# Monetarie PIX -- Complete System Mapping

**Version:** 1.0 | **Date:** 2026-02-07 | **Status:** Production (Dev Environment)

---

## 1. System Overview

Monetarie PIX is a **Brazilian instant payment (PIX) processing platform** built for licensed Payment Institutions (IPs) and Financial Institutions (IFs) participating in the Brazilian Central Bank's PIX ecosystem. It provides full DICT (key directory), SPI (instant payments), and settlement services.

**Target Performance:** 5,000 TPS sustained / 7,500 TPS burst

| Attribute | Value |
|-----------|-------|
| ISPB | 123456 |
| Institution | MONETARIE INSTITUICAO DE PAGAMENTO E SERVICOS LTDA |
| BACEN Environment | Homologation (ICOM-H) |
| Region | GCP `southamerica-east1` (Sao Paulo) |
| GKE Cluster | `fluxiq-dev` |
| Kubernetes Namespace | `pix` |

---

## 2. Infrastructure Topology

### 2.1 GKE Cluster Architecture

```
                          ┌─────────────────────────────────────────────────────────┐
                          │              INTERNET                                    │
                          └───────────────────────┬─────────────────────────────────┘
                                                  │
                                    ┌─────────────▼─────────────┐
                                    │   Let's Encrypt Wildcard   │
                                    │   *.dev.fluxiq.com.br      │
                                    └─────────────┬─────────────┘
                                                  │
                          ┌───────────────────────▼───────────────────────┐
                          │            Traefik Ingress Controller          │
                          │         (TLS termination, routing)            │
                          └────────┬────────────────────────┬─────────────┘
                                   │                        │
                    ┌──────────────▼──────────┐  ┌─────────▼──────────────┐
                    │  pixadmin-dev.fluxiq.com │  │  pixapi-dev.fluxiq.com  │
                    │     Ingress (HTTPS)      │  │     Ingress (HTTPS)     │
                    └──────────┬───────────────┘  └─────────┬──────────────┘
                               │                            │
              ┌────────────────▼────────────┐  ┌────────────▼─────────────────┐
              │    pix-frontend Service      │  │   pix-backend Service        │
              │    ClusterIP :80             │  │   ClusterIP :4001/4002/4003  │
              └────────────┬────────────────┘  └────────────┬─────────────────┘
                           │                                │
         ┌─────────────────▼─────────────┐   ┌─────────────▼──────────────────────┐
         │  pix-frontend Deployment      │   │  pix-backend Deployment             │
         │  ┌──────────────────────┐     │   │  ┌──────────────┐ ┌──────────────┐  │
         │  │  nginx:alpine        │ x2  │   │  │  Elixir App  │ │ Cloud SQL    │  │
         │  │  - Vue 3 SPA         │     │   │  │  :4001 DICT  │ │ Proxy 2.8.2  │  │
         │  │  - /api → backend    │     │   │  │  :4002 SPI   │ │ :5432→PG     │  │
         │  │  - port 80           │     │   │  │  :4003 SETTL │ │              │  │
         │  └──────────────────────┘     │   │  └──────────────┘ └──────────────┘  │
         │  Replicas: 2                  │   │  Replicas: 2 (HPA: 2-10, CPU 70%)  │
         │  CPU: 50m-200m               │   │  CPU: 250m-1000m                    │
         │  Memory: 64Mi-128Mi          │   │  Memory: 256Mi-1Gi                  │
         └───────────────────────────────┘   └─────────────────────────────────────┘
                                                         │
                               ┌─────────────────────────┼──────────────────────┐
                               │                         │                      │
              ┌────────────────▼──────┐  ┌───────────────▼───────┐  ┌──────────▼─────────┐
              │  Cloud SQL (PG 16)    │  │  NATS 2.10 JetStream  │  │  Redis 7            │
              │  fluxiq-pg-dev        │  │  3-node cluster        │  │  GCP Memorystore    │
              │  southamerica-east1   │  │  10.10.40.5/7/4       │  │                     │
              │  Auto IAM AuthN       │  │  (currently disabled)  │  │                     │
              └───────────────────────┘  └───────────────────────┘  └─────────────────────┘
```

