TabanTalayeNafis Test UI
not authenticated
Base URL:
Refresh /me
Auth
User
Admin
Public / Edge
Call Log
Register
anonymous
PhoneNumber
Password
BirthDate (Shamsi)
CaptchaToken (opt)
201 = created, 400 = validation (age < 18 etc.), 409 = duplicate phone.
POST /api/auth/register
Login (2-step MFA)
anonymous
PhoneNumber
Password
1) POST /api/auth/login
Step 1 returns LoginTicketId; OTP is sent by FakeSmsSender → read it from the
server console
.
LoginTicketId
OtpCode
Get OTP (dev outbox)
2) POST /api/auth/login/verify-mfa
Wrong ticket/OTP → 400/401. Success stores AccessToken + RefreshToken (localStorage).
Tokens (editable — for invalid/expired-token tests)
AccessToken
RefreshToken
Save tokens
Clear tokens (=→ 401 on protected calls)
Corrupt access token
Current session (JWT required)
GET /api/auth/me
GET /api/auth/sessions
—
Refresh / Logout
POST /api/auth/refresh (rotate)
Reuse of an already-rotated refresh token revokes the whole chain → repeat this twice with the same token to see it.
POST /api/auth/logout
POST /api/auth/logout-all
Step-up MFA (JWT required)
Purpose
Withdrawal
PhysicalDelivery
POST /api/auth/mfa/step-up/request
OTP again on server console.
ChallengeId
OtpCode
Get OTP (dev outbox)
POST /api/auth/mfa/step-up/verify
KYC (JWT required)
GET /api/auth/kyc/status
Level3 (register-only) users must pass Level2 before trading/depositing.
Submit Level2 (multipart)
FullName
NationalCode
MobilePhone
BankAccountInfo
NationalCardFront
NationalCardBack
POST /api/auth/kyc/level2
Missing/wrong-format file → 400. ≤5MB, jpg/png/pdf.
Submit Level1 (requires Level2 approved)
Address
PostalCode
Occupation
POST /api/auth/kyc/level1
Legal entity (requires Level1-approved representative)
CompanyName
CompanyNationalId
RegistrationNumber
CompanyBankAccountInfo
PowerOfAttorneyDocUrl
OfficialGazetteDocUrl
POST /api/auth/kyc/legal-entity
Document upload
file
POST /api/auth/kyc/documents
Wallet (JWT required)
GET /api/wallet
page
pageSize
GET /api/wallet/history
Admin variants (GET /api/wallet/{userId}[/history]) are on the Admin tab — a normal user gets 403 there.
Trade buy/sell (JWT + KYC≥Level2 + Idempotency-Key)
GoldWeightMg
Purity
Idempotency-Key
new Guid
clear
Empty key → 400. Level3 user → 403. Same key twice → idempotent replay.
POST /api/trade/buy
POST /api/trade/sell
Invoice transactionId
GET /api/ledger/invoices/{id}
User gets own invoice only; other user's → 403/404.
Deposits (JWT + KYC≥Level2 + Idempotency-Key)
AmountRial
Idem-Key
new Guid
POST /api/payments/deposit/initiate
deposit id
GET /api/payments/deposit/{id}
GET /api/payments/deposit (list)
Deposit status:
initiate returns DepositId + redirectUrl; the browser must open redirectUrl at ZarinPal (use /deposit.html for the real end-to-end payment).
Deposit lifecycle (real ZarinPal gateway — sandbox or prod per server config)
Base amount (Rial)
The gateway is real ZarinPal now — there is no fake/simulated provider. Verify outcome depends on the actual sandbox payment. A
Status=OK replay for an authority that was never paid
returns verify error -55 → final
Failed
.
Run deposit flow (initiate → status → wallet)
deposit id
Callback replay (OK — dev, idempotency test)
Re-check wallet
Full success path: run the payment in the browser via
/deposit.html
→ pay in sandbox → auto verify → wallet credit. NOK → verify is never called (status stays CallbackReceived). Unresolved gateway → stays Verifying → admin retry-verify.
Dashboard
Admin/SuperAdmin
GET /api/admin/dashboard
Users
Admin/SuperAdmin
phone filter
publicId
status
(any)
Active
Locked
Frozen
page
GET /api/admin/users
user id (internal long)
GET /api/admin/users/{id}
Freeze / Unfreeze
Reason
JudicialReferenceId
Hours (≤72)
POST /api/admin/users/{id}/freeze
Unfreeze Note
POST /api/admin/users/{id}/unfreeze
SuperAdmin-only
SuperAdmin
ExtendFreeze JudicialRef
+Hours
POST /api/admin/users/{id}/extend-freeze
Admin (non-super) calling this → 403.
Role
User
Admin
user PublicId
POST /api/admin/users/{publicId}/role
Audit logs
Admin/SuperAdmin
actor
action
entity
fromUtc
to
GET /api/admin/audit-logs
Deposits admin
Admin/SuperAdmin
status filter
(any)
Ambiguous
Verifying
Verified
Failed
page
GET /api/admin/deposits
deposit id
POST /api/admin/deposits/{id}/retry-verify
Trade offset
Admin/SuperAdmin
Direction
Buy
Sell
OffsetType
Fixed
Percent
Value (≥0)
POST /api/admin/trade-offset
Negative value → 400. Public history visible on Public tab.
KYC review
Admin/SuperAdmin
page
GET /api/admin/kyc (queue)
submission id
GET /api/admin/kyc/{id}
POST .../verify-images
POST .../approve
reject reason
POST .../reject
Pricing config (backend has no [Authorize] on this controller — verify!)
Mode
Auto
Manual
PUT /api/admin/prices/mode
ManualBasePrice
POST /api/admin/prices/manual
OffsetType
Fixed
Percent
buy
sell
PUT /api/admin/prices/offsets
Provider rankings (priority/failover)
Load current rankings
Save rankings
ProviderKey
Priority
Enabled
Priority = عدد کوچکتر اول امتحان میشود (1 بالاترین). Provider ذخیرهنشده = disabled. اعتبارسنجی بکاند: keys تکراری/لیست خالی → 400؛ کلید ناشناخته → در کنسول سرور Warning و skip.
Public (no auth)
GET /api/prices/gold
direction
(any)
Buy
Sell
GET /api/trade-offset/history
These work unauthenticated — quick liveness check.
Callback (browser return from gateway — no JWT)
authority
status
OK
NOK
(unknown)
GET /api/payments/deposit/callback
Unknown authority → 404. OK triggers server-side verify against the real gateway (from dev host it is IP-whitelisted; plain browser navigation is exempt anywhere).
Authorization matrix quick-tests
Run these while logged-in as the indicated role, or with cleared tokens, to check 401/403 behavior. Results appear in the panel below.
Run authorization checks
Runs: me (no token → 401 if cleared), admin/dashboard as normal user → 403, admin/users as normal user → 403, trade without idem-key → 400, trade as Level3 → 403, wallet/{otherUserId} as normal user → 403.
Call log (newest first — click a row to re-show its result)
Clear log
Ready. All calls hit the real backend.
—