Execute interceptor
Submits an acquirer request body to the interceptor identified by ref; Specter maps it to a decision and either forwards it (ALLOW) or returns a configured block or review response.
Authorizations
HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication).
Headers
Payment type declared by the merchant. Controls the initial payment state on the decision.
"authorization-and-capture"
Path Parameters
The interceptor's reference
Body
Acquirer request body
The body is of type object.
Response
Interceptor outcome. On ALLOW the merchant's request is forwarded and the destination's response is returned verbatim. On BLOCK/REVIEW the body is either the configured template response or, in decision mode, the decision result shown below.
Decision body returned by the interceptor runtime endpoint when it produces a decision (BLOCK or REVIEW in decision response mode). Identical to the standard decision result plus the interceptor-specific payment_type, payment_state, and payload fields.
Unique decision identifier
"1e7b9c0a-2d43-4f6a-8d29-c4a1f2d05b3e"
5000
One entry per backend rule that was executed.
"checkout"
Deterministic HMAC-SHA256 payment credential identifier
"crd_4ba218..."
Type of credential supplied in the request
pan, masked_pan, sepa, paypal "USD"
"customer-123"
BLOCK terminates on first match. REVIEW accumulates. ALLOW is the default when no rules match.
ALLOW, BLOCK, REVIEW, PROVISIONAL "fp-9c1e4b7a"
"1.2.3.4"
"2026-06-01T10:00:00Z"
Always empty on a freshly evaluated decision.
True if any backend_results entry carries a non-nil error (e.g. "backend_capability_disabled").
false
Integration type that originated this decision (e.g. 'interceptor')
"interceptor"
ID of the interceptor that originated this decision
null
4250
Display-safe masked representation, e.g. '411111 •••••• 4242' for cards or 's•••@example.com' for PayPal
"411111 •••••• 4242"
Merchant-supplied key-value pairs stored with the decision.
Always null on a freshly evaluated decision.
"6c1f4e8b-9a2d-4c7e-b5f3-8d1a6e9c4b2f"
7
RULE_ENGINE — condition rules only. BACKEND — backend rule(s) only. COMBINED — both.
RULE_ENGINE, BACKEND, COMBINED "X36Q9C"
Masked raw request body captured at intercept time.
Current payment lifecycle state. Advances as lifecycle events are submitted via POST /api/events. "fraud_reported" is a legacy value no longer written — fraud is tracked by the fraud marker fields, independent of payment_state.
authorized, captured, voided, fraud_reported, chargedback, failed Payment type declared by the merchant via the payment-type request header.
unknown, authorization, authorization-and-capture