# CBPay: English API Reference > CBPay developer documentation - fiat payouts and collections across Latin America, internal transfers, on-chain USDT and KYC. ## API Reference - [English / API Reference / API Reference (47 pages)](https://docs.cbpayapp.com/_llms/en/api-reference/api-reference.txt): Documentation for English / API Reference / API Reference. ### Contracts - [List my contract envelopes](https://docs.cbpayapp.com/api-reference/contracts/list-my-contract-envelopes.md): Returns the envelopes belonging to the authenticated account member. - [Get my contract envelope](https://docs.cbpayapp.com/api-reference/contracts/get-my-contract-envelope.md) - [Sign my contract envelope](https://docs.cbpayapp.com/api-reference/contracts/sign-my-contract-envelope.md): Requires a human owner/operator session, consent and a fresh OTP in `X-OTP-Token`. - [Download my contract PDF](https://docs.cbpayapp.com/api-reference/contracts/download-my-contract-pdf.md) - [Verify a contract by its public verification code](https://docs.cbpayapp.com/api-reference/contracts/verify-a-contract-by-its-public-verification-code.md): Public oracle for Grupo CB framework contract authenticity. No credentials required. The code is the letter K followed by an HMAC of the envelope ID, printed in the verification block of the final PDF and exposed as verify_code in the envelope JSON. Responds JSON by default, or a human HTML page whe… ### Receipts - [Download the payout receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-payout-receipt-pdf.md): Branded PDF receipt of the payout, with the beneficiary data, amounts, status badge and the signed verification QR. Non-final states carry a diagonal watermark. Only the payout's owner (or the org admin) can download it. - [Download the payin receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-payin-receipt-pdf.md): Branded PDF receipt of the collection, with the reference, amounts, status badge and the signed verification QR. Non-final states carry a diagonal watermark. - [Download the transfer receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-transfer-receipt-pdf.md): Branded PDF receipt of the internal transfer (both parties can download it; the counterparty is shown by display name). - [Download the crypto withdrawal receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-crypto-withdrawal-receipt-pdf.md): Branded PDF receipt of the on-chain withdrawal, with the network, destination address, tx hash and the signed verification QR. - [Download the crypto deposit receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-crypto-deposit-receipt-pdf.md): Branded PDF receipt of a credited on-chain deposit. The `depositID` is the `deposit_id` field returned by `GET /v1/crypto/transactions`. - [Download the swap receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-swap-receipt-pdf.md): Branded PDF receipt of the balance conversion, with both legs, the applied rate and the signed verification QR. - [Download the card purchase receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-card-purchase-receipt-pdf.md): Branded PDF receipt of a card transaction, with the merchant, USD amount, debited balance and the signed verification QR. - [Download the banking operation receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-banking-operation-receipt-pdf.md): Branded PDF receipt of a banking operation (amount, currency, counterparty, status) with the signed verification QR. Available for operations created after the traceability mirror went live. - [Download the segregated wallet send receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-segregated-wallet-send-receipt-pdf.md): Branded PDF receipt of an on-chain send from a segregated wallet, with the network, destination address, tx hash and the signed verification QR. - [Download the segregated wallet deposit receipt (PDF)](https://docs.cbpayapp.com/api-reference/receipts/download-the-segregated-wallet-deposit-receipt-pdf.md): Branded PDF receipt of an on-chain deposit received by a segregated wallet, with the network, origin address, tx hash and the signed verification QR. - [Verify a receipt's authenticity (public)](https://docs.cbpayapp.com/api-reference/receipts/verify-a-receipts-authenticity-public.md): Public endpoint (no credentials) behind the QR printed on every receipt. The code is cryptographically signed: a tampered or made-up one answers 404 with `valid: false`. The response shows the operation's REAL current status and amount — never the beneficiary's personal data. Browsers get a branded… - [Get the public tracking link of a transaction](https://docs.cbpayapp.com/api-reference/receipts/get-the-public-tracking-link-of-a-transaction.md): Returns the shareable public tracking link of any transaction in your read scope, without downloading the receipt PDF — the building block for a "Share link" button in your UI. The `code` is the same HMAC-signed, deterministic code printed as a QR on every receipt, so calling the endpoint twice for… - [Track an operation by its public link (public)](https://docs.cbpayapp.com/api-reference/receipts/track-an-operation-by-its-public-link-public.md): Public endpoint (no credentials) behind the shareable tracking link printed on every receipt and receipt email. The code is cryptographically signed: a tampered or made-up one answers a uniform 404. Review statuses are generalized to `processing` (anti tipping-off). The `timeline` uses a fixed step… - [Download the receipt PDF from the tracking link (public)](https://docs.cbpayapp.com/api-reference/receipts/download-the-receipt-pdf-from-the-tracking-link-public.md): Public endpoint (no credentials) that generates the receipt PDF on the fly with the same renderer as the authenticated endpoints, in the requested language (`lang=es|en|zh`; Chinese renders with the Noto Sans SC font). Same signed code as the JSON tracker. Responses carry `X-Robots-Tag: noindex` and… ### KYC / KYB - [Verify a report's authenticity (public)](https://docs.cbpayapp.com/api-reference/kyc-kyb/verify-a-reports-authenticity-public.md): Public endpoint (no credentials) behind the QR printed on every verification report. The code is cryptographically signed - a tampered or made-up one answers 404 with valid=false. The response only exposes the kind (KYC/KYB), the CURRENT decision status and its date - never the subject's identity, d… - [Request my onboarding verification link](https://docs.cbpayapp.com/api-reference/kyc-kyb/request-my-onboarding-verification-link.md): Returns the account's own identity-verification link (person accounts get a KYC link, company accounts a KYB link — derived from the account type). The hosted wizard covers the full flow: form, document uploads and video liveness. Free. A new self-service request requires a confirmed TOTP or a regis… - [Download my verification report (PDF/JSON)](https://docs.cbpayapp.com/api-reference/kyc-kyb/download-my-verification-report-pdfjson.md): Compliance report of your own onboarding verification, generated by the platform: verified identity, lifecycle, documents + OCR, liveness (one entry per session - the onboarding gate check plus any later evidence recaptures, each with its own session_id and purpose) and an AGGREGATED AML section (sa… - [My onboarding verification state](https://docs.cbpayapp.com/api-reference/kyc-kyb/my-onboarding-verification-state.md): Effective verification state of the calling account. The submission includes optional account-safe detail from the core: pending documents, requested-change comments, documents already received and the aggregate documents gate. These fields may be omitted when the read-only core refresh is unavailab… - [List KYC links](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyc-links.md) - [Create a KYC link for a customer](https://docs.cbpayapp.com/api-reference/kyc-kyb/create-a-kyc-link-for-a-customer.md): Company accounts only: generates a hosted KYC link for one of YOUR end customers. The wizard covers form, documents and video liveness. Bills the fixed `kyc_verification` fee when configured (refunded if creation fails); `idempotency_key` is required — a retry with the same key returns the original… - [Get a KYC link](https://docs.cbpayapp.com/api-reference/kyc-kyb/get-a-kyc-link.md) - [List KYB links](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyb-links.md) - [Create a KYB link for a customer](https://docs.cbpayapp.com/api-reference/kyc-kyb/create-a-kyb-link-for-a-customer.md): Company accounts only: generates a hosted KYB link for one of YOUR end customers (businesses). Bills the fixed `kyb_verification` fee when configured (refunded if creation fails); `idempotency_key` is required. `country` picks the wizard corridor: us, cl, ve, br, mx, co, pe, bo, py, ar or generic (s… - [Get a KYB link](https://docs.cbpayapp.com/api-reference/kyc-kyb/get-a-kyb-link.md) - [List KYC submissions](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyc-submissions.md) - [Create a KYC submission with API data](https://docs.cbpayapp.com/api-reference/kyc-kyb/create-a-kyc-submission-with-api-data.md): Company accounts only: verifies one of YOUR end customers sending the data directly (no wizard). Countries in ISO alpha-3, dates YYYY-MM-DD, id_type passport | id_card | drivers_license. Documents are optional at creation (upload them via the presign flow); no liveness is required at creation — the… - [Get a KYC submission](https://docs.cbpayapp.com/api-reference/kyc-kyb/get-a-kyc-submission.md): Aggregated state without internal sensitive data: status, risk_band, pending_documents (documents compliance requested), rejection_reason, changes_requested_comments, liveness_pending and documents_received. - [List KYB submissions](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyb-submissions.md) - [Create a KYB submission with API data](https://docs.cbpayapp.com/api-reference/kyc-kyb/create-a-kyb-submission-with-api-data.md): Company accounts only: verifies one of YOUR end customers (a business) sending the data directly. Body: external_customer_id, country?, business (the company fields), ubos?, directors?, signers?, bank_info?, metadata?. Bills the fixed `kyb_verification` fee; `idempotency_key` required. Re-sending wh… - [Get a KYB submission](https://docs.cbpayapp.com/api-reference/kyc-kyb/get-a-kyb-submission.md): Aggregated state: status, risk_band, pending_documents, rejection_reason, changes_requested_comments and aml_decision. - [List KYC document OCR results](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyc-document-ocr-results.md) - [Presign a KYC document upload](https://docs.cbpayapp.com/api-reference/kyc-kyb/presign-a-kyc-document-upload.md): Step 1 of the document flow: returns a temporary upload URL. Then PUT the binary to upload_url with the same Content-Type (step 2) and confirm (step 3). Categories: identity, proofOfResidence. Types: application/pdf, image/png, image/jpeg; 15 MB max; the URL expires in 15 minutes. - [Confirm a KYC document upload](https://docs.cbpayapp.com/api-reference/kyc-kyb/confirm-a-kyc-document-upload.md): Step 3 of the document flow. Attaches the uploaded file to the submission and queues its OCR validation; the result arrives via the kyc_document_validated webhook. - [List KYB document OCR results](https://docs.cbpayapp.com/api-reference/kyc-kyb/list-kyb-document-ocr-results.md) - [Presign a KYB document upload](https://docs.cbpayapp.com/api-reference/kyc-kyb/presign-a-kyb-document-upload.md): Same 3-step flow as KYC documents. Categories: legalPresence, ownershipStructure, controlStructure, companyDetails. - [Confirm a KYB document upload](https://docs.cbpayapp.com/api-reference/kyc-kyb/confirm-a-kyb-document-upload.md) - [Get the liveness link and check state](https://docs.cbpayapp.com/api-reference/kyc-kyb/get-the-liveness-link-and-check-state.md) - [Create a liveness link](https://docs.cbpayapp.com/api-reference/kyc-kyb/create-a-liveness-link.md): Hosted page