{
  "info": {
    "_postman_id": "7fa0d7a2-00d1-4b4f-92d5-smsgonder-v15",
    "name": "SMSGonder Public API — TEST Sandbox Quickstart",
    "description": "Customer integration collection. Uses real production host with /test Sandbox paths. TEST never calls the live provider. API Key identifies the application; the same key may be entered for messagingKey, verificationKey and hostedKey when that key has the corresponding Service Mode permissions. templateKey must be one of the APPROVED templates allowed for the selected API Key.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "baseUrl",
      "value": "https://www.smsgonder.com.tr"
    },
    {
      "key": "messagingKey",
      "value": "sk_REPLACE_OTP_MESSAGING",
      "description": "API Key with OTP_MESSAGING permission. May be the same secret used for other modes."
    },
    {
      "key": "verificationKey",
      "value": "sk_REPLACE_OTP_VERIFICATION",
      "description": "API Key with OTP_VERIFICATION permission. May be the same secret used for other modes."
    },
    {
      "key": "hostedKey",
      "value": "sk_REPLACE_HOSTED_OTP",
      "description": "API Key with HOSTED_OTP permission. May be the same secret used for other modes."
    },
    {
      "key": "templateKey",
      "value": "activation",
      "description": "Exact APPROVED TemplateKey allowed for the API Key (e.g. activation or login)."
    },
    {
      "key": "testOtpCode",
      "value": "123456"
    },
    {
      "key": "hostedReturnUrl",
      "value": "https://client.example/otp-return"
    },
    {
      "key": "hostedState",
      "value": "order-000001"
    }
  ],
  "item": [
    {
      "name": "OTP Messaging + Sandbox scenarios",
      "item": [
        {
          "name": "01 - Send delivered (900000000001)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "delivered-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000001\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\", function(){ pm.response.to.have.status(200); });",
                  "const j=pm.response.json(); pm.test(\"accepted\",()=>{pm.expect(j.success).eql(true);pm.expect(j.status).eql(\"accepted\");});",
                  "pm.collectionVariables.set(\"deliveredMessageId\", j.message_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "02 - Report delivered",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"message_id\": \"{{deliveredMessageId}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/report",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "report"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"delivered\",()=>pm.expect(j.status).eql(\"delivered\"));",
                  "pm.test(\"TEST environment explicit\",()=>pm.expect(j.environment).eql(\"test\"));",
                  "pm.test(\"provider availability explicit\",()=>pm.expect(j.provider_report_available).eql(true));",
                  "pm.test(\"legacy live is availability alias\",()=>pm.expect(j.live).eql(j.provider_report_available));"
                ]
              }
            }
          ]
        },
        {
          "name": "03 - Send failed (900000000002)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "failed-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000002\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.collectionVariables.set(\"failedMessageId\",j.message_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "04 - Report failed",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"message_id\": \"{{failedMessageId}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/report",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "report"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"failed\",()=>pm.expect(j.status).eql(\"failed\"));",
                  "pm.test(\"environment test\",()=>pm.expect(j.environment).eql(\"test\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "05 - Provider rejected JSON",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{rejectIdem}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000003\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.collectionVariables.set(\"rejectIdem\", \"reject-\" + pm.variables.replaceIn(\"{{$guid}}\"));"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 422\",()=>pm.response.to.have.status(422));",
                  "const j=pm.response.json(); pm.test(\"controlled reject\",()=>{pm.expect(j.success).eql(false);pm.expect(j.code).eql(\"PROVIDER_REJECTED\");});",
                  "pm.collectionVariables.set(\"rejectRequestId\",j.request_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "06 - Provider rejected duplicate replay",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{rejectIdem}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000003\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 422\",()=>pm.response.to.have.status(422));",
                  "const j=pm.response.json(); pm.test(\"same request id\",()=>pm.expect(j.request_id).eql(pm.collectionVariables.get(\"rejectRequestId\")));",
                  "pm.test(\"same error\",()=>pm.expect(j.code).eql(\"PROVIDER_REJECTED\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "07 - Balance after reject",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/test/balance",
              "host": [
                "{{baseUrl}}/test/balance"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"no reserved credit leak\",()=>pm.expect(j.reserved_sms_credits).eql(0));",
