# Northline Pay: platform business rules (merchant-facing)

Source: Payments Operations, internal wiki, shared on request. These rules are enforced by the platform in sandbox and production.

**BR-1 Authorization validity.** A card authorization can be captured for 7 calendar days. After that the payment moves to status `expired` and cannot be captured. Merchants must create a new payment.

**BR-2 Refund limits.** The cumulative amount of succeeded and pending refunds on a payment cannot exceed `captured_amount`. A refund request above the remaining amount is rejected with HTTP 400 and error code `refund_exceeds_captured`. The `message` field states the remaining refundable amount.

**BR-3 Amounts and currencies.** Amounts are integers in the smallest currency unit. Supported currencies are `CAD` and `EUR`, upper case. Requests with a non-integer amount or another currency are rejected with `invalid_request` and `param` set to the offending field.

**BR-4 Idempotency.** When a request carries an `Idempotency-Key`, the platform stores the key with the request body hash for 24 hours. A retry with the same key and the same body returns the original response with the original status code. The same key with a different body is rejected with HTTP 422 and error code `idempotency_key_reused`. Requests without the header are processed every time.

**BR-5 Webhook signatures.** Every webhook carries a `Northline-Signature` header: `t=<unix timestamp>,v1=<HMAC-SHA256 of "<timestamp>.<raw body>" with the endpoint secret>`. Merchants must reject a signature older than 5 minutes. The endpoint secret is shown once when the endpoint is created.

**BR-6 Split payments.** A split lists at most 10 seller accounts. Each split amount is at least 100 minor units. The sum of split amounts must equal the payment amount, or the request is rejected with `invalid_request` and `param: split`.

**BR-7 Settlement.** Captured amounts settle to the merchant on the second business day after capture (T+2). When a payment is included in a paid settlement, the `payment.settled` webhook is sent with the `settlement_id`.

**BR-8 Card data.** Responses never include the full card number or the CVC. The buyer email is returned only on payments created by the same merchant account.