# A2A InstaPay Sandbox

> Sandbox for the A2A InstaPay Tenant API v1 (Fintechnology Asia Pacific Lanka Ltd, licensed to FINAP USA LLC): Digital Accounts, bank linking, loads, payments (balance, pay by bank, QR payment requests), withdrawals, refunds and disputes over the RTP network, with hosted screens opened by the A2A Link SDK.

Rules for integrations: call the Tenant API only from the Tenant's servers; send an Idempotency-Key on every POST that creates or changes a record; amounts are integer cents in USD; verify the A2A-Signature header on every webhook (HMAC-SHA256 of "t.body", tolerance five minutes, one v1 value per active secret); treat webhooks as the source of truth; never place the client secret or webhook secret in a browser or app.

## Contract
- [OpenAPI 3.1 (JSON)](https://sandbox.a2ainstapay.com/openapi/a2a-instapay-tenant-api-v1.1.openapi.json)
- [OpenAPI 3.1 (YAML)](https://sandbox.a2ainstapay.com/openapi/a2a-instapay-tenant-api-v1.1.openapi.yaml)
- [Webhook event examples](https://sandbox.a2ainstapay.com/openapi/a2a-instapay-webhook-event-examples-v1.1.json)
- [Postman collection](https://sandbox.a2ainstapay.com/downloads/a2a-instapay-sandbox.postman_collection.json)

## Sandbox
- [Test values (JSON)](https://sandbox.a2ainstapay.com/sandbox/test-values.json): one-time code, SSN, EIN and mobile endings, test banks, amounts that fail
- [Sandbox and production differences (JSON)](https://sandbox.a2ainstapay.com/sandbox/differences.json)
- [Instant sandbox](https://sandbox.a2ainstapay.com/sandbox/instant): POST without an account to receive credentials for a workspace that lasts seven days
- Simulation: POST https://sandbox.a2ainstapay.com/v1/sandbox/simulate/{event} with {"object_id": "..."}; complete a hosted session without screens with POST https://sandbox.a2ainstapay.com/v1/sandbox/sessions/{id}/complete
- [Status](https://sandbox.a2ainstapay.com/status)

## SDK
- Web: https://sandbox.a2ainstapay.com/v1/a2a-link.js with A2ALink.init({ sdkKey, environment: "sandbox" }), A2ALink.open({ token | fetchToken, onSuccess, onExit, onEvent }) inside a tap handler, A2ALink.handleReturn() on the return page
- Bank linking simulator (drop-in for Plaid's link-initialize.js): https://sandbox.a2ainstapay.com/plaid-sim/link-initialize.js