Platform API Reference
Auto-generated from the live OpenAPI specification. 165 operations.
- Get webhook delivery record (admin) — Admin variant of GET /v1/webhooks/deliveries/:id. Returns a single delivery record scoped by tenantId — no further merchant-level ownership check.
- List webhook delivery records (admin) — Admin variant of GET /v1/webhooks/deliveries. Scoped by tenantId only — returns all delivery records in the tenant. Optional `endpoint_id` narrows further. Cursor-based pagination via `cursor` + `limit`.
- Create webhook endpoint (admin) — Admin variant of POST /v1/webhooks/endpoints. Creates a webhook endpoint at the tenant or platform level based on the caller context. Signing secret is returned ONCE in this response — store it securely. URL must use HTTPS.
- Delete webhook endpoint (admin) — Admin variant of DELETE /v1/webhooks/endpoints/:id. Soft-deletes the endpoint — deliveries stop immediately. The record is preserved for audit.
- Get webhook endpoint (admin) — Admin variant of GET /v1/webhooks/endpoints/:id. Returns a single endpoint by ID. The signing secret is never returned on read.
- List webhook endpoints (admin) — Admin variant of GET /v1/webhooks/endpoints. Lists endpoints scoped to the caller owner level (tenant or platform). Signing secrets are never included.
- Rotate webhook endpoint signing secret (admin) — Admin variant of POST /v1/webhooks/endpoints/:id/rotate-secret. Generates a new signing secret. The secret and exact deadline are returned in this non-cacheable response; reusing the same Idempotency-Key safely replays them after response loss. Store the secret securely and install it during the bounded grace period. Native and strp-compatible deliveries accept both secrets during grace; adn- and chkt-compatible deliveries keep using the previous secret until the deadline.
- Update webhook endpoint (admin) — Admin variant of PATCH /v1/webhooks/endpoints/:id. Updates mutable fields (url, events, description, status, maxAttempts). Events, if provided, REPLACE the previous subscription set.
- Create a new API key pair — Issues a new API key pair (public + secret). The plain-text secret is returned ONCE in the response — store it securely. Subsequent reads return only the public portion. Pass `ownerType: "merchant"` with `merchantId` to bind the key to a single merchant, or `ownerType: "tenant"` for a tenant-wide key. Use `livemode: false` to create a sandbox key (sk_test_*). A secret-key caller issues keys only in its own mode. Repeating the request with the same `Idempotency-Key` answers 409 `API_KEY_ALREADY_ISSUED` with the issued key id in `instance`.
- List API keys — Returns a paginated list of API keys visible to the caller, always in the caller's mode. Filters: `status`, `merchantId`, `createdBy`, `livemode` (a different mode yields an empty page). Uses cursor-based pagination — pass `cursor` from a previous response to fetch the next page. Default page size is 20, maximum 100. Raw secrets are never included.
- Get API key by ID — Returns details for a single API key. The raw secret is never returned — only the public key prefix and metadata.
- List permissions grantable on a new API key — Returns the permission codes a key of `ownerType` may carry when the caller issues it: the owner-layer set (merchant keys: merchant layer; tenant keys: operator layer) intersected with the caller's own permissions. A create request whose `permissions` stay inside this list passes both permission checks.
- Revoke an API key (DELETE variant) — Revokes an active API key. Once revoked, the key cannot authenticate further requests. Revocation is permanent — issue a new key if access is needed again. Soft delete: the record is preserved for audit.
- Revoke an API key (POST variant) — Same effect as `DELETE /v1/api-keys/:id`, but returns the updated entity. Use when the caller needs the fresh `status = "revoked"` body without a second GET.
- Rotate an API key — Creates a NEW API key inheriting the source key's scope, permissions and IP allowlist. The source key stays active for `graceHours` (default 24h) to allow downstream services to migrate. The new plaintext is returned ONCE. Repeating the request with the same `Idempotency-Key` answers 409 `API_KEY_ALREADY_ISSUED` with the successor id in `instance`.
