diff --git a/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApi.java b/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApi.java
index 86c57a8..7c59309 100644
--- a/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApi.java
+++ b/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApi.java
@@ -5,8 +5,13 @@
  */
 package com.supwisdom.dlpay.api;
 
+import com.supwisdom.dlpay.payapi.model.ErrorResponse;
 import com.supwisdom.dlpay.payapi.model.QrcodePayConfirmRequest;
+import com.supwisdom.dlpay.payapi.model.QrcodePayConfirmResponse;
 import com.supwisdom.dlpay.payapi.model.QrcodePayInitRequest;
+import com.supwisdom.dlpay.payapi.model.QrcodePayInitResponse;
+import com.supwisdom.dlpay.payapi.model.RefundRequest;
+import com.supwisdom.dlpay.payapi.model.RefundResponse;
 import io.swagger.annotations.*;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -27,7 +32,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-@javax.annotation.Generated(value = "org.openapitools.codegen.languages.SpringCodegen", date = "2020-03-12T16:17:20.799+08:00[Asia/Shanghai]")
+@javax.annotation.Generated(value = "org.openapitools.codegen.languages.SpringCodegen", date = "2020-03-17T08:49:02.541+08:00[Asia/Shanghai]")
 
 @Validated
 @Api(value = "consume", description = "the consume API")
@@ -37,43 +42,117 @@
         return Optional.empty();
     }
 
-    @ApiOperation(value = "", nickname = "qrcodePayConfirm", notes = "", tags={ "pos", })
+    @ApiOperation(value = "", nickname = "qrcodePayConfirm", notes = "", response = QrcodePayConfirmResponse.class, tags={ "pos", })
     @ApiResponses(value = { 
-        @ApiResponse(code = 200, message = "交易成功"),
-        @ApiResponse(code = 409, message = "交易正忙，稍后重试"),
-        @ApiResponse(code = 200, message = "交易失败") })
+        @ApiResponse(code = 200, message = "交易成功", response = QrcodePayConfirmResponse.class),
+        @ApiResponse(code = 409, message = "交易正忙，稍后重试", response = ErrorResponse.class),
+        @ApiResponse(code = 200, message = "交易失败", response = ErrorResponse.class) })
     @RequestMapping(value = "/consume/qrcode/confirm",
         produces = { "application/json" }, 
         consumes = { "application/json" },
         method = RequestMethod.POST)
-    default ResponseEntity<Void> qrcodePayConfirm(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "Qrcode确认"  )  @Valid @RequestBody QrcodePayConfirmRequest qrcodePayConfirmRequest) {
+    default ResponseEntity<QrcodePayConfirmResponse> qrcodePayConfirm(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "Qrcode确认"  )  @Valid @RequestBody QrcodePayConfirmRequest qrcodePayConfirmRequest) {
+        getRequest().ifPresent(request -> {
+            for (MediaType mediaType: MediaType.parseMediaTypes(request.getHeader("Accept"))) {
+                if (mediaType.isCompatibleWith(MediaType.valueOf("application/json"))) {
+                    String exampleString = "{ \"hostTime\" : \"hostTime\", \"refno\" : \"refno\", \"hostDate\" : \"hostDate\", \"description\" : \"description\" }";
+                    ApiUtil.setExampleResponse(request, "application/json", exampleString);
+                    break;
+                }
+            }
+        });
         return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
 
     }
 
 
-    @ApiOperation(value = "", nickname = "qrcodePayInit", notes = "", tags={ "pos", })
+    @ApiOperation(value = "", nickname = "qrcodePayInit", notes = "", response = QrcodePayInitResponse.class, tags={ "pos", })
     @ApiResponses(value = { 
-        @ApiResponse(code = 200, message = "初始化成功"),
-        @ApiResponse(code = 200, message = "请求错误") })
+        @ApiResponse(code = 200, message = "初始化成功", response = QrcodePayInitResponse.class),
+        @ApiResponse(code = 200, message = "请求错误", response = ErrorResponse.class) })
     @RequestMapping(value = "/consume/qrcode/init",
         produces = { "application/json" }, 
         consumes = { "application/json" },
         method = RequestMethod.POST)
-    default ResponseEntity<Void> qrcodePayInit(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "QrCode 初始化"  )  @Valid @RequestBody QrcodePayInitRequest qrcodePayInitRequest) {
+    default ResponseEntity<QrcodePayInitResponse> qrcodePayInit(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "QrCode 初始化"  )  @Valid @RequestBody QrcodePayInitRequest qrcodePayInitRequest) {
+        getRequest().ifPresent(request -> {
+            for (MediaType mediaType: MediaType.parseMediaTypes(request.getHeader("Accept"))) {
+                if (mediaType.isCompatibleWith(MediaType.valueOf("application/json"))) {
+                    String exampleString = "{ \"anonymous\" : true, \"sourcetype\" : \"sourcetype\", \"userid\" : \"userid\", \"username\" : \"username\" }";
+                    ApiUtil.setExampleResponse(request, "application/json", exampleString);
+                    break;
+                }
+            }
+        });
         return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
 