where your customer completes ONLY the video liveness check (camera gestures + server-side face match against the uploaded identity document). Free — the service was billed when the submission was created. If an open link exists the same one is returned; if the check already passed, 400… - [Verification report of a KYC you ran (PDF/JSON)](https://docs.cbpayapp.com/api-reference/kyc-kyb/verification-report-of-a-kyc-you-ran-pdfjson.md): Full compliance report of a verification you ran on your customer (company accounts only): verified profile, lifecycle, documents + OCR, liveness (one entry per session - the onboarding gate check plus any later evidence recaptures, each with its own session_id and purpose; for a KYB, every related… - [Verification report of a KYB you ran (PDF/JSON)](https://docs.cbpayapp.com/api-reference/kyc-kyb/verification-report-of-a-kyb-you-ran-pdfjson.md): Full compliance report of a verification you ran on your customer (company accounts only): verified profile, lifecycle, documents + OCR, liveness (one entry per session - the onboarding gate check plus any later evidence recaptures, each with its own session_id and purpose; for a KYB, every related… - [Download the signed compliance report (PDF)](https://docs.cbpayapp.com/api-reference/kyc-kyb/download-the-signed-compliance-report-pdf.md): Signed compliance report of a KYB verification — evidence for your own auditors. Free (the service was billed when the verification was created). ### Qscore - [Verify a Qscore report's authenticity (public)](https://docs.cbpayapp.com/api-reference/qscore/verify-a-qscore-reports-authenticity-public.md): Public endpoint (no credentials) behind the verification code printed on every Qscore credit report. The code is cryptographically signed: a tampered or made-up one answers 404 with `valid: false`. The response shows only non-sensitive facts: that the report exists, its score BAND (never the numeric… - [Check a Qscore seal's current validity (public)](https://docs.cbpayapp.com/api-reference/qscore/check-a-qscore-seals-current-validity-public.md): Public endpoint (no credentials) behind the Qscore seal a company activates with `POST /v1/qscore/my-seal`. The code is cryptographically signed: a tampered or made-up one answers 404 with `valid: false`. Eligibility is evaluated LIVE on every call: the band (A or B) is shown only while the seal is… - [Embeddable SVG badge with the live seal state (public)](https://docs.cbpayapp.com/api-reference/qscore/embeddable-svg-badge-with-the-live-seal-state-public.md): Public endpoint (no credentials) that renders the embeddable Qscore seal as an SVG image (180x64, dark background). While the seal is active and the subject still qualifies, the badge shows the current band letter (A or B) in green with the label "VERIFICADO"; otherwise the same URL renders a grey b… - [List credit reports](https://docs.cbpayapp.com/api-reference/qscore/list-credit-reports.md): Returns the credit reports of your account, newest first. The `from` and `to` date filters (organization timezone, both inclusive) are mandatory. Reports owned by other accounts are never visible (ownership isolation: a report id belonging to another account returns `404 not_found`). - [Create a credit report](https://docs.cbpayapp.com/api-reference/qscore/create-a-credit-report.md): Issues a new credit report for a subject (a person or a company), billed as a standalone fee (`risk_report_person` / `risk_report_company`) at the moment of issuance. Idempotency is mandatory: retrying with the same `idempotency_key` returns the original report with `idempotency_hit: true` and never… - [Get a credit report](https://docs.cbpayapp.com/api-reference/qscore/get-a-credit-report.md): Returns the full detail of a credit report owned by your account. When `status` is `ready` the full normalized `report` object is embedded; when it is `failed`, `error_code`/`error_message` explain why. A report owned by another account returns `404 not_found` (ownership isolation). - [Download the report PDF](https://docs.cbpayapp.com/api-reference/qscore/download-the-report-pdf.md): Downloads the branded PDF of a credit report in the language it was issued (`lang`), with the `verify_code` printed for public verification. Only available once the report is `ready` — otherwise `404 pdf_not_ready`. The PDF is generated on the fly per request; store it if you need an immutable copy. - [Get your latest self credit report](https://docs.cbpayapp.com/api-reference/qscore/get-your-latest-self-credit-report.md): Returns the most recent self report of the authenticated account holder (any status), without generating a new one. Returns `404 not_found` if the holder has never generated a self report. When `status` is `ready` the full normalized `report` object is embedded; when it is `failed`, `error_code`/`er… - [Generate your own credit report (self)](https://docs.cbpayapp.com/api-reference/qscore/generate-your-own-credit-report-self.md): Generates (or reuses) the Qscore credit report of the authenticated account holder — the ARCO / data-protection right of access to one's own credit information. Unlike `POST /v1/qscore/reports`, this endpoint is FREE (no fee is charged) and the subject identity is derived from the verified account:… - [Download your own report PDF](https://docs.cbpayapp.com/api-reference/qscore/download-your-own-report-pdf.md): Downloads the branded PDF of the most recent self report of the authenticated account holder, in the language it was issued (`lang`), with the `verify_code` printed for public verification at `GET /verify/qscore/{code}`. Only available once the report is `ready` — otherwise `404 pdf_not_ready`. The… - [Get my Qscore seal status](https://docs.cbpayapp.com/api-reference/qscore/get-my-qscore-seal-status.md): Returns the seal of the authenticated account (`null` if there is none) plus its live eligibility. An active seal includes `verify_code`, `verify_url` and `badge_url`; a revoked seal keeps only `revoked_at` (its URLs stop working permanently). Person accounts always get `seal: null` with `eligibilit… - [Activate my verifiable public Qscore seal](https://docs.cbpayapp.com/api-reference/qscore/activate-my-verifiable-public-qscore-seal.md): Activates the public Qscore seal for the authenticated company account. Eligibility (checked live): band A or B with an evaluation no older than 90 days — `seal_not_eligible` otherwise; the product is company-only (`seal_companies_only` for person accounts). Requires no request body and is idempoten… - [Revoke my Qscore seal](https://docs.cbpayapp.com/api-reference/qscore/revoke-my-qscore-seal.md): Revokes the active seal of the authenticated account. Immediate and PERMANENT for that seal: its public URL and badge switch to "not current" (the URL keeps answering — it never breaks a page that embedded it). It cannot be undone, but the account can activate a NEW seal (with a different code) at a… - [Look up a subject](https://docs.cbpayapp.com/api-reference/qscore/look-up-a-subject.md): Returns the subject record for a document id (no new report is issued and nothing is billed). Subjects are created automatically the first time a report is requested for that document. The `docId` path parameter is the document id as issued (e.g. a Chilean RUT like `12.345.678-5`); it is validated a… - [Current score of a subject](https://docs.cbpayapp.com/api-reference/qscore/current-score-of-a-subject.md): Returns only the latest score of a subject — the cheap lookup for recurring checks without issuing (or paying for) a new report. Returns `404 no_score` if no report has been computed yet for that subject. For the SC band (no data), `score` is absent. - [List subject disputes (ARCO)](https://docs.cbpayapp.com/api-reference/qscore/list-subject-disputes-arco.md): Lists the ARCO disputes opened for a subject (data subject rights: rectification and cancellation of credit data). Filterable by `status` (`open`, `under_review`, `resolved_corrected`, `resolved_rejected`). The dispute lifecycle is operated from the org admin panel or by your organization via `PATCH… - [Open a dispute (ARCO)](https://docs.cbpayapp.com/api-reference/qscore/open-a-dispute-arco.md): Opens an ARCO dispute on a specific record of a subject (e.g. a debt that does not belong to them or was already paid), in compliance with data subject rectification rights. The subject must already exist (it is created by the first report). `record_source` identifies the data source family of the d… - [Get a dispute](https://docs.cbpayapp.com/api-reference/qscore/get-a-dispute.md): Returns the detail and current status of an ARCO dispute owned by your account. A dispute owned by another account returns `404 not_found` (ownership isolation). - [Get a monitoring subscription](https://docs.cbpayapp.com/api-reference/qscore/get-a-monitoring-subscription.md): Returns the current monitoring subscription of your account for a subject, including the last observed score, the record count and the timestamps of the last check (`last_checked_at`) and the last alert (`last_event_at`). Returns `404 not_found` if there is no subscription. - [Subscribe to a subject (monitoring)](https://docs.cbpayapp.com/api-reference/qscore/subscribe-to-a-subject-monitoring.md): Creates or updates the monitoring subscription of your account to a subject (person or company). Monitoring is free, but requires your organization to have already purchased a `ready` report for that subject — the subscription baseline is seeded from that purchased data. By design (anti-oracle), a n… - [Unsubscribe a subject](https://docs.cbpayapp.com/api-reference/qscore/unsubscribe-a-subject.md): Deactivates the monitoring subscription of your account for a subject (`active: false`). No more `risk_monitoring_alert` webhooks are sent; you can subscribe again with `PUT`. Returns `404 not_found` if there is no subscription. - [List monitoring subscriptions](https://docs.cbpayapp.com/api-reference/qscore/list-monitoring-subscriptions.md): Lists the monitoring subscriptions of your account (newest first), paginated. `page` starts at 1; `page_size` defaults to 50 (maximum 200). - [List batch scoring jobs](https://docs.cbpayapp.com/api-reference/qscore/list-batch-scoring-jobs.md): Lists the batch scoring jobs of your account (newest first), paginated. `page` starts at 1; `page_size` defaults to 50 (maximum 200). The `from` and `to` date filters (organization timezone, both inclusive) are mandatory. Batches owned by other accounts are never visible (ownership isolation: a batc… - [Create a batch scoring job](https://docs.cbpayapp.com/api-reference/qscore/create-a-batch-scoring-job.md): Creates an asynchronous batch scoring job (portfolio scoring): the subjects are validated upfront, the batch is queued, and a background worker issues one full Qscore report per valid item. Send `subjects` (JSON array, 1 to 5000 entries) **or** `subjects_csv` (a CSV string with header `doc_id[,subje… - [Get a batch scoring job](https://docs.cbpayapp.com/api-reference/qscore/get-a-batch-scoring-job.md): Returns the batch detail: live counters, `started_at` / `completed_at`, and `error_code` / `error_message` when the batch itself failed. Ownership isolation: a batch id from another account returns 404. - [List batch items](https://docs.cbpayapp.com/api-reference/qscore/list-batch-items.md): Returns the items of the batch, paginated. `status` filters by item status (`pending`, `ready`, `failed`). Each `ready` item exposes its `report_id`, `score` and `band`; each `failed` item exposes `error_code` / `error_message`. - [Export batch results as CSV](https://docs.cbpayapp.com/api-reference/qscore/export-batch-results-as-csv.md): Downloads the batch results as a CSV file with a UTF-8 BOM (opens correctly in Excel). Visible headers follow the account locale; raw cell keys are `doc_id,subject_type,status,score,band,verify_code,report_id,error_code`. `verify_code` is the public