- Update API key — Updates mutable fields of an active API key (`name`, `permissions`, `expiresAt`). Only fields included in the body are changed. Cannot update revoked or expired keys (returns 409).
- Create antifraud plan
- Disable antifraud plan
- Enable antifraud plan
- Get antifraud plan by ID
- List antifraud plans
- Delete antifraud plan (soft delete, owner only)
- Update antifraud plan
- Create a company
- Disable (soft-delete) a company
- Get company by ID
- List companies
- List merchants under company
- Update a company
- Close fee assignment
- Create fee assignment
- Get fee assignment by ID
- List fee assignments
- Activate fee schedule (draft -> active)
- Archive fee schedule (active -> archived)
- Create fee schedule (draft)
- Get fee schedule by ID
- List fee schedules
- Update fee schedule
- Create a channel
- Create channel limit
- Disable a channel
- Disable channel limit
- Get channel by ID
- List channels
- List channel limits
- Update a channel
- Create an integration profile
- Get integration profile by ID
- List integration profiles
- Update an integration profile
- Cancel a pending invitation
- List invitations
- Resend invitation email
- Download KYB document
- Upload KYB document
- Create KYB submission (draft)
- Get KYB submission by ID
- Get latest KYB submission for own company
- List KYB submissions
- Submit KYB submission
- Update KYB submission data
- Approve KYB submission
- Ask merchant for more info on KYB submission
- Get KYB submission by ID
- List KYB submissions
- Reject KYB submission
- Record review verdict on a KYB document
- Add entry to list group
- Create list group
- Delete list entry (soft delete)
- Delete list group (soft delete + cascade entries)
- Get list group by ID
- List entries in list group
- List list groups
- Update list group
- Activate merchant
- Approve merchant for live
- Create merchant
- Create merchant limit
- Disable merchant
- Disable merchant limit
- List merchants
- Get merchant by ID
- Get merchant 3DS config
- List merchant limits
- Reject merchant (back to sandbox)
- Request live approval
- Suspend merchant
- Update merchant
- Set merchant checkout hosting (self_hosted/provider_hosted)
- Set merchant processing mode (principal/passthrough)
- Update merchant 3DS config
- Create partner assignment
- List partner assignments
- Get partner assignment by ID
- Suspend partner assignment
- Update partner assignment
- Activate partner
- Create partner
- Disable partner
- List partners
- Get partner by ID
- Suspend partner
- Update partner
- Get provider integration by ID
- List provider integrations
- Update provider integration capabilities — Overlay the connector-registered payment-method / feature capability declarations with portal-scoped adjustments. Primary source remains connector registration; use sparingly (audited).
- Update provider integration status — Transition the provider between `available`, `maintenance`, and `deprecated`. Full deprecation flow with grace period goes through the maker-checker queue separately.
- Delete risk configuration (reset to defaults)
- Get risk configuration for current tenant
- Create or update risk configuration
- Create a new role
- Delete role (soft delete)
- Get role by ID
- List available permissions
- List recent audit entries for a role
- List roles
- Update role
- Create scoring rule
- Get scoring rule by ID
- List scoring rules
- Delete scoring rule (soft delete)
- Update scoring rule
- Activate routing rule
- Archive routing rule
- Clone routing rule
- Create routing rule (draft)
- Get routing rule by ID
- List routing rules
- List routing rule versions
- Delete routing rule (draft only)
- Update routing rule (draft only)
- Activate tenant
- Create tenant
- Disable tenant
- List tenants
- Get tenant by ID
- Suspend tenant
- Update tenant
- Disable user
- Enable user
- List users
- Get user by ID
- Invite a new user
- Soft-delete user
- Update user
- Create a terminal
- Create terminal limit
- Add MPI account
- Create terminal restriction
- Delete MPI account
- Disable a terminal
- Disable terminal limit
- Disable terminal restriction
- Get terminal by ID
- Get terminal 3DS config
- List terminals
- List terminal limits
- List terminal restrictions
- Put terminal 3DS config
- Rotate terminal credentials
- Update a terminal
- Update MPI account
- Update terminal restriction