Security alerts

The separate payer OpenAPI 0.5.0 and payer SDK add GET /v1/payer/security-alerts. Supply a fresh route-bound DPoP proof and the active session token. The service derives payer identity from that session; the client never selects a payer. The first successful login on each enrolled device creates one NEW_DEVICE_LOGIN event atomically. Concurrent retries and later sessions do not duplicate it. Failed or rolled-back login produces no event.

The payer API runs only in the local sandbox: the hosted sandbox does not serve it yet.

The inbox holds at most twenty events, newest first. When next_cursor is present, pass it as the before parameter for the next page. Each read needs a new proof signed for the URL without parameters. Reading does not extend the idle timeout. An expired or revoked session, or a proof already used, is refused.

Each event exposes only an opaque event ID, device ID, kind, creation time and delivery_state. SYNTHETIC_PENDING means local delivery evidence is absent. SYNTHETIC_RECORDED means a private test service recorded a synthetic receipt. Neither means an actual SMS or push notification was sent. Native clients should localize the event and keep it separate from payment approvals.

The private synthetic-receipt endpoint requires a service key. That key must never be built into a native app or the public SDK. SMS and push providers, approved templates and protected destinations remain to be integrated. This feature authorizes no device addition and no recovery by SMS alone. Android and iOS keep independent logic; Android uses Retrofit, Room and Hilt.