### 2.2 Network Topology

| Component | Address | Port(s) | Protocol |
|-----------|---------|---------|----------|
| Frontend (external) | pixadmin-dev.fluxiq.com.br | 443 | HTTPS |
| API (external) | pixapi-dev.fluxiq.com.br | 443 | HTTPS |
| Dict Service (internal) | pix-backend.pix.svc.cluster.local | 4001 | HTTP |
| SPI Service (internal) | pix-backend.pix.svc.cluster.local | 4002 | HTTP |
| Settlement Service (internal) | pix-backend.pix.svc.cluster.local | 4003 | HTTP |
| PostgreSQL (via proxy) | 127.0.0.1 (sidecar) | 5432 | PostgreSQL |
| NATS JetStream | 10.10.40.5 | 4222 | NATS |
| Redis | GCP Memorystore | 6379 | Redis |

### 2.3 CI/CD Pipeline

```
Developer → git push → gcloud builds submit → Cloud Build
                                                  │
                                    ┌─────────────┼─────────────┐
                                    │ Step 0: Docker Build       │
                                    │ Step 1: Push :latest       │
                                    │ Step 2: Push :SHORT_SHA    │
                                    │ Step 3: kubectl set image  │
                                    │         via Connect Gateway│
                                    └────────────────────────────┘
                                                  │
                                    ┌─────────────▼─────────────┐
                                    │  GKE Rolling Update        │
                                    │  (zero-downtime)           │
                                    └────────────────────────────┘
```

---

## 3. Backend Architecture

### 3.1 Elixir Umbrella Apps

The backend is an **Elixir 1.17 / Phoenix 1.8.3 umbrella application** running as a single OTP release (`monetarie_pix`) with 4 apps:

| App | Port | Role | Key Dependencies |
|-----|------|------|------------------|
| **shared** | -- | Library: DB schemas, BACEN clients, auth, crypto, audit, validation, simulator | ecto_sql, postgrex, gnat, redix, finch, jose |
| **dict_service** | 4001 | PIX Key Directory (DICT API v2.10.0) | shared, phoenix, bcrypt_elixir |
| **spi_service** | 4002 | Instant Payments (SPI) | shared, phoenix, sweet_xml, xml_builder, pdf_generator |
| **settlement_service** | 4003 | API Gateway + Settlement + Netting | shared, phoenix, joken, eqrcode, req |

### 3.2 Request Flow

```
Browser → nginx (/api) → Settlement Service (:4003) → [Auth Pipeline]
                              │
                ┌─────────────┼─────────────────────┐
                │             │                     │
           Auth routes    Proxy to Dict        Proxy to SPI
           Settlement     (:4001 internal)     (:4002 internal)
           Netting
           Fees
           QR Codes
```

The **Settlement Service (port 4003)** acts as the **API Gateway**:
- All frontend API calls hit `:4003`
- Auth (login/logout/me) is handled directly
- DICT operations are proxied to Dict Service (:4001)
- SPI operations are proxied to SPI Service (:4002)
- Settlement, netting, fees, QR codes handled directly

