility": "public business",
      "auth": "Site Bearer",
      "summary": "Immutable charge.succeeded revenue snapshots with created filters and bidirectional cursor pagination; no webhook delivery."
    },
    {
      "method": "GET",
      "path": "/terms",
      "visibility": "public",
      "auth": "none",
      "summary": "Public terms of service HTML page."
    },
    {
      "method": "GET",
      "path": "/privacy",
      "visibility": "public",
      "auth": "none",
      "summary": "Public privacy policy HTML page."
    },
    {
      "method": "POST",
      "path": "/checkout/{session_id}",
      "visibility": "checkout",
      "auth": "capability + exact host",
      "summary": "Oceanpayment browser return, capability and host checked; never settles payment."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/oceanpayment/return",
      "visibility": "checkout",
      "auth": "capability + exact host",
      "summary": "Internal API validation for Oceanpayment browser return."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/oceanpayment/prepare",
      "visibility": "checkout",
      "auth": "capability + exact host",
      "summary": "Reserve one sandbox attempt and issue signed immutable checkout fields."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/oceanpayment/result",
      "visibility": "checkout",
      "auth": "capability + exact host",
      "summary": "Validate browser observation and restricted 3DS redirect; never settles payment."
    },
    {
      "method": "POST",
      "path": "/webhooks/oceanpayment/{account_id}/payment",
      "visibility": "provider",
      "auth": "provider signature",
      "summary": "Verify Oceanpayment signed payment/refund notification and reconcile frozen account/order."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/oceanpayment/status",
      "visibility": "checkout",
      "auth": "capability + exact host + Origin",
      "summary": "Confirm sandbox payment using a signed upstream query; browser data never settles payment."
    },
    {
      "method": "GET",
      "path": "/v1/provider-accounts",
      "visibility": "admin",
      "auth": "platform or merchant Bearer / admin Cookie; merchant scope restricted to bound sites",
      "summary": "Read-only configured provider accounts and key-owned site bindings; no credentials, dynamic routing or provider availability assertion."
    },
    {
      "method": "GET",
      "path": "/v1/oceanpayment/configurations",
      "visibility": "platform management",
      "auth": "platform Bearer or Admin Cookie; writes require CSRF with Cookie",
      "summary": "Read six configuration slots and version metadata; never returns credentials."
    },
    {
      "method": "POST",
      "path": "/v1/oceanpayment/configurations",
      "visibility": "platform management",
      "auth": "platform Bearer or Admin Cookie; writes require CSRF with Cookie",
      "summary": "Save a disabled immutable encrypted Oceanpayment credential version."
    },
    {
      "method": "PUT",
      "path": "/v1/oceanpayment/configurations/{account_id}/enabled",
      "visibility": "platform management",
      "auth": "platform Bearer or Admin Cookie; writes require CSRF with Cookie",
      "summary": "Change availability for new checkouts; preserves historical order configurations."
    },
    {
      "method": "GET",
      "path": "/v1/sites/{site_id}/oceanpayment-methods",
      "visibility": "platform management",
      "auth": "platform Bearer or Admin Cookie; writes require CSRF with Cookie",
      "summary": "Read key-owned Site method bindings."
    },
    {
      "method": "PUT",
      "path": "/v1/sites/{site_id}/oceanpayment-methods",
      "visibility": "platform management",
      "auth": "platform Bearer or Admin Cookie; writes require CSRF with Cookie",
      "summary": "Bind same-environment Oceanpayment method versions to a Site; new orders only."
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Read current receiving accounts, sites and management drafts; never exposes credentials."
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/usage",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Read verified USD receipts and conservative unresolved exposure; not a quota reservation ledger."
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/audit",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Read the latest 100 configuration revision summaries."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/{kind}/{resource_id}/review",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Validate a management draft and report affected sites without saving or activation."
