# Payment Frontend Validation Report

**Date:** 2026-07-27  
**Phase:** payment-frontend  
**Backend boundary:** MVP 14.0–14.5 (v0.14.5.0)

## Route validation

```bash
npm run validate:payment-routes
# Payment routes OK (23 MVP routes, 26 features)
```

## Module inventory

| Category | Count |
| --- | --- |
| Feature screens | 26 |
| MVP list routes | 23 |
| Detail routes | 3 (`requests/[id]`, `transactions/[id]`, `merchants/[id]`) |
| Core components (pre-existing) | 5 |
| Hooks | 2 |
| BFF proxy | 1 |

## API wiring

All list/detail screens call `paymentApi` methods against real `/api/v1/*` paths. No mock fixtures.

| Screen | API |
| --- | --- |
| Dashboard / KPIs | `requests.list`, `transactions.list`, `audit.list`, `metrics` |
| Transactions | `transactions.list/get` |
| Ledger | `ledger.list` |
| PSP | `pspConnections.list/test` |
| Merchants | `merchants.*` lifecycle |
| Requests | `requests.list/get/cancel/verify` |
| Callbacks | `audit.list` + `requests` filtered client-side |
| Verification | `requests.verify` queue |
| Bundles / toggles / settings | CRUD list endpoints |
| OpenAPI | `GET /openapi.json` |

## Known gaps

1. **Callback log list** — backend exposes POST callback ingress only; UI derives from audit + `redirect_issued` requests.
2. **14.6+ UI** — refunds, splits, reconciliation not implemented (by design).
3. **Create flows** — list pages are read-focused; POST create forms for workspace/PSP/merchant can be added incrementally.
4. **Permission UI gates** — `usePaymentPermissions` available; per-screen enforcement is soft (403 from API).

## Apps catalog

Torbat Pay registered as `available` → `/payment/hub`.

## Docker env

`NEXT_PUBLIC_PAYMENT_API_URL` + `PAYMENT_SERVICE_URL` added to frontend service in docker-compose.