Dashboard · 1.0.0 · 71 endpoints

Dashboard session API

The calls the dashboard makes for itself, plus the few public and OAuth endpoints. They are documented for completeness; an integration should use the merchant API.

Not for API keys

These endpoints use the dashboard session cookie and answer 403 session_required to an API key. To build an integration, use the merchant integration API.

status

Platform status messages staff publish for customers. Public.

GET/v1/status

Current platform status messages

What staff have told customers about incidents and maintenance. status is operational when no message is open and every component is operational, otherwise the worst of the open messages and the components. recent holds messages resolved in the last 14 days. The text is exactly what staff published; it never carries internal identifiers. components and incidents are derived by the platform itself (payments per network, payouts, refunds) and open and close without anyone writing a message; they never include a provider, a staff reason or a tenant-specific pause.

Auth: none

Response 200 · PlatformStatus

The status.

statusrequired
"operational" | "notice" | "maintenance" | "degraded" | "outage"
The worst of the service components and the open staff messages; a paused component counts as outage.
activerequired
StatusMessage[]
recentrequired
StatusMessage[]
componentsrequired
StatusComponent[]
One entry per payments network, plus payouts and refunds, derived from what the platform is doing.
incidentsrequired
StatusIncident[]
Automatic incidents, open ones and those closed in the last 14 days, newest first. Staff cannot hide or resolve them.

Errors: 429 · 500

payments

Payment requests (intents) a customer pays, with their state, fundings and fulfilment.

GET/v1/checkout/{token}

What a payer needs to pay one intent (hosted checkout)

Public and unauthenticated: the unguessable checkout token in the path, taken from instructions.checkout_url, is the credential. It returns only what the payer acts on (amount, fee, network, address, memo, expiry and progress) and nothing about the merchant. address, memo and hosted_url are empty once the intent is final. A held or blocked intent reads as processing. Any origin may read it (no credentials); it is rate limited per client (429 rate_limited). Responses are not cacheable.

Auth: none

Parameters

tokenpathrequiredstring

Response 200 · CheckoutView

The payer's view.

statusrequired
"requires_payment" | "processing" | "partially_funded" | "succeeded" | "expired" | "cancelled"
livemoderequired
boolean
False for a test-mode payment, whose address is synthetic.
assetrequired
object
networkrequired
object
amountrequired
unknown
The price.
feerequired
unknown
Added on top of the price.
amount_duerequired
unknown
Price plus fee: what the payer sends.
amount_seenrequired
unknown
Deposits seen, still confirming included.
amount_receivedrequired
unknown
Deposits verified.
amount_remainingrequired
unknown
amount_due less what is verified; zero when covered.
pricerequired
object | null
descriptionrequired
string
staterequired
"ready" | "pending" | "unavailable"
As instructions.state of the intent.
addressrequired
string
Empty while pending, when the intent is final, or when only hosted_url pays.
memorequired
string | null
Must be sent with the payment when present.
hosted_urlrequired
string (uri) | null
The provider's checkout page; when set the payer is sent there.
expires_atrequired
ISODate
server_timerequired
unknown
The server's clock, for a countdown that does not trust the device's.

Errors: 404 · 429 · 500

POST/v1/checkout/{token}/events

Record an anonymous payer funnel step on hosted checkout

Public and unauthenticated: records one deduplicated funnel step per (intent, step) for live payment intents without storing IP addresses, session identifiers or account IDs. Test-mode intents answer 204 without writing to live analytics. Any origin may send it (no credentials); it is rate limited per client (429 rate_limited).

Auth: none

Parameters

tokenpathrequiredstring
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CheckoutEventInput

steprequired
"viewed" | "instructions_ready" | "copy_address" | "copy_memo" | "reveal_qr" | "open_hosted"

Response 204

Recorded (or ignored for a test-mode intent or duplicate step).

Errors: 400 · 404 · 429 · 500

GET/v1/checkout/{token}/ton-connect

TON Connect transaction payload for a hosted checkout

Builds the authoritative TON Connect v2 signing payload for a TON payment intent (gram-ton or usdt-ton) that is awaiting payment (requires_payment or partially_funded). Native gram-ton payloads include a BOC text-comment cell when memo is present; usdt-ton payloads include the TEP-74 transfer cell BOC, jetton_master and ton_for_gas, plus a ready-to-send messages entry when payer_jetton_wallet is supplied.

Auth: none

Parameters

tokenpathrequiredstring
payer_addressquerystring
Optional TON address of the payer wallet, encoded as response_destination for excess gas on Jetton transfers.
payer_jetton_walletquerystring
Optional Jetton wallet contract address of the payer; when supplied for usdt-ton, messages carries the ready-to-sign Jetton transfer message.

Response 200 · TonConnectPayload

The TON Connect transaction payload.

networkrequired
"-239" | "-3"
-239 on TON mainnet (livemode: true), -3 in test mode.
valid_untilrequired
integer
Unix timestamp after which wallets refuse to sign.
kindrequired
"native" | "jetton"
asset_idrequired
string
destination_addressrequired
string
Merchant payment deposit address on TON.
amountrequired
unknown
Remaining amount due in asset base units.
memorequired
string | null
messagesrequired
TonConnectMessage[]
jetton_masterrequired
string | null
Jetton master contract address when kind is jetton, otherwise null.
ton_for_gasrequired
string | null
NanoTON attached to the Jetton wallet call (50000000 = 0.05 TON) when kind is jetton, otherwise null.
jetton_transfer_payloadrequired
string | null
Base64-encoded TEP-74 transfer BOC cell when kind is jetton, otherwise null.

Errors: 400 · 404 · 409 · 422 · 429 · 500

GET/v1/checkout/widget/{token}

Payer view for an embedded checkout widget

Public browser read authenticated by a short-lived wcs_ token from POST /v1/payment-intents/{id}/widget-token. The Origin request header must exact-match both the origin signed into the token and an active row in the merchant's checkout_origins allowlist (403 origin_not_approved otherwise, so deleting an origin cuts off active widget sessions at once). Sets Access-Control-Allow-Origin to that exact origin with Vary: Origin and Cache-Control: no-store. Expired tokens return 401 widget_token_expired.