### 3.3 Supervision Trees

```
[Shared.Application]
├── Shared.PostgrexSupervisor
├── Shared.Repo
├── {Finch, name: Shared.Finch}
├── Shared.Telemetry
├── Shared.Redis.Connection               ← Redis connection via Redix
├── Shared.Crypto.CertificatePool          ← In-memory cert pool (5-min refresh)
├── Shared.Bacen.ChannelRouter             ← CPM/CSM dual-channel health tracking
├── Shared.Bacen.ErrorLookup              ← ETS-cached error codes (10-min refresh)
└── [if NATS_ENABLED=true]
    └── Shared.Nats.Supervisor
        ├── Gnat.ConnectionSupervisor
        └── Shared.Nats.JetStream

[DictService.Application]
├── DictService.Repo
├── DictServiceWeb.Telemetry
├── {Phoenix.PubSub}
├── DictServiceWeb.Endpoint (:4001)
├── DictService.Sync.CidSyncService       ← 6h full sync + 5-min event polling
└── [if NATS_ENABLED=true]
    └── DictService.Events.NatsPublisher   ← 25+ event types

[SpiService.Application]
├── SpiService.Repo
├── SpiServiceWeb.Telemetry
├── {Phoenix.PubSub}
├── {Finch}
├── SpiServiceWeb.Endpoint (:4002)
└── [if NATS_ENABLED=true]
    ├── SpiService.Nats.Connection
    ├── SpiService.Nats.EventPublisher
    └── SpiService.Workers.Supervisor
        ├── InboundProcessor              ← BACEN inbound messages
        ├── OutboundSender                ← Send to BACEN with XMLDSig
        ├── ReturnProcessor               ← pacs.004 return flow
        └── StatusUpdater                 ← Transaction status events

[SettlementService.Application]
├── SettlementService.Repo
├── SettlementServiceWeb.Telemetry
├── {Phoenix.PubSub}
├── SettlementServiceWeb.Endpoint (:4003)
└── [if NATS_ENABLED=true]
    ├── SettlementService.NATS.Connection
    └── SettlementService.Workers.Supervisor
        ├── Scheduler                     ← Settlement window triggers
        └── FileImporter                  ← BACEN file imports (camt.052/053/054)
```

### 3.4 API Routes Summary

| Service | Port | Route Count | Key Endpoints |
|---------|------|-------------|---------------|
| Dict Service | 4001 | ~80+ | /api/v1/keys, /api/v2/entries, /api/v2/claims, /api/v2/funds-recoveries, /api/v2/cids |
| SPI Service | 4002 | ~100+ | /api/v1/transactions, /api/v1/payments, /api/v1/returns, /api/v1/balance, /api/v1/alcada |
| Settlement | 4003 | ~150+ | /api/v1/auth, /api/v1/netting, /api/v1/reconciliation, /api/v1/fees, /api/v1/qrcodes |

**Total API endpoints: ~330+**

### 3.5 BACEN Integration Modules

| Module | Purpose |
|--------|---------|
| `Shared.Bacen.Client` | HTTP client with mTLS for SPI/DICT APIs |
| `Shared.Bacen.ChannelRouter` | CPM (financial) / CSM (non-financial) dual-channel routing |
| `Shared.Bacen.Iso20022.MessageBuilder` | Builds all 27 ISO 20022 message types with BAH envelope |
| `Shared.Bacen.Iso20022.MessageParser` | Parses inbound XML, detects message type, extracts fields |
| `Shared.Bacen.ErrorLookup` | ETS-cached BACEN error code lookup (161 codes) |
| `Shared.Bacen.ProblemDetails` | RFC 7807 error responses |
| `Shared.Crypto.XmlSigner` | XMLDSig RSA-SHA256 (3 refs for SPI, 2 for DICT) |
| `Shared.Crypto.CertificatePool` | In-memory ICP-Brasil certificate pool |
| `Shared.Validation.XsdValidator` | Dual strategy XSD validation (structural + xmllint) |
| `Shared.Audit.BacenLogger` | Async audit logging (10yr ICOM, 2yr DICT reads) |
| `Shared.Audit.XmlArchiver` | XML archival with SHA-256 integrity hash |

### 3.6 BACEN Simulator

The simulator (`Shared.Bacen.Simulator`) is a GenServer that intercepts outbound BACEN calls and returns simulated responses. Enabled via `SIMULATOR_ENABLED=true`.

**8 built-in test scenarios:**
1. `happy_path` -- Full payment cycle (pacs.008 → pacs.002 ACCC)
2. `rejected_payment` -- Payment rejection (pacs.008 → pacs.002 RJCT)
3. `return_flow` -- Return after payment (pacs.004 → pacs.002)
4. `incoming_payment` -- Inbound payment from another PSP
5. `echo_test` -- pibr.001 echo request/response
6. `balance_check` -- camt.060 balance query
7. `full_cycle` -- Complete payment + return + settlement
8. `stress_test` -- High-volume concurrent transactions