verification code of the report (usable at `/verif… - [List consent links](https://docs.cbpayapp.com/api-reference/qscore/list-consent-links.md): Lists the consent links of your account (newest first), paginated. The `from` and `to` date filters (organization timezone, both inclusive) are mandatory; `page` starts at 1 and `page_size` defaults to 50 (maximum 200). Consents owned by other accounts are never visible (ownership isolation). - [Create a consent link](https://docs.cbpayapp.com/api-reference/qscore/create-a-consent-link.md): Creates an authorization link for the subject (the Destacame-style consent flow): you get a shareable `consent_url` and, if you pass `email`, the platform emails the branded link to the holder. The holder opens the public page, connects their bank through open finance and authorizes; a granted conse… - [Get a consent link](https://docs.cbpayapp.com/api-reference/qscore/get-a-consent-link.md): Returns the consent detail. Ownership is strict: a consent id from another account returns 404. A `pending` consent whose TTL already elapsed is lazily marked `expired` on read. - [Revoke a consent link](https://docs.cbpayapp.com/api-reference/qscore/revoke-a-consent-link.md): Revokes the consent (status `revoked`) and emits the `risk_consent_revoked` webhook. A consent the holder already decided (`granted`, or already `revoked`/`expired`) cannot transition again and returns `409 already_decided`. - [List fraud and identity reports in the caller's read scope.](https://docs.cbpayapp.com/api-reference/qscore/list-fraud-and-identity-reports-in-the-callers-read-scope.md) - [Create and read a fraud and identity report.](https://docs.cbpayapp.com/api-reference/qscore/create-and-read-a-fraud-and-identity-report.md) - [Read one fraud and identity report.](https://docs.cbpayapp.com/api-reference/qscore/read-one-fraud-and-identity-report.md) - [Download the private fraud and identity PDF.](https://docs.cbpayapp.com/api-reference/qscore/download-the-private-fraud-and-identity-pdf.md) - [Read the public anonymous quarterly Qscore Index.](https://docs.cbpayapp.com/api-reference/qscore/read-the-public-anonymous-quarterly-qscore-index.md) - [Read the Qscore Index with an authenticated account/read scope.](https://docs.cbpayapp.com/api-reference/qscore/read-the-qscore-index-with-an-authenticated-accountread-scope.md) - [Verify a fraud report code without authentication. No PII or score is returned.](https://docs.cbpayapp.com/api-reference/qscore/verify-a-fraud-report-code-without-authentication-no-pii-or-score-is-returned.md) ### OTC Desk - [Telegram bot webhook for OTC Desk callbacks (called by Telegram)](https://docs.cbpayapp.com/api-reference/otc-desk/telegram-bot-webhook-for-otc-desk-callbacks-called-by-telegram.md): Receives Telegram Bot API updates for the organization's OTC DESK group (inline button callbacks on BOB inventory offers). Called by Telegram, not by integrators: authenticated with the X-Telegram-Bot-Api-Secret-Token header (fail-closed 403), button payloads carry an HMAC signature, and duplicate d… ### Signature proofs - [Verify a signature proof (public)](https://docs.cbpayapp.com/api-reference/signature-proofs/verify-a-signature-proof-public.md): Public endpoint (no credentials) that verifies a wallet signature proof by its public capability code (the `proof_code`, which starts with `G`). Returns JSON by default; with `Accept: text/html` it renders a branded verification page. Anti-enumeration: an invalid or unknown code returns the same gen… - [List signature proofs of a segregated wallet](https://docs.cbpayapp.com/api-reference/signature-proofs/list-signature-proofs-of-a-segregated-wallet.md): Paginated list of the signature proofs issued by this segregated wallet. - [Sign a message with a segregated wallet](https://docs.cbpayapp.com/api-reference/signature-proofs/sign-a-message-with-a-segregated-wallet.md): Creates a signature proof: the segregated wallet (custody=cbpay) signs a structured CBPay Signature Proof envelope (anti-phishing) with the chain-native standard — EIP-191 for ETH/EVM, TIP-191 for TRON. The proof is persisted and publicly verifiable at `verify_url` (no auth). OTP-gated: the request… - [List signature proofs of the account](https://docs.cbpayapp.com/api-reference/signature-proofs/list-signature-proofs-of-the-account.md): Paginated list of the signature proofs of the authenticated account, with optional `purpose` filter. - [Get a signature proof](https://docs.cbpayapp.com/api-reference/signature-proofs/get-a-signature-proof.md): Returns the detail of one signature proof of the account. - [Revoke a signature proof](https://docs.cbpayapp.com/api-reference/signature-proofs/revoke-a-signature-proof.md): Revokes a signature proof. Idempotent: revoking an already revoked proof returns the same state. The public verification page immediately shows the proof as revoked. ### Issuer documents - [Download a card-issuance document (internal)](https://docs.cbpayapp.com/api-reference/issuer-documents/download-a-card-issuance-document-internal.md): Internal issuer-facing capability endpoint for card application review attachments. The HMAC code is scoped to one file and one `card_application` review. Invalid or unrelated codes return a generic 404. This endpoint is not for customer integrations. ### Checkout - [Universal checkout page (public)](https://docs.cbpayapp.com/api-reference/checkout/universal-checkout-page-public.md): Public branded HTML page behind the `checkout_url` returned by `POST /v1/payins` with `method: "checkout"`. The payer opens it without credentials, picks a country and fiat method, a crypto option (deposit address with scannable QR) or pays directly from the CBPay app (merchant QR + alias always vis… - [Universal checkout state (public)](https://docs.cbpayapp.com/api-reference/checkout/universal-checkout-state-public.md): JSON state of a universal checkout link — for the page's own polling and for integrators rendering their own payment front end over the same link. Shows the status, the settlement asset and amount, the winning method once paid, the frozen fiat materializations (`fiat_methods`), the live progress of… - [Quote a checkout link before choosing (public)](https://docs.cbpayapp.com/api-reference/checkout/quote-a-checkout-link-before-choosing-public.md): Indicative quotes for a universal checkout link BEFORE materializing — the catalog of countries with live fiat methods (card excluded — see `cards`), the card options listed separately per country+currency in `cards[]` with the quoted due amount (a corridor may accept several charge currencies, e.g.… - [Materialize a checkout payment option (public)](https://docs.cbpayapp.com/api-reference/checkout/materialize-a-checkout-payment-option-public.md): Creates (lazily) the payment option the payer picked on a universal checkout link and returns its instructions — the payment URL for card/hosted methods, the QR for QR methods, the announce reference for bank transfers, or an exclusive crypto deposit address with the exact quoted amount plus a scann… - [Request the OTP of a pull collection (public)](https://docs.cbpayapp.com/api-reference/checkout/request-the-otp-of-a-pull-collection-public.md): For pull methods whose rail sends the payer a one-time key on demand (`requires_otp_request: true` in the materialization). Triggers the OTP delivery to the payer and returns the `otp_reference` that must accompany the final `POST /pay/{token}/collect`. The pull option must be materialized first; th… - [Execute a pull collection with the payer's data (public)](https://docs.cbpayapp.com/api-reference/checkout/execute-a-pull-collection-with-the-payers-data-public.md): Runs the pull charge of a materialized collect option with the data the payer typed on the checkout page — bank, document, phone or account, and the OTP (generated in the payer's banking app, or requested via `POST /pay/{token}/collect/otp`, sending back its `otp_reference`). The amount is ALWAYS th… ### Account - [Get the platform branding](https://docs.cbpayapp.com/api-reference/account/get-the-platform-branding.md): Effective branding of the platform you operate on (name, colors, logos in base64) so a white-label front end can theme itself from the API instead of hardcoding assets. `logo_url`/`symbol_url` are public CDN URLs for the same logos — prefer them over the base64 payloads. Read-only, no PII. `timezone… - [Get my account](https://docs.cbpayapp.com/api-reference/account/get-my-account.md) - [Update my profile](https://docs.cbpayapp.com/api-reference/account/update-my-profile.md): Once your identity verification is approved, `display_name`, `tax_id` and `country` are filled from the verified identity and locked (`409 identity_locked`); `phone` stays editable with its own verification flow. - [List members](https://docs.cbpayapp.com/api-reference/account/list-members.md): Login members of the calling account (company accounts). - [Add a member](https://docs.cbpayapp.com/api-reference/account/add-a-member.md): Adds a login member. Only available for company accounts. - [Create an API key](https://docs.cbpayapp.com/api-reference/account/create-an-api-key.md): Issues a server-to-server API key bound to the calling account. The plaintext token (`pk_...`) is returned exactly once and cannot be retrieved again. - [Enabled services](https://docs.cbpayapp.com/api-reference/account/enabled-services.md): Effective map of which products this account can use right now (payouts, payins, transfers, crypto, banking, kyc, cards). When a service is disabled, its action endpoints answer 403 service_disabled; reads and money already in flight are never affected. Use it to decide what to show in your UI. - [Get my settlement settings](https://docs.cbpayapp.com/api-reference/account/get-my-settlement-settings.md): Returns which virtual balance your operations (payouts and service fees) debit from by default, the balance your payins settle into by default (`default_payin_asset`), which assets your organization allows, and the per-operation limit (USDT equivalent) applied to volatile assets (BTC/GOLD/SILVER/PLA… - [Set my default balances (payouts and payins)](https://docs.cbpayapp.com/api-reference/account/set-my-default-balances-payouts-and-payins.md): Changes your default balances. `default_settlement_asset` is the balance your payouts and service fees debit from when a request does not send an explicit `settlement_asset`. `default_payin_asset` is the balance your payins settle into — with `USD` (the default for new accounts) the net is credited… - [Change my password](https://docs.cbpayapp.com/api-reference/account/change-my-password.md): Changes the calling member's password. Requires the current password (members created via social login without a password set their first one here, leaving `current_password` empty) and, when the OTP policy requires it, an `X-OTP-Token` for the `password_change` action. All other sessions are revoke… - [Change my login email](https://docs.cbpayapp.com/api-reference/account/change-my-login-email.md): Starts a login-email change. A verification code is sent to the NEW email; confirm with `POST /v1/me/email/confirm`. When the OTP policy requires it, an `X-OTP-Token` for the `email_change` action is also required. Verifying the new email is mandatory — it prevents an attacker from pointing the logi… - [Verify my current email](https://docs.cbpayapp.com/api-reference/account/verify-my-current-email.md): Sends a code to the member's CURRENT email to mark it verified (required to use the email OTP channel for money actions). Confirm with `POST /v1/me/email/confirm`. - [Confirm an email change or verification](https://docs.cbpayapp.com/api-reference/account/confirm-an-email-change-or-verification.md): Confirms a pending email change (or verification) with the code received. On a change, the login email — and, for owners, the account contact email — are updated and the old email is