
The REST API allows to create integrations, retrieve data and automate workflows. It accepts and returns JSON-encoded data, uses standard HTTP response codes and authentication using JSON Web Tokens.
The OpenAPI specification provides the standardized documentation of the API that both humans and computers are able to discover and understand. Check the Swagger documentation for more information.
To authenticate a request, a JSON Web Token is included as an Authorization
header. The token needs to be signed using an application user’s authentication key.
To be able to authenticate you need to create an application user first. You can do this in your account at Account > Users > Application Users.
After creating an application user, the user’s ID and authentication key will be shown to you. Please be aware, that once you close the dialog or browser window, you will not be able to see the authentication key again. So make sure to write it down.
Please refer to https://jwt.io/ to learn how to generate and sign JSON Web Tokens and to find corresponding libraries.
{
"alg": "HS256", // Defines the signing algorithm that is used, must be `HS256`
"type": "JWT", // The type of the token, must be JWT
"ver": 1 // The version of the JWT authorisation method
}
{
"sub": "123456", // The ID of the application user whose authentication key is used to sign the token
"iat": 1664375069, // The current UNIX timestamp in seconds, used to prevent https://en.wikipedia.org/wiki/Relay_attack
"requestPath": "/api/customers/search?order=lastname", // The path component of the requested URL, including any query string
"requestMethod": "GET" // The HTTP method of the request, as uppercase string
}
The JSON Web Token needs to be signed using your application user’s authentication key. Depending on the tool you are using to generate the token, you need to decode the authentication key, as you get it base64-encoded.
The generated JSON Web Token is included as a header in the request to the API.
GET /api/customers/search?order=lastname HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsInZlciI6MX0.eyJzdWIiOiIxMjM0NTYiLCJpYXQiOjE2NjQzNzUwNjkwNTksInJlcXVlc3RQYXRoIjoiL2FwaS9jdXN0b21lcnMvc2VhcmNoP29yZGVyPWxhc3RuYW1lIiwicmVxdWVzdE1ldGhvZCI6IkdFVCJ9.1QNdpsjZSnavrJkNM7aiAWHEXZS_o9Tnpg6pt3VDBUA
API methods return HTTP status codes to indicate success or failure. Some errors include an error code that allows to identify and handle the error programmatically. The response body to a failed request contains detailed information, see Error Response.
Status | Description |
---|---|
400 Bad Request |
The request was not accepted often due to missing or invalid parameters. |
401 Unauthorized |
The necessary authentication credentials are missing or incorrect. |
403 Forbidden |
The application user is missing the required permissions. |
404 Not Found |
The requested resource was not found. |
406 Not Acceptable |
The requested response format is not supported. |
409 Conflict |
The request conflicts with another request often because of to optimistic locking. |
413 Payload Too Large |
Too many operations in a bulk request. |
415 Unsupported Media Type |
The request provides unsupported or invalid data. |
416 Range Not Satisfiable |
The pagination offset exceeds the limit. |
422 Unprocessable Entity |
The request is well-formed but contains semantic errors. Check the response body for details. |
429 Too Many Requests |
Too many requests hit the API too quickly. |
5xx Errors |
An internal error occurred on the server. |
If an object is modified by multiple users or processes at the same time, this can lead to race conditions. To prevent this, the API uses optimistic locking.
An object that is potentially affected will have a version
property which gets incremented everytime the object is updated. When updating an object, its current version needs to be fetched and included in the update request.
If the version is missing or it does not match the current value, the update request will be declined and a response with HTTP status 409 Conflict
will be returned. In this case, the current version needs to be fetched and the update request sent again.
Many objects allow you to request additional information by expanding the response using the expand
request parameter. This parameter is available on many API methods like list, search, create and update.
Properties that can be expanded are marked accordingly in this documentation. There are two different kinds of expandable properties.
Linked objects are often represented by their IDs in API responses. These objects can be expanded using the expand
parameter to be fully included in the response.
Some available properties are not included in responses by default. They can be requested by using the expand
parameter.
Properties can be expanded recursively by specifying nested fields using a dot (.
). Expanding charge.transaction
will include the full charge
object as well as the full transaction
object. The maximum depth is at four levels.
Multiple properties can be expanded at once by specifying all of them in the expand
parameter separated by commas (,
).
expand=charge.transaction,labels
The same search query syntax is used accross the API for all search
API methods. The search query is passed in the query
parameter.
A search query is made up of terms, connectives, modifiers and comparators. The search grammar is expressed as EBNF with the following terminal symbols:
Item | Description |
---|---|
|
Any sequence of space, tab, or newline characters |
|
Any sequence of non-whitespace, non-special characters |
|
Any name, or any quoted string (single or double quotes are both permitted) |
Query = Term { [ whitespace Connective ] whitespace Term }
A query consists of one or more terms separated by whitespace or single connectives.
Connective = "AND" | "OR"
If no connective is specified between two terms, AND
is implied.
Term = [ Modifier ] ( "(" Query ")" | name Comparator [ value ] )
A term consists of an optional modifier, followed by either a subquery enclosed in parantheses, or a name, comparator and value.