Auth: none

Parameters

tokenpathrequiredstring

Response 200 · CheckoutView

The payer's view.

statusrequired
"requires_payment" | "processing" | "partially_funded" | "succeeded" | "expired" | "cancelled"
livemoderequired
boolean
False for a test-mode payment, whose address is synthetic.
assetrequired
object
networkrequired
object
amountrequired
unknown
The price.
feerequired
unknown
Added on top of the price.
amount_duerequired
unknown
Price plus fee: what the payer sends.
amount_seenrequired
unknown
Deposits seen, still confirming included.
amount_receivedrequired
unknown
Deposits verified.
amount_remainingrequired
unknown
amount_due less what is verified; zero when covered.
pricerequired
object | null
descriptionrequired
string
staterequired
"ready" | "pending" | "unavailable"
As instructions.state of the intent.
addressrequired
string
Empty while pending, when the intent is final, or when only hosted_url pays.
memorequired
string | null
Must be sent with the payment when present.
hosted_urlrequired
string (uri) | null
The provider's checkout page; when set the payer is sent there.
expires_atrequired
ISODate
server_timerequired
unknown
The server's clock, for a countdown that does not trust the device's.

Errors: 401 · 403 · 404 · 429 · 500

GET/v1/checkout/widget/{token}/ton-connect

TON Connect transaction payload for an embedded checkout widget

Same payload as GET /v1/checkout/{token}/ton-connect, authenticated by a wcs_ widget token and enforcing exact-match Origin allowlisting against checkout_origins.

Auth: none

Parameters

tokenpathrequiredstring
payer_addressquerystring
payer_jetton_walletquerystring

Response 200 · TonConnectPayload

The TON Connect transaction payload.

networkrequired
"-239" | "-3"
-239 on TON mainnet (livemode: true), -3 in test mode.
valid_untilrequired
integer
Unix timestamp after which wallets refuse to sign.
kindrequired
"native" | "jetton"
asset_idrequired
string
destination_addressrequired
string
Merchant payment deposit address on TON.
amountrequired
unknown
Remaining amount due in asset base units.
memorequired
string | null
messagesrequired
TonConnectMessage[]
jetton_masterrequired
string | null
Jetton master contract address when kind is jetton, otherwise null.
ton_for_gasrequired
string | null
NanoTON attached to the Jetton wallet call (50000000 = 0.05 TON) when kind is jetton, otherwise null.
jetton_transfer_payloadrequired
string | null
Base64-encoded TEP-74 transfer BOC cell when kind is jetton, otherwise null.

Errors: 400 · 401 · 403 · 404 · 409 · 422 · 429 · 500

api keys

Create, rotate and revoke API keys, test keys included. Dashboard session with step-up MFA only.

GET/v1/api-keysDashboard session only

API keys of the account (never the secrets)

Auth: Dashboard session

Response 200 · object

Newest first, revoked ones included.

POST/v1/api-keysDashboard session only

Create an API key (owner, admin or developer; step-up MFA)

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · ApiKeyInput

namerequired
string
scopesrequired
Scope[]
expires_at
ISODate
coderequired
string
Step-up TOTP code or passkey step-up token.
mode
"live" | "test"
A test key (rvk_test_...) acts on the account's separate sandbox. 503 test_mode_unavailable where the deployment has no sandbox.

Response 201 · CreatedApiKey

The key with its secret, shown once.

secretrequired
string
The full credential rvk_<prefix>_<secret>. Shown once; store it hashed.

Errors: 400 · 403 · 409 · 422

DELETE/v1/api-keys/{id}Dashboard session only

Revoke a key immediately

Auth: Dashboard session

Parameters

idpathrequiredID

Response 204

Revoked.

Errors: 404

POST/v1/api-keys/{id}/rotateDashboard session only

Mint a replacement; the old key stays valid for 24 hours

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

coderequired
string
Step-up TOTP code or passkey step-up token.

Response 201 · CreatedApiKey

The new key with its secret, shown once.

secretrequired
string
The full credential rvk_<prefix>_<secret>. Shown once; store it hashed.

Errors: 404 · 409

team

Members and their roles. Dashboard session only.

GET/v1/teamDashboard session only

Team members of the account, invited ones included

Auth: Dashboard session

Response 200 · object

Members ordered by join date.

POST/v1/teamDashboard session only

Invite a team member by email (owner or admin)

Saves a pending membership and sends the invitee a link that expires in 7 days. The answer is the same whether or not the address already has a login, so an invitation never reveals one: the member has status: invited, no user_id or username, and an invitation that says whether the email went out. Limited to 20 invitations an hour per account (429 with Retry-After).

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · InviteInput

emailrequired
string (email)
rolerequired
Role
Team role. owner > admin > developer / finance > viewer.

Response 201 · Member

The invited membership. The invitee receives a signed link.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
user_idrequired
ID | null
emailrequired
string (email)
usernamerequired
string | null
rolerequired
Role
Team role. owner > admin > developer / finance > viewer.
statusrequired
"invited" | "active"
accepted_atrequired
ISODate | null
invitationrequired
MemberInvitation | null
created_atrequired
ISODate

Errors: 400 · 403 · 409 · 429

POST/v1/team/accept

Accept an invitation with a username and password

For an address that has no login: the invitee chooses a username and password, which creates the login and the seat in one step. If the address has gained a login since the invitation was sent, this answers 409 login_exists and the invitee signs in and uses POST /v1/team/invitations/accept. Limited per caller address and per link (429 with Retry-After).

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · AcceptInviteInput

tokenrequired
string
usernamerequired
string
passwordrequired
string

Response 204

Membership active; sign in normally.