---

## 4. Database Architecture

### 4.1 PostgreSQL Schema Prefixes

| Schema Prefix | Purpose | Table Count |
|---------------|---------|-------------|
| `monetarie_auth` | Users, groups, institutions, audit logs, sessions | ~8 |
| `monetarie_dict` | PIX keys, claims, MED 2.0 funds recovery, tracking | ~10 |
| `monetarie_spi` | Transactions, payments, balances, statements, alcada | ~15 |
| `monetarie_spi_ref` | Reference data (banks, error codes, domain values, XSD) | ~5 |
| `monetarie_spi_msg` | Crypto keys, private keys, XML messages | ~3 |
| `monetarie_audit` | XML audit logs, BACEN API validations | ~2 |
| `monetarie_settlement` | Netting, reconciliation, fees, QR codes, sessions | ~10 |
| `bacen_simulator` | Simulator config, scenarios, test runs, exchanges | ~10 |
| `public` | Legacy/alternate schemas | ~4 |

**Total: ~67 tables across 9 schema prefixes**

### 4.2 Key Tables

#### Auth (`monetarie_auth`)
| Table | PK Type | Purpose |
|-------|---------|---------|
| `users` | BIGINT | System users with bcrypt password hashing |
| `groups` | UUID | Access control groups (ADMINISTRATORS, OPERATORS, etc.) |
| `institutions` | UUID | Financial institutions (Monetarie, CAIXA, BB, etc.) |
| `user_groups` | UUID | M:N user-group relationships |
| `group_institutions` | UUID | M:N group-institution relationships |
| `activity_log` | BIGINT | Partitioned by month, user activity audit trail |
| `login_history` | BIGINT | Partitioned by month, login attempt history |

#### DICT (`monetarie_dict`)
| Table | PK Type | Purpose |
|-------|---------|---------|
| `keys` | AUTO | PIX keys (CPF/CNPJ/PHONE/EMAIL/EVP) |
| `claims` | AUTO | Key portability/ownership claims |
| `funds_recoveries` | UUID | MED 2.0 fraud recovery workflow |
| `infraction_reports` | UUID | Infraction reports between PSPs |
| `refund_requests` | UUID | Refund requests for disputed transactions |
| `tracking_graphs` | UUID | Fraud tracking graph analysis |

#### SPI (`monetarie_spi`)
| Table | PK Type | Purpose |
|-------|---------|---------|
| `messages` | AUTO | All ISO 20022 messages (pacs.008, pacs.002, etc.) |
| `payments` | Composite | Payment details (amount, debtor/creditor, initiation form) |
| `message_history` | Composite | Message status change history |
| `balance_cache` | ISPB | Real-time balance positions per participant |
| `statements` | UUID | Balance statements (intraday/end-of-day) |
| `bacen_inbound` | Composite | Inbound XML from BACEN |
| `bacen_outbound` | Composite | Outbound XML to BACEN |
| `endtoend_id_registry` | E2E ID | End-to-end ID uniqueness registry |
| `alcada_parameters` | AUTO | Authorization tier parameters |
| `alcada_registrations` | AUTO | Operations requiring authorization |
| `alcada_vistos` | AUTO | Authorization approvals/rejections |

#### Settlement (`monetarie_settlement`)
| Table | PK Type | Purpose |
|-------|---------|---------|
| `netting_cycles` | AUTO | Settlement windows (intraday/daily/monthly) |
| `netting_operations` | AUTO | Netting calculation results |
| `netting_positions` | AUTO | Net positions per participant |
| `fee_entries` | AUTO | Transaction fee calculations |
| `fee_tables` | AUTO | Fee schedule definitions |
| `fee_rules` | AUTO | Fee calculation rules (fixed/percentage/tiered) |

