API documentation

All API endpoints authenticate using bearer tokens (Authorization: Bearer cbs_<token>). There are two types of API key:

• Partner key — tied to a partner group; can access resources across all organisations within that group.

• Organisation key — tied to a single organisation; can only access resources belonging to that organisation.

The sections below describe which APIs are available to each key type.

Partner-level only

These APIs are restricted to partner keys. Requests made with an organisation key will be rejected.

They cover tenant provisioning — creating and managing organisations, merchants, memberships, and enrolments.

API	Methods	Docs
Organisations	POST GET PATCH DELETE	Organisations
Merchants	POST GET PATCH DELETE	Merchants
Memberships	POST GET PATCH DELETE	Memberships
Enrolments V1 (deprecated)	POST GET DELETE	—
Enrolments V2	POST GET DELETE	Enrolments

Note: Enrolments V1 is deprecated. Use the V2 enrolments API for all new integrations. V2 adds support for enrolling a descriptor with multiple merchants in a single request.

Note: Access to the Merchants and Enrolments V2 APIs with an organisation key can be enabled for select organisations on request. Contact support if you need this.

Organisation and partner level

These APIs accept both key types. Data is automatically scoped to the organisations the key has access to.

API	Methods	Docs
Alerts	GET PATCH	Alerts
Orders	GET POST PATCH	Orders
Integrations	GET POST PATCH	Integrations
Lookups	GET	Lookups
Representments	GET POST PATCH	—
Scheme Notices	GET	Scheme Notices
Simulations	POST PATCH	Simulations