What this audit checks
Authentication & access
- OAuth access token valid and auto-refreshing from refresh_token
- Granted scopes cover PAYMENTS_READ, DISPUTES_READ, PAYOUTS_READ (disputes/payouts cards empty without them)
- Environment (sandbox vs production) matches the connected merchant
Transaction health
- Blended authorisation success rate vs 92% floor
- Online (source_type = EXTERNAL) decline rate vs 8% threshold
- Top decline-reason concentration - any single failure_code >40% share
- POS card-present decline rate >2% (terminal / chip-reader fault signal)
3DS & checkout friction
- 3DS challenge abandonment rate on Square Online (EU >15%, US >10%)
- Frictionless vs challenged 3DS mix
- Magstripe-fallback share >15% (NFC / chip-reader hardware flag)
Refunds & disputes
- Refund rate vs 30-day baseline (>10% absolute, or +30% spike)
- Dispute rate vs Square’s 0.5% review threshold and Visa’s 0.9% VAMP cap
- Chargeback (LOST) rate trend over 90 days
- Open disputes approaching their evidence due_at deadline
Settlement & payouts
- Average settlement time vs T+1 baseline (>3 days)
- Oldest pending payout age (>3 days weekend/holiday-adjusted, >7 days review signal)
- Rolling-reserve hold present and its drag on settlement
Cross-channel: recoverable revenue at risk
- Square Online decline spike vs commerce_sibling checkout-completion drop in the same 15-min window (sibling = shopify/bigcommerce/adobe_commerce)
- Soft-decline value (INSUFFICIENT_FUNDS, EXPIRED_CARD, CARD_DECLINED) recoverable via dunning, sized against commerce_sibling repurchase rate
- Dispute reason = NOT_RECEIVED joined to commerce_sibling fulfilment_status in (delayed, lost)
Severity thresholds
| Signal | Warn | Critical |
|---|---|---|
decline_rate | 8 | 12 |
dispute_rate | 0.5 | 0.9 |
chargeback_rate | 0.9 | 1.5 |
refund_rate | 5 | 10 |
threedsecure_abandon_rate | 15 | 30 |
payout_age_days | 3 | 7 |
success_rate | 95 | - |
Data sources
GET https://{api_host}/v2/payments- Unified payment ledger across all channels - volume, success/decline, tender mix, decline reasonsGET https://{api_host}/v2/refunds- Refund volume + rateGET https://{api_host}/v2/disputes- Dispute + chargeback cases, states, due datesGET https://{api_host}/v2/payouts- Bank-deposit payout records - settlement timing + pending balance