MINDSCRAFT • PAYMENT OPERATIONS

NEPRA Payment Gateway

Secure, reliable payment notifications • Multi-merchant verification

PayFast webhookNEPRA inquiry APILive MongoDB monitoring

Gateway performance

Live operational metrics • figures retrieved from the gateway database

⟲Webhook Deliveries

—

Accepted callbacks archived; unknown MIDs rejected

✓Verified Payments

—

Authenticated PayFast success events

⧉Duplicate Callbacks

—

Repeat deliveries; not extra payments

◷Pending Verification

—

Provider hash not yet validated

Webhook Delivery Trend

Real deliveries vs verified transactions

DATA FROM MONGODB

Notifications Payments

Payment Overview

Current period

—

Verified collection (PKR)

NEPRA API inquiries—

Distinct callback events—

Rejected MID attempts—

Invalid / failed / refunded—

Quick actions

▣

MongoDBChecking database health

✧

PayFast WebhookCommon URL • all PayFast MIDs

◇

NEPRA Query APIOAuth 2.0 • short-lived access tokens

Recent NEPRA Payment Records

View all →

Bill Number	Amount	Status	MID	Transaction
Unlock to load data

Recent Webhook Deliveries

View all →

Time	Event	Duplicate
Unlock to load data

PayFast Merchant MIDs

Add, update, deactivate or remove MIDs. Only ACTIVE registered MIDs can submit accepted notifications.

Merchant Registry

Secret keys are encrypted in MongoDB and are never displayed again

0 merchants

MID	Merchant Name	Status	NEPRA Access	Secret Key	Last Updated	Action
Unlock to load merchant registry

The shared webhook requires a registered ACTIVE MID. In record-only mode PayFast must include a merchant ID in the actual callback; unsigned notifications remain pending. If PayFast omits MID, you must enable a confirmed hash-validation method so the correct merchant can be determined. Removing an MID stops future acceptance, but preserves past financial records.

User Management

Create individual accounts, assign permissions and merchants, disable access, and rotate passwords.

Portal User Accounts

—

Username	Full Name	Role	MID Access	State	Actions

User Activity Audit

Sign-ins, password changes, user creation, role changes and account deactivation.

Time	Actor	Action	Target User	Source IP

PayFast Master Notifications

One master notification per transaction/status • repeat deliveries grouped

First Received	MID	Transaction ID	Bill	Status	Deliveries	Duplicates

Original PayFast Deliveries

Every arrival preserved with original form/JSON payload, source and hash status

Individual Webhook Attempts

Select a row to inspect

Received	MID	Resolution	Bill	Signature	Duplicate	Payload Changed	Action

Original Payload & Delivery Metadata

Choose a delivery to view its exact received payload, headers and normalization metadata.

NEPRA Payment Records

Separate normalized view, indexed by bill number, amount and transaction ID

Bill Number	Amount (PKR)	PayFast ID	MID	Status	Authentication	Payment Time

Duplicate Webhook Report

Original notification + total received count + duplicate count for each event

MID	Transaction ID	Bill	Status	Main Notification ID	Total Received	Duplicates	Last Received

OAuth 2.0 API Clients

Create NEPRA application credentials, assign MIDs, rotate client secrets and revoke access.

Client Credentials grant: POST /oauth/token via HTTP Basic. Tokens expire in 15 minutes. Client secrets are displayed only at creation/rotation. NEPRA can access only assigned, active, NEPRA-enabled merchant MIDs.

Registered API Clients

0 clients

Client ID	Name	Status	Allowed MIDs	Allowed Source IPs	Last Used	Actions

OAuth Client Administration Audit

Time	Actor	Action	Client ID

NEPRA Verification API Audit

Every authorized inquiry is logged with bill, amount, time and result

Time	Bill Number	Amount	Response	Request ID

Merchant Profiles

Registered PayFast merchant accounts and NEPRA inquiry permissions.

Merchant profiles load from MongoDB after sign-in.

Webhook Mapping

One shared PayFast callback endpoint for active registered merchants.

Common PayFast notification URL

https://nepra.mindscraft.pk/api/v1/webhooks/payfast

PayFast must configure webhook delivery for externally generated NEPRA Static QRs. QR payloads do not carry a standard webhook-routing field.

Registered MID admission

—

Merchant MID	Merchant	Admission	NEPRA inquiry

Merchant-level webhook routing is registered with PayFast, not configured by embedding this URL into NEPRA's printed QR.

Reports & Analytics

Operational totals and duplicate delivery investigations from MongoDB.

Webhook deliveries

—

In selected reporting window

Verified payments

—

Authenticated successful transactions

Duplicate callbacks

—

Repeated provider deliveries

NEPRA API inquiries

—

Bill and amount lookups

Reporting basis

Current period: 30 days

All metrics come from the existing admin summary endpoint. Use the Duplicate Reports section for per-notification drill-down and CSV export. Financial status remains subject to PayFast signature verification.

System Health

Operational controls and payment-verification readiness.

◈

MongoDB & API

Checking…

Readiness from /health/ready

⌁

PayFast webhook

Configured route

/api/v1/webhooks/payfast

◌

Signature verification

Checking…

Only authentic payments may be reported PAID

Verification policy

Checking current PayFast validation configuration…

When validation is set to record_only, notifications are archived, but successful payment verification is not enabled. This status is available here instead of yellow warning banners throughout the portal.

Portal Settings

Personal workspace controls; server secrets remain managed by DevOps.

My account

Change your login password and invalidate current sessions.

Environment

Application domain: nepra.mindscraft.pk

Portal UI: MindsCraft Go Connect-inspired light theme