                  "pm.test(\"TEST ledger\",()=>pm.expect(j.environment).eql(\"test\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "08 - Provider timeout JSON",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{timeoutIdem}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000004\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.collectionVariables.set(\"timeoutIdem\", \"timeout-\" + pm.variables.replaceIn(\"{{$guid}}\"));"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 422 (not gateway 504)\",()=>pm.response.to.have.status(422));",
                  "const j=pm.response.json(); pm.test(\"controlled timeout\",()=>{pm.expect(j.success).eql(false);pm.expect(j.code).eql(\"PROVIDER_TIMEOUT\");});",
                  "pm.collectionVariables.set(\"timeoutRequestId\",j.request_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "09 - Provider timeout duplicate replay",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{timeoutIdem}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000004\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 422\",()=>pm.response.to.have.status(422));",
                  "const j=pm.response.json(); pm.test(\"same request id\",()=>pm.expect(j.request_id).eql(pm.collectionVariables.get(\"timeoutRequestId\")));",
                  "pm.test(\"same timeout error\",()=>pm.expect(j.code).eql(\"PROVIDER_TIMEOUT\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "10 - Balance after timeout",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/test/balance",
              "host": [
                "{{baseUrl}}/test/balance"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"no reserved credit leak\",()=>pm.expect(j.reserved_sms_credits).eql(0));"
                ]
              }
            }
          ]
        },
        {
          "name": "11 - Send pending (900000000005)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "pending-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000005\", \"template_key\": \"{{templateKey}}\", \"verification_code\": \"123456\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/send",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "send"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.collectionVariables.set(\"pendingMessageId\",j.message_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "12 - Report pending",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"message_id\": \"{{pendingMessageId}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/report",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "report"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"pending remains pending\",()=>pm.expect(j.status).eql(\"pending\"));",
                  "pm.test(\"environment test\",()=>pm.expect(j.environment).eql(\"test\"));"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "OTP Verification",
      "item": [
        {
          "name": "01 - OTP create",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{verificationKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "otp-create-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000001\", \"template_key\": \"{{templateKey}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/otp/create",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "otp",
                "create"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"accepted\",()=>pm.expect(j.status).eql(\"accepted\")); pm.collectionVariables.set(\"otpId\",j.otp_id); pm.collectionVariables.set(\"otpMaxAttempts\",j.max_attempts);"
                ]
              }
            }
          ]
        },
        {
          "name": "02 - OTP check verified",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{verificationKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "otp-check-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"otp_id\": \"{{otpId}}\", \"verification_code\": \"{{testOtpCode}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/otp/check",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "otp",
                "check"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"verified\",()=>{pm.expect(j.success).eql(true);pm.expect(j.status).eql(\"verified\");});"
                ]
              }
            }
          ]
        },
        {
          "name": "03 - OTP verified idempotent state",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{verificationKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "otp-recheck-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"otp_id\": \"{{otpId}}\", \"verification_code\": \"{{testOtpCode}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/otp/check",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "otp",
                "check"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"still verified\",()=>pm.expect(j.status).eql(\"verified\"));"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "Hosted OTP",
      "item": [
        {
          "name": "01 - Hosted create",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{hostedKey}}",
                "type": "text"
              },
              {
                "key": "Content-Type",
                "value": "application/json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "hosted-{{$guid}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\"phone\": \"900000000001\", \"template_key\": \"{{templateKey}}\", \"return_url\": \"{{hostedReturnUrl}}\", \"state\": \"{{hostedState}}\"}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": {
