diff --git a/payapi-spec/accountapi.yaml b/payapi-spec/accountapi.yaml
new file mode 100644
index 0000000..93b7ad6
--- /dev/null
+++ b/payapi-spec/accountapi.yaml
@@ -0,0 +1,260 @@
+components:
+  schemas:
+    AccountQueryRequest:
+      type: object
+      title: 账户查询请求
+      required:
+        - userid
+      properties:
+        userid:
+          title: 用户ID
+          type: string
+        subaccounts:
+          title: 子账户列表
+          type: array
+          items:
+            type: string
+            title: 子账户ID
+    AccountQueryResponse:
+      type: object
+      title: 账户查询应答
+      properties:
+        userid:
+          title: 用户ID
+          type: string
+        username:
+          title: 用户名
+          type: string
+        status:
+          title: 账户状态
+          $ref: 'definitions.yaml#/components/schemas/UserStatus'
+        balance:
+          title: 总余额(分)
+          type: integer
+        frozenbal:
+          title: 冻结金额(分)
+          type: integer
+        subaccountList:
+          type: array
+          title: 子账户列表
+          items:
+            title: 子账户属性
+            $ref: 'definitions.yaml#/components/schemas/SubAccountMetadata'
+    PreAuthorizedDebitRequest:
+      type: object
+      title: 预授权交易请求
+      required:
+        - userid
+        - accountType
+        - preAuthorizedAmount
+        - shopaccno
+        - transDate
+        - transTime
+      properties:
+        billno:
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        userid:
+          title: 用户ID
+          type: string
+        accountType:
+          title: 账户类型
+          type: string
+        preAuthorizedAmount:
+          title: 预授权金额(分)
+          type: integer
+        shopaccno:
+          $ref: 'definitions.yaml#/components/schemas/ShopAccNo'
+        transDate:
+          $ref: 'definitions.yaml#/components/schemas/TransDate'
+        transTime:
+          $ref: 'definitions.yaml#/components/schemas/TransTime'
+    PreAuthorizedDebitResponse:
+      type: object
+      title: 预授权交易应答
+      properties:
+        refno:
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        result:
+          $ref: 'definitions.yaml#/components/schemas/TransResult'
+        message:
+          type: string
+          title: 预授权交易信息
+    PreAuthorizedSettleRequest:
+      type: object
+      title: 预授权交易清算
+      required:
+        - refno
+        - billno
+        - transTime
+        - transTime
+        - amount
+      properties:
+        refno:
+          title: 预授权交易系统交易参考号
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        billno:
+          title: 预授权交易清算订单号
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        transDate:
+          $ref: 'definitions.yaml#/components/schemas/TransDate'
+        transTime:
+          $ref: 'definitions.yaml#/components/schemas/TransTime'
+        amount:
+          title: 清算金额, 小于等于预授权金额(分)
+          type: integer
+    PreAuthorizedSettleResponse:
+      type: object
+      title: 预授权交易清算结果
+      properties:
+        refno:
+          title: 预授权交易清算交易系统交易参考号
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        leftPreAuthorizedAmount:
+          title: 清算后剩余预授权金额
+          type: integer
+    AccountPayRequest:
+      type: object
+      title: 账户余额扣款交易
+      required:
+        - billno
+        - shopaccno
+        - transTime
+        - transDate
+        - userid
+        - amount
+        - dtltype
+      properties:
+        billno:
+          title: 交易订单号
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        shopaccno:
+          $ref: 'definitions.yaml#/components/schemas/ShopAccNo'
+        transDate:
+          $ref: 'definitions.yaml#/components/schemas/TransDate'
+        transTime:
+          $ref: 'definitions.yaml#/components/schemas/TransTime'
+        userid:
+          title: 用户ID
+          type: string
+        amount:
+          title: 扣款金额(分)
+          type: integer
+        description:
+          title: 交易描述
+          type: string
+        dtltype:
+          title: 交易类型
+          type: string
+          default: "pos"
+    AccountPayResponse:
+      type: object
+      title: 账户余额扣款交易应答
+      properties:
+        refno:
+          title: 系统交易参考号
+          $ref: 'definitions.yaml#/components/schemas/Refno'
+        description:
+          title: 系统返回交易描述
+          type: string
+        aftbal:
+          title: 账户余额(分)
