Cresora Commerce Documentation

Hosted Payment Pages — Cresora-hosted checkout. PCI scope stays with Cresora + the gateway. The partner only handles the session redirect and the callback on completion.

🔬Preview stream (/api/v1-preview)

These endpoints are reserved or behind feature flags and may change before promotion to stable. Operations badged “Reserved — not yet available”return 404 (or 501) today; do not build against them yet. This spec is generated from the canonical contract — see the stable /api/v1 reference for production-ready endpoints.

Create HPP session

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

Obtain via Partner Portal → Settings → API keys. Keys are only shown in full at creation/rotation time — Cresora does not retain the full value in retrievable form. Rotate any key that may have been exposed via logs, client code, or source control.

In: header

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Format: 1–128 characters of letters, digits, . _ : -. Anything else is rejected with 400 validation_error. The character set is narrower than base64: padded base64 (+ / =) is NOT accepted, base64url is. The key is forwarded verbatim to the payment gateway on transaction creates, so it must satisfy the gateway's key contract too — rejecting locally gives you an actionable error instead of an opaque upstream failure mid-request.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Retrying after an indeterminate failure. On 502 gateway_outcome_unknown the transaction is recorded as pending and the outcome is not yet known — retry with the SAME key (a fresh key risks a double charge) or poll the transaction. This is also what a gateway-side "an earlier request with this key is still in flight" response surfaces as.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

merchant_id*string

Formatuuid

amount?string

REQUIRED (and positive) for a chargeable session. MUST be omitted — or sent as exactly "0.00" — when save_card_only=true: a save-card-only session performs a zero-dollar account verification, not a charge, and the gateway rejects a non-zero amount on it. A missing/zero amount on a chargeable session, or a positive amount on a save-card-only session, returns 400 validation_error with a field-level message.

Match^\d+\.\d{2}$

currency?Currency

ISO 4217 currency code. Phase 1 supports USD only.

Value in"USD"

payment_method?string

Payment instrument the HPP should accept.

card — Cresora-hosted card entry form. Customer fills PAN/CVV/expiry on the gateway-hosted page (Cresora out of PCI scope).
ach — Cresora-hosted ACH form with NACHA WEB consent flow. Customer enters routing/account, ticks the WEB authorization checkbox before submission. Settlement window: 1-3 banking days. Returns possible per the standard NACHA R-code catalog.

When ach, the HPP also requires merchant.profile.allow_ach = true (configured at merchant onboarding).

Default"card"

Value in"card" | "ach"

expires_in_seconds?integer

Session TTL in seconds. Defaults to the platform-configured value (900s) when omitted; clamped to the vendor bounds.

Range60 <= value <= 900

rendering_mode?HppRenderingMode

Rendering surface for the HPP session.

redirect (default) — partner redirects the customer browser to hpp_url. Customer pays on the gateway-hosted page; on completion the browser is returned to the page's configured success-redirect destination. Completion is also delivered to the partner as an hpp.session.completed webhook event.
iframe — partner embeds the HPP in an <iframe> on their own page. Requires parent_origin; the gateway emits postMessage events back to the parent. Customer never leaves the partner's site.

Choice is per-session — same gateway-hosted page renders both surfaces; the difference is server-side activation of the postMessage event channel.

Value in"redirect" | "iframe"

parent_origin?string

REQUIRED when rendering_mode=iframe. HTTPS origin string (scheme + host only, no path, no trailing slash), e.g. https://shop.example.com. The gateway uses this as the targetOrigin argument on every postMessage call.

Host MUST match an entry in the HPP page's configured AllowedEmbeddingDomains allow-list — session creation is rejected at the vendor side if it does not (fail-closed: an empty allow-list rejects every parent_origin). Matching is host-only; an explicit port on the origin is ignored.

Local development: https://localhost[:port] is accepted only when the page's allow-list carries the explicit localhost entry (see the embedding-domains endpoints under /config/hpp-page); any other loopback origin is rejected with parent_origin_unsafe.

Rejected when rendering_mode=redirect.

Match^https://[^/]+$

Lengthlength <= 256

allowed_embedding_domains?array<>

Per-session replica of the HPP page-level AllowedEmbeddingDomains allow-list. Hostnames (NOT URLs); wildcard subdomain prefix (*.example.com) allowed; raw IPs / no-TLD entries rejected. The literal localhost is accepted as an explicit allow-list entry for local iframe development. Max 20 entries.

Cresora persists the list locally for audit replay. Vendor-side sync via the page-management API is pending vendor confirmation.

Itemsitems <= 20

tokenize?boolean

Request that the card be saved when this session's payment succeeds. On success Cresora vaults the credential and delivers the CRESORA saved-card reference to your hpp_session.completed webhook as data.cresoraVaultToken (a cvt_… value, also readable via the stored-credentials API). The raw gateway token is never delivered. true forces tokenization on for this session regardless of the merchant default.

