Cresora Commerce Documentation

Merchant lifecycle — create, submit for underwriting review, update, and close merchant accounts. Merchants progress through a state machine owned by Cresora Operations.

List merchants

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

Obtain via Partner Portal → Settings → API keys. Keys are only shown in full at creation/rotation time — Cresora does not retain the full value in retrievable form. Rotate any key that may have been exposed via logs, client code, or source control.

In: header

Query Parameters

cursor?string

Opaque pagination cursor from previous response. Do not parse.

Lengthlength <= 256

page_size?integer

Items per page (1–100).

Default25

Range1 <= value <= 100

state?string

Merchant lifecycle state.

DRAFT — being edited by partner, not yet submitted
SUBMITTED — awaiting Cresora Operations review
REVIEWING — under active Cresora review (pre-underwriting)
UNDER_REVIEW — submitted to Paysafe underwriting; status-only — the underwriting result transitions it to APPROVED or REJECTED
APPROVED — underwriting passed, awaiting provisioning
CONFIGURING — approved; per-processor payment-gateway provisioning in progress
BOOTSTRAP_FAILED — provisioning failed after retries; an admin can retry (resumes at the failed step)
LIVE — processing real payments
REJECTED — rejected with rejection_reason_code + rejection_reason (see RejectionCode)
AWAITING_CLARIFICATION — Cresora requested more information; editable by the partner, re-enters review on response
SUSPENDED — temporarily blocked by Cresora
CLOSED — terminal state, cannot transition out

Value in

"DRAFT" | "SUBMITTED" | "REVIEWING" | "UNDER_REVIEW" | "APPROVED" | "CONFIGURING" | "BOOTSTRAP_FAILED" | "LIVE" | "REJECTED" | "AWAITING_CLARIFICATION" | "SUSPENDED" | "CLOSED"

mcc?string

Filter by exact merchant category code.

Match^[0-9]{4}$

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants"

{
  "data": [
    {
      "id": "01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42",
      "partner_id": "01885d7a-1234-7abc-8def-987654321fed",
      "business_name": "Acme Pharmacy LLC",
      "contact_email": "owner@acmepharmacy.com",
      "contact_name": "Sarah Chen",
      "state": "LIVE",
      "merchant_category_code": "5912",
      "channel": "CNP_ONLY",
      "processor_mids": [
        {
          "processor": "TSYS",
          "mid": "880012345678"
        }
      ],
      "gateway_merchant_id": "wpg_m_8745",
      "location_count": 2,
      "resubmission_count": 0,
      "resubmission_limit": 3,
      "created_at": "2026-03-12T14:23:45Z",
      "version": 7
    }
  ],
  "pagination": {
    "next_cursor": "eyJpZCI6IjAxODg1ZmVjLThjMGYtN2EzMSJ9",
    "has_more": true,
    "total_count": 147
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Create merchant (DRAFT)

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Format: 1–128 characters of letters, digits, . _ : -. Anything else is rejected with 400 validation_error. The character set is narrower than base64: padded base64 (+ / =) is NOT accepted, base64url is. The key is forwarded verbatim to the payment gateway on transaction creates, so it must satisfy the gateway's key contract too — rejecting locally gives you an actionable error instead of an opaque upstream failure mid-request.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Retrying after an indeterminate failure. On 502 gateway_outcome_unknown the transaction is recorded as pending and the outcome is not yet known — retry with the SAME key (a fresh key risks a double charge) or poll the transaction. This is also what a gateway-side "an earlier request with this key is still in flight" response surfaces as.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

business_name*string

Legal business name. Bounded at 5–100 characters by the payment gateway's own validation — a shorter or longer value is stored but can never be provisioned for processing, so it is rejected here rather than at go-live.

Length5 <= length <= 100

contact_email*string

Formatemail

contact_name?string

Lengthlength <= 200

merchant_category_code*string

ISO 18245 merchant category code (4 digits). Must be within the partner's certified mcc_scope (see Capabilities.mcc_scope) or request returns 422 mcc_outside_scope.