notified. - [Set the profile alias derived from the verified name](https://docs.cbpayapp.com/api-reference/account/set-the-profile-alias-derived-from-the-verified-name.md): Sets the account's permanent public alias once. The alias is derived from the account's verified KYC/KYB display name; it is not freely chosen. The request body is optional. If `alias` is supplied, it must equal one of the candidates derived from that verified name. Once set, the alias cannot be cha… - [My profile QR code](https://docs.cbpayapp.com/api-reference/account/my-profile-qr-code.md): Returns the account's immutable QR token, its payload URI (`cbpay:pay?to=`) and a ready-to-render PNG. The QR only lets others SEND money to you; it never changes. - [Upload my profile photo](https://docs.cbpayapp.com/api-reference/account/upload-my-profile-photo.md): Uploads (or replaces) the account avatar. Body is the raw image bytes (JPEG, PNG or WebP), max 512 KB. The content type is detected from the file's magic bytes, never the header. When the image is published to the public CDN, `avatar_url` is an absolute URL that loads without authentication; otherwi… - [Delete my profile photo](https://docs.cbpayapp.com/api-reference/account/delete-my-profile-photo.md) - [Get an account's avatar](https://docs.cbpayapp.com/api-reference/account/get-an-accounts-avatar.md): Serves the avatar image of an account in the same organization (used for the recipient preview in transfers and contacts). Avatars published to the public CDN answer with a `302` redirect to the CDN URL; previously uploaded avatars are served directly. - [Resolve a recipient by alias or QR](https://docs.cbpayapp.com/api-reference/account/resolve-a-recipient-by-alias-or-qr.md): Returns a minimal preview (alias, display name, type, avatar) of an account in the same organization, to confirm before sending. Provide `alias` or `qr` (the raw token or the full `cbpay:pay?to=…` payload). Returns a uniform 404 and is rate-limited to prevent enumeration. - [List my active sessions](https://docs.cbpayapp.com/api-reference/account/list-my-active-sessions.md): Lists the member's sessions (devices) with IP, user agent, login method and whether each is the current one. - [Revoke one of my sessions](https://docs.cbpayapp.com/api-reference/account/revoke-one-of-my-sessions.md): Signs out a specific device. - [Revoke all my other sessions](https://docs.cbpayapp.com/api-reference/account/revoke-all-my-other-sessions.md): Signs out every session except the current one. - [My security activity](https://docs.cbpayapp.com/api-reference/account/my-security-activity.md): Append-only history of security events for the account (logins, credential changes, factors added/removed). Requires `from`/`to` date filters. - [List my transaction reviews](https://docs.cbpayapp.com/api-reference/account/list-my-transaction-reviews.md): Money operations of the account held by the transactional firewall (payouts, crypto withdrawals, payins, banking transfers) with their review status. Filter by `status` and date range (`from`/`to`, organization timezone, both inclusive). When a review moves to `info_requested`, upload the requested… - [Get a review](https://docs.cbpayapp.com/api-reference/account/get-a-review.md): Detail of one review of the account, with the information request message (`info_request`) and the files already uploaded. The internal hold reason and compliance notes are never exposed (anti tipping-off). A rejected review also includes `decision_note` (the same text as the rejection email) and `d… - [Upload a file for an information request](https://docs.cbpayapp.com/api-reference/account/upload-a-file-for-an-information-request.md): Uploads a supporting document for a review in `info_requested`. Send the raw binary body with its `Content-Type` (PDF, PNG, JPEG, WEBP, TXT, CSV, DOC(X) or XLS(X), up to 50 MB) and the filename in the `name` query param. Uploading a file moves the review back to `in_review` so the compliance team re… - [Download a file you uploaded](https://docs.cbpayapp.com/api-reference/account/download-a-file-you-uploaded.md): Downloads a file previously uploaded by the account for this review. Returns the raw binary with the original `Content-Type`. Files from other accounts or other reviews answer `404 not_found` (never `403`, so existence is not leaked). - [Get account integration eligibility](https://docs.cbpayapp.com/api-reference/account/get-account-integration-eligibility.md): Returns the current eligibility for account-level API keys and webhooks. Companies require an active account with approved KYB. Persons require an active account, approved KYC and an effective administrator grant. The response never exposes the administrator's internal grant reason. ### Authentication - [Register an account](https://docs.cbpayapp.com/api-reference/authentication/register-an-account.md): Creates a person or company account with its owner login member and returns a session token. One endpoint for both types: `type` is data. - [Get a test-mode handoff token](https://docs.cbpayapp.com/api-reference/authentication/get-a-test-mode-handoff-token.md): Issues a single-use token (60-second TTL) that moves the CURRENT member session to the test environment — this is what powers the dashboard's one-click test/live switch, with no second login and no new OTP challenge. Only the live environment issues handoffs, and only member sessions (JWT) can reque… - [Exchange a handoff token for a test session](https://docs.cbpayapp.com/api-reference/authentication/exchange-a-handoff-token-for-a-test-session.md): Test environment only (live always answers 404). Exchanges the single-use token issued by `POST /v1/auth/environment-handoff` in live for a session of the test environment. If the account does not exist in test yet, its mirror is provisioned automatically — the test mode always exists for every user… - [Log in](https://docs.cbpayapp.com/api-reference/authentication/log-in.md) - [Complete two-step login](https://docs.cbpayapp.com/api-reference/authentication/complete-two-step-login.md): Exchanges the `pending_token` from `POST /v1/auth/login` plus the OTP code received over SMS/WhatsApp for the real session token. The pending token expires after 10 minutes and can never call the API by itself. - [Refresh the session](https://docs.cbpayapp.com/api-reference/authentication/refresh-the-session.md): Exchanges a single-use refresh token (`rt_…`, issued with every login) for a fresh access token + refresh token pair without asking for credentials again. Strict rotation: the previous access token of that device is revoked on exchange, and presenting an already-exchanged refresh token revokes the d… - [Request a password reset code](https://docs.cbpayapp.com/api-reference/authentication/request-a-password-reset-code.md): Sends a reset code to the member's email (default) or to their verified phone (`channel:"sms"`). Always returns 200 with the same body regardless of whether the account exists — this prevents account enumeration. Complete the reset with `POST /v1/auth/password/reset`. - [Reset the password with a code](https://docs.cbpayapp.com/api-reference/authentication/reset-the-password-with-a-code.md): Validates the code sent by `forgot` and sets a new password. All existing sessions are revoked. A single generic error (`invalid_code`) covers unknown org/member/code so nothing about account existence leaks. ### Social login - [Sign in or register with a social provider](https://docs.cbpayapp.com/api-reference/social-login/sign-in-or-register-with-a-social-provider.md): Token exchange. The front end obtains the provider credential (Google/Apple/Microsoft `id_token`, Facebook `access_token`) and posts it here. The API verifies it against the provider and returns the CBPay session — creating the account on first use. Respects the account's OTP-on-login policy (may re… - [List enabled social providers](https://docs.cbpayapp.com/api-reference/social-login/list-enabled-social-providers.md): Public. Returns the social providers enabled for the org and their `client_id`, so the front end can render the right buttons. - [List my linked providers](https://docs.cbpayapp.com/api-reference/social-login/list-my-linked-providers.md) - [Link a provider to my account](https://docs.cbpayapp.com/api-reference/social-login/link-a-provider-to-my-account.md) - [Unlink a provider](https://docs.cbpayapp.com/api-reference/social-login/unlink-a-provider.md): Blocked with `409 last_login_method` if it is the only sign-in method (no password and no other linked provider). ### Balances - [Get balances](https://docs.cbpayapp.com/api-reference/balances/get-balances.md): The ten independent virtual balances of the calling account (USD — the principal currency —, USDT, USDC, BTC, GOLD in grams of fine gold, SILVER in grams of fine silver, PLATINUM in grams of fine platinum, and fiat BOB, MXN and ARS with two decimals). Every supported asset is always present, with ze… - [Get balance history](https://docs.cbpayapp.com/api-reference/balances/get-balance-history.md): Daily evolution of the account's balances for dashboard charts: one series per asset (the closing available balance of each day, carried forward on days without movements) plus an aggregated USD series that values every balance at each day's historical reference price (USDT/USDC at par; BTC/GOLD/SIL… - [List movements](https://docs.cbpayapp.com/api-reference/balances/list-movements.md): Immutable ledger history of the calling account. - [Get my FX rates and fees](https://docs.cbpayapp.com/api-reference/balances/get-my-fx-rates-and-fees.md): Returns the exchange rates that apply to the calling account for each country — the same rates used when operations execute (`local_amount / rate = USDT`) — plus the account's **effective** fee configuration — org defaults already resolved against your account's overrides — so clients can compute th… - [Get FX rate history](https://docs.cbpayapp.com/api-reference/balances/get-fx-rate-history.md): Time series of the FX rates that apply to the calling account, for rate-evolution charts. Each point carries the same rates you would get operating at that time — `rate` (payout side) and `payin_rate` (deposit side) — and every country block includes `first`, `last` and the signed `change_pct` betwe… - [Account statement (JSON, PDF or Excel)](https://docs.cbpayapp.com/api-reference/balances/account-statement-json-pdf-or-excel.md): Consolidates every movement of the period — payouts, payins, crypto deposits and withdrawals, internal transfers and service charges — into one auditable statement with an exact reconciliation: opening_balance + total_in − total_out = closing_balance, verified against the ledger (`balanced`). The su… ### Payouts - [List payouts](https://docs.cbpayapp.com/api-reference/payouts/list-payouts.md): Returns the payouts of the calling account. - [Create a payout](https://docs.cbpayapp.com/api-reference/payouts/create-a-payout.md): Disperses fiat to a local bank account. The local amount converts to USDT at **your account's rate** (the same one returned by `GET /v1/rates`); `usdt_amount` plus the fixed fee (when configured) is debited and held until the dispersal completes. If it fails, the full debit is refunded. - [Upload a payout supporting document](https://docs.cbpayapp.com/api-reference/payouts/upload-a-payout-supporting-document.md): Uploads the supporting document (invoice/receipt) that the US/USD corridor requires on EVERY outbound transfer (`ach`, `wire` and `swift`). Send the raw binary body with its `Content-Type` (PDF, PNG, JPEG, WEBP, TXT, CSV, DOC(X) or XLS(X), up to 50 MB) and the filename in the `name` query param. The… - [Get a payout](https://docs.cbpayapp.com/api-reference/payouts/get-a-payout.md) - [List payout methods](https://docs.cbpayapp.com/api-reference/payouts/list-payout-methods.md): Available payout corridors (country, currency, method) offered by CBPay. Pass-through