{
 "categories": [
  "payments",
  "fintech"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-14",
   "fact": "homepage",
   "note": "The public Swish site returned HTTP 200. Machine contract for this pass is the Merchant Integration Guide, not the JavaScript shell.",
   "source": "https://www.swish.nu/",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "vendor",
   "note": "The integration guide documents Swish Commerce as the merchant API product operated with bank enrolment and Getswish certificate management.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.api.exists",
   "note": "Guide 2.5 documents REST payment request, refund, and payout resources under /swish-cpcapi/api/v1/.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.api.kinds[0]",
   "note": "Endpoints are HTTP JSON resources such as POST /api/v1/paymentrequests on cpc.getswish.net.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.api.auth[0]",
   "note": "Security is PKI TLS client/server certificates. The merchant installs a TLS-certificate as the API client certificate.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.api.auth[1]",
   "note": "Payouts require a SHA-512 hash of the JSON payload signed with the private key of a separate signing-certificate.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.extensibility.webhooks",
   "note": "Merchants must receive Swish callback HTTPS POST requests on port 443. callbackUrl is part of payment, refund, and payout create requests.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened https://www.swish.nu/llms.txt. The response was HTTP 200 text/html (SPA fallback), not an agent catalog, so llms_txt is false.",
   "source": "https://www.swish.nu/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "verdict.scores.api",
   "note": "Documented REST plus callbacks support an api score of 6. Bank enrolment and mutual TLS keep it below 7.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "freshness.watch[0].url",
   "note": "Opened Merchant Integration Guide 2.5 and confirmed hosts, TLS client certs, payout signing, and callbacks.",
   "source": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "freshness.watch[1].url",
   "note": "Opened the Commerce API getting-started URL (HTTP 200). The page is a JavaScript app; the PDF remains the readable contract.",
   "source": "https://developer.swish.nu/documentation/getting-started/swish-commerce-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-14",
   "fact": "freshness.watch[2].url",
   "note": "Opened the public Swish homepage (HTTP 200).",
   "source": "https://www.swish.nu/",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-14",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf"
   },
   {
    "type": "docs",
    "url": "https://developer.swish.nu/documentation/getting-started/swish-commerce-api"
   },
   {
    "type": "docs",
    "url": "https://www.swish.nu/"
   }
  ]
 },
 "homepage": "https://www.swish.nu/",
 "id": "swish",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": false
  },
  "api": {
   "auth": [
    "client-tls",
    "sha512-payload-signature"
   ],
   "coverage": "partial",
   "docs": "https://assets.ctfassets.net/zrqoyh8r449h/68UD4zzhqCEVffNDD7G2ko/e53ac6bae9d3608858fd98d58732f336/Merchant_Integration_Guide_2.5.pdf",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Merchant automation opened here is the Swish Commerce REST API with mutual TLS and HTTPS callbacks, not the consumer Swish app.\n",
   "ui_stack": [
    "web-dom",
    "mobile-app"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Swish",
 "platforms": [
  "web",
  "ios",
  "android"
 ],
 "related": {
  "alternatives": [
   "vipps-mobilepay"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Getswish AB",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 6,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 6,
   "rpa": null
  },
  "summary": "Swish is automatable today for Swedish merchants through the Swish Commerce REST API. This record is Getswish payment requests, refunds, and payouts, not Swedish BankID and not Vipps MobilePay. Merchant Integration Guide 2.5 documents hosts under https://cpc.getswish.net/swish-cpcapi/api/v1/ for paymentrequests, refunds, and payouts. Access uses PKI TLS client certificates issued from portal.swish.nu after bank enrolment; certificates are valid for two years and TLS 1.2 or higher is required. Payouts add a SHA-512 payload hash signed with a separate signing-certificate. Status callbacks are HTTPS POST to the merchant on port 443. The public site and developer portal are JavaScript applications; this pass used the opened PDF contract. First-party MCP and official SDKs were not established. Computer-use viability is unassessed. API scores 6 because the write path is real but bank-issued and certificate-gated.\n"
 }
}