# Deactivate 27 of the 40 YSP card endpoints (13 stay active)

## Summary

We were told that only 13 of the 40 YSP card APIs are in scope: Create Card, Update Customer Details, Get Card Details, Block/Unblock, Card Activation, Card Replacement, Query Balance, Get X Transactions, Debit/Credit, Fund Transfer, Card Order, Card Order Status and Status Request.

This PR switches the other 27 off instead of deleting them. A switched-off endpoint answers with a clear 404 and nothing is sent to YSP. The code and tests for the 27 stay in the repo, so one can be switched back on by changing one list. The tag `ysp-simulator-all-40-endpoints` marks the code as it was before.

Base branch: `task/ysp-card-postman-flow` (not `main`), so this diff shows only this change.

## What a caller sees

Calling a switched-off endpoint, through the middle layer or on the simulator directly:

```json
{"error": "endpoint_not_enabled", "message": "load is not enabled in Bank Bridge."}
```

HTTP 404. The middle layer refuses it before validating or sending anything. The simulator refuses it before checking headers and does not use up the `txnRefNo`. The 404 is deliberately not a YSP response code, so it cannot be mistaken for a real YSP answer. An unknown name is still `unknown_endpoint`.

## What changed

**Simulator (`ysp-simulator/`)**
- `ActiveEndpoints` holds the 13 names. `CardApi.run/4` checks it first.
- One setting, `gate_endpoints`: on in `config.exs`, off in the test environment so the existing tests are unchanged.
- `demo.sh` now uses only the 13 endpoints (all 10 steps pass).
- README: separate tables for active and inactive endpoints, with descriptions for the 13. `docs/endpoints.md` and `docs/behaviour/` updated.

**Middle layer**
- `YspCard.Endpoints`: `all/0` and `names/0` are the 13; new `inactive/0` and `inactive?/1` for the 27. `fetch/1` still finds all 40.
- `YspCardController`: balance, load, block and the generic proxy refuse switched-off endpoints. The `/load` route stays and answers the 404.
- Postman collection and README tables regenerated for the 13 (21 requests). The requests that depended on Load Card were reworked: the status request and transaction list now use a small credit through debit/credit.

## Switching an endpoint back on

- Simulator: add its name to `ysp-simulator/lib/ysp_simulator/active_endpoints.ex`.
- Middle layer: remove its name from `@inactive` in `lib/da_product_app/ysp_card/endpoints.ex`.

## Testing

- Simulator: `mix test` passes (375 tests, including 5 new gate tests).
- Middle layer: the 237 YSP tests pass, 103 of them integration tests. The integration tests call all 40 endpoints, so they need your own simulator with the gate off; the commands are in `test/da_product_app/ysp_card_integration_test.exs`. Against a normally started simulator, 64 of the 103 fail with the 404, as expected.
- End to end: a private simulator (gate on) and the middle layer on dev port 4006, running the regenerated Postman collection with Newman: 21 requests, 26 assertions, 0 failures. `/api/card/load` and `/api/card/getlimit` returned the 404 and the simulator's log showed that neither reached it.

## For the reviewer

- **Merge conflicts with `task/ysp-card-failure-controls`** are likely in `ysp-simulator/lib/ysp_simulator/card_api.ex`, `lib/da_product_app/ysp_card/endpoints.ex`, the controller and proxy tests, the integration test, `ysp-simulator/docs/behaviour/general-and-cards.md` and the root `README.md`. That branch also lists `accountfunding` (load) as a `fail_next` target; with the gate on, a request to it is refused before the failure is applied. Its simulator Postman collection will need regenerating.
- **The Postman `simUrl` variable still defaults to the shared simulator**, and request 0 resets the simulator it points at. Change `simUrl` before running the collection against anything shared.
- Top-level request names in the collection keep their numbers (0, 1 and 4-7), because a script on `failure-controls` matches `0. Reset` and `7. Missing field`.

## Not in this PR

- Storing request and response bodies (a requirement raised separately). The DB call log already exists on `task/create-db-logs`; it is not merged.
- Authentication on `/api/card/*`, and masking PINs and card numbers in logs. Both are known and must be fixed before this points at real YSP.
- Simplifying the router and removing the dead code for the 27. They are still in use if an endpoint is switched back on.

## Commits

1. Simulator: add ActiveEndpoints (13 of 40, not wired in yet)
2. Simulator: return 404 for endpoints that are not active
3. Simulator docs: active and inactive endpoints
4. Simulator demo.sh: only the 13 active endpoints
5. YspCard.Endpoints: 13 active, 27 inactive
6. YspCardController: 404 for inactive endpoints
7. Integration tests: say to start a private simulator with the gate off
8. Postman collection and README: 13 active endpoints
9. Simulator docs: endpoints.md notes the 13 active endpoints
10. Simulator README: separate tables for active and inactive endpoints
11. Simulator README: describe the 13 active endpoints

🤖 Generated with [Claude Code](https://claude.com/claude-code)