chore: add a Bruno collection covering every API route

api-tests/Addresses/Create Address.bru

@@ -0,0 +1,33 @@
+meta {
+  name: Create Address
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/addresses
+  body: json
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+body:json {
+  {
+    "customer_ref": "test-customer-1",
+    "metadata": { "plan": "pro" }
+  }
+}
+
+script:post-response {
+  if (res.body?.data?.id) {
+    bru.setVar("address_id", res.body.data.id);
+  }
+}
+
+docs {
+  Generates a dedicated deposit address (muxed M... plus a G...+memo fallback) instantly,
+  off-chain. Both forms credit the same master wallet — there's nothing to sweep.
+}

api-tests/Addresses/List Addresses.bru

@@ -0,0 +1,14 @@
+meta {
+  name: List Addresses
+  type: http
+  seq: 2
+}
+
+get {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/addresses
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}

api-tests/Auth/Login.bru

@@ -0,0 +1,29 @@
+meta {
+  name: Login
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/v1/auth/login
+  body: json
+  auth: none
+}
+
+body:json {
+  {
+    "email": "your-existing-user@octo.test",
+    "password": "supersecret123"
+  }
+}
+
+script:post-response {
+  if (res.body?.data?.token) {
+    bru.setVar("token", res.body.data.token);
+  }
+}
+
+docs {
+  Log in an existing user. Edit the email/password to match a real account, or just re-run
+  Signup instead if you don't need a persistent one.
+}

api-tests/Auth/Logout.bru

@@ -0,0 +1,18 @@
+meta {
+  name: Logout
+  type: http
+  seq: 5
+}
+
+post {
+  url: {{base_url}}/v1/auth/logout
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+docs {
+  Revokes the current token. Every other request will 401 until you Signup/Login again.
+}

api-tests/Auth/Me.bru

@@ -0,0 +1,18 @@
+meta {
+  name: Me
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{base_url}}/v1/auth/me
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+docs {
+  Returns the authenticated user. Confirms the token from Signup/Login is still valid.
+}

api-tests/Auth/Refresh.bru

@@ -0,0 +1,24 @@
+meta {
+  name: Refresh
+  type: http
+  seq: 4
+}
+
+post {
+  url: {{base_url}}/v1/auth/refresh
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+script:post-response {
+  if (res.body?.data?.token) {
+    bru.setVar("token", res.body.data.token);
+  }
+}
+
+docs {
+  Issues a fresh token for an already-valid session and auto-saves it, replacing the old one.
+}

api-tests/Auth/Signup.bru

@@ -0,0 +1,33 @@
+meta {
+  name: Signup
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{base_url}}/v1/auth/signup
+  body: json
+  auth: none
+}
+
+body:json {
+  {
+    "email": "test-{{$randomInt}}@octo.test",
+    "password": "supersecret123"
+  }
+}
+
+script:post-response {
+  if (res.body?.data?.token) {
+    bru.setVar("token", res.body.data.token);
+    bru.setVar("user_id", res.body.data.user.id);
+  }
+}
+
+docs {
+  Creates a dashboard user and returns a bearer token. The token is auto-saved to the
+  `token` variable so every other request in this collection can reuse it via
+  `Authorization: Bearer {{token}}`.
+
+  Re-run this any time you need a fresh user — each run generates a unique email.
+}

api-tests/Payment Links/Create Payment Link.bru

@@ -0,0 +1,42 @@
+meta {
+  name: Create Payment Link
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/payment-links
+  body: json
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+body:json {
+  {
+    "name": "Test payment link",
+    "description": "Created from Bruno",
+    "amount_usdc_stroops": 10000000,
+    "redirect_url": "https://example.com/thank-you"
+  }
+}
+
+script:post-response {
+  if (res.body?.data?.slug) {
+    bru.setVar("link_id", res.body.data.id);
+    bru.setVar("link_slug", res.body.data.slug);
+    bru.setVar("checkout_url", res.body.data.url);
+  }
+}
+
+docs {
+  amount_usdc_stroops is optional — omit it for a flexible-amount link the payer fills in.
+  redirect_url is optional too — where the payer's browser goes after a confirmed payment.
+
+  The response's `url` field is the real hosted checkout link — open checkout_url in a browser
+  after running this to see the actual pay page. It's built from PUBLIC_APP_URL on the server,
+  so if it ever shows localhost in production, that env var isn't set correctly on the backend
+  host.
+}