Values can be quoted (single or double quotes). If the value does not contain any whitespace, the quotes are optional.
Modifier = "-" | "NOT" whitespace
-
with no following whitespace and NOT
followed by whitespace mean the same thing.
Comparator = ":" | ":<" | ":>" | ":<=" | ":>=" | ":*" | ":~"
Comparator | Description |
---|---|
|
Equals (case-insensitive) |
|
Less than |
|
Greater than |
|
Less than or equal |
|
Greater than or equal |
|
Is |
|
Contains |
query=firstName:"John Peter" lastName:Doe
Search for John Peter
as first name AND Doe
as last name
query=charge.transaction.state=PENDING AND currency=EUR
Search for objects linked to pending transactions AND with currency EUR
query=quantity:>2 quantity:<=10
Search for objects with quantities between 3 and 10.
query=NOT currency:EUR
query=-currency:EUR
Search that excludes objects with currency EUR
.
query=state:SUCCESSFUL AND (currency:CHF OR currency:EUR)
Search for successful objects with currency CHF
or EUR
query=paymentMethod:*
Search for objects without a payment method.
The Is NULL
comparator (:*
) does not ask for a value.
query=color:~red,blue,green
Search for objects with all the colors red
, blue
and green
.
The objects retrieved from a search
API method can be sorted by specifying the order
parameter. They can be ordered by multiple fields.
order=lastName
order=lastName+firstName
order=lastName:ASC+firstName:DESC
The fields are separated by a space. The order (ASC
or DESC
) can be explicitly specified by adding it after a :
. If no order is specified, ASC
is implied.
The response of a list
API method represents a single page of objects. The parameters limit
, before
, after
and order
can be used to control pagination. If you specify none of them, you will receive the first 10 objects in chronological order.
You can set the after
parameter to an object’s ID to retrieve the page of objects coming immediately after the named object in the applied order. Similarly, you can use the before
parameter to retrieve the objects coming immediately before the named object. Both parameters after
and before
can be set at the same time to get a specific range of objects.
Use the limit
parameter to specify the maximum number of objects that should be returned. This cannot exceed 100.
The response of a search
API method represents a single page of filtered objects. The parameters limit
and offset
can be used to control pagination. If you specify none of them, you will receive the first 10 objects.
The offset
parameter allows you to get objects at an offset. So if you set offset
to 20, the first 20 objects will be skipped and the first object returned will be the 21st.
Use the limit
parameter to specify the maximum number of objects that should be returned. This cannot exceed 100.
Some objects have a metadata
property. You can use this property to attach arbitrary key-value data to these objects. Metadata can be used for storing additional, structured information on an object. Metadata is not used or changed by the system.
You can specify up to 25 keys, with key names up to 40 and values up to 512 characters long.
Do not store any sensitive information (bank account numbers, card details, passwords, …) in metadata.
This section details all API services and their operations. An operation may accept data as part of the path, in the request’s header, as query parameter or in the request’s body.
Here is an example request to update a customer:
POST /api/v2/customers/123?expand=metaData HTTP/1.1
Space: 1
Authorization: Bearer [calculated JWT token]
{"version": 1, "givenName": "Jane", "familyName": "Doe"}
Get query execution for Portal analytics query token. (Potentially, this is a long-running request. Max request timeout ~100 sec. Queries are processed asynchronously and may take few minutes to reach the final status. Assume long polling, which can take up to 100 seconds. If obtained queryresult still has status "processing" - repeat the call later. Please avoid making frequent requests to this endpoint,this will not have any effect on query processing.HTTP status codes: 200 - OK. Query reached its final status. If query is under processing 200 status is returned with Retry-After header; 5xx - Internal server errors; )
97 seconds
Generate a short-living (5 min) URL of Analytics query result file. Each download of the output file is billed, we also count each file URL generation as potential attempt of file download. NB: Please, DO NOT use this endpoint for periodic checks of the result file availability - use 'Get query details by Query token' for periodic checks instead. HTTP status codes: 200 - OK (short-living URL is available); 202 - Result is expected to be available later; 204 - Empty result set (this may mean that query was cancelled or has failed); 404 - No query found for the given token;
Permanently deletes an account. It cannot be undone.
Permanently deletes a space. It cannot be undone.
Permanently deletes a payment connector configuration. It cannot be undone.
Permanently deletes a payment link. It cannot be undone.
Permanently deletes a payment method configuration.
Permanently deletes a payment processor configuration.
This operation creates a set of credentials to use within the WebSocket.
Starts a payment terminal transaction and waits for its completion. If the call returns with a long polling timeout status, you may try again. The processing of the transaction will be picked up where it was left off.
90 seconds
Starts a payment terminal transaction and waits for its completion. If the call returns with a long polling timeout status, you may try again. The processing of the transaction will be picked up where it was left off.
90 seconds
Permanently deletes a payment terminal. It cannot be undone.
Fetch the payment page URL that is been applied on the charge flow linked with the provided transaction. The operation might return an empty result when no payment page is needed or when it cannot be invoked.
This operation checks if the given transaction can be used to create a token out of it.
