ارتباط سازمانی (امضای درخواست)

METHOD|PATH|TIMESTAMP|PAYLOAD

import hashlib
import json
import uuid
from datetime import datetime, timezone

import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ed25519, padding, rsa

BASE_URL = "https://api.mehrad.app"


def sign(private_key, string_to_sign: str) -> str:
    digest_hex = hashlib.sha256(string_to_sign.encode("utf-8")).hexdigest()
    message = digest_hex.encode("utf-8")

    if isinstance(private_key, rsa.RSAPrivateKey):
        signature = private_key.sign(
            message,
            padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
            hashes.SHA256(),
        )
    elif isinstance(private_key, ed25519.Ed25519PrivateKey):
        signature = private_key.sign(message)
    else:
        raise TypeError("unsupported key type")

    return signature.hex()


def grant_credit(private_key_pem: str, api_key: str, body: dict) -> dict:
    private_key = serialization.load_pem_private_key(private_key_pem.encode("utf-8"), password=None)

    path = "/gateway/transfer/credit"
    timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
    # build the body once and send exactly these bytes
    payload = json.dumps(body, separators=(",", ":"), ensure_ascii=False)
    string_to_sign = f"POST|{path}|{timestamp}|{payload}"

    headers = {
        "Content-Type": "application/json",
        "x-api-key": api_key,
        "x-timestamp": timestamp,
        "x-signature": sign(private_key, string_to_sign),
        "x-external-request-id": str(uuid.uuid4()),
    }

    response = requests.post(f"{BASE_URL}{path}", headers=headers, data=payload.encode("utf-8"), timeout=15)
    response.raise_for_status()
    return response.json()["data"]

const crypto = require("crypto");

const BASE_URL = "https://api.mehrad.app";

function sign(privateKeyPem, stringToSign) {
  const digestHex = crypto.createHash("sha256").update(stringToSign, "utf8").digest("hex");
  const key = crypto.createPrivateKey(privateKeyPem);

  // Ed25519 keys are signed in one shot with a null algorithm
  if (key.asymmetricKeyType === "ed25519") {
    return crypto.sign(null, Buffer.from(digestHex, "utf8"), key).toString("hex");
  }

  return crypto
    .sign("sha256", Buffer.from(digestHex, "utf8"), {
      key,
      padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
      saltLength: crypto.constants.RSA_PSS_SALTLEN_MAX_SIGN,
    })
    .toString("hex");
}

async function grantCredit(privateKeyPem, apiKey, body) {
  const path = "/gateway/transfer/credit";
  const timestamp = new Date().toISOString().split(".")[0] + "Z";
  // build the body once and send exactly this string
  const payload = JSON.stringify(body);
  const stringToSign = `POST|${path}|${timestamp}|${payload}`;

  const res = await fetch(`${BASE_URL}${path}`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": apiKey,
      "x-timestamp": timestamp,
      "x-signature": sign(privateKeyPem, stringToSign),
      "x-external-request-id": crypto.randomUUID(),
    },
    body: payload,
  });

  if (!res.ok) throw new Error(`request failed: ${res.status}`);
  return (await res.json()).data;
}

POST /gateway/transfer/credit HTTP/1.1
Host: api.mehrad.app
Content-Type: application/json
x-api-key: YOUR_API_KEY
x-timestamp: 2026-09-19T12:00:00Z
x-external-request-id: 4b446a5e-ad25-47d4-b5b8-9d3d403ea219
x-signature: 3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b

{"national_code":"0012345678","credit_type_id":"c1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f","amount":5000000}

POST|/gateway/organization-app/test|2026-09-19T12:00:00Z|

{
  "success": true,
  "data": {
    "status": "authenticated",
    "app_id": "0b6f1e2d-3c4b-4a59-8e7f-6d5c4b3a2190",
    "api_key": "YOUR_API_KEY",
    "organization_id": "5a4b3c2d-1e0f-4a9b-8c7d-6e5f4a3b2c10",
    "is_active": true,
    "message": "Organization app authentication successful"
  },
  "meta": null
}

{
  "national_code": "0012345678",
  "credit_type_id": "c1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
  "amount": 5000000
}

{
  "success": true,
  "data": {
    "credit_id": "7d9e0f1a-2b3c-4d5e-8f90-1a2b3c4d5e6f",
    "user_id": "3f1a9c22-58b4-4f6e-9d77-1b2c3d4e5f60",
    "national_code": "0012345678",
    "amount": 5000000,
    "total_amount": 5000000,
    "balance": 5000000
  },
  "meta": null
}

{
  "status": 200,
  "data": {
    "0012345678": {
      "visited": true,
      "add_to_cart": true,
      "orders": [
        {
          "order_id": "268714445",
          "order_status": "sent",
          "shipment_cost": 0,
          "order_created_at": "2024-11-10 08:47:58",
          "price": 380124600,
          "shipments": [
            {
              "status": "processing",
              "items": [
                {
                  "item_name": "تلویزیون سام مدل 43C5300",
                  "active": true,
                  "price": 380124600
                }
              ]
            }
          ],
          "payments": [
            {
              "status": "accepted",
              "type": "user_paid",
              "method": "credit",
              "amount": 380000000
            },
            {
              "status": "accepted",
              "type": "user_paid",
              "method": "online",
              "amount": 124600
            }
          ]
        }
      ]
    }
  }
}

{
  "success": false,
  "error": {
    "code": "ORGANIZATION_APP_INVALID_SIGNATURE",
    "message": "امضای درخواست نامعتبر می‌باشد.",
    "details": null
  }
}

{
  "success": false,
  "error": {
    "code": "CREDIT_GRANT_IN_PROCESS",
    "message": "اعطای اعتبار دیگری با همین شناسه در سیستم موجود می‌باشد.",
    "details": null
  }
}

{
  "success": false,
  "error": {
    "code": "INVALID_ORDER_STATISTICS_PARAMS",
    "message": "کد ملی ارسال‌شده برای آمار سفارش‌ها معتبر نیست.",
    "details": null
  }
}