Go-live checklist

Run through this on https://test.unipay.co.zw, then send the results to your Axis Solutions contact to request production credentials.

Authentication

• A token request returns 200 with an access_token.
• A wrong client_secret returns invalid_client; your system alerts rather than retrying in a loop.
• Under sustained load, your system requests about one token per 30 minutes per process — check your logs.
• An expired or revoked token (401) makes your client get a new token and retry once.
• The client secret is in a secrets vault, not in code or configuration files.

Lookup

• A valid bill number returns the bill; you show the customer payableNow and the bill’s currency.
• An unknown bill number shows the customer a clear message, and no payment is offered.
• If you offer account payments: an account lookup returns status 1 (Owing), and statuses 0 and 3 are refused.
• A bill with an expiryDate in the past is refused before the customer is debited.

Payment

• A payment returns "successful": true, "isNewRecord": true.
• Sending the same request again returns "isNewRecord": false, and your system treats it as success.
• Each payment gets a new rrn, unique across your organisation, stored before the first attempt.
• A payment in a currency the provider doesn’t accept is refused, and your system reverses the debit.
• A paymentDate in the future is refused; your paymentDate carries a UTC offset.
• A simulated timeout (e.g. block the connection after sending) leads to a retry with the same rrn — not a reversal.
• A 429 or 5xx leads to backoff and retry, capped at about five attempts, then an alert.

Day settlements

If you pay service providers directly:

• A settlement listing every payment of a test day returns "isBalanced": true.
• Leaving a payment out returns it in unsettledByProcessor; your system alerts rather than ignoring it.
• Sending the same settlement again returns "isNewRecord": false, and your system treats it as success.
• Each transfer is sent once per provider and currency, with its bank reference as transferReference.

Operations

• You log every request and response with a timestamp, the rrn, and your client_id — with tokens and secrets redacted.
• You alert on the rate of "successful": false answers, not only on HTTP errors.
• Timeouts are set: 10 s to connect, 30 s to read.
• Separate credentials are ready for production; none are shared with test.