add dhiraagu bill pay

docs/dhiraaguapi/02-reload.md

@@ -172,4 +172,4 @@ UA, so these calls are made the same way.
 **Related:** [Number Lookup](01-number-lookup.md) · [BML Merchant Card Payment](../bmlapi/16-card-payment.md) ·
 App side: [Transfer Flows](../thijooree/20-transfer-flows.md#carrier-services-by-bml-card)
 
-[← Number Lookup](01-number-lookup.md)
+[← Number Lookup](01-number-lookup.md) · [Bill Pay →](03-bill-pay.md)

docs/dhiraaguapi/03-bill-pay.md

@@ -0,0 +1,132 @@
+# Bill Pay (Easy Pay, paid by BML card)
+
+Pay a Dhiraagu postpaid bill through the dhiraagu.com.mv **Easy Pay** page. Like
+[Reload](02-reload.md), Dhiraagu only builds the order and the money moves on a **BML Merchant
+Services transaction** paid by card + 3-D Secure
+([BML API → Merchant Card Payment](../bmlapi/16-card-payment.md)). From the payment page on,
+the two flows are identical; only the first page, the cart call and the form id differ.
+
+Reconstructed from `docs/dhiraaguapi/tmp/dhiraagu_billpay_gateway.har` (a Firefox HAR) and the
+Easy Pay page's inline script.
+
+---
+
+## Flow overview
+
+```
+GET  /services/easy-pay                       → nonce #1
+GET  setting&act=bill          (nonce #1)     → blocked account statuses / customer types
+POST dhiraaguIO&act=infoUnlisted (nonce #1)   → accountNumber, type, accountStatus, customerType
+POST cart&act=easyPay          (nonce #1)     → cartId
+GET  /services/payment-v2?cartid=<cartId>     → nonce #2
+POST merchant&act=form  {"formId":1}          → BML gateway's merchantId
+POST payment&act=create (formId 1)            → paymentId, oid (EP…)
+POST bml&act=createV2                         → BML transaction url
+        ── from here: the BML card-only merchant flow ──
+GET  transaction.merchants…/<id>?wait=1   → 302 dhiraagu-bml-response.aspx (posts the payment)
+                                          → 302 /services/bill-receipt?pyid=<paymentId>
+```
+
+As with reload, the `?wait=1` return hop is what tells Dhiraagu it was paid.
+
+Common headers and the `{"respStatus":"OK","resp":…}` envelope are as in
+[Reload → Common](02-reload.md#common).
+
+---
+
+## 1. Settings
+
+`GET …&sub=setting&act=bill` (no body, so a GET) — rules the page checks the lookup against:
+
+```json
+{"settingAppJson1":{"accountStatus":{"val":["F"],…},"customerType":{"val":["P"],…}}}
+```
+
+A number whose `accountStatus` or `customerType` is in a `val` list is refused before ordering
+("Payment for this service could not be accepted… [Account Status: F]" / "The number is not
+allowed. [Customer Type: P]"). Thijooree applies the same rules, skipping them if the call fails.
+
+`setting&act=maintenance` has `public.easyPay` — `"Y"` means the page is under maintenance.
+Not checked.
+
+---
+
+## 2. Lookup
+
+`sub=dhiraaguIO&act=infoUnlisted`, `{"number":"7XXXXXX"}` — the same call as
+[Number Lookup](01-number-lookup.md), but the bill payment needs more of its answer:
+
+```json
+{"respStatus":"OK","accountNumber":"1466154","accountStatus":"W","customerType":"S",
+ "type":"BillPayment","serviceDetails":[{"unlisted":"N","prepaidIndicator":"N"}],
+ "accountOwnerInfo":{"name":"…"}}
+```
+
+Note the fields are at the top level, not under `resp`.
+
+| Field | Use |
+|---|---|
+| `accountNumber` | the billing account the cart is made out to |
+| `type` | `BillPayment`, or `writeOffPayments` for a written-off account — sent as `billType` |
+| `prepaidIndicator` | `"Y"` is refused ("Prepaid number is not allowed.") |
+
+The page also accepts the account number itself in place of a service number (then
+`serviceNumber` is sent empty); Thijooree only pays by phone number.
+
+---
+
+## 3. Cart
+
+`sub=cart&act=easyPay`, nonce from `GET /services/easy-pay`.
+
+```json
+{"formId":1,"serviceNumber":"7XXXXXX","accountNumber":"1466154","amount":"1.05",
+ "memberId":"","memberName":"","memberNId":"","billRef":"","billType":"BillPayment"}
+```
+```json
+{"cartId":"8fc33fa4-…","formId":1,"cartJson":[{"accountNumber":"1466154","serviceNumber":"7XXXXXX",
+ "amount":1.05,"billRef":"","billType":"BillPayment"}],"cartAmount":1.05,"cartExpiry":"…(20 min)…",
+ "paymentUrl":"https://www.dhiraagu.com.mv/services/payment-v2?cartid=8fc33fa4-…", …}
+```
+
+| Rule | Value |
+|---|---|
+| Amount | any positive amount, up to 2 decimal places (the page's only check). No min / max. |
+| GST | none |
+
+---
+
+## 4. Payment page
+
+Same as [Reload §3–5](02-reload.md#3-payment-gateway) with `formId: 1`:
+
+- `merchant&act=form` lists DhiraaguPay (3), Bank of Maldives (1) and MIB (2) for "Easy Pay".
+  The BML `merchantId` is the same as reload's.
+- `payment&act=create` returns an `oid` starting `EP` (reload's start `ET`).
+- `bml&act=createV2` returns the transaction with `"customerReference":"WebApp - Easy Pay"` and
+  the same `redirectUrl`. Its page is card-only, no BML Pay.
+
+---
+
+## Bill record
+
+`sub=bill&act=list`, `{"paymentId"}`, nonce from the receipt page — what the receipt shows:
+
+```json
+[{"oid":"EP20260006911918","transId":"<BML txn id>","accountNumber":"1466154","serviceNumber":"7XXXXXX",
+  "amount":1.05,"billStatus":1,"paidStatus":1,"cbsStatus":1,"cbsReceipt":"EP…-130","billType":"BillPayment", …}]
+```
+
+Not used by Thijooree yet.
+
+---
+
+&nbsp;
+
+---
+
+**Related:** [Number Lookup](01-number-lookup.md) · [Reload](02-reload.md) ·
+[BML Merchant Card Payment](../bmlapi/16-card-payment.md) ·
+App side: [Transfer Flows](../thijooree/20-transfer-flows.md#carrier-services-by-bml-card)
+
+[← Reload](02-reload.md)

docs/dhiraaguapi/README.md

@@ -97,6 +97,7 @@ The API only returns a valid result for numbers currently on the Dhiraagu networ
 |---|---|---|
 | 1 | [Number Lookup](01-number-lookup.md) | Validate a Dhiraagu number and determine account type |
 | 2 | [Reload](02-reload.md) | Easy TopUp order → BML merchant transaction, paid by card |
+| 3 | [Bill Pay](03-bill-pay.md) | Easy Pay order → BML merchant transaction, paid by card |
 
 ---