### 4.3 Database Migrations

16 migration files from `20260201000001` through `20260206200003`:

| Migration | Purpose |
|-----------|---------|
| `20260201000001` | Complete base schema (all tables) |
| `20260203000001` | Gap resolution tables (13 additional) |
| `20260203000002` | Reference data seeding (banks, status codes) |
| `20260203100001` | PostgreSQL extensions and ENUMs |
| `20260203100002` | Auth tables (users, groups, institutions, activity_log, login_history) |
| `20260203100003` | Missing DICT tables |
| `20260203100004` | Missing SPI tables |
| `20260203100005` | Missing settlement tables |
| `20260203100006` | New schema tables |
| `20260203100007` | DB functions, triggers, views |
| `20260203100008` | BACEN simulator tables |
| `20260203100009` | Remaining seed SQL (users_entities, pix_keys, dict_operations) |
| `20260206000001` | Auth institutions and groups |
| `20260206200001` | Compliance tables (crypto keys, validations, XSD, error codes) |
| `20260206200002` | Domain values table |
| `20260206200003` | Alcada tables (parameters, registrations, vistos) |

### 4.4 Seed Data Summary

| Category | Count | Source |
|----------|-------|--------|
| Participants | 10 | seeds.exs |
| Users | 7 | Direct SQL |
| Institutions | 10 | users_entities_seed.sql |
| Groups | 8 | users_entities_seed.sql |
| Reference banks | 369+ | gap_resolution_seed.sql |
| PIX keys | 277 | pix_keys_seed.sql |
| DICT operations | 15,442 | dict_operations_seed.sql |
| XSD schemas | 27 | xsd_schemas_seed.exs |
| Error codes | 161 | bacen_error_codes_seed.exs |
| Domain values | 175+ | bacen_domain_values_seed.exs |
| Transactions (30d) | 1,000+ | realistic_transactions_seed.exs |
| Simulator config | 130+ | simulator_seed.exs |

---

## 5. Messaging Architecture (NATS JetStream)

### 5.1 Streams

| Stream | Subjects | Retention | Max Age | Purpose |
|--------|----------|-----------|---------|---------|
| `MONETARIE_SPI` | `monetarie.spi.>` | limits | 7 days | SPI transaction events |
| `MONETARIE_DICT` | `monetarie.dict.>` | limits | 7 days | DICT key/claim events |
| `MONETARIE_SETTLEMENT` | `monetarie.settlement.>` | limits | 7 days | Settlement events |
| `MONETARIE_AUDIT` | `monetarie.audit.>` | limits | 90 days | Audit trail events |
| `MONETARIE_DLQ` | `monetarie.dlq.>` | limits | 90 days | Dead letter queue |

### 5.2 Consumers (Pull-based Workers)

| Consumer | Stream | Filter | Poll | Batch | Purpose |
|----------|--------|--------|------|-------|---------|
| `inbound-processor` | MONETARIE_SPI | `monetarie.spi.inbound.>` | 500ms | 20 | Process inbound BACEN messages |
| `outbound-sender` | MONETARIE_SPI | `monetarie.spi.outbound.>` | 500ms | 10 | Send outbound to BACEN |
| `return-processor` | MONETARIE_SPI | `monetarie.spi.return.>` | 1000ms | 10 | Process pacs.004 returns |
| `status-updater` | MONETARIE_SPI | `monetarie.spi.transaction.>` | 1000ms | 20 | Update transaction status |
| `settlement-scheduler` | MONETARIE_SETTLEMENT | `monetarie.settlement.schedule.>` | 5000ms | 5 | Settlement window management |
| `file-importer` | MONETARIE_SETTLEMENT | `monetarie.settlement.file.>` | 10000ms | 5 | Import BACEN files |

### 5.3 Event Subjects

| Subject Pattern | Publisher | Purpose |
|----------------|-----------|---------|
| `monetarie.spi.inbound.*` | BACEN webhook | Inbound messages |
| `monetarie.spi.outbound.*` | ReturnProcessor | Outbound queue |
| `monetarie.spi.transaction.*` | Various | Status events |
| `monetarie.dict.keys.*` | NatsPublisher | Key CRUD events |
| `monetarie.dict.claims.*` | NatsPublisher | Claim lifecycle |
| `monetarie.dict.infractions.*` | NatsPublisher | Infraction events |
| `monetarie.dict.recovery.*` | NatsPublisher | Funds recovery |
| `monetarie.audit.*` | All services | Audit trail |
| `monetarie.dlq.*` | BaseWorker | Dead letter queue |