Match^[0-9]{4}$

channel?MerchantChannel

Card-acceptance channel mix for the merchant.

Default"CNP_ONLY"

Value in"CNP_ONLY" | "CP_ONLY" | "OMNICHANNEL"

application?

Sections 2–5 of the nine-section merchant application. Every field is optional — a DRAFT may carry any subset; completeness is enforced only at submit (DRAFT → SUBMITTED). A null section is left unchanged; a present section replaces it.

PII — SSN, EIN/tax_id, government-ID number, and bank account_number are write-only: accepted as plaintext, encrypted at rest (AES-256), and never echoed back. Responses carry only a masked display suffix (*_last4 / tax_id_last2). Live PII capture is gated on compliance sign-off.

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "business_name": "Acme Pharmacy LLC",    "contact_email": "owner@acmepharmacy.com",    "contact_name": "Sarah Chen",    "merchant_category_code": "5912"  }'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get merchant

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Update merchant (DRAFT only)

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

business_name?string

Legal business name. Bounded at 5–100 characters by the payment gateway's own validation (see CreateMerchantRequest).

Length5 <= length <= 100

contact_email?string

Formatemail

Length1 <= length

contact_name?string

Length1 <= length <= 200

merchant_category_code?string

Match^[0-9]{4}$

channel?MerchantChannel

Card-acceptance channel mix for the merchant.

Value in"CNP_ONLY" | "CP_ONLY" | "OMNICHANNEL"

application?

Response Body

`application/json`

`application/problem+json`

curl -X PATCH "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "business_name": "Acme Pharmacy Holdings LLC",    "contact_email": "accounts@acmepharmacy.com",    "merchant_category_code": "5912"  }'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Submit merchant for review

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/submit" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "detail": "Idempotency-Key header is required on write operations",
  "instance": "urn:cresora:trace:0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "idempotency_key_required",
  "retryable": false,
  "error_id": "0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Resubmit a rejected merchant for review

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/resubmit" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "detail": "Idempotency-Key header is required on write operations",
  "instance": "urn:cresora:trace:0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "idempotency_key_required",
  "retryable": false,
  "error_id": "0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Operation not permitted in current state.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Respond to a clarification request

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/respond-clarification" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "business_name": "Acme Pharmacy LLC",
  "contact_email": "owner@acmepharmacy.com",
  "contact_name": "Sarah Chen",
  "merchant_category_code": "5812",
  "state": "DRAFT",
  "channel": "CNP_ONLY",
  "processor_mids": [
    {
      "processor": "TSYS",
      "mid": "string"
    }
  ],
  "gateway_merchant_id": "string",
  "location_count": 0,
  "clarification_message": "string",
  "rejection_reason_code": "REJ_001",
  "rejection_reason": "string",
  "resubmission_count": 0,
  "resubmission_limit": 0,
  "submitted_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "detail": "Idempotency-Key header is required on write operations",
  "instance": "urn:cresora:trace:0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "idempotency_key_required",
  "retryable": false,
  "error_id": "0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get merchant state-transition history

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Query Parameters

cursor?string

Opaque pagination cursor from previous response. Do not parse.

Lengthlength <= 256

page_size?integer

Items per page (1–100).

Default25

Range1 <= value <= 100

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/transitions"

{
  "data": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "from_state": "string",
      "to_state": "string",
      "actor_type": "string",
      "actor_id": "string",
      "actor_label": "string",
      "reason": "string",
      "trace_id": "string",
      "occurred_at": "2019-08-24T14:15:22Z"
    }
  ],
  "pagination": {
    "next_cursor": "eyJpZCI6IjAxSFhZWi4uLiJ9",
    "has_more": true,
    "total_count": 0
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get a merchant's go-live gate status

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/go-live-gate"

{
  "can_go_live": true,
  "items": [
    {
      "id": "GATEWAY_MERCHANT",
      "label": "string",
      "verified_by": "Gateway provisioning",
      "verification": "AUTO",
      "overridable": true,
      "status": "PASSED",
      "unresolved_reason": "string"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get a merchant's application sections 2–5 (PII masked)