Errors: 400 · 409 · 422 · 429

POST/v1/team/invitation

Say what an invitation link is for, before anyone signs in

Returns the state of the link and, unless it is invalid, the account, the role and the masked address it was sent to. mode is create when the invitee must choose a username and password and sign_in when the address already has a login. A link that was replaced by a resend, whose seat was withdrawn, or that never existed is invalid. Limited per caller address and per link.

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · InvitationTokenInput

tokenrequired
string

Response 200 · InvitationPreview

The state of the link.

staterequired
"valid" | "expired" | "used" | "invalid"
account_name
string
role
Role
Team role. owner > admin > developer / finance > viewer.
masked_email
string
The invited address with all but its first letter and its domain hidden.
mode
"create" | "sign_in"

Errors: 429

POST/v1/team/invitations/acceptDashboard session only

Accept an invitation as the signed-in person

For an address that already has a login. The signed-in person's email must equal the address the invitation was sent to; otherwise 403 invitation_wrong_user names the masked address and the link is not spent, so the right person can still use it. Accepting also confirms the login's email address, since the link reached its mailbox. Cookie sessions only: an API key or connected app is refused with 403 session_required.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · InvitationTokenInput

tokenrequired
string

Response 200 · AcceptedInvitation

The seat is active; the account is listed in `Me.accounts` from now on.

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
account_namerequired
string

Errors: 403 · 409 · 422 · 429

POST/v1/team/{id}/resendDashboard session only

Send a pending member a new invitation link (owner or admin)

Replaces every unused link of the pending member with a new one and sends it; the old links stop working. Limited to 1 a minute and 5 a day per member and 30 an hour per account (429 with Retry-After).

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200 · Member

The pending member with its new invitation.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
user_idrequired
ID | null
emailrequired
string (email)
usernamerequired
string | null
rolerequired
Role
Team role. owner > admin > developer / finance > viewer.
statusrequired
"invited" | "active"
accepted_atrequired
ISODate | null
invitationrequired
MemberInvitation | null
created_atrequired
ISODate

Errors: 403 · 404 · 409 · 429

PATCH/v1/team/{id}Dashboard session only

Change a member's role (owner or admin; only owners grant or remove owner)

Auth: Dashboard session

Parameters

idpathrequiredID

Request body · object

rolerequired
Role
Team role. owner > admin > developer / finance > viewer.

Response 200 · Member

The updated membership.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
user_idrequired
ID | null
emailrequired
string (email)
usernamerequired
string | null
rolerequired
Role
Team role. owner > admin > developer / finance > viewer.
statusrequired
"invited" | "active"
accepted_atrequired
ISODate | null
invitationrequired
MemberInvitation | null
created_atrequired
ISODate

Errors: 404 · 409

DELETE/v1/team/{id}Dashboard session only

Remove a member and end their sessions

Auth: Dashboard session

Parameters

idpathrequiredID

Response 204

Removed.

Errors: 404 · 409

identity

Sign-up, email verification, sign-in and sign-out (session cookie).

POST/v1/signup

Create a merchant account with its owner and send the verification email

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · SignUpRequest

emailrequired
string (email)
usernamerequired
string
passwordrequired
string
account_name
string
The merchant's display name; defaults to the username.
country
string
The country the business is registered in (ISO 3166-1 alpha-2). Required in practice: a sign-up without it is refused with 400 invalid_country. The schema keeps it optional so the 1.x contract stays additive. It decides which activities the platform offers; staff confirm it during verification and the confirmed value governs.
subdivision
string
An ISO 3166-2 code inside country, needed only where a rule targets a region.

Response 201 · object

Account created; the address a verification link was sent to.

verification_sent_torequired
string (email)

Errors: 400 · 403 · 409 · 429 · 500

POST/v1/email/verify

Consume an email verification token

Tokens are single use and expire 30 minutes after they were sent.

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

tokenrequired
string

Response 200 · object

Email verified.

verifiedrequired
boolean

Errors: 400 · 422 · 500

POST/v1/email/verify/resend

Send a new verification link

Mails a new link (valid 30 minutes) when the address is registered and not yet verified. The answer is the same for every address, so it never reveals whether an account exists. Rate limited per IP and per address.

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

emailrequired
string (email)

Response 202 · object

Accepted; a link is on its way if the address needs one.

acceptedrequired
boolean

Errors: 400 · 429 · 500

POST/v1/session

Sign in with email and password (plus TOTP when enabled)

Verifies the password and, when an authenticator app is enabled, code (a 6-digit TOTP or a passkey step-up code). Issues a new session every time (rotation): an existing wp_session sent with the request is revoked. Sets the wp_session and wp_csrf cookies and returns Me. Sign-in is rate limited per IP and per email (429 rate_limited).

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · SignInRequest

emailrequired
string (email)
passwordrequired
string
code
string
6-digit TOTP, or a passkey: step-up code. Required when the account has an authenticator app enabled.

Response 200 · Me

Signed in.

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
livemoderequired
boolean
False for objects created with a test-mode key (rvk_test_); they live in the sandbox and never touch real funds.
account_namerequired
string
The merchant's display name.
rolerequired
unknown
The caller's role; for an API key, the role of the member who created it.
emailrequired
string (email)
usernamerequired
string
localerequired
string
BCP-47 tag, e.g. en, pt-BR, ar. Default en.
display_currencyrequired
unknown
Currency balances are shown in. Default USD.
time_zonerequired
string | null
IANA zone dates are shown in, e.g. Europe/Lisbon; null follows the browser. Timestamps in the API are always UTC.
mfarequired
object
withdrawals_frozen_untilrequired
ISODate | null
Present while a security freeze is active (48 h after password/MFA/email change).
notifications_seen_atrequired
ISODate | null
When this member last marked the notification bell read (POST /v1/me/notifications/seen); null until they first do. Items newer than this are unread.
limitsrequired
object
The active limits of the account (the platform default unless an admin set an override; UTC day and month windows) with the usage reserved so far.
created_atrequired
ISODate
accountsrequired
object[]
The accounts the signed-in person can work in, for the account switcher. Empty for an API key.
account_choice_requiredrequired
boolean
True while the person has several accounts and has never picked one; the dashboard asks which to open. Becomes false once they do (POST /v1/session/account).