**Note:** NATS is currently **disabled** in the dev environment (`NATS_ENABLED=false`). Workers start conditionally.

---

## 6. Frontend Architecture

### 6.1 Technology Stack

| Component | Version |
|-----------|---------|
| Vue.js | 3.5.24 |
| Vue Router | 4.6.4 |
| Pinia | 3.0.4 |
| Axios | 1.13.4 |
| Vite | 7.3.1 |
| Tailwind CSS | 4.1.18 |
| TypeScript | 5.9.3 |
| vue-i18n | 11.2.8 |
| lucide-vue-next | 0.563.0 |

### 6.2 Route Summary (72 routes)

| Section | Routes | Views |
|---------|--------|-------|
| Dashboard | 1 | 1 |
| Participants | 8 (1 + 7 children) | 8 |
| Operations (legacy) | 7 | 7 |
| Balance | 8 | 8 |
| Alcada | 3 | 3 |
| Accounting | 10 | 10 |
| Simulator | 3 | 3 |
| DICT | 4 | 4 |
| Monitors | 3 | 3 |
| Tools | 1 | 1 |
| Reports | 10 | 10 |
| Security | 6 | 6 |
| System | 3 | 3 |
| Auth | 1 | 1 |
| **Total** | **72** | **70** |

### 6.3 Pinia Stores (14)

`auth`, `balance`, `participants`, `reports`, `security`, `settings`, `systemHealth`, `ui`, `simulator`, `alcada`, `accounting`, `institution`, `monitors`, `dict`

### 6.4 API Services (17)

12 real API services + 4 mock services (institution, monitors, dict, notifications) + 1 client-side (xml)

### 6.5 i18n (4 locales)

Portuguese (pt-BR), English (en-US), Spanish (es-ES), Chinese Simplified (zh-CN)

---

## 7. Failure Analysis and Resilience

### 7.1 Single Points of Failure

| Component | Impact if Down | Mitigation |
|-----------|---------------|------------|
| **PostgreSQL** | ALL services down | Cloud SQL HA, automated backups |
| **Settlement Service (:4003)** | Frontend can't reach any API | HPA (2-10 replicas), health checks |
| **Dict Service (:4001)** | No key lookups, no auth tokens | Runs in same pod, restart policy |
| **SPI Service (:4002)** | No transaction processing | Runs in same pod, restart policy |
| **Cloud SQL Proxy** | DB unreachable from pod | Sidecar restarts with pod |

### 7.2 Degraded Mode Scenarios

| Scenario | Services Affected | Behavior |
|----------|-------------------|----------|
| NATS down | Workers don't process | Workers are conditional (`NATS_ENABLED`). API still works for queries. Transactions queue up. |
| Redis down | Certificate pool fallback | `Shared.Redis.Connection` reconnects. Some caching lost. |
| BACEN unreachable | No outbound/inbound | `ChannelRouter` marks channel as `down` after 3 failures. Auto-failover to CSM. Recovery check every 2 min. |
| Certificate expired | XMLDSig fails | `CertificatePool` refreshes every 5 min. Alert on cert approaching expiry. |
| Simulator enabled but DB down | Simulator returns errors | Graceful fallback in simulator GenServer. |

### 7.3 Health Monitoring

| Endpoint | Port | Checks |
|----------|------|--------|
| `GET /health` | 4001 | Dict service alive + DB connection |
| `GET /health` | 4002 | SPI service alive |
| `GET /health` | 4003 | Settlement service alive + upstream services |
| `GET /ready` | 4001 | Dict service ready to accept traffic |
| `GET /ready` | 4002 | SPI service ready |
| `GET /health` | 80 | nginx static health response |

### 7.4 Kubernetes Probes

| Component | Liveness | Readiness |
|-----------|----------|-----------|
| Backend | GET /health:4001 (30s init, 10s period) | GET /health:4001 (5s init, 5s period) |
| Frontend | GET /health:80 (5s init, 10s period) | GET /health:80 (3s init, 5s period) |

### 7.5 Auto-Scaling

| Component | Min | Max | Metric | Target |
|-----------|-----|-----|--------|--------|
| Backend | 2 | 10 | CPU Utilization | 70% |
| Frontend | 2 | -- | Fixed | -- |

