Enterprise & Finance Risk API · v1 · REST & HMAC-SHA256 Webhooks

Real-Time Resolution & Chargeback Risk API for Banks, PSPs & Enterprise ERPs

Query verified 96-hour resolution rates and Visa 13.1 / Mastercard 4853 chargeback risk scores in real time, and synchronize corporate dispute cases two-way with SAP, Zendesk, Salesforce, Shopify, or custom ERPs.

Start Enterprise Subscription (19,900.00 ₺ / mo) Compare All Business Plans

SHA-256 Bearer Key (`czm_ent_live_...`)

HMAC-SHA256 Signed (`X-Uzlasio-Signature`)

300 Requests / Min · Enterprise SLA

19,900.00 ₺ / mo · 199,000.00 ₺ / yr (VAT Incl.)

Three Enterprise Integration Layers

1. Bank & PSP Merchant Chargeback Risk Score API

0..100 underwriting score computed from verified 96h resolution rates, active sanction breaches, reopened unfulfilled promises, and corporate domain/tax ID verification.

2. Two-Way ERP / CRM Case Synchronization

Pull brand disputes into your internal desk (`GET /cases`), post official responses directly from SAP or Zendesk (`POST /respond`), and report refund/replacement outcomes (`POST /outcome`).

3. Cryptographic Auth & Live Subscription Isolation

Raw API keys are never stored in the database (only SHA-256 digests). If a key is revoked or Enterprise subscription lapses, API access is blocked instantaneously.

REST Endpoint Reference

Base URL: https://uzlasio.com/api/v1/enterprise

Every request requires `Authorization: Bearer czm_ent_live_...` (or `X-API-Key`). All responses use UTF-8 JSON.

Method	Endpoint	Scope	Description
GET	/api/v1/enterprise/risk/brands	risk:read	List verified merchants with real-time 96h compliance and Chargeback Risk Scores (0..100).
GET	/api/v1/enterprise/risk/brands/:slug	risk:read	Detailed merchant risk report (`LOW`..`CRITICAL`), underwriting guidance, and resolution metrics.
GET	/api/v1/enterprise/cases	cases:read	List active and closed dispute cases assigned to your verified brand.
GET	/api/v1/enterprise/cases/:id	cases:read	Retrieve full ERP snapshot, version, and SLA status of a single case.
POST	/api/v1/enterprise/cases/:id/respond	cases:write	Post an official corporate response from your ERP/CRM (auto-accepts `INVITED` cases).
POST	/api/v1/enterprise/cases/:id/outcome	cases:write	Report resolution outcome (`FULL_REFUND`, `PARTIAL_REFUND`, `REPLACEMENT`, `REPAIR`, `REJECTED`).

Example 1 · Query Merchant Chargeback Risk Score (Bank / PSP / Marketplace)

HTTP 200 JSON

curl -sS https://uzlasio.com/api/v1/enterprise/risk/brands/ornek-elektronik \
  -H "Authorization: Bearer czm_ent_live_YOUR_SECRET_KEY"

# Response (200 OK):
{
  "brand_slug": "ornek-elektronik",
  "display_name": "Örnek Elektronik A.Ş.",
  "vkn_verified": true,
  "domain_verified": true,
  "chargeback_risk_score": 11,
  "risk_tier": "LOW",
  "metrics": {
    "shared_cases": 42,
    "verified_resolved_cases": 40,
    "verified_resolution_rate_pct": 95,
    "sanctioned_96h_breach_cases": 0,
    "reopened_cases": 0,
    "median_resolution_seconds": 14400
  }
}

Example 2 · Verify Outbound ERP Webhook Signature (`X-Uzlasio-Signature`)

HMAC-SHA256

Uzlasio signs every outbound event (`case.message_received`, `case.outcome_confirmed`, `webhook.ping`) using `t=<unix_ts>,v1=<hex_hmac_sha256>`:

# Header:
# X-Uzlasio-Event: case.outcome_confirmed
# X-Uzlasio-Signature: t=1762857600,v1=8f4a9c...

signed_payload = `${timestamp}.${rawRequestBody}`;
expected_v1 = crypto
  .createHmac("sha256", process.env.UZLASIO_WEBHOOK_SECRET)
  .update(signed_payload, "utf8")
  .digest("hex");

crypto.timingSafeEqual(Buffer.from(expected_v1), Buffer.from(v1));

Chargeback Risk Score (0..100) Underwriting Tiers

0 – 24 · LOW Risk

High 96h settlement rate, zero active breaches, verified corporate domain & tax ID. Eligible for standard POS settlement windows.

25 – 49 · MODERATE Risk

Normal resolution metrics or newly onboarded merchant. Standard rolling reserve policy recommended.

50 – 74 · HIGH Risk

Multiple 96h shield breaches or delayed settlements. Extended settlement hold or collateral recommended.

75 – 99 · CRITICAL Risk

Persistent unanswered 96h breaches and active Visa 13.1 / MC 4853 escalations. Manual underwriting review required.

Standard HTTP Status & Error Codes

HTTP 401	UNAUTHENTICATED	Missing `Authorization: Bearer czm_ent_live_...` header.
HTTP 401	INVALID_API_KEY	Unknown or malformed Enterprise API key.
HTTP 401	REVOKED_API_KEY	API key was revoked from the Business Panel.
HTTP 403	ENTERPRISE_SUBSCRIPTION_INACTIVE	Key is valid, but the company's paid Enterprise subscription is inactive.
HTTP 404	BRAND_NOT_FOUND	No verified merchant or transparency record found for the given `slug`.
HTTP 429	RATE_LIMITED	Rate limit of 300 requests/minute exceeded.

Connect Your Enterprise Stack Today

The moment your Enterprise subscription is activated via PayTR 3D Secure or Proforma Wire Transfer, API key generation and HMAC webhook configuration unlock in your Business Panel.

Start Enterprise Subscription (19,900.00 ₺ / mo)