     }
 
 
-    @ApiOperation(value = "", nickname = "qrcodePayQuery", notes = "根据系统交易参考号查询流水状态", tags={ "pos", })
+    @ApiOperation(value = "", nickname = "qrcodePayQuery", notes = "根据系统交易参考号查询流水状态", response = QrcodePayConfirmResponse.class, tags={ "pos", })
     @ApiResponses(value = { 
-        @ApiResponse(code = 200, message = "查询成功"),
-        @ApiResponse(code = 200, message = "查询失败") })
+        @ApiResponse(code = 200, message = "查询成功", response = QrcodePayConfirmResponse.class),
+        @ApiResponse(code = 200, message = "查询失败", response = ErrorResponse.class) })
     @RequestMapping(value = "/consume/qrcode/query/{refno}",
         produces = { "application/json" }, 
         method = RequestMethod.GET)
-    default ResponseEntity<Void> qrcodePayQuery(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "系统交易参考号",required=true) @PathVariable("refno") String refno) {
+    default ResponseEntity<QrcodePayConfirmResponse> qrcodePayQuery(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "系统交易参考号",required=true) @PathVariable("refno") String refno) {
+        getRequest().ifPresent(request -> {
+            for (MediaType mediaType: MediaType.parseMediaTypes(request.getHeader("Accept"))) {
+                if (mediaType.isCompatibleWith(MediaType.valueOf("application/json"))) {
+                    String exampleString = "{ \"hostTime\" : \"hostTime\", \"refno\" : \"refno\", \"hostDate\" : \"hostDate\", \"description\" : \"description\" }";
+                    ApiUtil.setExampleResponse(request, "application/json", exampleString);
+                    break;
+                }
+            }
+        });
+        return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
+
+    }
+
+
+    @ApiOperation(value = "", nickname = "refund", notes = "退款交易", response = RefundResponse.class, tags={ "pos", })
+    @ApiResponses(value = { 
+        @ApiResponse(code = 200, message = "退款申请成功，等待查询", response = RefundResponse.class),
+        @ApiResponse(code = 409, message = "退款申请失败，订单号已存在或正在退款中", response = ErrorResponse.class),
+        @ApiResponse(code = 200, message = "退款申请失败", response = ErrorResponse.class) })
+    @RequestMapping(value = "/consume/refund",
+        produces = { "application/json" }, 
+        consumes = { "application/json" },
+        method = RequestMethod.POST)
+    default ResponseEntity<RefundResponse> refund(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = ""  )  @Valid @RequestBody RefundRequest refundRequest) {
+        getRequest().ifPresent(request -> {
+            for (MediaType mediaType: MediaType.parseMediaTypes(request.getHeader("Accept"))) {
+                if (mediaType.isCompatibleWith(MediaType.valueOf("application/json"))) {
+                    String exampleString = "{ \"hostTime\" : \"hostTime\", \"refno\" : \"refno\", \"hostDate\" : \"hostDate\", \"billno\" : \"billno\" }";
+                    ApiUtil.setExampleResponse(request, "application/json", exampleString);
+                    break;
+                }
+            }
+        });
+        return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
+
+    }
+
+
+    @ApiOperation(value = "", nickname = "refundQuery", notes = "退款申请查询", response = RefundResponse.class, tags={ "pos", })
+    @ApiResponses(value = { 
+        @ApiResponse(code = 200, message = "退款申请查询成功", response = RefundResponse.class),
+        @ApiResponse(code = 404, message = "退款申请订单不存在", response = ErrorResponse.class),
+        @ApiResponse(code = 200, message = "退款申请失败", response = ErrorResponse.class) })
+    @RequestMapping(value = "/consume/refund/query/{billno}",
+        produces = { "application/json" }, 
+        method = RequestMethod.GET)
+    default ResponseEntity<RefundResponse> refundQuery(@ApiParam(value = "租户ID" ,required=true) @RequestHeader(value="X-Tenant-Id", required=true) String xTenantId,@ApiParam(value = "退款订单号",required=true) @PathVariable("billno") String billno) {
+        getRequest().ifPresent(request -> {
+            for (MediaType mediaType: MediaType.parseMediaTypes(request.getHeader("Accept"))) {
+                if (mediaType.isCompatibleWith(MediaType.valueOf("application/json"))) {
+                    String exampleString = "{ \"hostTime\" : \"hostTime\", \"refno\" : \"refno\", \"hostDate\" : \"hostDate\", \"billno\" : \"billno\" }";
+                    ApiUtil.setExampleResponse(request, "application/json", exampleString);
+                    break;
+                }
+            }
+        });
         return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
 