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/application"

{
  "processing_profile": {
    "dba": "string",
    "business_type": "string",
    "tax_id_last2": "string",
    "business_address": {
      "address_line1": "string",
      "address_line2": "string",
      "city": "string",
      "state": "string",
      "zip": "string",
      "country": "US"
    },
    "business_website": "string",
    "business_start_date": "2019-08-24",
    "estimated_monthly_volume": 0,
    "expected_annual_volume": 0,
    "estimated_avg_ticket": 0,
    "card_present_percentage": 0,
    "card_not_present_percentage": 0,
    "processing_history": {
      "previous_processor": "string",
      "years_processing": "string",
      "chargeback_rate": "string",
      "chargeback_notes": "string"
    },
    "primary_contact_phone": "string"
  },
  "beneficial_owners": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "full_legal_name": "string",
      "ownership_percentage": 0,
      "date_of_birth": "2019-08-24",
      "ssn_last4": "string",
      "phone": "string",
      "email": "string",
      "residential_address": {
        "address_line1": "string",
        "address_line2": "string",
        "city": "string",
        "state": "string",
        "zip": "string",
        "country": "US"
      },
      "kyc_status": "string"
    }
  ],
  "principal": {
    "first_name": "string",
    "last_name": "string",
    "title": "string",
    "ownership_percentage": 0,
    "email": "string",
    "phone": "string",
    "gov_id_type": "string",
    "gov_id_number_last4": "string",
    "gov_id_expiration": "2019-08-24",
    "gov_id_issuing_region": "string",
    "gov_id_issuing_country": "string"
  },
  "bank_account": {
    "account_holder_name": "string",
    "routing_number": "string",
    "account_number_last4": "string",
    "account_type": "string",
    "funding_method": "string",
    "statement_descriptor": "string"
  },
  "accepted_modalities": [
    "string"
  ],
  "payment_config": {
    "hsa_fsa_iias": true,
    "surcharging": true,
    "settlement_frequency": "string",
    "settlement_currency": "string",
    "batch_close_time": "string"
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get the settlement bank-account verification status

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/bank-verification"

{
  "status": "NOT_STARTED",
  "updated_at": "2019-08-24T14:15:22Z"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Poll the provider and refresh the bank-verification status

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/bank-verification/check" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5"

{
  "status": "NOT_STARTED",
  "updated_at": "2019-08-24T14:15:22Z"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "detail": "Idempotency-Key header is required on write operations",
  "instance": "urn:cresora:trace:0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "idempotency_key_required",
  "retryable": false,
  "error_id": "0191c8a2-aa3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get merchant fee settings

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/fee-settings"

{
  "surcharge": {
    "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
    "enabled": true,
    "merchant_state": "string",
    "activated_at": "2019-08-24T14:15:22Z",
    "surcharge_rate": 1,
    "actual_processing_cost": 1,
    "amex_eligible": true,
    "hsa_allowed": true,
    "brand_notified_at": "2019-08-24T14:15:22Z",
    "brand_notification_attested_by": "string",
    "version": 0
  },
  "convenience_fee": {
    "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
    "enabled": true,
    "fee_type": "FIXED",
    "fixed_amount": 0.01,
    "percentage_rate": 1,
    "version": 0
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Create or update the merchant's surcharge program

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

enabled*boolean

merchant_state*string

Match^[A-Z]{2}$

activated_at*string

Formatdate-time

surcharge_rate*number

Range0 < value <= 1

actual_processing_cost*number

Range0 < value <= 1

amex_eligible?boolean

Defaultfalse

hsa_allowed?boolean

Defaultfalse

brand_notified_at?|

When the card-brand advance notification was filed. Required (together with brand_notification_attested) to enable the program; activated_at must be at least the configured notice window (default 30 days) after this timestamp.

Formatdate-time

brand_notification_attested?boolean

Explicit attestation that the brand notification was filed. Required (together with brand_notified_at) to enable surcharging; the attesting actor is stamped server-side. A missing/false attestation while enabling is rejected with 422 surcharge_notification_not_attested.

