# GCash Scan User API v1.1

Human documentation: ./docs.html
OpenAPI 3.1 contract: ./openapi.json
AI-oriented Markdown reference: ./api-reference.md

Use openapi.json as the canonical endpoint and schema contract. Use api-reference.md for lifecycle, retry, and operational semantics.

Automation capabilities: idempotent extraction/order creation, recovery by client_request_id, extraction-to-order linking, detailed stages, stable error codes, and signed retryable callbacks.

Compatibility: POST /extractions, GET /extractions/{task_no}, POST /orders, GET /orders/{order_no}, and GET /balance remain backward compatible. All v1.1 request fields are optional.

Security-sensitive parsing rule: verify X-Signature as lowercase-hex HMAC-SHA256 over the exact raw callback JSON bytes before decoding. Deduplicate callback events by X-Request-ID.