Errors: 400 · 401 · 403 · 422 · 429 · 500

DELETE/v1/sessionDashboard session only

Sign out (revoke the current session)

Auth: Dashboard session

Response 204

Session revoked and cookies cleared.

Errors: 401 · 403 · 500

POST/v1/session/accountDashboard session only

Move the session to another of the person's accounts

Changes the account the signed-in session works in and remembers it as the person's last account, so the next sign-in lands there. The target must be a live account the person is an active member of and must not be suspended or closed; any other account, including a test-mode twin, is refused with 403 forbidden, and a suspended or closed one with 403 account_inactive. Returns Me for the new account. Cookie sessions only: an API key or connected app is refused with 403 session_required. Limited to 30 switches a minute per session. No step-up: it grants nothing the person does not already hold.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.

Response 200 · Me

Switched; the body describes the new current account.

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
livemoderequired
boolean
False for objects created with a test-mode key (rvk_test_); they live in the sandbox and never touch real funds.
account_namerequired
string
The merchant's display name.
rolerequired
unknown
The caller's role; for an API key, the role of the member who created it.
emailrequired
string (email)
usernamerequired
string
localerequired
string
BCP-47 tag, e.g. en, pt-BR, ar. Default en.
display_currencyrequired
unknown
Currency balances are shown in. Default USD.
time_zonerequired
string | null
IANA zone dates are shown in, e.g. Europe/Lisbon; null follows the browser. Timestamps in the API are always UTC.
mfarequired
object
withdrawals_frozen_untilrequired
ISODate | null
Present while a security freeze is active (48 h after password/MFA/email change).
notifications_seen_atrequired
ISODate | null
When this member last marked the notification bell read (POST /v1/me/notifications/seen); null until they first do. Items newer than this are unread.
limitsrequired
object
The active limits of the account (the platform default unless an admin set an override; UTC day and month windows) with the usage reserved so far.
created_atrequired
ISODate
accountsrequired
object[]
The accounts the signed-in person can work in, for the account switcher. Empty for an API key.
account_choice_requiredrequired
boolean
True while the person has several accounts and has never picked one; the dashboard asks which to open. Becomes false once they do (POST /v1/session/account).

Errors: 400 · 401 · 403 · 409 · 429 · 500

POST/v1/passkeys/login/begin

Start a usernameless passkey sign-in

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200 · CeremonyStart

Options for the browser WebAuthn call plus the sealed ceremony token.

ceremonyrequired
string
Opaque, sealed server state; send it back unchanged in the finish call. Valid 5 minutes.
optionsrequired
object
{publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions} in go-webauthn's JSON encoding (base64url binary fields).

Errors: 401 · 500

POST/v1/passkeys/login/finish

Sign in with a passkey assertion

Sets the session cookies and returns Me, like POST /v1/session.

Auth: none

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CeremonyFinish

ceremonyrequired
string
credentialrequired
object
The PublicKeyCredential returned by the browser, serialised with toJSON() (base64url fields).
name
string
Label for a new passkey (registration only).

Response 200 · Me

Signed in.

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
livemoderequired
boolean
False for objects created with a test-mode key (rvk_test_); they live in the sandbox and never touch real funds.
account_namerequired
string
The merchant's display name.
rolerequired
unknown
The caller's role; for an API key, the role of the member who created it.
emailrequired
string (email)
usernamerequired
string
localerequired
string
BCP-47 tag, e.g. en, pt-BR, ar. Default en.
display_currencyrequired
unknown
Currency balances are shown in. Default USD.
time_zonerequired
string | null
IANA zone dates are shown in, e.g. Europe/Lisbon; null follows the browser. Timestamps in the API are always UTC.
mfarequired
object
withdrawals_frozen_untilrequired
ISODate | null
Present while a security freeze is active (48 h after password/MFA/email change).
notifications_seen_atrequired
ISODate | null
When this member last marked the notification bell read (POST /v1/me/notifications/seen); null until they first do. Items newer than this are unread.
limitsrequired
object
The active limits of the account (the platform default unless an admin set an override; UTC day and month windows) with the usage reserved so far.
created_atrequired
ISODate
accountsrequired
object[]
The accounts the signed-in person can work in, for the account switcher. Empty for an API key.
account_choice_requiredrequired
boolean
True while the person has several accounts and has never picked one; the dashboard asks which to open. Becomes false once they do (POST /v1/session/account).

Errors: 400 · 401 · 403 · 422 · 429 · 500

privacy

The signed-in member asks for their personal data to be deleted and sees what that does.

GET/v1/privacy/deletion-requestDashboard session only

What a deletion request would do, and the member's latest request

The plan lists every personal field with what happens to it: anonymised, restricted until the retention period of the account ends, or kept, each with a reason code. blocked is owner_of_open_account when the member is the only owner of an account that is still open.

Auth: Dashboard session

Response 200 · DeletionStatus

The plan and the latest request, if any.

planrequired
DeletionPlanItem[]
requestrequired
DeletionRequest | null
blockedrequired
"owner_of_open_account" | null

Errors: 401 · 429 · 500

POST/v1/privacy/deletion-requestDashboard session only

Ask for the signed-in member's personal data to be deleted

Records the request; compliance staff process it. Processing anonymises personal fields, ends the member's sessions and keeps ids and financial rows. A tenant or member under a legal hold is not processed until the hold is released. One open request per member: deletion_request_exists (409). The only owner of an open account gets deletion_owner_blocked (409).

Auth: Dashboard session

Response 201 · DeletionRequest

Recorded.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
statusrequired
"requested" | "completed" | "rejected" | "cancelled"
requested_atrequired
ISODate
planrequired
DeletionPlanItem[]
processed_atrequired
ISODate | null
outcomerequired
DeletionPlanItem[]
What processing did, same shape as the plan. Empty until completed.

