Skip to main content
POST

Authorizations

DPoP
string
header
required

Per-request DPoP proof JWT (RFC 9449). MUST accompany the Authorization: DPoP <access_token> header on every protected operation. The proof is signed by the merchant's private DPoP key and carries htm, htu, iat, jti, and ath claims.

Headers

Idempotency-Key
string

Recommended for enterprise retries (REQUIRED on the authenticated surface). If both this header and body idempotency_key are supplied, the header wins.

Maximum string length: 255

Body

application/json
use_case
enum<string>
required
Available options:
payee_registration,
instrument_screening,
payout_screening,
merchant_onboarding,
monitoring
entity
object
required
client_reference_id
string

Client-supplied reference for reconciliation. Not used for merchant scoping.

idempotency_key
string

Body fallback for testing. Prefer the Idempotency-Key header.

instrument
object
payout
object
merchant
object

Accepted for future compatibility but ignored on the public test endpoint.

context
object

Response

Evaluation created (synchronous use cases).

data
object
required