Testing Guide

What the testing API is

The testing environment is a staging-only replica of the Challanwala organization API. It mirrors the public contract, but uses deterministic dummy data and a simulated payment flow.

• Host: https://cms-staging.challanwala.com
• API root: /api/v1/staging
• Auth type: bearer secret
• Data source: dummy challans generated from the RC number you search

Staging key generation

Testing keys are public self-serve credentials intended only for the staging environment. They do not expose production organization data and they do not work against production routes.

curl --request POST 'https://cms-staging.challanwala.com/api/v1/staging/api-keys' \  --header 'Content-Type: application/json' \  --data '{"name": "Partner QA Sandbox"}'

const response = await fetch('https://cms-staging.challanwala.com/api/v1/staging/api-keys', {  method: 'POST',  headers: {    'Content-Type': 'application/json',  },  body: JSON.stringify({name: "Partner QA Sandbox"}),});const data = await response.json();console.log(data);

{"success": true,"message": "Organization API secret generated","data": {  "key": {    "id": "8c9d962c-56cb-4b5d-998c-5a2a23c07e71",    "name": "Partner QA Sandbox",    "keyPrefix": "cms_test_2b15d8d31",    "status": "ACTIVE",    "createdAt": "2026-05-14T09:32:00.000Z",    "maskedKey": "cms_test_2b15d8d31************************"  },  "apiSecret": "cms_test_2b15d8d3156f98f1c1234ab5678ef901234567"}}

Replica routes

The staging API includes the same primary business capabilities as production, plus testing-only webhook configuration helpers:

Configure staging webhooks

Use the protected webhook-config routes after generating a staging key.

curl --request PUT 'https://cms-staging.challanwala.com/api/v1/staging/webhook-config' \  --header 'Authorization: Bearer YOUR_API_SECRET' \  --header 'Content-Type: application/json' \  --data '{"webhookUrl": "https://example.com/challanwala/webhook","isActive": true,"rotateSecret": true}'

const response = await fetch('https://cms-staging.challanwala.com/api/v1/staging/webhook-config', {  method: 'PUT',  headers: {    Authorization: 'Bearer YOUR_API_SECRET',    'Content-Type': 'application/json',  },  body: JSON.stringify({webhookUrl: "https://example.com/challanwala/webhook",isActive: true,rotateSecret: true}),});const data = await response.json();console.log(data);

{"success": true,"message": "Webhook configuration saved","data": {  "config": {    "id": "71414ce7-84da-43d6-bdb6-1c9fce1f9760",    "webhookUrl": "https://example.com/challanwala/webhook",    "isActive": true,    "createdAt": "2026-05-14T09:41:00.000Z",    "updatedAt": "2026-05-14T09:41:00.000Z"  },  "webhookSecret": "whsec_54123f6a8dc9eaf73125cda94c336d98c701d1"}}

If the callback is unsafe, the staging API rejects it before saving:

{"success": false,"message": "Webhook URL must be a public HTTPS endpoint","errors": [  {    "path": "webhookUrl",    "message": "Localhost and mDNS webhook targets are not allowed."  }]}

curl --request POST 'https://cms-staging.challanwala.com/api/v1/staging/webhook-config/test' \  --header 'Authorization: Bearer YOUR_API_SECRET'

const response = await fetch('https://cms-staging.challanwala.com/api/v1/staging/webhook-config/test', {  method: 'POST',  headers: {    Authorization: 'Bearer YOUR_API_SECRET',  },});const data = await response.json();console.log(data);

{"success": true,"message": "Webhook test event queued","data": {  "eventType": "webhook.test"}}

What webhook events fire in testing

The staging replica does more than store a webhook URL. It also emits predictable test events so you can validate your receiver end to end.

Recommended staging webhook test sequence:

1. Generate a staging API key.
2. Save a public HTTPS webhook URL with rotateSecret: true.
3. Verify the returned whsec_... secret in your receiver.
4. Trigger POST /webhook-config/test and confirm webhook.test.
5. Run a challan search and confirm challan_search.completed.
6. Create a payment link and confirm payment_link.created and the final payment event.

Simulated payments

Generated staging payment links use a real testing page under the same host. Opening the paymentUrl shows a branded result page, but no real money movement happens.

• Standard RC numbers: create returns ACTIVE, then status lookup becomes PAID
• STGPAYEXPIRE: create returns ACTIVE, then status becomes EXPIRED
• STGPAYFAILED: create returns ACTIVE, then status becomes FAILED

Use the reserved testing inputs on the next page for predictable edge-case validation.