Cresora Commerce Documentation

🔬Preview stream (/api/v1-preview)

These endpoints are reserved or behind feature flags and may change before promotion to stable. Operations badged “Reserved — not yet available”return 404 (or 501) today; do not build against them yet. This spec is generated from the canonical contract — see the stable /api/v1 reference for production-ready endpoints.

Api KeysAPI key management — list active keys, rotate, revoke.
CapabilitiesQuery what your partner can do today — enabled features, certification status, MCC scope.
CertificationRequest and track partner certification checks. Certification is the gate a partner clears before onboarding real merchants.
ConfigPartner configuration — webhook URL, IP allowlist, HPP defaults, rate-limit tier, AVS decline policy. Read your own config; write via `PUT /config/partners/{partnerId}`. Rate-limit tier and AVS decline policy are Cresora-managed (admin-only); webhook URL, HPP settings, and IP allowlist are partner self-service.
Custom FieldsPer-merchant custom-field definitions — up to 10 fields per merchant (a Cresora product cap; the gateway documents none). Definitions are delivered onto the merchant's gateway record and the field VALUES ride transaction creates (Sale / Authorization / ACH debit + recurring contract create) and hosted-page checkouts. Partner self-service (`custom_fields:config:read` / `custom_fields:config:write`); the merchant is scoped from your API key, never a path/body param.
CustomersPayer customers under a merchant. A customer owns the merchant's stored payment methods (the tokenization vault). Partner self-service (`customer:read` / `customer:write`); the merchant is the path scope and the partner is scoped from your API key.
HealthService health and liveness probes — for partner integration monitoring and uptime dashboards. Unauthenticated endpoint.
H P PHosted Payment Pages — Cresora-hosted checkout. PCI scope stays with Cresora + the gateway. The partner only handles the session redirect and the callback on completion.
MerchantsMerchant lifecycle — create, submit for underwriting review, update, and close merchant accounts. Merchants progress through a state machine owned by Cresora Operations.
NotificationsPartner-portal notification feed — the bell dropdown and `/notifications` page. Read state is tracked per portal user: one teammate marking a notification as read does not clear it for the rest of the team. Primarily a portal-session surface; API keys can read it with the `notification:read` / `notification:update` scopes.
PartnersPartner self-service reads. The `/partner/me` endpoint returns the partner record bound to the authenticated caller's API key — useful for portal "who am I" displays and federated-identity contracts. Admin cross-tenant partner lookups (`GET /iam/partners` and `GET /iam/partners/{id}`) live in the admin-only surface — partners cannot use those paths.
RecurringManage recurring billing plans. First payment captures a gateway token via HPP; subsequent charges use the stored token. Retries are configurable per plan (soft decline + ACH R01).
Stored credentialsThe tokenization vault — cards a merchant has stored for reuse. Entries are minted at a hosted-page (HPP) establishing completion, not created directly; ISVs list, inspect, and revoke them, and charge a stored card by its opaque vault token (`stored_credential:read` / `:revoke` / `:charge`). The charge path is part of the stored-credential (MIT/COF) reuse program, which is gated on a pending gateway release — calls return `503` until it is enabled for the deployment.
TerminalsRegister, provision, suspend and reactivate POS terminals. Terminal runtime communication uses WebSocket — see the separate AsyncAPI spec for the terminal protocol.
TransactionsProcess card sales, refunds, voids, authorizations and captures. Batch close operations for settlement timing.
WebhooksManage webhook subscriptions — event types, delivery URLs, HMAC secret rotation. See `webhooks:` section for event schemas.

Cresora Commerce API (v1-preview)