<!-- Extension API v0 — pre-1.0. Interfaces may change without notice until P2 seals the custom-code format. First-party extensions track HEAD. -->

# `mozaik.iyzico` — iyzico ile kart ödemesi

Kendi iyzico hesabınla kredi/banka kartı ödemesi al — 3D Secure ve taksit destekli.

- version **1.1.0** · publisher `mozaik` · runtime `platform` · listed: true
- provider kind: `payment` · methodId `card_iyzico` · settlement `card`
- capabilities: `threeds`, `hostedForm`, `installments`, `refund`, `partialRefund`, `binlookup`
- scopes: `checkout`
- PII: name, email, phone, address, city, ip — Ödeme işlemini iyzico üzerinden başlatmak için alıcı bilgileri iyzico'ya iletilir.
- admin panels: — · actions: —

## Secrets

| key | label (TR) | required | sandbox prefix |
|---|---|---|---|
| `psp.iyzico.api_key` | API Anahtarı | yes | `sandbox-` |
| `psp.iyzico.secret_key` | Güvenlik Anahtarı | yes | `sandbox-` |

Secrets are write-only and owner-entered — see [Tokens](/reference/tokens).

## Provider-driven inbound

Webhooks and jobs are the platform's to ingest and schedule — **never callable by agents**.

| kind | name | note |
|---|---|---|
| webhook | `psp` (`/v1/ext/mozaik.iyzico/wh/psp/{storeId}`) | provider-driven ingestion (payment_events); not callable by agents |

## Config schema

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "mode": {
      "default": "sandbox",
      "type": "string",
      "const": "sandbox"
    },
    "enabledInstallments": {
      "maxItems": 12,
      "type": "array",
      "items": {
        "type": "integer",
        "minimum": 1,
        "maximum": 12
      }
    }
  },
  "additionalProperties": false
}
```

## For agents

Card payments through the merchant's own iyzico account (3-D Secure, installments). Agents can propose refunds; checkout itself is shopper-driven.

### Setup

1. **Install** — [`extension.install`](/reference/commands/extension.install) with `{"extensionId": "mozaik.iyzico"}` and the consent block. extension.install with the consent payload (scopes + buyer PII go to iyzico).
2. **Secret** — the owner enters `psp.iyzico.api_key` in the admin panel (agents cannot set secrets). Owner enters it in the admin panel — agents can never set secrets.
3. **Secret** — the owner enters `psp.iyzico.secret_key` in the admin panel (agents cannot set secrets).
4. **Configure** — [`extension.configure`](/reference/commands/extension.configure) setting `/mode`. mode stays 'sandbox' until the platform unlocks live PSP traffic (M7).
5. **Enable** — [`extension.enable`](/reference/commands/extension.enable).
6. **Verify** — run op `refund` via [`orders.refund`](/reference/routes/orders.refund). Dry-run orders.refund on a paid test order — a clean preview proves credentials.

### Operations

| op | via | effects | proposal-only | requires |
|---|---|---|---|---|
| `refund` | [`orders.refund`](/reference/routes/orders.refund) | `external` | ✓ | enabled · capability `refund` |

[`extensions.ops.get`](/reference/routes/extensions.ops.get) (`GET /v1/extensions/mozaik.iyzico/ops`) returns this table with live readiness — exactly what blocks each op right now (`missing_secret:<key>`, `missing_config:<pointer>`, `not_enabled`, …).

### Lifecycle

[`extension.install`](/reference/commands/extension.install) → [`extension.configure`](/reference/commands/extension.configure) → [`extension.enable`](/reference/commands/extension.enable) → [`extension.disable`](/reference/commands/extension.disable) → [`extension.uninstall`](/reference/commands/extension.uninstall)