Defaultfalse

version?integer

0 on first-time setup; the last-read version on updates (stale value → 409).

Default0

Range0 <= value

Response Body

`application/json`

`application/problem+json`

curl -X PUT "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/fee-settings/surcharge" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "enabled": true,    "merchant_state": "string",    "activated_at": "2019-08-24T14:15:22Z",    "surcharge_rate": 1,    "actual_processing_cost": 1  }'

{
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "enabled": true,
  "merchant_state": "string",
  "activated_at": "2019-08-24T14:15:22Z",
  "surcharge_rate": 1,
  "actual_processing_cost": 1,
  "amex_eligible": true,
  "hsa_allowed": true,
  "brand_notified_at": "2019-08-24T14:15:22Z",
  "brand_notification_attested_by": "string",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/webhook_subscription_not_active",
  "title": "Conflict",
  "status": 409,
  "detail": "Subscription is not ACTIVE",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "webhook_subscription_not_active",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Create or update the merchant's convenience-fee program

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

enabled*boolean

fee_type*string

Value in"FIXED" | "PERCENTAGE"

fixed_amount?|

Range0.01 <= value

percentage_rate?|

Range0 < value <= 1

version?integer

Default0

Range0 <= value

Response Body

`application/json`

`application/problem+json`

curl -X PUT "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/fee-settings/convenience-fee" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "enabled": true,    "fee_type": "FIXED"  }'

{
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "enabled": true,
  "fee_type": "FIXED",
  "fixed_amount": 0.01,
  "percentage_rate": 1,
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/webhook_subscription_not_active",
  "title": "Conflict",
  "status": 409,
  "detail": "Subscription is not ACTIVE",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "webhook_subscription_not_active",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

List merchant locations

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Query Parameters

cursor?string

Opaque pagination cursor from previous response. Do not parse.

Lengthlength <= 256

page_size?integer

Items per page (1–100).

Default25

Range1 <= value <= 100

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/locations"

{
  "data": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
      "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
      "location_name": "string",
      "address_line1": "string",
      "address_line2": "string",
      "city": "string",
      "state_province": "string",
      "postal_code": "string",
      "country": "string",
      "phone_number": "string",
      "contact_name": "string",
      "mid": "string",
      "merchant_category_code": "string",
      "is_active": true,
      "created_at": "2019-08-24T14:15:22Z",
      "version": 0
    }
  ],
  "pagination": {
    "next_cursor": "eyJpZCI6IjAxSFhZWi4uLiJ9",
    "has_more": true,
    "total_count": 0
  }
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Create merchant location

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

location_name*string

Lengthlength <= 200

address_line1*string

address_line2?string

city*string

state_province*string

postal_code*string

country?string

Default"US"

Value in"US"

phone_number?string

contact_name?string

Lengthlength <= 200

mid?string

merchant_category_code?string

Match^[0-9]{4}$

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/locations" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "location_name": "string",    "address_line1": "string",    "city": "string",    "state_province": "string",    "postal_code": "string"  }'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "location_name": "string",
  "address_line1": "string",
  "address_line2": "string",
  "city": "string",
  "state_province": "string",
  "postal_code": "string",
  "country": "string",
  "phone_number": "string",
  "contact_name": "string",
  "mid": "string",
  "merchant_category_code": "string",
  "is_active": true,
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Get merchant location

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

locationId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/locations/497f6eca-6276-4993-bfeb-53cbbbba6f08"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "location_name": "string",
  "address_line1": "string",
  "address_line2": "string",
  "city": "string",
  "state_province": "string",
  "postal_code": "string",
  "country": "string",
  "phone_number": "string",
  "contact_name": "string",
  "mid": "string",
  "merchant_category_code": "string",
  "is_active": true,
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Update merchant location

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

locationId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

location_name?string

Length1 <= length <= 200

address_line1?string

Length1 <= length

address_line2?string

city?string

Length1 <= length

state_province?string

Length1 <= length

postal_code?string

Length1 <= length

country?Country

ISO 3166-1 alpha-2 country code. Phase 1 supports US only.