     }
diff --git a/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApiController.java b/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApiController.java
index dc318fe..7aac744 100644
--- a/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApiController.java
+++ b/payapi/src/main/java/com/supwisdom/dlpay/api/ConsumeApiController.java
@@ -4,22 +4,22 @@
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.context.request.NativeWebRequest;
 import java.util.Optional;
-@javax.annotation.Generated(value = "org.openapitools.codegen.languages.SpringCodegen", date = "2020-03-12T16:09:45.966+08:00[Asia/Shanghai]")
-
-@Controller
-@RequestMapping("${openapi.aPITitle.base-path:/api}")
-public class ConsumeApiController implements ConsumeApi {
-
-    private final NativeWebRequest request;
-
-    @org.springframework.beans.factory.annotation.Autowired
-    public ConsumeApiController(NativeWebRequest request) {
-        this.request = request;
-    }
-
-    @Override
-    public Optional<NativeWebRequest> getRequest() {
-        return Optional.ofNullable(request);
-    }
-
-}
+//@javax.annotation.Generated(value = "org.openapitools.codegen.languages.SpringCodegen", date = "2020-03-12T16:09:45.966+08:00[Asia/Shanghai]")
+//
+//@Controller
+//@RequestMapping("${openapi.aPITitle.base-path:/api}")
+//public class ConsumeApiController implements ConsumeApi {
+//
+//    private final NativeWebRequest request;
+//
+//    @org.springframework.beans.factory.annotation.Autowired
+//    public ConsumeApiController(NativeWebRequest request) {
+//        this.request = request;
+//    }
+//
+//    @Override
+//    public Optional<NativeWebRequest> getRequest() {
+//        return Optional.ofNullable(request);
+//    }
+//
+//}
diff --git a/payapi/src/main/java/org/openapitools/configuration/HomeController.java b/payapi/src/main/java/org/openapitools/configuration/HomeController.java
index 2572783..2697428 100644
--- a/payapi/src/main/java/org/openapitools/configuration/HomeController.java
+++ b/payapi/src/main/java/org/openapitools/configuration/HomeController.java
@@ -7,13 +7,13 @@
 /**
  * Home redirection to OpenAPI api documentation
  */
-@Controller
-public class HomeController {
-
-    @RequestMapping("/")
-    public String index() {
-        return "redirect:swagger-ui.html";
-    }
-
-
-}
+//@Controller
+//public class HomeController {
+//
+//    @RequestMapping("/")
+//    public String index() {
+//        return "redirect:swagger-ui.html";
+//    }
+//
+//
+//}
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/k12_consume_api_controller.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/k12_consume_api_controller.kt
index 5fe60fe..9aff498 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/k12_consume_api_controller.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/k12_consume_api_controller.kt
@@ -3,22 +3,21 @@
 import com.supwisdom.dlpay.agent.AgentCode
 import com.supwisdom.dlpay.agent.AgentPayService
 import com.supwisdom.dlpay.agent.AgentPayServiceContext
+import com.supwisdom.dlpay.agent.domain.QrcodePattern
 import com.supwisdom.dlpay.agent.domain.QrcodePayTrans
 import com.supwisdom.dlpay.agent.service.AgentServiceProxy
 import com.supwisdom.dlpay.api.bean.QrcodePayResponse
 import com.supwisdom.dlpay.api.service.*
+import com.supwisdom.dlpay.exception.BadRequestError
 import com.supwisdom.dlpay.exception.TransactionCheckException
 import com.supwisdom.dlpay.framework.ResponseBodyBuilder
 import com.supwisdom.dlpay.framework.service.SystemUtilService
-import com.supwisdom.dlpay.framework.util.Dictionary
-import com.supwisdom.dlpay.framework.util.TradeCode
-import com.supwisdom.dlpay.framework.util.TradeDict
-import com.supwisdom.dlpay.framework.util.TradeErrorCode
+import com.supwisdom.dlpay.framework.util.*
 import com.supwisdom.dlpay.payapi.model.QrcodePayConfirmRequest
 import com.supwisdom.dlpay.payapi.model.QrcodePayInitRequest
 import com.supwisdom.dlpay.payapi.model.QrcodePayInitResponse
+import com.supwisdom.multitenant.TenantContextHolder
 import org.apache.commons.lang3.StringUtils
-import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
 import org.springframework.stereotype.Controller
 import org.springframework.web.bind.annotation.RequestMapping
@@ -38,25 +37,28 @@
             private val userService: UserService,
             private val consumePayService: ConsumePayService,
             private val transactionService: TransactionServiceProxy,
-            private val accountUtilServcie: AccountUtilServcie ) : ConsumeApi {
+            private val accountUtilServcie: AccountUtilServcie) : ConsumeApi {
 