    },
    {
      "method": "PUT",
      "path": "/v1/admin-setup/{kind}/{resource_id}",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Save a management-only account or site draft with revision and dependency checks; no payment activation."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/preview",
      "visibility": "platform administration",
      "auth": "platform Bearer or admin Cookie; writes require Origin and CSRF",
      "summary": "Evaluate a draft against saved orders; does not create a payment or modify reservations."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/{kind}/{resource_id}/activate",
      "visibility": "administrative",
      "auth": "platform",
      "summary": "Activate saved collection config for new orders"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/domain-check",
      "visibility": "administrative",
      "auth": "platform",
      "summary": "Check explicitly connected checkout entry"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/domain-restore",
      "visibility": "administrative",
      "auth": "platform",
      "summary": "Restore checked previous entry for new orders"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/wallet-domain",
      "visibility": "administrative",
      "auth": "platform",
      "summary": "Record provider wallet domain confirmation"
    },
    {
      "method": "GET",
      "path": "/checkout-domain-check/{challenge}",
      "visibility": "capability",
      "auth": "none",
      "summary": "Read-only checkout deployment probe"
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/select",
      "visibility": "capability",
      "auth": "checkout token + Origin",
      "summary": "Atomically choose actual account and reserve hard exposure"
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/pending",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Pending original orders and followup alerts"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/pending/{session_id}/query",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Query original payment with lease and throttling"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/pending/{session_id}/release",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Close unissued reservation only"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/pending/{session_id}/note",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Record followup without changing money"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/bank-credentials",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Create immutable bank credential draft"
    },
    {
      "method": "PUT",
      "path": "/v1/admin-setup/bank-credentials/{credential_id}/enabled",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Gate credential for new orders"
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/credential-info/{account_id}",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "View public account metadata without keys"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/account-credentials",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Create or rotate credential version as draft"
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/deployment-status",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Whole fleet and worker activation status"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/deployment-check",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Signed whole fleet check; empty check revokes activation"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/pending/{session_id}/legacy-review",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Register legacy case without financial override"
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/pending/{session_id}/legacy-query",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Verify supported original legacy order; never create upstream payment"
    },
    {
      "method": "GET",
      "path": "/v1/admin-setup/accounts/{account_id}/acceptance",
      "visibility": "administrative",
      "auth": "platform admin; CSRF for cookie writes",
      "summary": "Per credential verified payment, callback, delivery and refund facts"
    },
    {
      "method": "GET",
      "path": "/management/dispute-records",
      "visibility": "private management",
      "auth": "platform or scoped merchant key; admin Cookie allowed, Origin + CSRF required for writes; Site key denied",
      "summary": "Lists scoped external dispute records without financial operations."
    },
    {
      "method": "GET",
      "path": "/management/dispute-records/{record_id}",
      "visibility": "private management",
      "auth": "platform or scoped merchant key; admin Cookie allowed, Origin + CSRF required for writes; Site key denied",
      "summary": "Reads one owned external dispute record."
    },
    {
      "method": "POST",
      "path": "/management/dispute-records",
      "visibility": "private management",
      "auth": "platform or scoped merchant key; admin Cookie allowed, Origin + CSRF required for writes; Site key denied",
      "summary": "Creates or deduplicates an external dispute record; requires an Idempotency-Key, never initiates a refund."
    },
    {
      "method": "PATCH",
      "path": "/management/dispute-records/{record_id}",
      "visibility": "private management",
      "auth": "platform or scoped merchant key; admin Cookie allowed, Origin + CSRF required for writes; Site key denied",
      "summary": "Updates allowed record fields using expected_version; keeps the original payment association immutable."
    },
    {
      "method": "GET",
      "path": "/checkout-api/{session_id}/oceanpayment/wallet-options",
      "visibility": "checkout",
      "auth": "capability + exact host",
      "summary": "Read-only native wallet button metadata; no signed fields, payment attempt, or provider request."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/legacy-checkout/review",
      "visibility": "administrative",
      "auth": "platform admin; Origin + CSRF for cookie writes",
      "summary": "Review restoring a persistent Site to original legacy card checkout; return configuration before-image and state tokens."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/legacy-checkout/check",
      "visibility": "administrative",
      "auth": "platform admin; Origin + CSRF for cookie writes",
      "summary": "Verify deployment-connected HTTPS instance and legacy card checkout assets; no payment-provider request."
    },
    {
      "method": "POST",
      "path": "/v1/admin-setup/sites/{site_id}/legacy-checkout/apply",
      "visibility": "administrative",
      "auth": "platform admin; Origin + CSRF for cookie writes",
      "summary": "Atomically restore new orders to original legacy card checkout with state/domain/deployment proof and audited idempotency; preserve historical snapshots."
    },
    {
      "method": "POST",
      "path": "/checkout-api/{session_id}/oceanpayment/buyer-context",
      "auth": "Opaque checkout token and exact checkout Origin/Host; original-order scope",
      "visibility": "private",
      "summary": "Prepare and persist order-local automatic billing details; does not issue a payment."
    },
    {
      "method": "PUT",
      "path": "/v1/sites/{site_id}/payment-contact",
      "visibility": "platform admin",
      "auth": "platform Bearer or Cookie + CSRF",
      "summary": "Configure confirmed payment alias domain for new DreamCore B and MakePhoto sessions; no account email rewrite."
    }
  ],
  "scope": "Business and management routes; provider-internal callbacks are intentionally omitted."
}