Capabilities
Query what your partner can do today — enabled features, certification status, MCC scope.
Authorization
BearerAuth Cresora API key, sent as an opaque bearer token in the
Authorization header. Format:
csk__
<prefix>— 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g.csk_Ab3kX9mQ…). UseApiKey.prefixto match.<random>— 24+ cryptographically random URL-safe chars.
Obtain via Partner Portal → Settings → API keys. Keys are only shown in full at creation/rotation time — Cresora does not retain the full value in retrievable form. Rotate any key that may have been exposed via logs, client code, or source control.
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/capabilities"{
"partner_id": "01940000-0000-7000-8000-00000000aaaa",
"certification_status": "CERTIFIED",
"enabled_features": [
"ach_payments",
"recurring_payments",
"hpp_flow",
"three_ds2"
],
"rate_limit_tier": "STANDARD"
}{
"type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
"title": "Unauthorized",
"status": 401,
"detail": "API key not recognized or revoked.",
"instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
"code": "invalid_api_key",
"retryable": false,
"error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}{
"type": "https://docs.cresoracommerce.com/errors/permission_denied",
"title": "Forbidden",
"status": 403,
"detail": "API key lacks scope 'transactions.write' required for this endpoint.",
"instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
"code": "permission_denied",
"retryable": false,
"error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}{
"type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
"title": "Too Many Requests",
"status": 429,
"detail": "Too many requests. Retry after 60 seconds.",
"instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
"code": "rate_limit_exceeded",
"retryable": true,
"error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}{
"type": "https://docs.cresoracommerce.com/errors/internal_error",
"title": "Internal Server Error",
"status": 500,
"detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
"instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
"code": "internal_error",
"retryable": true,
"error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}Api Keys
API key management — list active keys, rotate, revoke.
Config
Partner configuration — webhook URL, IP allowlist, HPP defaults, rate-limit tier, AVS decline policy. Read your own config; write via `PUT /config/partners/{partnerId}`. Rate-limit tier and AVS decline policy are Cresora-managed (admin-only); webhook URL, HPP settings, and IP allowlist are partner self-service.