     override fun getRequest(): Optional<NativeWebRequest> {
         return Optional.ofNullable(request)
     }
 
-    override fun qrcodePayInit(xTenantId: String, @Valid param: QrcodePayInitRequest): ResponseEntity<Void> {
+    override fun qrcodePayInit(xTenantId: String, @Valid param: QrcodePayInitRequest): ResponseEntity<QrcodePayInitResponse> {
+        TenantContextHolder.getContext().tenant.id = "{tenantid}"
         val apiResp = QrcodePayInitResponse()
         // 1. 检查 qrcode
-        val qrcode = agentServiceProxy.qrcodeMatch(param.qrcode)
-                ?: return ResponseBodyBuilder.badRequest("未识别的支付码") as ResponseEntity<Void>
-
+        val qrcode: QrcodePattern
+        try {
+            qrcode = agentServiceProxy.qrcodeMatch(param.qrcode)
+                    ?: throw BadRequestError("未识别的支付码")
+        } catch (e: Exception) {
+            throw BadRequestError(e.message!!)
+        }
         val sourceType = sourceTypeService.getBySourceType(qrcode.sourceType)
-                ?: return ResponseBodyBuilder.badRequest(
-                        "不支持的支付方式<${qrcode.sourceType}>") as ResponseEntity<Void>
+                ?: throw BadRequestError("不支持的支付方式<${qrcode.sourceType}>")
         if (sourceType.paySubjno.isEmpty()
                 || !StringUtils.isNumeric(sourceType.paySubjno)) {
-            return ResponseBodyBuilder.notFound(
-                    "支付方式<${qrcode.sourceType}>未配置科目号") as ResponseEntity<Void>
+            throw BadRequestError("支付方式<${qrcode.sourceType}>未配置科目号")
         }
         val systime = systemUtilService.sysdatetime
         // 2. 记录 qrcode 交易明细表
@@ -83,45 +85,35 @@
         return when (agentResp.code) {
             AgentCode.SUCCESS -> {
                 val qrcodeTransResp = agentResp.payload
-                // 更新qrcode交易明细表 是否匿名 字段
-                agentServiceProxy.qrcodePayTransSaveOrUpdate(qrcodeTrans.also{
-                    it.isAnonymous = qrcodeTransResp.isAnonymous
-                })
                 if (!sourceType.anonymousEnable && qrcodeTransResp.isAnonymous) {
-                    ResponseBodyBuilder.failEntity(apiResp,
-                            HttpStatus.BAD_REQUEST.value(),
-                            "支付方式<${qrcode.sourceType}> 不支持匿名支付") as ResponseEntity<Void>
+                    throw BadRequestError("支付方式<${qrcode.sourceType}> 不支持匿名支付")
                 } else {
-                    val person = userService.findByUseridOrThirdUniqueIdenty(qrcodeTransResp.userid, null)
-                    ResponseBodyBuilder.successEntity(
-                            QrcodePayInitResponse().apply {
-                                this.anonymous = qrcodeTransResp.isAnonymous
-                                this.sourcetype = sourceType.sourceType
+                    // 更新qrcode交易明细表 是否匿名 字段
+                    if (StringUtil.isEmpty(qrcodeTransResp.userid)) {
+                        qrcodeTransResp.isAnonymous = true
+                    } else {
+                        val person = userService.findByUseridOrThirdUniqueIdenty(qrcodeTransResp.userid, null)
+                        if (person == null) {
+                            qrcodeTransResp.isAnonymous = true
+                        } else {
+                            apiResp.apply {
+                                qrcodeTransResp.isAnonymous = false