api-tests/Payment Links/Deactivate Payment Link.bru

@@ -0,0 +1,25 @@
+meta {
+  name: Deactivate Payment Link
+  type: http
+  seq: 4
+}
+
+put {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/payment-links/{{link_id}}
+  body: json
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+body:json {
+  {
+    "active": false
+  }
+}
+
+docs {
+  Set active: true to reactivate. An inactive link's public page (GET /v1/pay/:slug) 404s.
+}

api-tests/Payment Links/Get Payment Link.bru

@@ -0,0 +1,18 @@
+meta {
+  name: Get Payment Link
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/payment-links/{{link_id}}
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+docs {
+  link_id is auto-saved by Create Payment Link.
+}

api-tests/Payment Links/List Payment Links.bru

@@ -0,0 +1,14 @@
+meta {
+  name: List Payment Links
+  type: http
+  seq: 2
+}
+
+get {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/payment-links
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}

api-tests/Payment Links/List Payments (owner).bru

@@ -0,0 +1,19 @@
+meta {
+  name: List Payments (owner)
+  type: http
+  seq: 5
+}
+
+get {
+  url: {{base_url}}/v1/wallets/{{wallet_id}}/payment-links/{{link_id}}/payments
+  auth: none
+}
+
+headers {
+  authorization: Bearer {{token}}
+}
+
+docs {
+  Owner-only: includes payer name/email, unlike anything on the public side. Includes pending
+  intents too, not just confirmed payments, so you can see abandoned checkouts.
+}

api-tests/Payment Links/Public - Create Intent.bru

@@ -0,0 +1,30 @@
+meta {
+  name: Public - Create Intent
+  type: http
+  seq: 7
+}
+
+post {
+  url: {{base_url}}/v1/pay/{{link_slug}}/intent
+  body: json
+  auth: none
+}
+
+body:json {
+  {
+    "payer_name": "Jane Doe",
+    "payer_email": "jane@example.com"
+  }
+}
+
+script:post-response {
+  if (res.body?.data?.payment_id) {
+    bru.setVar("payment_id", res.body.data.payment_id);
+  }
+}
+
+docs {
+  No auth, rate-limited by IP (5/min). Allocates a dedicated address for THIS payment — two
+  concurrent payers on the same link get different addresses, so a deposit can only ever match
+  one of them. amount_usdc_stroops is required here only if the link itself is flexible-amount.
+}

api-tests/Payment Links/Public - Get Link.bru

@@ -0,0 +1,15 @@
+meta {
+  name: Public - Get Link
+  type: http
+  seq: 6
+}
+
+get {
+  url: {{base_url}}/v1/pay/{{link_slug}}
+  auth: none
+}
+
+docs {
+  No auth — this is what the hosted checkout page calls first. Returns the link's public
+  details plus the deposit address to send USDC to.
+}

api-tests/Payment Links/Public - Get Payment Status.bru

@@ -0,0 +1,16 @@
+meta {
+  name: Public - Get Payment Status
+  type: http
+  seq: 8
+}
+
+get {
+  url: {{base_url}}/v1/pay/{{link_slug}}/payments/{{payment_id}}
+  auth: none
+}
+
+docs {
+  No auth. status is one of pending | confirmed | expired | underpaid | overpaid. The pay page
+  polls this every ~3s while waiting. expected_usdc_stroops/received_usdc_stroops let you show
+  a mismatch banner without a second request.
+}

api-tests/Payment Links/Public - Get Signing Info.bru

@@ -0,0 +1,19 @@
+meta {
+  name: Public - Get Signing Info
+  type: http
+  seq: 9
+}
+
+get {
+  url: {{base_url}}/v1/pay/{{link_slug}}/signing-info?account={{payer_account}}
+  auth: none
+}
+
+docs {
+  No auth. account should be the PAYER's own Stellar address (e.g. from Freighter) — this
+  returns THAT account's current sequence number, network passphrase, and base fee, everything
+  needed to build a transaction client-side without hitting Horizon directly.
+
+  Set the payer_account variable to a real G... address to try this (e.g. the one printed by
+  sign-challenge.js, once funded).
+}