Charging the saved card later is a SALE on POST /transactions: send the cvt_… value as vault_token with a use_type (raw PAN and raw gateway tokens are never accepted at that boundary).

Defaultfalse

page_purpose?string

The session's page purpose — the canonical spelling of the session intent. payment (default) is a chargeable session. save_card saves the card WITHOUT charging it: the gateway runs a zero-dollar account verification ($0 auth + AVS/CVV + immediate void), then vaults the card and captures consent ("save card now, charge later"). save_card requires tokenize=true, payment_method=card, and amount omitted (or exactly "0.00"); it is incompatible with capture_mode: authorize. Equivalent to the legacy save_card_only: true — sending a non-save_card purpose together with save_card_only: true is a contradiction and returns 400.

save_card_with_initial_charge vaults the card AND charges the first payment of the inlined recurring_plan (required alongside): the completion materializes a CAPTURED sale for the plan's initial charge, the card is vaulted with recurring consent, and the GATEWAY creates the customer contract that originates the remaining payments. Requires tokenize=true, payment_method=card, amount omitted (the charge is plan-driven), a card-only hosted page for the merchant (else 422 hpp_page_not_card_only), and is incompatible with capture_mode: authorize and save_card_only: true.

Default"payment"

Value in"payment" | "save_card" | "save_card_with_initial_charge"

recurring_plan?|

Inline recurring-schedule definition — REQUIRED with (and exclusive to) page_purpose: save_card_with_initial_charge. The plan is a definition the gateway builds the customer contract from; the follow-up charges are gateway-originated.

save_card_only?boolean

Legacy synonym of page_purpose: save_card — new integrations should send page_purpose. Save the card WITHOUT charging it: the gateway runs a zero-dollar account verification ($0 auth + AVS/CVV + immediate void), then vaults the card and captures consent ("save card now, charge later"). Requires tokenize=true, payment_method=card, and amount omitted (or exactly "0.00") — see the amount field. The completion creates NO transaction (transaction_id stays null on the session); the deliverables are the cresoraVaultToken (cvt_…) saved-card reference and the card display block on the hpp_session.completed webhook + session status.

Defaultfalse

credential_usage?string

Permitted merchant-initiated use of the stored credential, captured as cardholder consent at tokenization time. A non-none value requires tokenize=true.

Default"none"

Value in"none" | "recurring" | "installment" | "unscheduled_cof" | "one_time_future"

capture_mode?string

How the hosted-page payment is captured. sale (default) — the payment is authorized and captured in one step; the completed session materializes a CAPTURED sale transaction (existing behaviour). authorize — the hosted page runs an authorization only; the completed session materializes an AUTHORIZED auth-only transaction that you capture later via POST /transactions/{transactionId}/capture. Card rail only, and incompatible with a card-capture session (page_purpose: save_card / save_card_only: true / page_purpose: save_card_with_initial_charge).

Default"sale"

Value in"sale" | "authorize"

amount_mode?string

How the hosted page treats the amount the payer sees. customer_entered (default) — the session sends no amount and the payer types it (historical behaviour; omitting the field is equivalent). suggested — the session's amount pre-fills the page but the payer may edit it (e.g. a suggested donation). locked — the session's amount pre-fills the page read-only and the gateway verifies on submit that the charged base (including supported fee components) matches the session amount (e.g. paying an invoice).

suggested and locked require a positive amount. Valid ONLY on the chargeable Payment flow — rejected with 400 on a save-card / card-capture session (page_purpose: save_card / save_card_only: true / page_purpose: save_card_with_initial_charge).

Default"customer_entered"

Value in"customer_entered" | "suggested" | "locked"

require_consent?|

Per-session override for whether the payer MUST tick the save-card consent box before the payment can be submitted. Tri-state:

omitted / null (default) — the gateway account-level consent setting applies (existing behaviour).
true — consent is mandatory: the hosted page blocks submission until the payer ticks the box. Use for flows that require an explicit card-on-file opt-in.
false — consent is optional: the box is shown but the payer may pay without ticking it. Declining completes a normal sale with no credential vaulted (data.cresoraVaultToken stays null) and no consent record written.

Requires tokenize=true (the consent box governs stored-credential capture; 400 otherwise).

Defaultnull

custom_fields?array<>

Merchant custom-field values (reconciliation identifiers — e.g. an invoice, tenant, or pay-by-link reference) carried onto the hosted page and, on completion, onto the materialized transaction. Each name must reference an ENABLED definition on the merchant that is VISIBLE on the hosted-payment-page surface; values are validated against the definition (400 custom_field_invalid otherwise). The values pre-fill the page's custom fields — a payer can edit a visible non-read-only field, and the gateway-confirmed values on the completion are authoritative over the submitted ones. Echoed on the materialized transaction's custom_fields and on the hpp_session.completed webhook.

