{
  "info": {
    "name": "PayAGL Enhanced Security \u2014 synthetic staging",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
    "description": "Use an isolated staging service. Variables are synthetic placeholders; never use production credentials. Existing endpoint URLs are preserved."
  },
  "variable": [
    {
      "key": "base_url",
      "value": "https://staging.example.invalid"
    },
    {
      "key": "api_key",
      "value": "synthetic-api-key"
    },
    {
      "key": "request_secret",
      "value": "synthetic-request-secret"
    }
  ],
  "event": [
    {
      "listen": "prerequest",
      "script": {
        "type": "text/javascript",
        "exec": [
          "const CryptoJS = require('crypto-js');",
          "const secret = pm.variables.get('request_secret');",
          "const timestamp = String(Math.floor(Date.now()/1000));",
          "const nonce = CryptoJS.lib.WordArray.random(16).toString(CryptoJS.enc.Hex);",
          "const target = pm.variables.replaceIn(pm.request.url.toString()).replace(/^https?:\\/\\/[^/]+/, '');",
          "const encode = s => encodeURIComponent(s).replace(/[!'()*]/g,c=>'%' + c.charCodeAt(0).toString(16).toUpperCase());",
          "const parts=target.split('?');",
          "const path=parts[0].split('/').map(s=>encode(decodeURIComponent(s))).join('/');",
          "const pairs=(parts[1] ? parts[1].split('&') : []).map(pair=>{const at=pair.indexOf('=');return [at<0?pair:pair.slice(0,at),at<0?'':pair.slice(at+1)].map(s=>encode(decodeURIComponent(s.replace(/\\+/g,' '))));});",
          "pairs.sort((a,b)=>a[0]<b[0]?-1:a[0]>b[0]?1:a[1]<b[1]?-1:a[1]>b[1]?1:0);",
          "const canonicalTarget=path+(pairs.length?'?'+pairs.map(p=>p.join('=')).join('&'):'');",
          "const raw=pm.variables.replaceIn(pm.request.body ? pm.request.body.raw || '' : '');",
          "if (pm.request.body) pm.request.body.update(raw);",
          "const canonical=[pm.request.method.toUpperCase(),canonicalTarget,timestamp,nonce,CryptoJS.SHA256(raw).toString(CryptoJS.enc.Hex)].join('\\n');",
          "pm.request.headers.upsert({key:'x-api-key',value:pm.variables.get('api_key')});",
          "pm.request.headers.upsert({key:'X-PayAGL-Timestamp',value:timestamp});",
          "pm.request.headers.upsert({key:'X-PayAGL-Nonce',value:nonce});",
          "pm.request.headers.upsert({key:'X-PayAGL-Signature',value:CryptoJS.HmacSHA256(canonical,secret).toString(CryptoJS.enc.Hex)});"
        ]
      }
    }
  ],
  "item": [
    {
      "name": "Signed /api/payment/create",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          }
        ],
        "body": {
          "mode": "raw",
          "raw": "{\"amount\":500,\"order_id\":\"synthetic-payin\"}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        },
        "url": "{{base_url}}/api/payment/create"
      }
    },
    {
      "name": "Signed /api/payout/create",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json"
          }
        ],
        "body": {
          "mode": "raw",
          "raw": "{\"amount\":500,\"order_id\":\"synthetic-payout\",\"beneficiary_name\":\"Synthetic\",\"account_number\":\"12345678\",\"ifsc\":\"HDFC0000001\"}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        },
        "url": "{{base_url}}/api/payout/create"
      }
    }
  ]
}