# CardSwitch API - Take-Home

## Your Task

This API contains a number of intentional bugs.

**Deliverable:** Write automated tests that document the bugs you find — each test should describe the issue, demonstrate it, and assert the correct behaviour.

**Submission:** Send us your bug report and a link to your repo (or a zip of your work). Your repo should be **private** — please add [`eneakllomollari`](https://github.com/eneakllomollari) as a collaborator.

---

> Virtual card management and merchant switching — simple, session-based REST API.

## Quick Start

```bash
# 1. Create a session
curl -X POST http://localhost:8000/sessions

# 2. List available merchants (use the session_id from above)
curl http://localhost:8000/merchants \
  -H "X-Session-Id: <session_id>"

# 3. Add a card to the session
curl -X POST http://localhost:8000/cards \
  -H "X-Session-Id: <session_id>" \
  -H "Content-Type: application/json" \
  -d '{"card_number": "4242424242424242", "holder_name": "Jane Doe", "expiry_month": "12", "expiry_year": "2030"}'

# 4. Switch the card to a merchant
curl -X POST http://localhost:8000/switches \
  -H "X-Session-Id: <session_id>" \
  -H "Content-Type: application/json" \
  -d '{"card_id": <card_id>, "merchant_id": <merchant_id>}'
```

## Authentication

All endpoints (except `POST /sessions`) require an `X-Session-Id` header containing
the session ID returned when you created your session.

```
X-Session-Id: <your-session-id>
```

Full API documentation is available at [/docs](/docs).