Pre-flight a Remote Host Authorization endpoint
StraitsX calls the client's POST /api/v1/authorization on every Visa authorization. It waits 6 seconds, never retries, and a timeout is a decline. This suite sends the eleven request shapes a client meets in the scheduled sandbox session, grades each response against the spec, then delivers the signed transaction webhooks that follow each approval.
Requests leave from Cloudflare's edge with the same shape, headers and timeouts StraitsX documents. The reference host runs inside this Worker, so its latency excludes network time. Keys are used for the run only and never stored.
Results
| # | Case | Result | ms | Checks |
|---|
Message for the client channel
Ready to paste into the client's Slack or WhatsApp group.
Single request
Edit any payload and send it once. Useful for reproducing one client ticket.
Sign and deliver a webhook
StraitsX signs every webhook with X-COP-Signature-256: sha256=<HMAC-SHA256(raw body, secret)>. Send a signed event to a receiver and see whether it verifies.
Verify a signature locally
Paste what the client's server logged. Computed in this browser; nothing is sent anywhere.
Transaction webhook retry schedule
Eleven retries, 10 s timeout per attempt. A receiver that is down for more than about 6.5 hours after the first attempt loses the event and needs a transaction list pull to reconcile.
Decode a payload from a ticket
Paste an RHA request or a transaction webhook. The decoder reads the ISO 8583 fields StraitsX forwards (F3, F18, F22, ECI, CVV2, CAVV) and any rejection_reason, then says what happened and who acts next.
Error lookup
Three code families in one search: CMS API errors (XFC…), the codes a client returns from RHA (CARD00xx), and webhook rejection_reason values.
| Code | Family | Meaning and next step |
|---|
Sandbox to production, per client
The tracker an integration engineer keeps for each programme. Ticks are saved in this browser only.
Spec notes
Places where the public docs disagree with themselves, found while building this console. Each one is a likely client ticket. The suite accepts both readings where they conflict and says which one it saw.