of the processing core catalog. Every item carries `availability` (`operational` | `degraded` | `down`) — the live health of the corridor, so you can decide at render time whether to show, warn about or hide a chan… - [List destination banks](https://docs.cbpayapp.com/api-reference/payouts/list-destination-banks.md): Bank catalog for a country's payouts. Without `method` it returns the union of every payout method's banks for the country (deduplicated by code); pass `method` to get a single channel's catalog. Some methods have no bank catalog (e.g. QR) and contribute no entries. - [Look up a bank by routing number or SWIFT/BIC](https://docs.cbpayapp.com/api-reference/payouts/look-up-a-bank-by-routing-number-or-swiftbic.md): Autocompletes the beneficiary bank from an embedded public bank directory — pass exactly one of `routing_number` (9 digits, US only) or `swift` (8 or 11 characters; an `XXX` suffix is normalized to the head office). Use it to autodetect the bank while the sender types the routing number or SWIFT/BIC… - [Scan a payout QR (Bolivia, Brazil)](https://docs.cbpayapp.com/api-reference/payouts/scan-a-payout-qr-bolivia-brazil.md): Step 1 of the QR payout — Bolivia (local interoperable QR) and Brazil (PIX QR, including the "copia e cola" code): reads a collection QR and returns the recipient's data plus the `provider_reference` needed to confirm. **Free of charge** — nothing is debited until the confirm step. Defaults to Boliv… - [Confirm a QR payout (Bolivia, Brazil)](https://docs.cbpayapp.com/api-reference/payouts/confirm-a-qr-payout-bolivia-brazil.md): Step 2 of the QR payout (Bolivia and Brazil/PIX), charged exactly like a regular payout: the local amount converts at **your account's rate** and `usdt_amount + fixed fee` is debited. The result is **synchronous** — the response carries the final state (`completed`, or `failed` with an automatic ref… ### Payins - [List payins](https://docs.cbpayapp.com/api-reference/payins/list-payins.md) - [Create a payin (top-up charge)](https://docs.cbpayapp.com/api-reference/payins/create-a-payin-top-up-charge.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Creates a fiat top-up. With `method: "qr"` (default) an active QR charge is generated through the processor — in Bolivia t… - [Request confirmation of an announced bank deposit (maker)](https://docs.cbpayapp.com/api-reference/payins/request-confirmation-of-an-announced-bank-deposit-maker.md): Maker step of the two-person confirmation for an announced EC/USD push bank_transfer manual payin. It only accepts EC/USD/bank_transfer announced payins. The caller is the maker: an org admin with `ops:write` in a human session (API keys are rejected). The payin stays `pending` and nothing is credit… - [Approve a confirm request and credit the payin (checker)](https://docs.cbpayapp.com/api-reference/payins/approve-a-confirm-request-and-credit-the-payin-checker.md): Checker step of the two-person confirmation: a named god different from the maker approves the pending request and credits the payin. No request body. Replaying after the approve returns the credited payin with `idempotency_hit: true` when the evidence matches. - [Cancel a pending confirm request (maker or named god)](https://docs.cbpayapp.com/api-reference/payins/cancel-a-pending-confirm-request-maker-or-named-god.md): Cancels the pending confirm request. The maker cancels with their own credential; a named platform god cancels any request. No request body. Nothing is credited. The request has no expiry — cancel it explicitly when the evidence is wrong. - [Get a payin](https://docs.cbpayapp.com/api-reference/payins/get-a-payin.md) - [List refunds of a payin](https://docs.cbpayapp.com/api-reference/payins/list-refunds-of-a-payin.md) - [Refund a card payin](https://docs.cbpayapp.com/api-reference/payins/refund-a-card-payin.md): Returns money to the cardholder and reverses the credit on your balance. Only card-acquired payins in status `credited` can be refunded (`refund_not_supported` on the other rails) — and only once their balance is actually available: a credited payin whose settlement is still pending (`settlement_pen… - [List refunds](https://docs.cbpayapp.com/api-reference/payins/list-refunds.md): Every refund of the account. Filter by `payin_id`, `status` (`pending` | `completed` | `failed`) and `kind` (`refund` | `void` | `chargeback`). - [Get a refund](https://docs.cbpayapp.com/api-reference/payins/get-a-refund.md) - [Refund receipt (PDF)](https://docs.cbpayapp.com/api-reference/payins/refund-receipt-pdf.md): Branded PDF receipt with a public verification code. Use `?lang=en|es|zh` (default `en`). - [List payin methods](https://docs.cbpayapp.com/api-reference/payins/list-payin-methods.md): Available payin corridors. Every item carries `availability` (`operational` | `degraded` | `down`) — the live health of the corridor (see the service status guide). - [Active collection (pull)](https://docs.cbpayapp.com/api-reference/payins/active-collection-pull.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Charges the payer directly in corridors that support pull collections. For `VE/VES/c2p`, the payer-generated `claveDinamic… - [Request a collection OTP](https://docs.cbpayapp.com/api-reference/payins/request-a-collection-otp.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Requests the one-time password only for pull methods that issue one before the charge. It is not part of the `VE/VES/c2p`… - [List my deposit accounts](https://docs.cbpayapp.com/api-reference/payins/list-my-deposit-accounts.md): Lists the dedicated deposit destinations bound to the calling account. - [Create a dedicated deposit account](https://docs.cbpayapp.com/api-reference/payins/create-a-dedicated-deposit-account.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Provisions a fixed deposit destination bound to your account in corridors that support it (e.g. a Mexican CLABE or an Arge… - [Set or rename an Argentine bank alias](https://docs.cbpayapp.com/api-reference/payins/set-or-rename-an-argentine-bank-alias.md): Sets the bank-addressable alias chosen by the caller for an existing AR/ARS bank-transfer deposit account. The platform verifies that the instrument belongs to the authenticated account and asks the core to verify the alias with the banking rail. Repeating the same alias is an idempotent no-op. This… - [Preview the deposit instructions for a corridor](https://docs.cbpayapp.com/api-reference/payins/preview-the-deposit-instructions-for-a-corridor.md): Returns the bank account text your organization publishes for a `bank_transfer` corridor — same content that gets embedded automatically in an announced payin's response. Useful to render a "where do I send the money" screen before the payer creates the payin, or to show the current instructions on… ### Transfers - [List transfers](https://docs.cbpayapp.com/api-reference/transfers/list-transfers.md): Lists the account's transfers (sent and received), newest first. - [Create an internal transfer](https://docs.cbpayapp.com/api-reference/transfers/create-an-internal-transfer.md): Moves balance between two CBPay accounts, atomically and always free of charge — any combination works: person to person, person to company, company to person or company to company. Works with the ten virtual balances (`USD`, `USDT`, `USDC`, `BTC`, `GOLD`, `SILVER`, `PLATINUM`, `BOB`, `MXN`, `ARS`)… - [Get a transfer](https://docs.cbpayapp.com/api-reference/transfers/get-a-transfer.md): Returns one transfer; visible only to its two parties. ### Crypto - [Create an on-chain withdrawal](https://docs.cbpayapp.com/api-reference/crypto/create-an-on-chain-withdrawal.md): Sends USDT, USDC or BTC on-chain from its own balance. Supported pairs: `tron`/`USDT`, `eth`/`USDT`, `eth`/`USDC`, `btc`/`BTC` (GOLD has no on-chain rail). `amount + withdrawal fee` is debited atomically and held; final state arrives via the `crypto_withdrawal_status_changed` webhook. `failed` refun… - [Get a withdrawal](https://docs.cbpayapp.com/api-reference/crypto/get-a-withdrawal.md) - [List on-chain activity](https://docs.cbpayapp.com/api-reference/crypto/list-on-chain-activity.md): Funding credits and withdrawals of the calling account. - [List my wallets](https://docs.cbpayapp.com/api-reference/crypto/list-my-wallets.md): Returns every wallet of the calling account, oldest first. - [Restore a missing deposit wallet](https://docs.cbpayapp.com/api-reference/crypto/restore-a-missing-deposit-wallet.md): Every account — person and company — holds exactly **one deposit wallet per supported pair** (`tron`/`usdt`, `eth`/`usdt`, `eth`/`usdc`, `btc`/`btc`), provisioned automatically and free of charge on registration. Deposit wallets only **receive** crypto that credits the account's virtual balance: the… ### AML screening - [List AML screenings](https://docs.cbpayapp.com/api-reference/aml-screening/list-aml-screenings.md): History of the account's AML screenings (person, company and rescreens), newest first. Requires the from/to date range; supports pagination and a risk filter. - [Submit an AML screening](https://docs.cbpayapp.com/api-reference/aml-screening/submit-an-aml-screening.md): Screens a person or company (detected from the payload) against sanctions, PEP and adverse-media lists via the compliance service. This is list screening only — identity verification with documents and liveness lives under /v1/kyc and /v1/kyb. All identity fields are optional and forwarded whole to… - [Get an AML screening](https://docs.cbpayapp.com/api-reference/aml-screening/get-an-aml-screening.md): Detail of a screening, including the full stored result. An id that belongs to another account returns 404. - [Download the AML screening report (PDF)](https://docs.cbpayapp.com/api-reference/aml-screening/download-the-aml-screening-report-pdf.md): Branded PDF report of the screening — executive decision page, risk indicators (sanctions, watchlists, PEP, adverse media...), consolidated matches, aliases, glossary and a final backing section with the international data sources consulted. Trilingual via `lang` (default English). Pure read — no fe… - [Re-run an AML screening](https://docs.cbpayapp.com/api-reference/aml-screening/re-run-an-aml-screening.md): Re-runs the account's screening. Requires a prior screening. Bills the `compliance_rescreen` fee if configured; refunded on upstream failure. Each rescreen is stored in the audit history (`GET /v1/aml/screenings`). `idempotency_key` is required — replaying with the same key returns the original resc… - [Enable or disable AML monitoring](https://docs.cbpayapp.com/api-reference/aml-screening/enable-or-disable-aml-monitoring.md): Toggles continuous compliance monitoring for the account's verified identity. Enabling bills the `compliance_monitoring` fee if configured; disabling is free. Requires a prior screening. Each state change is stored in the audit history (`GET /v1/aml/screenings`, filter kind monitoring). When the sta… - [Compliance form catalogs](https://docs.cbpayapp.com/api-reference/aml-screening/compliance-form-catalogs.md): Returns every catalog (list of value/label pairs) the front should use to build consistent compliance and verification forms: genders, company status, address types, company legal forms (global list plus per-country cascade), income/wealth sources, industry standards with their per-country default,… - [Cities catalog for a country](https://docs.cbpayapp.com/api-reference/aml-screening/cities-catalog-for-a-country.md): Returns the cities of one ISO 3166-1 alpha-2 country, grouped by subdivision: `states` keys are the same ISO 3166-2 codes as `country_subdivisions` in `GET /v1/aml/catalogs`, and `country_cities` lists the cities whose region could not be mapped to a subdivision (offer them too). Neither field is ev… - [Look up city and state by postal code](https://docs.cbpayapp.com/api-reference/aml-screening/look-up-city-and-state-by-postal-code.md): Resolves a postal