---

## 8. Security Architecture

### 8.1 Authentication Flow

```
User → Login Form → POST /api/v1/auth/login
                         │
                    Settlement Service (:4003)
                         │ (proxies to Dict Service)
                         │
                    Dict Service (:4001)
                         │
                    bcrypt verify password
                         │
                    Generate JWT token
                         │
                    Return { token, user }
                         │
                    Frontend stores in localStorage
                         │
                    All subsequent requests include
                    Authorization: Bearer {token}
                    X-Institution-ISPB: {ispb}
```

### 8.2 BACEN mTLS

- **Client Certificate:** ICP-Brasil (CPIC) for channel authentication
- **Signing Certificate:** ICP-Brasil (CPIA) for XMLDSig
- **QR Code Certificate:** ICP-Brasil (CQRC) for JWS QR code signing
- **CA Chain:** ICP-Brasil root + intermediate CAs

### 8.3 XMLDSig Specification

| Context | References | Algorithm |
|---------|-----------|-----------|
| SPI messages | 3 (KeyInfo by ID, AppHdr empty URI, Document no URI) | RSA-SHA256 |
| DICT messages | 2 (AppHdr + Document) | RSA-SHA256 |
| Canonicalization | Exclusive XML C14N | xml-exc-c14n# |

---

## 9. Environment Variables Reference

### Database
| Variable | Default | Required |
|----------|---------|----------|
| `DATABASE_URL` | -- | Prod only |
| `DB_HOST` | localhost | Dev |
| `DB_PORT` | 5432 | Dev |
| `DB_USER` | postgres | Dev |
| `DB_PASS` | postgres | Dev |
| `DB_NAME` | monetarie | Dev |
| `POOL_SIZE` | 10 | -- |

### Phoenix
| Variable | Default | Required |
|----------|---------|----------|
| `SECRET_KEY_BASE` | -- | Prod |
| `JWT_SECRET` | dev default | Yes |
| `DICT_PORT` | 4001 | -- |
| `SPI_PORT` | 4002 | -- |
| `SETTLEMENT_PORT` | 4003 | -- |
| `CORS_ORIGINS` | -- | Yes |

### BACEN
| Variable | Default | Required |
|----------|---------|----------|
| `BACEN_ENV` | homolog | -- |
| `BACEN_ENABLED` | false | -- |
| `BACEN_ISPB` | 00000000 | Yes |
| `SIMULATOR_ENABLED` | false | -- |
| `BACEN_CA_CERT_PATH` | -- | Prod |
| `BACEN_CLIENT_CERT_PATH` | -- | Prod |
| `BACEN_CLIENT_KEY_PATH` | -- | Prod |

### Infrastructure
| Variable | Default | Required |
|----------|---------|----------|
| `NATS_HOST` | localhost | -- |
| `NATS_PORT` | 4222 | -- |
| `NATS_ENABLED` | false | -- |
| `REDIS_HOST` | localhost | -- |
| `REDIS_PORT` | 6379 | -- |

---

## 10. ISO 20022 Message Types Supported

| Message | Name | Direction | Category |
|---------|------|-----------|----------|
| pacs.008 | FIToFI Customer Credit Transfer | Outbound/Inbound | Financial |
| pacs.002 | Payment Status Report | Inbound | Financial |
| pacs.004 | Payment Return | Outbound/Inbound | Financial |
| pacs.028 | Payment Status Request | Outbound | Financial |
| camt.052 | Bank to Customer Account Report (Intraday) | Inbound | Balance |
| camt.053 | Bank to Customer Statement | Inbound | Balance |
| camt.054 | Debit Credit Notification | Inbound | Balance |
| camt.060 | Account Reporting Request | Outbound | Balance |
| admi.002 | System Event Notification | Inbound | Admin |
| admi.004 | System Event Acknowledgement | Outbound | Admin |
| pibr.001 | Echo Request | Outbound | Technical |
| pibr.002 | Echo Response | Inbound | Technical |
| Plus 15 additional DICT-specific types | | | |

**Total: 27 message types**

---

*Document generated: 2026-02-07 | Monetarie PIX Platform v1.0*