API v1
The Lunixi API carries its version in the URL path:
https://api-gateway.lunixi.com/api/v1/...This page records what v1 covers. Changes from here on are published below, dated.
The panel, portal and partner surfaces have their own roots (/api/panel/v1, /api/portal/v1, /api/partner/v1). This documentation describes only the /api/v1 customer surface — if an endpoint is not here, it is not open for integration.
Products covered by v1
| Product | Scope |
|---|---|
| Payment Orchestrator | Accepting payments, 3DS, instalments and instalment cost, card storage, refunds and disputes |
| Wallet | Top-up, transfer, withdrawal, spend policy, QR collection, webhooks |
| Fraud & Fraud AI | Real-time decision endpoint, flow publishing, rule engine |
| Identity | Device and session signals, identity intelligence |
| Sanction | Name / account / transaction / wallet screening, adverse media, indirect exposure |
| Automation | Workflow automation and outbound provider connections |
The fraud surface in v1
- One decision endpoint —
POST /api/v1/fraud/decisions/evaluate, returningallow/force_3d/review/block - 39 flow nodes — flow control, velocity and pattern counting, list and sanctions screening, context fetching, external calls, your own JavaScript, operational nodes
- 53 ready-made rule templates — the TCMB Risk Management Guide 3.1.1–3.1.4 (37), remittance (5), account takeover (5) and UK APP / PSR (6) packs; each with its own reason-code prefix → Transaction Monitoring
- Event backbone —
POST /api/v1/fraud/events/transactionsand/batch; history-based rules (velocity, baseline deviation) do not work without this feed - Decision logs —
GET /api/v1/fraud/decision-logsand/{traceId}; cursor paging → Decision Logs
Sanctions sources in v1
Ten sources are ingested: OFAC · OFAC_NONSDN · CSL · UN · EU · UKSL · CA_SEMA · MASAK · SPK_BAN · TR_TERROR_WANTED
The last three are Turkish sources, ingested live — for an institution operating in Türkiye, screening only the international lists is not sufficient.
Three behaviours to know before integrating
These are deliberate design decisions in v1, and each does the opposite of the natural assumption. All three follow one principle: uncertainty resolves to the safe side.
1 — A missing field does not silence a rule; it can fire it. The rule evaluator is three-valued (true · false · indeterminate). If operands are missing or their types do not line up, the result is indeterminate and is treated as matched. Do not silence a rule by leaving a field empty; narrow the rule's scope instead. → Decision API
2 — An unconfigured merchant does not silently get allow. If no capability bundle, rule group or flow resolves, the engine returns the configured default with code fraud.decision.unconfigured (default review). "I haven't written rules" ≠ "there is no risk". → Flows and Resolution
3 — A flow error is fail-closed. If a flow errors while running, the decision is raised to at least review; an existing block is never downgraded.
Amounts
All amounts are minor-unit integers — 250000 = ₺2,500.00. Never send decimals.
Authentication
Sign a request to POST /api/v1/auth/token with your registered Ed25519 key to mint a short-lived Bearer token. The authenticated party (merchantId) is read from the token, never from the request body — the body cannot spoof a different tenant. → Authentication
Changes
2026-10-05
- The Event Ingest API became its own reference page: required fields, the event-type vocabulary, the per-request signing contract, deduplication and the batch limit. → Event Ingest API
- Decision Logs became its own reference page: filters, cursor paging and record fields. → Decision Logs
- Fraud error codes, quota headers and retry rules were collected on a single page. → Errors and Retries
- The Decision API page gained the channel taxonomy fields (
channel,surface,stage,operationKind,authModeRequested,authModeApplied,transactionRef,subjectId,subMerchantRef,identityAssertion) and thesessionobject. - Response envelope corrected: the fraud response examples showed a
successfield; the real envelope carriesstatusat the top level. - Template count corrected: this page said 49 ready-made rule templates; the template gallery holds 53.