Value in"US"

phone_number?string

contact_name?string

Lengthlength <= 200

mid?string

merchant_category_code?string

Match^[0-9]{4}$

is_active?boolean

Response Body

`application/json`

`application/problem+json`

curl -X PATCH "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/locations/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{}'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "partner_id": "6a3a39f6-861b-4a48-b868-5de838400e06",
  "location_name": "string",
  "address_line1": "string",
  "address_line2": "string",
  "city": "string",
  "state_province": "string",
  "postal_code": "string",
  "country": "string",
  "phone_number": "string",
  "contact_name": "string",
  "mid": "string",
  "merchant_category_code": "string",
  "is_active": true,
  "created_at": "2019-08-24T14:15:22Z",
  "version": 0
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Delete merchant location

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

locationId*string

Formatuuid

Response Body

`application/problem+json`

curl -X DELETE "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/locations/497f6eca-6276-4993-bfeb-53cbbbba6f08"

Empty

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

List own merchant's compliance documents (metadata only)

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/compliance-documents"

[
  {
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "document_type": "PCI_SAQ_A",
    "status": "NOT_UPLOADED",
    "file_name": "string",
    "file_size_bytes": 0,
    "mime_type": "string",
    "uploaded_at": "2019-08-24T14:15:22Z",
    "uploaded_by": "string",
    "reviewed_by": "string",
    "reviewed_at": "2019-08-24T14:15:22Z",
    "rejection_reason": "string"
  }
]

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Upload a compliance document (encrypted at rest)

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

multipart/form-data

TypeScript Definitions

Use the request body type in TypeScript.

document_type*ComplianceDocumentType

Value in

"PCI_SAQ_A" | "PCI_SAQ_A_EP" | "PCI_SAQ_B_IP" | "PCI_SAQ_D" | "PCI_SAQ_P2PE" | "PCI_SAQ_C_VT" | "HIPAA_BAA" | "HIPAA_BAA_AMENDMENT"

file*file

Formatbinary

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/compliance-documents" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -F document_type="PCI_SAQ_A" \  -F file="string"

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "document_type": "PCI_SAQ_A",
  "status": "NOT_UPLOADED",
  "file_name": "string",
  "file_size_bytes": 0,
  "mime_type": "string",
  "uploaded_at": "2019-08-24T14:15:22Z"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Record the SAQ type determined by the SAQ wizard

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Header Parameters

Idempotency-Key*string

Client-generated unique key — a UUIDv4 is the recommended form. Cresora deduplicates within a 24-hour window scoped to the partner.

Reserved prefixes — rejected with 400 idempotency_key_reserved:

hpp:, recurring: — Cresora's own server-minted deterministic keys. A client key in these namespaces could collide with a platform-generated record.
rb:, inv-charge:, inv-installment: — reserved by the payment gateway for its internally-minted keys.

Replay semantics:

Same key + same request body → Cresora returns the cached response from the original call. Response includes header Idempotency-Replay: true so the client can distinguish replays from fresh executions. Status code, body and side effects are identical to the original call.
Same key + different body → 409 idempotency_key_conflict. Generate a new key and retry.
Key older than 24 hours → treated as a fresh key; no replay guarantee from beyond the window.

Do NOT reuse keys across different partners. Scope is enforced per partner_id so the same key in partner A and partner B is independent.

Match^[A-Za-z0-9._:\-]+$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

saq_type*PciSaqType

PCI SAQ type. Determined by the ISV's 5-question SAQ wizard and confirmed by Cresora Compliance. C_VT is reachable only via wizard override (no question maps to it).

Value in"A" | "A_EP" | "B_IP" | "C_VT" | "P2PE" | "D"

override_reason?string

Required only when the ISV overrides the wizard's recommendation. Persisted verbatim in the 7-year audit trail; must not contain a card number (rejected with a validation error if it does).