Errors: 401 · 409 · 429 · 500

POST/v1/privacy/deletion-request/cancelDashboard session only

Withdraw the open deletion request

Auth: Dashboard session

Response 200 · DeletionRequest

Withdrawn.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
statusrequired
"requested" | "completed" | "rejected" | "cancelled"
requested_atrequired
ISODate
planrequired
DeletionPlanItem[]
processed_atrequired
ISODate | null
outcomerequired
DeletionPlanItem[]
What processing did, same shape as the plan. Empty until completed.

Errors: 401 · 404 · 429 · 500

security

Sessions, devices, password, TOTP and passkeys of the signed-in user.

GET/v1/sessionsDashboard session only

Live sessions of the account

Auth: Dashboard session

Response 200 · object

Newest activity first; `current` marks the caller's session.

Errors: 401 · 500

DELETE/v1/sessions/{id}Dashboard session only

Revoke a session

Auth: Dashboard session

Parameters

idpathrequiredID

Response 204

Revoked (cookies are cleared when it was the current session).

Errors: 401 · 403 · 404 · 500

GET/v1/devicesDashboard session only

Known devices (browser installations) of the account

Auth: Dashboard session

Response 200 · object

Most recently seen first.

Errors: 401 · 500

DELETE/v1/devices/{id}Dashboard session only

Forget a device and end all its sessions

Auth: Dashboard session

Parameters

idpathrequiredID

Response 204

Device and its sessions revoked.

Errors: 401 · 403 · 404 · 500

POST/v1/password/changeDashboard session only

Change the password

Starts the 48-hour withdrawal freeze and signs out every other session. A new password found in a known data breach is refused with password_breached (400).

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

current_passwordrequired
string
new_passwordrequired
string
code
string
TOTP or passkey: step-up code; required once the user has a second factor.

Response 204

Password changed.

Errors: 400 · 401 · 403 · 500

POST/v1/totp/enrolDashboard session only

Start enrolling an authenticator app

Returns the seed once. Nothing counts as MFA until POST /v1/totp/confirm succeeds. When the user already has a passkey, code (a passkey: step-up code) is required.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · StepUpCode

code
string
TOTP or passkey: step-up code; required once the user has a second factor.

Response 201 · TotpEnrolment

Pending authenticator.

credential_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
secretrequired
string
Base32 seed, shown once.
otpauth_urirequired
string (uri)
otpauth://totp/... for a QR code.

Errors: 401 · 403 · 409 · 500

POST/v1/totp/confirmDashboard session only

Activate the pending authenticator with a first valid code

Starts the 48-hour withdrawal freeze.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CodeRequest

coderequired
string
Step-up code (6-digit TOTP or passkey: code from /v1/passkeys/assert/finish).

Response 204

Done.

Errors: 401 · 403 · 409 · 422 · 500

POST/v1/totp/disableDashboard session only

Remove the authenticator app (step-up required)

Starts the 48-hour withdrawal freeze.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CodeRequest

coderequired
string
Step-up code (6-digit TOTP or passkey: code from /v1/passkeys/assert/finish).

Response 204

Done.

Errors: 401 · 403 · 404 · 422 · 500

GET/v1/passkeysDashboard session only

Registered passkeys

Auth: Dashboard session

Response 200 · object

Oldest first.

Errors: 401 · 500

POST/v1/passkeys/register/beginDashboard session only

Start registering a passkey

Returns creation options for navigator.credentials.create() and an opaque ceremony token to send back to the finish call (valid 5 minutes). Once the user has a second factor, code (TOTP or passkey: step-up) is required.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · StepUpCode

code
string
TOTP or passkey: step-up code; required once the user has a second factor.

Response 200 · CeremonyStart

Options for the browser WebAuthn call plus the sealed ceremony token.

ceremonyrequired
string
Opaque, sealed server state; send it back unchanged in the finish call. Valid 5 minutes.
optionsrequired
object
{publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions} in go-webauthn's JSON encoding (base64url binary fields).

Errors: 401 · 500

POST/v1/passkeys/register/finishDashboard session only

Store the new passkey

Starts the 48-hour withdrawal freeze.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CeremonyFinish

ceremonyrequired
string
credentialrequired
object
The PublicKeyCredential returned by the browser, serialised with toJSON() (base64url fields).
name
string
Label for a new passkey (registration only).

Response 201 · Passkey

The passkey.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
namerequired
string
created_atrequired
ISODate
last_used_atrequired
ISODate | null

Errors: 400 · 401 · 403 · 422 · 500

POST/v1/passkeys/assert/beginDashboard session only

Start a passkey step-up for the signed-in user

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200 · CeremonyStart

Options for the browser WebAuthn call plus the sealed ceremony token.

ceremonyrequired
string
Opaque, sealed server state; send it back unchanged in the finish call. Valid 5 minutes.
optionsrequired
object
{publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions} in go-webauthn's JSON encoding (base64url binary fields).

Errors: 401 · 500

POST/v1/passkeys/assert/finishDashboard session only

Exchange a passkey assertion for a step-up code

The returned code (prefixed passkey:) is valid for 5 minutes wherever a TOTP code is accepted.

Auth: Dashboard session

Parameters

Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CeremonyFinish

ceremonyrequired
string
credentialrequired
object
The PublicKeyCredential returned by the browser, serialised with toJSON() (base64url fields).
name
string
Label for a new passkey (registration only).

Response 200 · object

Step-up code.

coderequired
string

Errors: 400 · 401 · 403 · 422 · 500

POST/v1/passkeys/{id}/removeDashboard session only

Remove a passkey (step-up required)

Starts the 48-hour withdrawal freeze.

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · CodeRequest

coderequired
string
Step-up code (6-digit TOTP or passkey: code from /v1/passkeys/assert/finish).

Response 204

Done.

Errors: 401 · 403 · 404 · 422 · 500

account

PATCH/v1/me/preferencesDashboard session only

Update display preferences

Partial update of locale (BCP-47, canonicalised), display_currency (one of the codes in GET /v1/rates) and time_zone (IANA name, or empty for the browser's zone).