Rejected with 422 custom_field_invalid when page_purpose is save_card: the hosted page does not render custom fields on save-card pages, so the values would be silently discarded.

Itemsitems <= 10

customer_email?string

Optional customer email pre-filled onto the hosted page. Strongly recommended when tokenize=true: the gateway vaults a saved card against a Customer record built from this email, so supplying it guarantees the card-on-file token is minted even if the payer leaves the (optional) email field blank. Also used for the payment receipt.

Formatemail

Lengthlength <= 254

customer_id?string

Optional CRESORA customer id (the id returned by POST /merchants/{merchant_id}/customers) binding this session to exactly one directory customer. When supplied, tokenization / consent capture resolves against THAT customer exclusively — no fallback to the email-derived find-or-create. Cresora resolves the gateway-side identity internally; gateway ids are never accepted or exposed on this surface.

The id is validated at session create: it must exist under this merchant, else the create is rejected with not_found (HTTP 404 — no cross-merchant binding). A gateway-side rejection of the resolved identity surfaces as hpp_customer_rejected (HTTP 422, retryable=false). This is NOT your own CRM reference — for free-form reconciliation identifiers use custom_fields. Omit for the default behaviour (customer derived from the cardholder email).

Formatuuid

level3_data?

Level 3 payload for the session's eventual transaction. The gateway stores it on the session and re-stamps it server-side on page submit (the payer's browser cannot tamper with it). Persisted on the session — echoed on GET /hpp/sessions/{sessionId} and attached to the materialized transaction on completion. Not accepted on save-card-only sessions (400 level3_not_supported_for_save_card_only). No level2_data on this surface: Level 2 on hosted-page flows comes from the merchant-level order-data defaults.

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/hpp/sessions" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea"  }'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "payment_method": "card",
  "state": "PENDING",
  "hpp_url": "http://example.com",
  "iframe_url": "http://example.com",
  "rendering_mode": "redirect",
  "capture_mode": "sale",
  "amount_mode": "customer_entered",
  "page_purpose": "payment",
  "recurring_plan": {
    "recurring_amount": "10.00",
    "frequency": "monthly",
    "interval": 1,
    "number_of_payments": 12,
    "initial_charge_amount": "49.99"
  },
  "customer_id": "160c0c4b-9966-4dc1-a916-8407eb10d74e",
  "amount": "42.50",
  "surcharge_amount": "42.50",
  "convenience_fee_amount": "42.50",
  "total_amount": "42.50",
  "currency": "USD",
  "expires_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/gateway_unavailable",
  "title": "Bad Gateway",
  "status": 502,
  "detail": "Payment gateway temporarily unavailable.",
  "instance": "urn:cresora:trace:0191c8a2-ebcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "gateway_unavailable",
  "retryable": true,
  "error_id": "0191c8a2-ebcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/gateway_timeout",
  "title": "Gateway Timeout",
  "status": 504,
  "detail": "Payment gateway read timeout - outcome indeterminate, replay only via idempotency key",
  "instance": "urn:cresora:trace:0191c8a2-abcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "gateway_timeout",
  "retryable": true,
  "error_id": "0191c8a2-abcd-7a31-8c44-d8f1e2c3a4b5"
}

Get HPP session status

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

sessionId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/hpp/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "state": "PENDING",
  "capture_mode": "sale",
  "amount_mode": "customer_entered",
  "page_purpose": "payment",
  "recurring_plan": {
    "recurring_amount": "10.00",
    "frequency": "monthly",
    "interval": 1,
    "number_of_payments": 12,
    "initial_charge_amount": "49.99"
  },
  "customer_id": "160c0c4b-9966-4dc1-a916-8407eb10d74e",
  "transaction_id": "0fec1e58-b197-4052-99cf-2218496c5482",
  "completed_at": "2019-08-24T14:15:22Z",
  "expires_at": "2019-08-24T14:15:22Z",
  "rendering_mode": "redirect",
  "last_attempt": {
    "at": "2019-08-24T14:15:22Z",
    "reason": "reversed"
  },
  "card": {
    "last4": "string",
    "expiry_month": 1,
    "expiry_year": 0,
    "brand": "string"
  },
  "token_capture_failure": {
    "at": "2019-08-24T14:15:22Z",
    "reason": "string"
  },
  "level3_data": {
    "ship_from_zip": "78701",
    "destination_zip": "90210",
    "destination_country_code": "USA",
    "invoice_number": "INV-42",
    "freight_amount": "5.00",
    "line_items": [
      {
        "product_code": "SVC-001",
        "description": "Consulting",
        "quantity": "2",
        "unit_price": "50.00",
        "tax_amount": "8.25",
        "extended_amount": "100.00",
        "total_amount": "108.25"
      }
    ]
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

H P P

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

502application/problem+json

503application/problem+json

504application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

429application/problem+json

500application/problem+json

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`