code to its city and state from an embedded public dataset — today only US ZIP codes are covered. Use it to autofill the city/state fields while the user types the ZIP in address forms: a 404 means "unknown ZIP" (or a country without a dataset) and the fields should simply stay man… ### Wallet screening - [List address screenings](https://docs.cbpayapp.com/api-reference/wallet-screening/list-address-screenings.md): History of the account's screenings, newest first. Requires the from/to date range; supports pagination and a risk filter. - [Screen a blockchain address](https://docs.cbpayapp.com/api-reference/wallet-screening/screen-a-blockchain-address.md): Assesses the AML risk of a blockchain address (sanctioned entity, illicit-fund exposure) against global on-chain intelligence and returns a normalized risk level (Low/Medium/High/Severe) with the full evidence. Network-agnostic: the address is evaluated across every supported chain at once; `chain`… - [Get an address screening](https://docs.cbpayapp.com/api-reference/wallet-screening/get-an-address-screening.md): Detail of a screening, including the full stored assessment. An id that belongs to another account returns 404. ### Contacts - [List contacts](https://docs.cbpayapp.com/api-reference/contacts/list-contacts.md): Your account's private contact book, ordered by favorites and last use. Contacts are created automatically by every send (transfer, payout, crypto withdrawal), by manual CRUD or by importing the phone's address book. - [Create a contact](https://docs.cbpayapp.com/api-reference/contacts/create-a-contact.md): Adds a contact manually. The phone is normalized to E.164 (local numbers use your account's country) and matched against accounts of your operator to fill `has_cbpay`. - [Import the phone address book](https://docs.cbpayapp.com/api-reference/contacts/import-the-phone-address-book.md): Uploads up to 1,000 contacts per request (paginate beyond that). Phones are normalized to E.164; existing contacts are never duplicated; `has_cbpay` tells you which contacts already have an active account of your same operator (match by phone). - [Get a contact](https://docs.cbpayapp.com/api-reference/contacts/get-a-contact.md): The contact plus its saved destinations (CBPay account, payout beneficiaries per corridor, on-chain addresses). - [Delete a contact](https://docs.cbpayapp.com/api-reference/contacts/delete-a-contact.md): Deletes the contact and its saved destinations. - [Update a contact](https://docs.cbpayapp.com/api-reference/contacts/update-a-contact.md): Partial update (name, alias, phone, email, favorite). Changing the phone re-runs the CBPay match. - [Add a destination to a contact](https://docs.cbpayapp.com/api-reference/contacts/add-a-destination-to-a-contact.md): Saves a reusable destination manually: `payout` (country + method + beneficiary), `crypto` (chain + address) or `cbpay` (requires the contact to be linked). Destinations are deduplicated: repeating one refreshes its last use. - [Delete a saved destination](https://docs.cbpayapp.com/api-reference/contacts/delete-a-saved-destination.md) ### Swaps - [Quote a swap](https://docs.cbpayapp.com/api-reference/swaps/quote-a-swap.md): Free indicative quote to convert between your USDT, USDC, BTC, GOLD, SILVER and PLATINUM balances (any pair, source different from destination). The rate you see is your account's execution rate — quoted = received, no separate fees. Indicative: execution uses the price at the POST moment (stablecoi… - [List swaps](https://docs.cbpayapp.com/api-reference/swaps/list-swaps.md) - [Create a swap](https://docs.cbpayapp.com/api-reference/swaps/create-a-swap.md): Converts balance between two of your currencies, synchronously and atomically — your balance changes instantly and the money never leaves your account (no OTP). Volatile pairs (BTC/GOLD/SILVER/PLATINUM) share the per-operation and 24h volume limits with payouts and card purchases. Requires an idempo… - [Get a swap](https://docs.cbpayapp.com/api-reference/swaps/get-a-swap.md) ### QR Crypto POS - [List POS merchants](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/list-pos-merchants.md): Paginated list of the merchants registered by the account (processor). - [Register a POS merchant](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/register-a-pos-merchant.md): Registers a merchant (restaurant, hotel, store) bound to an APPROVED third-party KYC/KYB verification — the identity comes from the verification. fee_percent/fee_fixed are the processor's informative commission to the merchant (computed per paid charge and in the summary; never charged by the platfo… - [Get a POS merchant](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/get-a-pos-merchant.md): Merchant detail. Only the owning account (or the org admin) can read it. - [Update a POS merchant](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/update-a-pos-merchant.md): Updates status (active/disabled — a disabled merchant cannot generate new charges), the informative commission and the external reference. Identity is never edited: it comes from the verification. - [List POS charges](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/list-pos-charges.md): Charges of the account with merchant_id/status filters and a mandatory date range — the per-client reconciliation view. - [Create a POS charge (crypto QR with amount)](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/create-a-pos-charge-crypto-qr-with-amount.md): Creates an amount-bearing crypto QR charge for a merchant. Same contract as the universal checkout link: amount + settlement_asset (account default when omitted); the due the customer pays is quoted in the QR's crypto at creation (the payer covers any conversion — you receive your exact target). The… - [Get a POS charge (POS polling)](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/get-a-pos-charge-pos-polling.md): Charge detail for the POS polling loop. While pending, if an on-chain deposit is already detected but not yet confirmed, the response adds confirming:true + detected_amount (UX signal only — credit happens on confirmation). Partial payments accumulate in received; late payments into an expired charg… - [Refund a POS charge](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/refund-a-pos-charge.md): Returns (part of) what the charge received to the payer as a regular crypto withdrawal from the account balance (hold, withdrawal fee and every compliance control of the rail). to_address is always explicit — never auto-refunded to the deposit origin. Hard cap: the sum of refunds can never exceed wh… - [List the refunds of a POS charge](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/list-the-refunds-of-a-pos-charge.md): Refunds of the charge; each status follows its withdrawal lifecycle (a failed withdrawal refunds the debit and releases the cap). - [POS reconciliation summary per merchant](https://docs.cbpayapp.com/api-reference/qr-crypto-pos/pos-reconciliation-summary-per-merchant.md): Per-merchant aggregate over a date range: charge counts, gross collected (target of paid charges), the processor's informative commission, refunded totals and the net to distribute to each merchant. ### Webhooks - [List webhook subscriptions](https://docs.cbpayapp.com/api-reference/webhooks/list-webhook-subscriptions.md): Lists the account's webhook subscriptions (the secret is never returned). - [Create a webhook subscription](https://docs.cbpayapp.com/api-reference/webhooks/create-a-webhook-subscription.md): Subscribes an HTTPS callback to the calling account's events. - [Disable or reactivate a webhook subscription](https://docs.cbpayapp.com/api-reference/webhooks/disable-or-reactivate-a-webhook-subscription.md): Toggles one of the account's subscriptions between `active` and `disabled`. A `disabled` subscription stops receiving NEW events; deliveries already queued are still sent. Idempotent: repeating the current status is a no-op `200`. Subscriptions are never deleted — disabling is how you unsubscribe. O… ### Status - [Service health](https://docs.cbpayapp.com/api-reference/status/service-health.md): Public liveness check of the API and its database. - [Public status page (HTML)](https://docs.cbpayapp.com/api-reference/status/public-status-page-html.md): Hosted, branded status page of the organization: live state of every payment corridor, 90-day uptime and incident history. Public (no credentials), safe to share with your own customers or embed in your product. The `orgToken` is the opaque token shared by the operator (org admins read the full URL… - [Public status feed (JSON)](https://docs.cbpayapp.com/api-reference/status/public-status-feed-json.md): The same data behind the status page as JSON, for your own status tooling or monitoring: overall status, per-corridor state with 90-day uptime, and the recent incident history (state transitions). Public, rate limited per IP. ### Segregated wallets - [List my segregated wallets](https://docs.cbpayapp.com/api-reference/segregated-wallets/list-my-segregated-wallets.md): Lists the calling account's segregated wallets, newest first. - [Create a segregated wallet](https://docs.cbpayapp.com/api-reference/segregated-wallets/create-a-segregated-wallet.md): Creates a new on-chain wallet owned by the calling account. Its balance lives on-chain (never in the ledger) and it is exempt from the treasury sweep. Supported pairs: `tron`/`usdt`, `eth`/`usdt`, `eth`/`usdc`, `btc`/`btc`. Company accounts can create unlimited wallets; person accounts hold **1 per… - [Import an external wallet](https://docs.cbpayapp.com/api-reference/segregated-wallets/import-an-external-wallet.md): Imports a wallet you already control by providing its `private_key_hex`. The key travels only to the custodian and is **never stored or logged** in the platform. Requires a signed-in user session with 2FA (API keys are rejected with `human_session_required`), a verified account and OTP. Bills the `w… - [Get a segregated wallet](https://docs.cbpayapp.com/api-reference/segregated-wallets/get-a-segregated-wallet.md) - [Get the live on-chain balance](https://docs.cbpayapp.com/api-reference/segregated-wallets/get-the-live-on-chain-balance.md): Returns the wallet's live on-chain balance, including native gas (TRX/ETH) so you can tell whether it can pay a network fee. - [List on-chain deposits](https://docs.cbpayapp.com/api-reference/segregated-wallets/list-on-chain-deposits.md) - [List on-chain activity](https://docs.cbpayapp.com/api-reference/segregated-wallets/list-on-chain-activity.md): Full on-chain activity (deposits and sends) of the wallet. - [List sends from the wallet](https://docs.cbpayapp.com/api-reference/segregated-wallets/list-sends-from-the-wallet.md) - [Send crypto from the wallet](https://docs.cbpayapp.com/api-reference/segregated-wallets/send-crypto-from-the-wallet.md): Sends crypto **from the wallet itself** (real source address, signed by the custodian). `idempotency_key` is required. Gas is on the client: if the wallet lacks native gas the send is rejected with `422 insufficient_gas` before any charge. May bill the `wallet_send` fee (from the account ledger sett… - [Get a send](https://docs.cbpayapp.com/api-reference/segregated-wallets/get-a-send.md) - [Export the private key](https://docs.cbpayapp.com/api-reference/segregated-wallets/export-the-private-key.md): Returns the wallet's private key (shared custody: the wallet stays operational in the platform after export). The most sensitive operation of the product: requires a signed-in user session with 2FA (API keys rejected), a verified account and a `reason` of at least 20 characters kept in the audit tra… - [Get the auto-forward rule](https://docs.cbpayapp.com/api-reference/segregated-wallets/get-the-auto-forward-rule.md) - [Configure auto-forward](https://docs.cbpayapp.com/api-reference/segregated-wallets/configure-auto-forward.md): Forwards everything that arrives at the wallet to