PayPal经常性付款滥用

Question

我已使用 PayPal REST api 在我的网站中实现订阅（定期付款）。我必须设置一个通知网址，以便通过 PayPal 订阅计划通知付款（例如月度计划）。 PayPal 将其称为即时付款通知。

我的问题是，开发人员可以滥用该调用来模拟来自 PayPal 的调用吗？因为开发人员知道通知 url 和传递给该方法的参数。开发者只需要知道 recurring_payment_id。

如果它可能被滥用，那么我应该采取哪些步骤来防止它。请指导我。

Answer 1

Instant Payment Notifications 不适用于 Rest API，但是，Rest API 有自己的发回通知。

为了使用 Notifications for Rest API，开发人员需要创建 Webhook。
WebHooks and Notifications with PayPal Rest API

使用结算协议配置文件 ID，开发者可以取消协议或暂停协议。开发人员无法从 PayPal 获取信用卡数据。

以下是 PayPal 开发者网站上有关定期付款和账单协议创建的一些信息：

即使有人能够从服务器获得响应，也只是计费协议的状态。不返回账户持有人信息。

这是来自 PayPal 开发者网站的示例响应： Retrieve an Agreement Rest API

{
"id": "I-0LN988D3JACS",
"state": "Pending",
"description": "New Description",
"plan": {
"payment_definitions": [
  {
    "type": "REGULAR",
    "frequency": "Month",
    "amount": {
      "currency": "USD",
      "value": "100.00"
    },
    "charge_models": [
      {
        "type": "TAX",
        "amount": {
          "currency": "USD",
          "value": "12.00"
        }
      },
      {
        "type": "SHIPPING",
        "amount": {
          "currency": "USD",
          "value": "10.00"
        }
      }
    ],
    "cycles": "12",
    "frequency_interval": "2"
  }
],
"merchant_preferences": {
  "setup_fee": {
    "currency": "USD",
    "value": "0.00"
  },
  "max_fail_attempts": "0",
  "auto_bill_amount": "YES"
 }
},
"links": [
{
  "href": "https://api.sandbox.paypal.com/v1/payments/billing-agreements   /I-0LN988D3JACS/suspend",
  "rel": "suspend",
  "method": "POST"
},
{
  "href": "https://api.sandbox.paypal.com/v1/payments/billing-agreements/I-0LN988D3JACS/re-activate",
  "rel": "re_activate",
  "method": "POST"
},
{
  "href": "https://api.sandbox.paypal.com/v1/payments/billing-agreements/I-0LN988D3JACS/cancel",
  "rel": "cancel",
  "method": "POST"
},
{
  "href": "https://api.sandbox.paypal.com/v1/payments/billing-agreements/I-0LN988D3JACS/bill-balance",
  "rel": "self",
  "method": "POST"
},
{
  "href": "https://api.sandbox.paypal.com/v1/payments/billing-agreements/I-0LN988D3JACS/set-balance",
  "rel": "self",
  "method": "POST"
}
],
"start_date": "2015-02-19T08:00:00Z",
"agreement_details": {
"outstanding_balance": {
  "currency": "USD",
  "value": "0.00"
},
"cycles_remaining": "12",
"cycles_completed": "0",
"final_payment_date": "2016-12-19T10:00:00Z",
"failed_payment_count": "0"
}
}