Auth: Dashboard session

Request body · PreferencesPatch

locale
string
BCP-47 tag; canonicalised on save.
display_currency
CurrencyCode
ISO 4217 code of a supported display currency (see GET /v1/rates).
time_zone
string
IANA name, e.g. America/Sao_Paulo; an empty string goes back to the browser's zone.

Response 200 · Me

The updated account.

account_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
livemoderequired
boolean
False for objects created with a test-mode key (rvk_test_); they live in the sandbox and never touch real funds.
account_namerequired
string
The merchant's display name.
rolerequired
unknown
The caller's role; for an API key, the role of the member who created it.
emailrequired
string (email)
usernamerequired
string
localerequired
string
BCP-47 tag, e.g. en, pt-BR, ar. Default en.
display_currencyrequired
unknown
Currency balances are shown in. Default USD.
time_zonerequired
string | null
IANA zone dates are shown in, e.g. Europe/Lisbon; null follows the browser. Timestamps in the API are always UTC.
mfarequired
object
withdrawals_frozen_untilrequired
ISODate | null
Present while a security freeze is active (48 h after password/MFA/email change).
notifications_seen_atrequired
ISODate | null
When this member last marked the notification bell read (POST /v1/me/notifications/seen); null until they first do. Items newer than this are unread.
limitsrequired
object
The active limits of the account (the platform default unless an admin set an override; UTC day and month windows) with the usage reserved so far.
created_atrequired
ISODate
accountsrequired
object[]
The accounts the signed-in person can work in, for the account switcher. Empty for an API key.
account_choice_requiredrequired
boolean
True while the person has several accounts and has never picked one; the dashboard asks which to open. Becomes false once they do (POST /v1/session/account).

Errors: 400 · 401 · 403 · 500

POST/v1/me/notifications/seenDashboard session only

Mark the notification bell read

Stamps the signed-in member's Me.notifications_seen_at with the current time. It is kept per member, so the unread count follows the person across devices and other members are unaffected. Safe to repeat. Any signed-in member; an API key is refused.

Auth: Dashboard session

Response 204

Marked.

Errors: 401 · 403 · 500

PUT/v1/me/countryDashboard session only

Give the country the business is registered in

For an account that has no country on record, which is every account created before sign-up asked for one. Until it has one, POST /v1/payment-intents is refused with country_required; payouts, refunds and returns are not affected. It only fills a missing country: once one is on record, declared or confirmed by staff, only staff correct it (409 country_already_set). Owners and admins only, signed in; an API key is refused.

Auth: Dashboard session

Request body · CountryRequest

countryrequired
string
The country the business is registered in (ISO 3166-1 alpha-2), case-insensitive.
subdivision
string
An ISO 3166-2 code inside country, needed only where a rule targets a region.

Response 200 · MarketEligibility

What the market allows now.

country_requiredrequired
boolean
True when the merchant has no country on record; new payments are refused with country_required until PUT /v1/me/country supplies one.
statusrequired
"allowed" | "servicing" | "blocked"
The strictest state across the activities an existing merchant can still start.
marketrequired
object | null
Null when no country is on record, in which case no market rule applies.
version_idrequired
ID | null
The eligibility matrix version this answer came from; operations are pinned to the version they were judged under.
versionrequired
integer
activitiesrequired
object[]

Errors: 400 · 401 · 403 · 409 · 500

catalogue

GET/v1/assets

Enabled assets and networks

One entry per asset and network pair with limits, contract and price.

Auth: none

Response 200 · object

Assets in display order.

Errors: 429 · 500

conversions

Currency conversion through a venue. Off for everyone until the venue is qualified and enabled by two staff members: while it is off every endpoint answers `409 conversion_unavailable` and nothing reaches the venue. A quote is indicative and an execution is at market, so every conversion keeps the quoted output next to the actual one and the slippage between them.

POST/v1/conversions/quotesDashboard session only

Ask for an indicative conversion quote

Session only. Records the request and returns 202 with the conversion in quoting; poll GET /v1/conversions/{id} until it is quoted. The quote is indicative and expires at expires_at.

Auth: Dashboard session

Parameters

X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · ConversionQuoteRequest

from_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
to_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
amountrequired
BaseUnits
Non-negative integer amount in the asset's smallest unit, as a decimal string.

Response 202 · Conversion

The conversion, awaiting its quote.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
statusrequired
"quoting" | "quoted" | "submitting" | "completed" | "failed" | "unknown"
from_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
to_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
from_amountrequired
BaseUnits
Non-negative integer amount in the asset's smallest unit, as a decimal string.
quoted_amountrequired
BaseUnits | null
The venue's indicative output; null until the quote arrives.
quoted_raterequired
string | null
indicativerequired
boolean
Always true; the venue promises no minimum output.
quoted_atrequired
ISODate | null
expires_atrequired
ISODate | null
actual_amountrequired
BaseUnits | null
What the venue delivered; null until the conversion completes.
slippage_bpsrequired
integer | null
How far the actual output fell short of the quote, in basis points; negative when it beat the quote.
failure_reasonrequired
string | null
legsrequired
ConversionLeg[]
created_atrequired
ISODate
completed_atrequired
ISODate | null

Errors: 400 · 409

POST/v1/conversionsDashboard session only

Execute a quoted conversion at market

Session only. Holds the source amount and queues the conversion; returns 202 with the conversion in submitting. The output is whatever the venue delivers, which can differ from the quote.

Auth: Dashboard session

Parameters

X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · ConversionRequest

quote_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.

