# Veracity Pay – Qliro One

Base `https://qliro.pay.veracity.se` in place of https://pago.qit.nu – Qliro's own paths follow (also at `https://pay.veracity.se/qliro`). Auth: `Authorization: Qliro base64(sha256(rawBody + secret))` (raw digest; empty body for GET) and `MerchantApiKey` in the JSON body. MerchantApiKey = your MID, secret = your secret key.

## 1. Environment
```
QLIRO_BASE_URL=https://qliro.pay.veracity.se
QLIRO_MERCHANT_API_KEY=<your MID>
QLIRO_MERCHANT_API_SECRET=vp_sk_test_…
```

## 2. Create an order
`POST /checkout/merchantapi/Orders` with MerchantApiKey, MerchantReference, Currency, Country, Language, MerchantTermsUrl, MerchantConfirmationUrl, MerchantCheckoutStatusPushUrl, MerchantOrderManagementStatusPushUrl and OrderItems [{MerchantReference, Description, Type "Product", Quantity, PricePerItemIncVat, PricePerItemExVat, VatRate 0.25}]. The answer is 201 with OrderId and PaymentLink; `GET /checkout/merchantapi/Orders/{OrderId}` gives OrderHtmlSnippet for the page.

## 3. After the purchase
Qliro POSTs the checkout status (Completed) to MerchantCheckoutStatusPushUrl; answer `{"CallbackResponse":"received"}`. Pushes are not signed, so re-read the order before acting.

## 4. Order management (`/checkout/adminapi/v2/…`)
MarkItemsAsShipped, ReturnItems, CancelOrder, UpdateItems, UpdateMerchantReference (POST, MerchantApiKey, RequestId, OrderId in the body); `GET /checkout/adminapi/v2/orders/{id}` and `…/paymentTransactions/{id}`. Each operation sends a push to MerchantOrderManagementStatusPushUrl. Without a browser: `POST https://pay.veracity.se/v1/test_helpers/checkout/sessions/{OrderId}/complete`.

## Going live and deviations from the original

Original documentation: [Qliro One API](https://developers.qliro.com/docs/api), [Qliro authorization](https://developers.qliro.com/docs/qliro-checkout/get-started/authorization).

To go live, change only the host and the keys: Test: `https://pago.qit.nu`; Production: `https://payments.qit.nu`. Replace MerchantApiKey (MID) and the secret with the ones from Qliro.

Deviations in Veracity Pay:
- The OnHold and Refused flows and Qliro's test personal numbers are not emulated; PersonalNumber is always null.
- MerchantOrderValidationUrl is not called. Upsell, saved cards, AddItemsToInvoice, retryReversal and Admin API v1 are missing.
- Order-management transactions become Success at once (the answer still says Created), and orders last 24 h instead of 48 h.
- UpdateItems works only before the first shipment and cannot raise the total. The subtypes for Swish and Trustly are estimates.