+          type: integer
+
+
+  paths:
+    accountQuery:
+      parameters:
+        - $ref: definitions.yaml#/components/headers/TenantId
+      post:
+        tags:
+          - pos
+        requestBody:
+          description: 账户余额查询
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountQueryRequest'
+        responses:
+          '200':
+            description: 查询账户成功
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/AccountQueryResponse'
+          '404':
+            description: 指定用户不存在
+            content:
+              application/json:
+                schema:
+                  $ref: 'definitions.yaml#/components/schemas/ErrorResponse'
+          default:
+            description: 查询错误
+            content:
+              application/json:
+                schema:
+                  $ref: 'definitions.yaml#/components/schemas/ErrorResponse'
+    accountPay:
+      parameters:
+        - $ref: definitions.yaml#/components/headers/TenantId
+      post:
+        tags:
+          - pos
+        requestBody:
+          description: 账户余额消费
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountPayRequest'
+        responses:
+          '200':
+            description: 账户消费成功
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/AccountPayResponse'
+          default:
+            description: 消费失败
+            content:
+              application/json:
+                schema:
+                  $ref: 'definitions.yaml#/components/schemas/ErrorResponse'
+    accountPreAuthorizedDebit:
+      parameters:
+        - $ref: definitions.yaml#/components/headers/TenantId
+      post:
+        tags:
+          - pos
+        requestBody:
+          description: 账户预授权交易
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PreAuthorizedDebitRequest'
+        responses:
+          '200':
+            description: 预授权交易成功
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/PreAuthorizedDebitResponse'
+    accountPreAuthorizedSettle:
+      parameters:
+        - $ref: definitions.yaml#/components/headers/TenantId
+      post:
+        tags:
+          - pos
+        requestBody:
+          description: 预授权交易清算
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PreAuthorizedSettleRequest'
+
+        responses:
+          '200':
+            description: 预授权交易清算成功
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/PreAuthorizedSettleResponse'
+
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
index b355603..b67d419 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
@@ -51,9 +51,11 @@
     override fun doFilterInternal(request: HttpServletRequest, response: HttpServletResponse, filterChain: FilterChain) {
         try {
             jwtTokenContext.jwt.ifPresent { jwt ->
+
                 val auth = UsernamePasswordAuthenticationToken(jwt.uid, null,
-                        (jwt.authorities as ArrayList<Any>)
-                                .map { SimpleGrantedAuthority(it as String) })
+                        jwt.authorities.mapNotNull { a ->
+                            SimpleGrantedAuthority(a.toString())
+                        })
                 SecurityContextHolder.getContext().authentication = auth
             }
             filterChain.doFilter(request, response)
@@ -147,13 +149,16 @@
         class MobileApiSecurityConfigurationAdapter : WebSecurityConfigurerAdapter() {
             @Autowired
             lateinit var failureHandler: AuthLoginFailHandler
+
             @Autowired
             lateinit var successHandler: AuthLoginSuccessHandler
+
             @Autowired
             lateinit var passwordBCryptConfig: PasswordBCryptConfig
 
             @Autowired
             lateinit var userDetailsService: MobileUserService
+
             @Autowired
             lateinit var mobileSecurityFilter: MobileSecurityFilter
 
@@ -215,12 +220,16 @@
         class MvcWebSecurityConfigurationAdapter : WebSecurityConfigurerAdapter() {
             @Autowired
             lateinit var dataSource: DataSource
+
             @Autowired
             lateinit var validateCodeSecurityConfig: ValidateCodeSecurityConfig
+
             @Autowired
             lateinit var authenticationFailureHandler: MyAuthenticationFailureHandler
+
             @Autowired
             lateinit var passwordBCryptConfig: PasswordBCryptConfig
+
             @Autowired
             lateinit var multiTenantOperatorDetailService: MultiTenantOperatorDetailService