                                 this.userid = qrcodeTransResp.agentUserId
-                                this.username = person!!.name
+                                this.username = person.name
                             }
-                    ) as ResponseEntity<Void>
+                        }
+                    }
+                    agentServiceProxy.qrcodePayTransSaveOrUpdate(qrcodeTrans.also {
+                        it.isAnonymous = qrcodeTransResp.isAnonymous
+                    })
+                    ResponseBodyBuilder.ok(apiResp)
                 }
             }
             AgentCode.NOT_SUPPORT -> {
-                val qrcodeTransResp = agentResp.payload
-                agentServiceProxy.qrcodePayTransSaveOrUpdate(qrcodeTrans.also{
-                    it.isAnonymous = qrcodeTransResp.isAnonymous
-                })
-                if (!sourceType.anonymousEnable) {
-                    ResponseBodyBuilder.failEntity(apiResp,
-                            HttpStatus.BAD_REQUEST.value(),
-                            "支付方式<${qrcode.sourceType}> 不支持匿名支付") as ResponseEntity<Void>
-                } else {
-                    ResponseBodyBuilder.successEntity(apiResp.also {
-                        it.anonymous = qrcodeTransResp.isAnonymous
-                    }) as ResponseEntity<Void>
-                }
+                throw BadRequestError("系统或商户暂不支持当前的支付类型}")
             }
             else -> {
-                ResponseBodyBuilder.failEntity(apiResp,
-                        HttpStatus.INTERNAL_SERVER_ERROR.value(),
-                        "第三方身份错误,<${agentResp.agentMsg}") as ResponseEntity<Void>
+                throw BadRequestError("第三方身份错误,<${agentResp.agentMsg}")
             }
         }
     }
@@ -242,7 +234,7 @@
 //            }
 //        }
 //    }
-//
+
 //    override fun qrcodePayQuery(xTenantId: String, refno: String): ResponseEntity<Void> {
 //        return null
 //    }
diff --git a/payapi/src/main/resources/application.properties b/payapi/src/main/resources/application.properties
index 7565c8c..bdd8bfe 100644
--- a/payapi/src/main/resources/application.properties
+++ b/payapi/src/main/resources/application.properties
@@ -50,8 +50,7 @@
 spring.redis.database=0
 ###################################################
 springfox.documentation.swagger.v2.path=/api-docs
-openapi.aPITitle.base-path=/payapi
-spring.jackson.date-format=com.supwisdom.dlpay.payapi.RFC3339DateFormat
+spring.jackson.date-format=yyyy-MM-dd HH:mm:ss
 spring.jackson.serialization.WRITE_DATES_AS_TIMESTAMPS=false
 
 multi-tenant.header.key=X-TENANT-ID
diff --git a/payapi/src/test/kotlin/com/supwisdom/dlpay/controller/security_controller_test.kt b/payapi/src/test/kotlin/com/supwisdom/dlpay/controller/security_controller_test.kt
index 65bd05b..96d2460 100644
--- a/payapi/src/test/kotlin/com/supwisdom/dlpay/controller/security_controller_test.kt
+++ b/payapi/src/test/kotlin/com/supwisdom/dlpay/controller/security_controller_test.kt
@@ -123,4 +123,11 @@
                 }
     }
 
+    @Test
+    fun testHMACSHA256() {
+        val token = "TJ3UlX9/tyunSZ2b"
+        val secret = "5f788ce433ec44f299351cdf7f137e81"
+        val jwt = HmacUtil.HMACSHA256(token, secret)
+        println(jwt)
+    }
 }
\ No newline at end of file