an address of yours. Redirects future funds, so it requires a verified account and OTP. ### Wallet links - [Create a wallet link challenge](https://docs.cbpayapp.com/api-reference/wallet-links/create-a-wallet-link-challenge.md): Creates a nonce challenge to link an external wallet (custody=client) to the account. The wallet owner signs the structured envelope with the chain-native standard (EIP-191 / TIP-191) and the signature is submitted to `POST /v1/wallet-links/verify`. - [Verify a wallet link challenge](https://docs.cbpayapp.com/api-reference/wallet-links/verify-a-wallet-link-challenge.md): Verifies the signature of a wallet link challenge and links the external wallet (custody=client) to the account. Emits the `wallet_linked` webhook. - [List linked wallets](https://docs.cbpayapp.com/api-reference/wallet-links/list-linked-wallets.md): Paginated list of the external wallets linked to the account. - [Revoke a wallet link](https://docs.cbpayapp.com/api-reference/wallet-links/revoke-a-wallet-link.md): Revokes a wallet link. The external wallet keeps its custody; only the ownership attestation is revoked. ### Stored cards - [List stored cards](https://docs.cbpayapp.com/api-reference/stored-cards/list-stored-cards.md): Cards saved by your payers on the hosted card checkout (COF mandate): only display data (brand, last 4, expiry) — the card number never exists on this platform. Filter by `payer_reference` to show a returning customer their cards. Requires `from`/`to`. - [Get a stored card](https://docs.cbpayapp.com/api-reference/stored-cards/get-a-stored-card.md) - [Revoke a stored card](https://docs.cbpayapp.com/api-reference/stored-cards/revoke-a-stored-card.md): Revokes the stored credential upstream and marks the mirror `revoked` (history is never deleted). Merchant-initiated charges and saved-card payments stop working immediately. Emits the `stored_card_revoked` webhook. - [Charge a stored card (merchant-initiated)](https://docs.cbpayapp.com/api-reference/stored-cards/charge-a-stored-card-merchant-initiated.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Charges the saved card WITHOUT the payer present (MIT under the card-brand mandate, citing the original consented 3-D Secu… ### Subscriptions - [List subscriptions](https://docs.cbpayapp.com/api-reference/subscriptions/list-subscriptions.md): Your subscriptions (org admins see the whole org with account_id). Filter by status, stored_card_id or payer_reference. Requires from/to. - [Create a subscription](https://docs.cbpayapp.com/api-reference/subscriptions/create-a-subscription.md): Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Recurring charges on a saved card (the platform runs the schedule for you). The first period is charged synchronously on c… - [Get a subscription](https://docs.cbpayapp.com/api-reference/subscriptions/get-a-subscription.md) - [Pause a subscription](https://docs.cbpayapp.com/api-reference/subscriptions/pause-a-subscription.md): Stops charges (from active). Resuming does NOT catch up missed periods. - [Resume a subscription](https://docs.cbpayapp.com/api-reference/subscriptions/resume-a-subscription.md): Reactivates from paused or past_due. From past_due it retries the pending period once (a fresh decline returns to past_due). From paused with a future date it keeps the original schedule (no early charge). - [Cancel a subscription](https://docs.cbpayapp.com/api-reference/subscriptions/cancel-a-subscription.md): Terminal. Revoking the stored card also cancels its subscriptions automatically. ### Banking - [Get my banking profile](https://docs.cbpayapp.com/api-reference/banking/get-my-banking-profile.md): Returns the account's banking profile with its live verification status. - [Create my banking profile](https://docs.cbpayapp.com/api-reference/banking/create-my-banking-profile.md): >- Opens the account's banking profile (once per account). Omitted `type`/`name`/`email` autofill from the CBPay account. Billed as the fixed `banking_customer` fee from your settlement asset (USD is the principal balance); refunded if the corridor rejects. The platform derives a deterministic core… - [Upload a verification document](https://docs.cbpayapp.com/api-reference/banking/upload-a-verification-document.md): Uploads one KYC document (base64) to the banking profile. Free of charge. - [Submit my profile for review](https://docs.cbpayapp.com/api-reference/banking/submit-my-profile-for-review.md): Sends the banking profile to verification. Free. Track progress via GET /v1/banking/customer or the banking_customer_status_changed webhook. - [List my bank accounts](https://docs.cbpayapp.com/api-reference/banking/list-my-bank-accounts.md) - [Open a bank account](https://docs.cbpayapp.com/api-reference/banking/open-a-bank-account.md): Opens a bank account for the approved profile (one per currency as enabled). Billed as the fixed `banking_account` fee; refunded if the corridor rejects. `data` carries the receiving details (account number/IBAN, routing, bank). - [Get a bank account](https://docs.cbpayapp.com/api-reference/banking/get-a-bank-account.md): Returns the live details of one of your bank accounts (name, currency, status and the receiving requisites — wire/local rails — under `data`). Use it to render the deposit instructions of a specific account. If the bank cannot serve the account live, the endpoint returns the last mirrored snapshot a… - [Get a bank account balance](https://docs.cbpayapp.com/api-reference/banking/get-a-bank-account-balance.md) - [List my beneficiaries](https://docs.cbpayapp.com/api-reference/banking/list-my-beneficiaries.md) - [Register a beneficiary](https://docs.cbpayapp.com/api-reference/banking/register-a-beneficiary.md): Registers a third-party beneficiary with its banking details. Free; the beneficiary account goes through moderation before it can receive WITHDRAW payments. - [Add an account to a beneficiary](https://docs.cbpayapp.com/api-reference/banking/add-an-account-to-a-beneficiary.md) - [Quote a bank payment](https://docs.cbpayapp.com/api-reference/banking/quote-a-bank-payment.md): Validates and quotes an operation (fees, balances) without moving money. Free. - [List my bank payments](https://docs.cbpayapp.com/api-reference/banking/list-my-bank-payments.md): History of your bank operations, including inbound deposits and charges discovered automatically. Items carry the enriched neutral view: the optional fields direction, amount (net decimal string — credited amount for `in`, net charge for `out`), currency, counterparty and reference appear only when… - [Send a bank payment](https://docs.cbpayapp.com/api-reference/banking/send-a-bank-payment.md): Executes a TRANSFER (between your own bank accounts) or WITHDRAW (to a registered beneficiary). Requires an idempotency key; retries with the same key return the original operation without re-charging. Billed as the fixed `banking_operation` fee; refunded if the corridor rejects. The final state arr… - [Get a bank payment](https://docs.cbpayapp.com/api-reference/banking/get-a-bank-payment.md): Operation with live status and the enriched neutral view: the optional fields direction, amount (net decimal string), currency, counterparty and reference appear only when the banking provider reports them. - [List third-party banking users](https://docs.cbpayapp.com/api-reference/banking/list-third-party-banking-users.md) - [Register a third-party banking user (companies only)](https://docs.cbpayapp.com/api-reference/banking/register-a-third-party-banking-user-companies-only.md): Company accounts register end clients as separate banking users with accounts in their name. Requires the verification_id of an APPROVED KYC/KYB verification of the third party: the type comes from the verification kind (KYC = INDIVIDUAL, KYB = COMPANY), identity data auto-fills from the verified pr… - [Get a third-party banking user (live KYC status)](https://docs.cbpayapp.com/api-reference/banking/get-a-third-party-banking-user-live-kyc-status.md) - [Upload a KYC document for the third party (free)](https://docs.cbpayapp.com/api-reference/banking/upload-a-kyc-document-for-the-third-party-free.md) - [Submit the third party to verification (free)](https://docs.cbpayapp.com/api-reference/banking/submit-the-third-party-to-verification-free.md) - [List the third party's bank accounts](https://docs.cbpayapp.com/api-reference/banking/list-the-third-partys-bank-accounts.md) - [Open a bank account for the third party](https://docs.cbpayapp.com/api-reference/banking/open-a-bank-account-for-the-third-party.md) - [Third party's bank account balance](https://docs.cbpayapp.com/api-reference/banking/third-partys-bank-account-balance.md) - [List the account's virtual IBAN requests](https://docs.cbpayapp.com/api-reference/banking/list-the-accounts-virtual-iban-requests.md): Lists requests with pagination and the organization date window. `purpose` and `status` are optional filters. - [Request an EUR virtual IBAN](https://docs.cbpayapp.com/api-reference/banking/request-an-eur-virtual-iban.md): Requests one durable virtual IBAN allocation for the authenticated account. `funding_usdt` is the default purpose; `banking_eur` requires the Banking product. The platform autofills the provider V3 registrant from the approved KYC/KYB profile. The optional document and incorporation fields below acc… - [Get one virtual IBAN request](https://docs.cbpayapp.com/api-reference/banking/get-one-virtual-iban-request.md) - [Close an active virtual IBAN](https://docs.cbpayapp.com/api-reference/banking/close-an-active-virtual-iban.md): Closes one of the authenticated account's virtual IBANs at the EUR rail. Only active rows with an allocated address can be closed; the call is idempotent (an already closed row answers 200 with its current state) and a provider 404 converges to closed locally. Closing is free and never refunds the a… - [List a third party's Banking EUR virtual IBANs](https://docs.cbpayapp.com/api-reference/banking/list-a-third-partys-banking-eur-virtual-ibans.md) - [Request a Banking EUR virtual IBAN for a third party](https://docs.cbpayapp.com/api-reference/banking/request-a-banking-eur-virtual-iban-for-a-third-party.md): Company accounts can request a `banking_eur` virtual IBAN for an owned, verified third party. The third party owns the Banking EUR balance; the company is the manager of the relationship. - [Get a Banking EUR virtual IBAN balance](https://docs.cbpayapp.com/api-reference/banking/get-a-banking-eur-virtual-iban-balance.md): Returns the reconciled platform ledger balance for a `banking_eur` virtual IBAN. A `funding_usdt` virtual IBAN does not hold BANK_EUR. - [List the authenticated account's durable company-wallet reservations.](https://docs.cbpayapp.com/api-reference/banking/list-the-authenticated-accounts-durable-company-wallet-reservations.md) - [Reserve and read a dedicated EUR company wallet for a verified business account.](https://docs.cbpayapp.com/api-reference/banking/reserve-and-read-a-dedicated-eur-company-wallet-for-a-verified-business-account.md): Requires the Banking product, a verified company account and an idempotency key. Optional registrant overrides complete the approved KYB profile, including one document pair per UBO (ubo_{i}_document_issued_country, ubo_{i}_document_expiration_date, zero-based UBO index, camelCase aliases accepted):… - [Get one company wallet. A pending read may include sync_error when provider reconciliation is temporarily unavailable.](https://docs.cbpayapp.com/api-reference/banking/get-one-company-wallet-a-pending-read-may-include-sync_error-when-provider-reconciliation-is-temporarily-unavailable.md) - [Read the live EUR balance of an active company wallet.](https://docs.cbpayapp.com/api-reference/banking/read-the-live-eur-balance-of-an-active-company-wallet.md) - [List wallet operations for a completed-day date window.](https://docs.cbpayapp.com/api-reference/banking/list-wallet-operations-for-a-completed-day-date-window.md) - [List