# Veracity Pay – Svea Checkout and Payment Admin

Host `https://svea.pay.veracity.se` in place of both https://checkoutapistage.svea.com and https://paymentadminapistage.svea.com – the paths are Svea's own (`/api/orders…` for checkout, `/api/v1/…` for Payment Admin), so SDKs that only take a host work. Without that host, the same API is at `https://pay.veracity.se/svea/checkout` and `https://pay.veracity.se/svea/admin`.
Auth on every call: `Authorization: Svea base64(<merchant id>:sha512hex(body + secret + timestamp))` and `Timestamp: yyyy-MM-dd HH:mm` (UTC). Merchant id = your MID, secret = your secret key.

## 1. Environment
```
SVEA_CHECKOUT_BASE_URL=https://svea.pay.veracity.se
SVEA_ADMIN_BASE_URL=https://svea.pay.veracity.se
SVEA_CHECKOUT_MERCHANT_ID=<your MID>
SVEA_CHECKOUT_SECRET=vp_sk_test_…
```

## 2. Create an order
`POST /api/orders` with CountryCode "SE", Currency "SEK", Locale "sv-SE", ClientOrderNumber, MerchantSettings {TermsUri, CheckoutUri, ConfirmationUri, PushUri – `{checkout.order.uri}` is replaced by the order id} and Cart.Items [{ArticleNumber, Name, Quantity ×100, UnitPrice in minor units incl. VAT, VatPercent ×100, Unit}]. The answer has OrderId (integer), Status Created and Gui.Snippet (the iframe to put on the page).

## 3. After the purchase
Svea POSTs `{"type":"Finalized"}` to PushUri (signed X-Signature-512 = base64(HMAC-SHA512(secret, "{X-Timestamp}.{body}"))). Read `GET /api/orders/{id}`: Status Final and PaymentType (INVOICE, PAYMENTPLAN, SVEACARDPAY, SWISH, TRUSTLY).

## 4. Payment Admin
`GET /api/v1/orders/{id}` (Actions tells what is allowed), `POST /api/v1/orders/{id}/deliveries` ({OrderRowIds}), `POST …/deliveries/{deliveryId}/credits`, `PATCH /api/v1/orders/{id}` ({IsCancelled:true}). Tasks answer 202 with a queue Location that redirects (303) to the order. Without a browser: `POST https://pay.veracity.se/v1/test_helpers/checkout/sessions/{OrderId}/complete`.

## Going live and deviations from the original

Original documentation: [Svea Checkout API](https://paymentsdocs.svea.com/docs/checkout), [Svea authentication](https://paymentsdocs.svea.com/docs/getting-started/authentication), [Svea Payment Admin API](https://paymentsdocs.svea.com/docs/payment-admin).

To go live, change only the host and the keys: Stage (checkout): `https://checkoutapistage.svea.com`; Stage (admin): `https://paymentadminapistage.svea.com`; Production (checkout): `https://checkoutapi.svea.com`; Production (admin): `https://paymentadminapi.svea.com`. Replace the checkout merchant id (MID) and the secret with the ones you get from Svea.

Deviations in Veracity Pay:
- One host for both checkout and admin (svea.pay.veracity.se); Svea's paths tell them apart. Svea's PHP SDK and WooCommerce plugin hard-code Svea's hosts and need a patched base URL.
- The validation callback (CheckoutValidationCallBackUri) is not made, and callback subscriptions (webhooks v2) are missing; only PushUri gets a push.
- Recurring orders and /api/tokens answer 903 (Recurring not enabled). Adding, updating and replacing order rows in Payment Admin is not supported.
- Queue tasks finish at once (never InProgress), checkout orders last 24 h instead of 48 h, and admin orders do not expire.
- NationalId is always null and IsCompany always false; the merchant country is SE.