{
  "_doc": "The `#pay=` codec. The URL is base64url of the request's wire JSON under a fixed base, so `expect_url` is checkable by hand; the tolerance rows are what a real address bar hands you.",
  "base": "https://banca.ardegazu.ro/",
  "request": {
    "v": 1,
    "t": "wpr",
    "cur": "0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc.LEI",
    "amt": 100,
    "to": "Kay64UG8yvCyLhqU000LxzYeUm0L_hLIl5S8kyKWbdc",
    "tox": "HrbyYLOKnDdB_6dSrAU1uOJJcXA2VS5SsE5ha14y5Cg",
    "ctx": "",
    "memo": "cafea",
    "exp": 1735693200000,
    "sig": "7kqXZ2cnDbteT7blpjh_di-yWlPSRauqWdDIUqMcJldARPT56S95WWZ-1aQvFjxgike8jmvci5Mdu4rGJfOxCQ"
  },
  "expect_url": "https://banca.ardegazu.ro/#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiN2txWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1EifQ",
  "accept_forms": [
    {
      "name": "the whole URL",
      "form": "url"
    },
    {
      "name": "the fragment with its #",
      "form": "hash"
    },
    {
      "name": "the bare fragment",
      "form": "bare"
    },
    {
      "name": "other parameters before it",
      "form": "prefixed"
    },
    {
      "name": "other parameters after it",
      "form": "suffixed"
    }
  ],
  "reject_forms": [
    {
      "name": "no pay parameter",
      "input": "#other=1"
    },
    {
      "name": "empty fragment",
      "input": "#"
    },
    {
      "name": "not base64url",
      "input": "#pay=!!!!"
    },
    {
      "name": "base64url of something that is not JSON",
      "input": "#pay=bm90IGpzb24"
    },
    {
      "name": "base64url of an unsigned request",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMH0"
    },
    {
      "name": "base64url of a request with a flipped signature",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiQWtxWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1EifQ"
    },
    {
      "name": "standard base64 with padding, not base64url",
      "why": "decodes to the same request under a lenient decoder, which would give one request three link spellings; the kit is strict about encoding malleability everywhere else",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiN2txWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1EifQ=="
    },
    {
      "name": "canonical base64url with a stray = pad",
      "why": "unpadded is the only form; a padded one is a second spelling of one link",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiN2txWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1EifQ="
    },
    {
      "name": "percent-encoded payload",
      "why": "base64url has no character a fragment escapes, so a percent sequence is a re-encoder fingerprint, never a user link",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiN2txWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1EifQ%3D%3D"
    },
    {
      "name": "a length no byte string can encode to",
      "why": "86 % 4 == 2 is fine; a length of 1 mod 4 is not the encoding of anything",
      "input": "#pay=eyJ2IjoxLCJ0Ijoid3ByIiwiY3VyIjoiMEVxeU1uUXJ0S3M2RTJpOVJoWGs1dEFpU3JjYUFXdXZoU0NqTXNsM2h6Yy5MRUkiLCJhbXQiOjEwMCwidG8iOiJLYXk2NFVHOHl2Q3lMaHFVMDAwTHh6WWVVbTBMX2hMSWw1UzhreUtXYmRjIiwidG94IjoiSHJieVlMT0tuRGRCXzZkU3JBVTF1T0pKY1hBMlZTNVNzRTVoYTE0eTVDZyIsImN0eCI6IiIsIm1lbW8iOiJjYWZlYSIsImV4cCI6MTczNTY5MzIwMDAwMCwic2lnIjoiN2txWFoyY25EYnRlVDdibHBqaF9kaS15V2xQU1JhdXFXZERJVXFNY0psZEFSUFQ1NlM5NVdXWi0xYVF2Rmp4Z2lrZThqbXZjaTVNZHU0ckdKZk94Q1Eif"
    }
  ]
}