Response 202 · Conversion

The conversion, now submitting.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
statusrequired
"quoting" | "quoted" | "submitting" | "completed" | "failed" | "unknown"
from_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
to_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
from_amountrequired
BaseUnits
Non-negative integer amount in the asset's smallest unit, as a decimal string.
quoted_amountrequired
BaseUnits | null
The venue's indicative output; null until the quote arrives.
quoted_raterequired
string | null
indicativerequired
boolean
Always true; the venue promises no minimum output.
quoted_atrequired
ISODate | null
expires_atrequired
ISODate | null
actual_amountrequired
BaseUnits | null
What the venue delivered; null until the conversion completes.
slippage_bpsrequired
integer | null
How far the actual output fell short of the quote, in basis points; negative when it beat the quote.
failure_reasonrequired
string | null
legsrequired
ConversionLeg[]
created_atrequired
ISODate
completed_atrequired
ISODate | null

Errors: 404 · 409

GET/v1/conversions/{id}Dashboard session only

A conversion with its quoted and actual output

Auth: Dashboard session

Parameters

X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
idpathrequiredID

Response 200 · Conversion

The conversion.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
statusrequired
"quoting" | "quoted" | "submitting" | "completed" | "failed" | "unknown"
from_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
to_asset_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
from_amountrequired
BaseUnits
Non-negative integer amount in the asset's smallest unit, as a decimal string.
quoted_amountrequired
BaseUnits | null
The venue's indicative output; null until the quote arrives.
quoted_raterequired
string | null
indicativerequired
boolean
Always true; the venue promises no minimum output.
quoted_atrequired
ISODate | null
expires_atrequired
ISODate | null
actual_amountrequired
BaseUnits | null
What the venue delivered; null until the conversion completes.
slippage_bpsrequired
integer | null
How far the actual output fell short of the quote, in basis points; negative when it beat the quote.
failure_reasonrequired
string | null
legsrequired
ConversionLeg[]
created_atrequired
ISODate
completed_atrequired
ISODate | null

Errors: 404

address book

POST/v1/address-bookDashboard session only

Save a payout address

Signed-in owner, admin or finance members only, with a step-up MFA code. The entry starts as cooling_off and becomes active after 24 h. An address with the same first and last four characters as a saved one is refused (422 lookalike_address).

Auth: Dashboard session

Parameters

X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · AddAddressRequest

labelrequired
string
networkrequired
NetworkID
addressrequired
string
memo
string
Destination tag or memo, when the network needs one (TON).
coderequired
string
Step-up MFA code (TOTP or passkey assertion token).

Response 201 · AddressBookEntry

The new entry.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
labelrequired
string
networkrequired
NetworkID
addressrequired
string
memorequired
string | null
Destination tag or memo the network needs (TON), if any.
statusrequired
"cooling_off" | "active"
active_fromrequired
unknown
End of the 24 h cooling-off period.
created_atrequired
ISODate

Errors: 400 · 401 · 403 · 409 · 422 · 429 · 500

POST/v1/address-book/{id}/removeDashboard session only

Remove a saved payout address (step-up MFA)

Auth: Dashboard session

Parameters

idpathrequiredID
X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

coderequired
string

Response 204

Removed; payouts already prepared keep their destination.

Errors: 404 · 422

oauth

Authorization server for MCP clients. Discovery at `/.well-known/oauth-authorization-server` (RFC 8414). Public clients only, registered dynamically (RFC 7591) or identified by an https client ID metadata document. The consent screen lives in the dashboard; a team member approves with a passkey or TOTP code, and the app never gets more than that member's role allows.

GET/.well-known/oauth-authorization-server

Authorization server metadata (RFC 8414)

Auth: none

Response 200 · object

Issuer, endpoints, `code_challenge_methods_supported: [S256]`, `client_id_metadata_document_supported: true`.

POST/oauth/register

Register a public client (RFC 7591)

redirect_uris must be https, http on a loopback host (any port matches), or a private-use scheme. token_endpoint_auth_method must be none. Limited per IP. No Idempotency-Key.

Auth: none

Request body · object

redirect_urisrequired
string[]
client_name
string
client_uri
string (uri)
token_endpoint_auth_method
"none"
grant_types
"authorization_code" | "refresh_token"[]
response_types
"code"[]

Response 201 · object

The registered client.

Errors: 400 · 429

GET/oauth/authorize

Start an authorization (browser)

Validates the request and redirects the browser to the dashboard's consent screen (/oauth/consent?request=<id>). resource (the MCP server URL), code_challenge and code_challenge_method=S256 are required. An unknown client or unregistered redirect URI is shown as an error page and never redirected to; other errors return to the client with error, state and iss.

Auth: none

Parameters

response_typequeryrequired"code"
client_idqueryrequiredstring
redirect_uriqueryrequiredstring
code_challengequeryrequiredstring
code_challenge_methodqueryrequired"S256"
resourcequeryrequiredstring (uri)
scopequerystring
statequerystring

Errors: 302 · 400

POST/oauth/token

Exchange a code or refresh token

Form-encoded. authorization_code needs code, client_id, redirect_uri and code_verifier; a failed PKCE check burns the code, and a code presented twice revokes the grant. refresh_token rotates: a refresh token used twice revokes the grant. scope on a refresh may only narrow. Access tokens last 15 minutes, refresh tokens 30 days, and a connection 90 days from consent however often it refreshes. A wrong code_verifier does not use up the code.

Auth: none

Response 200 · object

`access_token`, `token_type: Bearer`, `expires_in`, `refresh_token`, `scope`.

access_tokenrequired
string
token_typerequired
"Bearer"
expires_inrequired
integer
refresh_tokenrequired
string
scoperequired
string

Errors: 400

POST/oauth/revoke

Revoke a token (RFC 7009)

Revokes the whole grant behind a token the client owns. Unknown tokens are not an error.

Auth: none

Response 200

Revoked, or nothing to revoke.

connected apps

The dashboard's consent screen and the list of connected OAuth apps (signed-in members only).

GET/v1/oauth/requests/{id}Dashboard session only

What an app is asking for

Everything shown comes from the client's registration and our scope catalogue, never from model output. Only the browser that called /oauth/authorize can read or answer the request (a wp_oauth_browser cookie set there), so a forwarded consent link is refused.