Create transaction credentials to delegate temporarily the access to the web service API for this particular transaction.
Ccreates the URL which can be used to embed the JavaScript for handling the iFrame checkout flow.
Returns the invoice PDF document for transaction with the given id and the given target media type.
Creates the URL which can be used to embed the JavaScript for handling the Lightbox checkout flow.
Returns the packing slip PDF document for transaction with the given id and the given target media type.
Get the payment method configurations which can be used with the provided transaction.
Creates the URL to which the user should be redirected to when the payment page should be used.
Returns all receipts for the requested terminal transaction.
Builds the URL which is used to load the payment form within a WebView on a mobile device. This operation is typically called through the mobile SDK.
Returns the token version objects which references the tokens usable as one-click payment tokens for the provided transaction.
Get the payment method configurations which can be used with the provided transaction.
Export transactions into a CSV file.
60 seconds
Apply the appropriate charge flow to the specified transaction.
Cancel the charge flow that is linked with the transaction indicated by the given ID.
Completes the transaction offline. The completion is not forwarded to the processor. This implies the processor does not do anything. This method is only here to fix manually the transaction state.
Completes the transaction online. The completion is forwarded to the processor. This implies that the processor may take some actions based on the completion.
This operation can be used to partially complete the transaction offline. This implies the processor does not do anything. This method is only here to fix manually the transaction state.
This operation can be used to partially complete the transaction online. The completion is forwarded to the processor. This implies that the processor may take some actions based on the completion.
Marks the transaction as confirmed. Once the transaction is confirmed no more changes can be applied.
The process method will process the transaction with the given card details without using 3-D secure.
The process method will process the transaction with the given card details by eventually using 3-D secure. The buyer has to be redirect to the URL returned by this method.
This operation processes the given transaction by using the token associated with the transaction.
This operation processes the transaction without requiring that the customer is present. It applies strategies to process the transaction without a direct interaction with the buyer. This operation is suitable for recurring transactions.
This operation voids the transaction online. The void is forwarded to the processor.This implies the processor does not do anything. This method is only here to fix manually the transaction state.
This operation voids the transaction online. The void is not forwarded to the processor. This implies that the processor may take some actions based on the void.
Assigns the given token to the transaction and processes it. It will return a URL where the customer has to be redirected to complete the transaction.
Sends the payment link of the charge flow level with the given 'id'.
Returns the token version which is currently active given by the token id. In case no token version is active the method will return null.
Creates a transaction which allows the updating of the provided token.
Permanently deletes a token. It cannot be undone.
Marks the delivery indication as not suitable.
Marks the delivery indication as suitable.
Returns the PDF document for the refund with given id and the given target media type.
This operation allows to mark a refund as failed which is in state MANUAL_CHECK.
This operation allows to mark a refund as successful which is in state MANUAL_CHECK.
Returns whether the transaction invoice with the given id can be replaced.
Returns the PDF document for the invoice with given id and the given target media type.
Marks the transaction invoice with the given id as derecognized.
Marks the transaction invoice with the given id as paid.
Replaces the transaction invoice with given id with the replacement.
Permanently deletes a application user. It cannot be undone.
Export human users into a CSV file.
60 seconds
Permanently deletes a human user. It cannot be undone.
Permanently deletes a role. It cannot be undone.
Permanently deletes a single sign-on user. It cannot be undone.
Permanently deletes a saved view. It cannot be undone.
Return true if the web app is installed in the provided space.
Confirm the installation of a web app. This has to be done when the user returns to the web app after granting permissions, using the activation code provided in the request.
Uninstall the web app from the provided space.
This section details all models that are accepted or returned by API operations.
Request to be sent to Analytics database.
Response for Analytics query execution.
Submitted Analytics query execution
Represents the result of a single operation in a bulk request.
A document template contains the customizations for a particular document template type.
A manual task requires the manual intervention of a human.
The manual task type indicates what kind of manual task is required to be executed by the human.
This model holds the card data and optional cardholder authentication details.
This model holds the card data and optional cardholder authentication details.
Request to process a card transaction without using 3D-Secure.
This model holds the additional card authentication.
This model holds the additional card authentication.
This model holds the cardholder authentication data (e.g. 3-D Secure authentication).
This model holds the cardholder authentication data (e.g. 3-D Secure authentication).
A payment information hash is calculated based on the information entered by the user. The same input leads to the same hash. The hash is collision free.
The payment link defines an URL to automatically create transactions.
The refund represents a credit back to the customer. It can be issued by the merchant or by the customer (reversal).
The receipt fetch request allows to retrieve the receipt documents for a terminal transaction.
This model holds the card data in plain.
This model holds the card data in plain.
Request to process a card transaction with using 3D-Secure.
The transaction invoice represents the invoice document for a particular transaction.
The payment method configuration builds the base to connect with different payment method connectors.
Payment processors handle the connection to third part companies (payment service providers) that technically manage payment transactions and therefore process payments.
A condition allows you to define a criteria that a transaction must fulfill in order for a connector configuration to be considered for processing the payment.
The confirmation response provides details about the installation of the web app.
The webhook identity represents a set of keys that will be used to sign the webhook messages.