operations received by a virtual IBAN](https://docs.cbpayapp.com/api-reference/banking/list-operations-received-by-a-virtual-iban.md): The mirror view is scoped to the virtual IBAN and requires a completed-day date range. ### Cards - [List cards](https://docs.cbpayapp.com/api-reference/cards/list-cards.md): Account credentials list the account's cards; org admin credentials list every card in the organization (filter with `account_id`). - [Create a card](https://docs.cbpayapp.com/api-reference/cards/create-a-card.md): Issues a card (virtual or physical) that spends Just-In-Time from the account's central balance in the card's spending asset (`spending_asset`: USDT/USDC 1:1 with the USD, or BTC/GOLD/SILVER/PLATINUM converted at the price of the moment of each event) — no prefunding: every purchase is authorized in… - [Get a card](https://docs.cbpayapp.com/api-reference/cards/get-a-card.md) - [Update limits, spending asset or freeze/unfreeze](https://docs.cbpayapp.com/api-reference/cards/update-limits-spending-asset-or-freezeunfreeze.md): Updates the card's spending limits (send "0" to remove a limit), changes the balance it spends from (`spending_asset`, future purchases only) and freezes or unfreezes it. Frozen cards decline every authorization instantly. - [Activate a physical card](https://docs.cbpayapp.com/api-reference/cards/activate-a-physical-card.md): Confirms the holder received the physical card. Only cards in `pending_activation`. - [Cancel a card](https://docs.cbpayapp.com/api-reference/cards/cancel-a-card.md): Cancels the card permanently (irreversible). Bills the `card_cancellation` fee when configured (0 = free); refunded if the cancellation fails upstream. - [Reveal PAN and CVV](https://docs.cbpayapp.com/api-reference/cards/reveal-pan-and-cvv.md): Returns the card's sensitive data (PAN, CVV, expiration) as a one-time pass-through for display to the holder. Only the owning account can call it (never the org admin). **Never store or log this response** — the platform does not persist it either (PCI). - [List card transactions](https://docs.cbpayapp.com/api-reference/cards/list-card-transactions.md): Purchases and their lifecycle: `authorized` (real-time hold), `settled` (confirmed at clearing), `reversed` (annulled, funds returned to the same balance) and `declined` (with the reason: insufficient_funds, card_limit_exceeded, card_frozen...). `spend_asset` / `spend_amount` show which balance the… - [Occupation catalog](https://docs.cbpayapp.com/api-reference/cards/occupation-catalog.md): Official issuer occupation codes (for the `occupation` field when designating a person cardholder). Search with `q` (matches code or label). Use the `code` value; a free-text occupation is rejected with 400 invalid_occupation. - [Business activity catalog](https://docs.cbpayapp.com/api-reference/cards/business-activity-catalog.md): Official issuer economic-activity codes (for `kind_of_business` when creating a company cardholder). Search with `q`. Use the `code` value; a free-text value is rejected with 400 invalid_kind_of_business. ### Security (OTP) - [My OTP policy](https://docs.cbpayapp.com/api-reference/security-otp/my-otp-policy.md): Effective OTP policy for the calling account — whether the feature is enabled, which actions require a code and over which channel, plus the (masked) phone and its verification state. - [List my OTP challenges](https://docs.cbpayapp.com/api-reference/security-otp/list-my-otp-challenges.md) - [Request an OTP code](https://docs.cbpayapp.com/api-reference/security-otp/request-an-otp-code.md): Sends a one-time code to the account's phone over the channel configured for the action. Requires a user session (JWT) — API keys receive `403 session_required`. Hourly send limits apply. - [Get an OTP challenge](https://docs.cbpayapp.com/api-reference/security-otp/get-an-otp-challenge.md) - [Verify the code](https://docs.cbpayapp.com/api-reference/security-otp/verify-the-code.md): Validates the code received over SMS/WhatsApp and returns the single-use `otp_token` that authorizes the protected action (send it in the `X-OTP-Token` header). 5 attempts per challenge. - [My 2FA preferences](https://docs.cbpayapp.com/api-reference/security-otp/my-2fa-preferences.md): Shows the effective 2FA policy for the account with, per action, whether it is locked by the organization (the org policy is the floor the account cannot go below). - [Update my 2FA preferences](https://docs.cbpayapp.com/api-reference/security-otp/update-my-2fa-preferences.md): Lets the account owner configure its own 2FA. You can always harden (enable actions, move to a stronger channel: totp > email > sms/whatsapp) but never go below the organization floor. Weakening (disabling an active action or lowering the channel) requires an `X-OTP-Token` for the `security_settings… ### Analytics - [Account summary for dashboards](https://docs.cbpayapp.com/api-reference/analytics/account-summary-for-dashboards.md): Aggregated view of the whole account flow in a single call: gross volume in/out, transaction counts, new banking users, per-service sections (payouts, payins, deposits, withdrawals, transfers, swaps, cards, banking, verifications, aml, contacts) with their dimensions (country, currency, method, stat… ### Passkeys - [Begin passwordless passkey login](https://docs.cbpayapp.com/api-reference/passkeys/begin-passwordless-passkey-login.md): Starts a WebAuthn discoverable login ceremony. Pass the returned `options.publicKey` to `navigator.credentials.get()` and send the result to `finish`. The challenge is single-use and expires in 2 minutes. - [Finish passwordless passkey login](https://docs.cbpayapp.com/api-reference/passkeys/finish-passwordless-passkey-login.md): Validates the authenticator assertion and issues a session. A passkey is already two factors (device + biometrics), so this login does not go through the login OTP. - [My authenticator app status](https://docs.cbpayapp.com/api-reference/passkeys/my-authenticator-app-status.md): Whether an authenticator app (TOTP) is active and how many backup codes remain. - [Remove my authenticator app](https://docs.cbpayapp.com/api-reference/passkeys/remove-my-authenticator-app.md): Disables TOTP. Requires a valid authenticator (or backup) code and respects the org floor — if the organization mandates the authenticator app it cannot be removed. - [Start authenticator app enrollment](https://docs.cbpayapp.com/api-reference/passkeys/start-authenticator-app-enrollment.md): Generates a TOTP secret and returns the `otpauth://` URI plus a QR PNG to scan in Google Authenticator / Authy. Requires the current password (if the member has one). Confirm with `POST /v1/me/totp/confirm`. - [Confirm and activate the authenticator app](https://docs.cbpayapp.com/api-reference/passkeys/confirm-and-activate-the-authenticator-app.md): Activates TOTP with the first valid code and returns 10 one-time backup codes (shown only once). - [Regenerate backup codes](https://docs.cbpayapp.com/api-reference/passkeys/regenerate-backup-codes.md): Issues a fresh set of backup codes and invalidates the previous ones. Requires a valid authenticator or backup code. - [List my passkeys](https://docs.cbpayapp.com/api-reference/passkeys/list-my-passkeys.md) - [Begin passkey registration](https://docs.cbpayapp.com/api-reference/passkeys/begin-passkey-registration.md): Starts a WebAuthn registration ceremony. Requires the current password (if the member has one) — a new sign-in factor is never added from a stolen session. Pass `options.publicKey` to `navigator.credentials.create()`. - [Finish passkey registration](https://docs.cbpayapp.com/api-reference/passkeys/finish-passkey-registration.md): Validates the attestation and stores the passkey under a friendly name. - [Remove a passkey](https://docs.cbpayapp.com/api-reference/passkeys/remove-a-passkey.md): Removes a passkey. Requires the current password (if the member has one) and is blocked if it is the only sign-in method left. ### Real-time events - [Real-time event stream (SSE)](https://docs.cbpayapp.com/api-reference/real-time-events/real-time-event-stream-sse.md): Opens a `text/event-stream` connection that delivers every event of the account in real time — the same events that travel by webhook, without exposing a public endpoint. - [Event history](https://docs.cbpayapp.com/api-reference/real-time-events/event-history.md): The same log that feeds the stream, queryable. Requires `from`/`to` date filters. Retention is 90 days: the log is a notification buffer, the financial facts live in their own immutable resources (movements, payins, payouts). - [Event detail](https://docs.cbpayapp.com/api-reference/real-time-events/event-detail.md): Detail of a single event by its public `event_id` (the same one that travels in the webhook). An event outside your scope returns `404`, never `403`. ### Consent - [Read a consent request (public, holder)](https://docs.cbpayapp.com/api-reference/consent/read-a-consent-request-public-holder.md): Public view of the consent request behind a `consent_url`. The URL token IS the capability (128 random bits, unique per consent): no login is required, and an unknown token answers a generic 404 (anti-enumeration). The response is minimal on purpose: `doc_id` is masked to its last 4 characters, and… - [Start the bank connection (public, holder)](https://docs.cbpayapp.com/api-reference/consent/start-the-bank-connection-public-holder.md): Opens the bank-connection session for the holder: returns the `widget_token` and `public_key` the open-finance widget needs to render the institution picker. Only a `pending` consent can begin; any other status returns `409 already_decided`. Rate limited per IP. - [Grant the consent after connecting the bank (public, holder)](https://docs.cbpayapp.com/api-reference/consent/grant-the-consent-after-connecting-the-bank-public-holder.md): Completes the flow after the holder connected their bank in the widget: the platform exchanges the `exchange_token`, requires the banking link to be `active` (`409 link_inactive`) and requires the holder document verified by the bank to match the subject document exactly (`409 holder_mismatch` — an… - [Decline the consent request (public, holder)](https://docs.cbpayapp.com/api-reference/consent/decline-the-consent-request-public-holder.md): The holder rejects the request: the consent becomes `revoked`, the legal evidence is sealed and the `risk_consent_revoked` webhook is emitted. An already decided consent returns `409 already_decided`. ### Corridors - [List organization rail variants](https://docs.cbpayapp.com/api-reference/corridors/list-organization-rail-variants.md): Returns the organization-scoped payout variant configuration. The selector supports BO/BOB bank_transfer with `legacy` or `v2`, and CL/CLP bank_transfer with direct or batched dispatch. Payin routing uses corridor controls. - [Update an organization rail variant](https://docs.cbpayapp.com/api-reference/corridors/update-an-organization-rail-variant.md) ### Disputes - [List account dispute cases](https://docs.cbpayapp.com/api-reference/disputes/list-account-dispute-cases.md): Account-scoped, provider-neutral dispute data. Decisions are organization-admin only. - [Get an account dispute case](https://docs.cbpayapp.com/api-reference/disputes/get-an-account-dispute-case.md) - [List account case evidence](https://docs.cbpayapp.com/api-reference/disputes/list-account-case-evidence.md) - [Upload account case evidence](https://docs.cbpayapp.com/api-reference/disputes/upload-account-case-evidence.md): Multipart field `file`; accepted content types are PDF, PNG and JPG; maximum 10 MB. - [Download account case evidence](https://docs.cbpayapp.com/api-reference/disputes/download-account-case-evidence.md) ## OpenAPI Specs - [openapi](/mcp-pack/openapi.yaml) - [openapi](/openapi.yaml) - [openapi.zh](/mcp-pack/openapi.zh.yaml) - [openapi.zh](/openapi.zh.yaml)