Auth: Dashboard session

Parameters

idpathrequiredID

Response 200 · ConsentRequest

The pending request.

idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
clientrequired
object
redirect_urirequired
string
resourcerequired
string
scopesrequired
object[]
expires_atrequired
ISODate

Errors: 403 · 404

POST/v1/oauth/requests/{id}/approveDashboard session only

Connect the app

Needs a passkey or TOTP code. scopes may narrow the request; each must be allowed for the member's role.

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

coderequired
string
scopes
string[]

Response 200 · RedirectTo

Where to send the browser (the client's redirect URI with `code`, `state` and `iss`).

redirect_torequired
string (uri)

Errors: 403 · 404 · 422

POST/v1/oauth/requests/{id}/denyDashboard session only

Decline the app

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200 · RedirectTo

The client's redirect URI with `error=access_denied`.

redirect_torequired
string (uri)

Errors: 403 · 404

GET/v1/oauth/grantsDashboard session only

Connected apps

Auth: Dashboard session

Response 200 · object

Newest first, revoked ones included.

POST/v1/oauth/grants/{id}/revokeDashboard session only

Disconnect an app

The member who connected it, or an owner or admin. Its tokens stop working at once.

Auth: Dashboard session

Parameters

idpathrequiredID
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200

Revoked.

Errors: 403 · 404

pricing

GET/v1/rates

FX rates per USD for the display currencies

From the latest snapshot, taken every five minutes. estimated is true when the snapshot is older than 15 minutes or none exists yet. Before the first snapshot, outside local development, rates is empty and clients keep showing USD. Clients convert USD-cent values from /v1/portfolio/history and asset prices with these rates.

Auth: none

Response 200 · Rates

Rates per 1 USD.

baserequired
string
taken_atrequired
ISODate
estimatedrequired
boolean
True when the snapshot is older than 15 minutes or no snapshot exists yet.
ratesrequired
object
Currency code to units per USD (USD is 1). Empty before the first snapshot outside local development.

Errors: 429 · 500

legal

The interface languages the platform enables and the legal texts merchants accept. Texts are versioned; an acceptance records the exact version and is never rewritten, so a later edit asks for a new acceptance without touching the old one.

GET/v1/languages

Interface languages the platform enables

The language pickers offer these tags only; default is what a new visitor gets.

Auth: none

Response 200 · Languages

Enabled languages in display order.

enabledrequired
string[]
defaultrequired
string
version_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.

Errors: 429 · 500

GET/v1/legal/{document}

The current text of a legal document

Markdown in the requested locale, falling back to the language alone and then to English; locale in the response says which was served. version_id is what an acceptance names.

Auth: none

Parameters

documentpathrequiredLegalDocumentName
localequerystring
BCP-47 tag; defaults to English.

Response 200 · LegalDocument

The document.

documentrequired
LegalDocumentName
version_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
localerequired
string
The locale served, after fallback.
titlerequired
string
markdownrequired
string
effective_fromrequired
ISODate

Errors: 404 · 429 · 500

GET/v1/legal/acceptancesDashboard session only

Where the account stands on each legal document

One entry per document: the current version, the version the account last accepted (if any) and whether that acceptance still covers the current text. An edit to one document never affects another's standing.

Auth: Dashboard session

Response 200 · object

One entry per document.

Errors: 401 · 429 · 500

POST/v1/legal/{document}/acceptDashboard session only

Accept the current text of a legal document

Records that the signed-in member accepted version_id for the account. The version must read the same as the text in force for that document, else legal_version_stale (409): load the document again. Acceptances are append-only; a new one is added, the old one stays.

Auth: Dashboard session

Parameters

documentpathrequiredLegalDocumentName
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · LegalAcceptInput

version_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
locale
string
The locale the member read; recorded with the acceptance.

Response 201 · LegalAcceptance

Recorded.

documentrequired
LegalDocumentName
current_version_idrequired
ID
Resource identifier. UUIDv7 for user-owned rows; catalogue ids are slugs like usdt-tron.
accepted_version_idrequired
ID | null
accepted_atrequired
ISODate | null
up_to_daterequired
boolean
True when the accepted version's text of this document reads the same as the current one.

Errors: 400 · 401 · 404 · 409 · 429 · 500

approvals

GET/v1/approvalsDashboard session only

Payouts waiting for a team member's approval

Auth: Dashboard session

Parameters

X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).

Response 200 · object

Newest first.

GET/v1/approvals/{id}Dashboard session only

One payout approval (the payout id)

Auth: Dashboard session

Parameters

idpathrequiredID
X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).

Response 200 · PendingApproval

The approval.

typerequired
"withdrawal" | "refund" | "overpayment_return"
operationrequired
Withdrawal

Errors: 404

POST/v1/approvals/{id}/approveDashboard session only

Approve a payout with step-up MFA

Owner, admin or finance members only. Never available to API keys. With two or more approvers on the account the preparer is refused (403 approver_must_differ); a late approval is refused with 409 approval_expired and the request is cancelled.

Auth: Dashboard session

Parameters

idpathrequiredID
X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Request body · object

coderequired
string
TOTP code or passkey step-up token.

Response 200 · PendingApproval

The payout, now `submitted` or `pending_review`.

typerequired
"withdrawal" | "refund" | "overpayment_return"
operationrequired
Withdrawal

Errors: 403 · 404 · 409 · 422 · 423

POST/v1/approvals/{id}/rejectDashboard session only

Reject a payout and release its funds

Auth: Dashboard session

Parameters

idpathrequiredID
X-Test-Modeheaderboolean
When true, a cookie-session request acts on the linked sandbox account (503 test_mode_unavailable when sandbox is disabled). Live API keys cannot switch modes (400 invalid_mode).
Idempotency-Keyheaderrequiredstring
Client-generated unique key (UUID recommended) that makes the POST safe to retry.

Response 200 · PendingApproval

The payout, now `cancelled`.

typerequired
"withdrawal" | "refund" | "overpayment_return"
operationrequired
Withdrawal

Errors: 404 · 409