Lengthlength <= 1000

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/compliance/saq-type" \  -H "Idempotency-Key: 7f3e2a9c-b4c1-4e25-9ab3-d8f1e2c3a4b5" \  -H "Content-Type: application/json" \  -d '{    "saq_type": "A"  }'

{
  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
  "hipaa_baa_status": "NOT_REQUIRED",
  "pci_saq_type": "A",
  "baa_verified_by": "string",
  "baa_verified_at": "2019-08-24T14:15:22Z",
  "saq_confirmed_by": "string",
  "saq_confirmed_at": "2019-08-24T14:15:22Z"
}

{
  "type": "https://docs.cresoracommerce.com/errors/validation_error",
  "title": "Bad Request",
  "status": 400,
  "detail": "Validation failed for 1 field(s)",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "code": "validation_error",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b6",
  "errors": [
    {
      "field": "merchant_category_code",
      "code": "Pattern",
      "message": "must match pattern ^[0-9]{4}$"
    }
  ]
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/idempotency_key_conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "Idempotency-Key was used 5 minutes ago with a different request body.",
  "instance": "urn:cresora:trace:0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "idempotency_key_conflict",
  "retryable": false,
  "error_id": "0191c8a2-cbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_state_transition",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "Transaction already VOIDED — void cannot be applied again.",
  "instance": "urn:cresora:trace:0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "invalid_state_transition",
  "retryable": false,
  "error_id": "0191c8a2-bbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Download the HIPAA BAA template to sign

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Path Parameters

merchantId*string

Formatuuid

Response Body

`application/pdf`

`application/problem+json`

curl -X GET "https://example.com/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/compliance/baa-template"

"string"

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/merchant_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "Merchant 01885fec-8c0f-7a31-9bbb-3e5b9a1f8c42 does not exist or is not accessible.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "merchant_not_found",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

List PCI SAQ types

Authorization

BearerAuth

AuthorizationBearer <token>

Cresora API key, sent as an opaque bearer token in the Authorization header. Format:

csk__

<prefix> — 8 URL-safe chars, shown in UI and logs for identification without revealing the full key (e.g. csk_Ab3kX9mQ…). Use ApiKey.prefix to match.
<random> — 24+ cryptographically random URL-safe chars.

In: header

Response Body

`application/json`

`application/problem+json`

curl -X GET "https://example.com/onboarding/saq-types"

[
  {
    "code": "A_EP",
    "label": "SAQ A-EP"
  }
]

{
  "type": "https://docs.cresoracommerce.com/errors/invalid_api_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key not recognized or revoked.",
  "instance": "urn:cresora:trace:0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5",
  "code": "invalid_api_key",
  "retryable": false,
  "error_id": "0191c8a2-7f3e-7c21-9ab3-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/permission_denied",
  "title": "Forbidden",
  "status": 403,
  "detail": "API key lacks scope 'transactions.write' required for this endpoint.",
  "instance": "urn:cresora:trace:0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5",
  "code": "permission_denied",
  "retryable": false,
  "error_id": "0191c8a2-9b7c-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/rate_limit_exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Too many requests. Retry after 60 seconds.",
  "instance": "urn:cresora:trace:0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "rate_limit_exceeded",
  "retryable": true,
  "error_id": "0191c8a2-dbcd-7a31-8c44-d8f1e2c3a4b5"
}

{
  "type": "https://docs.cresoracommerce.com/errors/internal_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "An internal error occurred. Please retry; if the error persists, contact support with the error_id.",
  "instance": "urn:cresora:trace:0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5",
  "code": "internal_error",
  "retryable": true,
  "error_id": "0191c8a2-fbcd-7a31-8c44-d8f1e2c3a4b5"
}

Merchants

200application/json

401application/problem+json

403application/problem+json

429application/problem+json

500application/problem+json

201application/json

400application/problem+json

401application/problem+json

403application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

429application/problem+json

500application/problem+json

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

Merchant not in REJECTED state

Resubmission cap reached

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

422application/problem+json

429application/problem+json

500application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

429application/problem+json

500application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

429application/problem+json

500application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

429application/problem+json

500application/problem+json

200application/json

401application/problem+json

403application/problem+json

404application/problem+json

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/json`