              "raw": "{{baseUrl}}/test/hosted/create",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "hosted",
                "create"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"JSON content type\", function(){ pm.expect(pm.response.headers.get(\"Content-Type\") || \"\").to.include(\"application/json\"); });",
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json(); pm.test(\"accepted\",()=>pm.expect(j.status).eql(\"accepted\")); pm.collectionVariables.set(\"hostedUrl\",j.hosted_url); pm.collectionVariables.set(\"hostedTransactionId\",j.transaction_id);",
                  "pm.test(\"TEST route generated\",()=>pm.expect(j.hosted_url).to.include(\"/test/otp/\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "02 - Hosted URL GET renders",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{hostedUrl}}",
              "host": [
                "{{hostedUrl}}"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "pm.test(\"HTML page\",()=>pm.expect(pm.response.text()).to.include('name=\"verification_code\"'));",
                  "const m=pm.response.text().match(/name=\"form_nonce\" value=\"([^\"]+)\"/);",
                  "pm.test(\"form nonce present\",()=>pm.expect(m).to.not.eql(null));",
                  "if(m) pm.collectionVariables.set(\"hostedFormNonce\",m[1]);"
                ]
              }
            }
          ]
        },
        {
          "name": "03 - Hosted OTP POST verifies",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "form_nonce",
                  "value": "{{hostedFormNonce}}",
                  "type": "text"
                },
                {
                  "key": "verification_code",
                  "value": "{{testOtpCode}}",
                  "type": "text"
                }
              ]
            },
            "url": {
              "raw": "{{hostedUrl}}",
              "host": [
                "{{hostedUrl}}"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const t=pm.response.text();",
                  "pm.test(\"verified page\",()=>pm.expect(t).to.include(\"Doğrulandı\"));",
                  "const returnUrl=pm.variables.replaceIn(\"{{hostedReturnUrl}}\");",
                  "const state=pm.variables.replaceIn(\"{{hostedState}}\");",
                  "pm.test(\"exact return form action\",()=>pm.expect(t).to.include('action=\"'+returnUrl+'\"'));",
                  "pm.test(\"state preserved\",()=>pm.expect(t).to.include('name=\"state\" value=\"'+state+'\"'));",
                  "pm.test(\"transaction id present\",()=>pm.expect(t).to.include('name=\"transaction_id\"'));",
                  "pm.test(\"timestamp present\",()=>pm.expect(t).to.include('name=\"timestamp\"'));",
                  "pm.test(\"signature present\",()=>pm.expect(t).to.include('name=\"signature\"'));"
                ]
              }
            }
          ]
        },
        {
          "name": "04 - Hosted used token controlled",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{hostedUrl}}",
              "host": [
                "{{hostedUrl}}"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "pm.test(\"used token is controlled\",()=>pm.expect(pm.response.text()).to.include(\"daha önce uygulamaya iletildi\"));"
                ]
              }
            }
          ]
        },
        {
          "name": "05 - Invalid Hosted token controlled",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{baseUrl}}/test/otp/not-a-valid-token",
              "host": [
                "{{baseUrl}}/test/otp/not-a-valid-token"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 404\",()=>pm.response.to.have.status(404));",
                  "pm.test(\"controlled HTML error\",()=>pm.expect(pm.response.text()).to.include(\"Doğrulama bağlantısı geçersiz\"));"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "Account / Capacity",
      "item": [
        {
          "name": "01 - Balance",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/test/balance",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "balance"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json();",
                  "pm.test(\"TEST environment\",()=>pm.expect(j.environment).eql(\"test\"));",
                  "pm.test(\"no leaked reservation\",()=>pm.expect(j.reserved_sms_credits).to.be.at.least(0));"
                ]
              }
            }
          ]
        },
        {
          "name": "02 - Usage",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{messagingKey}}",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/test/usage",
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "test",
                "usage"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\",()=>pm.response.to.have.status(200));",
                  "const j=pm.response.json();",
                  "pm.test(\"request second limit\",()=>pm.expect(j.requests.second.limit).eql(10));",
                  "pm.test(\"unit second limit\",()=>pm.expect(j.units.second.limit).eql(20));",
                  "pm.test(\"request minute limit\",()=>pm.expect(j.requests.minute.limit).eql(300));",
                  "pm.test(\"unit minute limit\",()=>pm.expect(j.units.minute.limit).eql(600));"
                ]
              }
            }
          ]
        }
      ]
    }
  ]
}