Send country on every Pay-In and Pay-Out request, for every provider. Mozarto matches it against the Processing Scope configured for the provider - first at company level, then on the account your brand uses (Payments Module - your brand - the account - Processing Scope). A request whose country falls outside either scope is rejected with HTTP 400.
For scope matching, Mozarto accepts any of three forms, case-insensitively, and normalizes them internally:
Form
Example
Full country name
"Germany"
ISO 3166-1 alpha-2
"DE"
ISO 3166-1 alpha-3
"DEU"
Individual providers are stricter about what they forward to the provider API - CashLib expects alpha-3, Cleo accepts only "Chile", "Peru", or "Mexico", and several providers derive the charged currency from the country. Use the form documented on the provider page.
Mozarto resolves the country by geo-locating the caller's IP address and continues with the country it detects. Treat that as a safety net, not a feature:
Server-to-server calls, proxies, VPNs, and load balancers report the country of your infrastructure, not the payer's. A wrong country routes the transaction to the wrong account or rejects it.
When the IP cannot be resolved to a country, the scope check is skipped entirely, so a request that should have been rejected may go through to the provider.
Providers that need the country in their own payload still fail without a usable value.
