Benji Pays Payment Method Requests API

openapi: 3.2.0
info:
  title: Benji Pays Merchant Payment Method Requests API
  description: 'The Benji Pays Merchant API is a JSON over HTTPS API. All endpoints live under `/v2`. Errors follow RFC 7807 and are served as `application/problem+json`. This overview describes the cross-cutting behavior shared by every merchant endpoint. Endpoint-specific schemas live with each operation. ## Authentication


    Merchant endpoints authenticate with an organization-scoped `x-api-key` header issued from the merchant app:


    ```

    x-api-key:

    ```


    The key is scoped to one organization and inherits the permissions of the login that created it. Failures return `401 Unauthorized` (missing/expired/invalid credentials) or `403 Forbidden` (insufficient mapping permission or organization lifecycle restrictions). ## Request and Correlation IDs


    Two header pairs help with tracing:


    | Header | Direction | Purpose |

    | --- | --- | --- |

    | `X-Request-ID` | request (optional) / response (always) | Unique identifier for one request. Generated as a UUID v4 when the client omits it. |

    | `X-Correlation-ID` | request (optional) / response (always) | Identifier that flows across service boundaries for distributed tracing. Generated as a UUID v4 when omitted. |


    Both IDs are echoed on success and included as `requestId` / `correlationId` extensions on `application/problem+json` error responses. These headers are auto-injected on every operation in this spec — do not redeclare them per route. ## Idempotency


    POST, PATCH, and PUT endpoints accept an `Idempotency-Key` header to make retries safe. - Format: 1–255 characters, alphanumeric only (`[a-zA-Z0-9]+`). - Scope: keys are scoped per actor (no cross-tenant collisions). - Cache: the first response for a given key is cached for 24 hours. - Replay: a duplicate request with the same key and the same body returns the cached response with `X-Idempotency-Replayed: true` only after credentials were resolved by the global authenticate middleware (API key or Auth0 JWT signature check) before the idempotency cache lookup. - Conflict: same key with a different body returns `409 Conflict`. - In-flight: a second request with the same key while the first is still being processed returns `429 Too Many Requests` with `Retry-After` and problem `type` `https://api.benjipays.com/problems/idempotency-processing` (distinct from rate-limit `…/rate-limit-exceeded`). `Idempotency-Key` is auto-injected on every POST/PATCH/PUT operation in this spec — do not redeclare it per route. Routes that intentionally opt out set `x-bp-skip-idempotency: true`. The middleware fails open: if the cache layer is unavailable the request proceeds without idempotency protection. Most write routes treat the header as optional. Routes that require it set `x-bp-require-idempotency: true` and return `400 Bad Request` when it is missing — currently `POST /v2/transactions`, `POST /v2/transactions/prepayments`, and `POST /v2/transactions/{transactionId}/retry-accounting`. Those routes are also the exception to the fail-open rule above: when the cache layer is unavailable they return `503 Service Unavailable` with `Retry-After` and problem `type` `https://api.benjipays.com/problems/idempotency-unavailable`, and the request is not processed. Retry with the same key. The two charge routes (`POST /v2/transactions` and `POST /v2/transactions/prepayments`) also save the key on the charge. Recover a charge with `GET /v2/transactions?idempotencyKey={key}` (empty `data` when the key was never used). After the 24-hour replay window, the same key creates a new charge. ## Pagination


    List endpoints use offset-based pagination with two query parameters:


    | Parameter | Type | Default | Bounds |

    | --- | --- | --- | --- |

    | `limit` | integer | `20` | `1`–`1000` |

    | `offset` | integer | `0` | `≥ 0` |


    Some endpoints use different bounds (for example usage/billing and autoprocessing forecast). Check the per-operation schema.'
  version: 2.0.0
  contact:
    name: Benji Pays API Support
    email: benji@benjipays.com
servers:
- url: https://api.benjipays.com
  description: Development server
security:
- ApiKeyAuth: []
tags:
- name: Payment Method Requests
  description: Customer payment-method-on-file requests for authenticated organizations
paths:
  /v2/payment-method-requests:
    get:
      summary: List payment-method-on-file requests
      description: Returns paginated customer payment-method-on-file requests for the organization associated with the authenticated API key. Excludes generic (no-customer) portal-link submissions. Filter by customer, gateway, and status. Requires `organizations:payment-method-requests:read`.
      tags:
      - Payment Method Requests
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/CorrelationIdHeader'
      - in: query
        name: customerId
        schema:
          description: Filter to a single accounting customer ID.
          type: string
          minLength: 1
          maxLength: 200
        description: Filter to a single accounting customer ID.
      - in: query
        name: gatewayId
        schema:
          description: Filter to a gateway store identifier (or default-currency hash).
          type: string
          minLength: 1
          maxLength: 100
        description: Filter to a gateway store identifier (or default-currency hash).
      - in: query
        name: status
        schema:
          description: Filter by request status (`pending` or `completed`).
          type: string
          enum:
          - pending
          - completed
        description: Filter by request status (`pending` or `completed`).
      - in: query
        name: limit
        schema:
          default: 20
          type: integer
          minimum: 1
          maximum: 1000
      - in: query
        name: offset
        schema:
          default: 0
          type: integer
          minimum: 0
          maximum: 9007199254740991
      responses:
        '200':
          description: Paginated payment-method-request list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPaymentMethodRequestsResponse'
        '400':
          description: Bad Request — invalid query or portal/accounting configuration
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '401':
          description: Unauthorized — invalid or missing authentication, or API access is not active for this organization (disabled or missing).
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '403':
          description: Forbidden — missing required OAuth scope (`organizations:payment-method-requests:read`) and/or insufficient live mapping permission on the API key owner (e.g. `companyAdmin`). Scope and mapping are independent gates; see response `detail`.
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
                examples:
                  missingScope:
                    summary: Missing OAuth scope
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: 'Missing required scope: organizations:payment-method-requests:read'
                      instance: /v2/payment-method-requests
                  insufficientMappingPermission:
                    summary: Insufficient live mapping permission (API key owner)
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: Insufficient permission for this resource
                      instance: /v2/payment-method-requests
        '404':
          description: Organization not found
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '429':
          description: Too Many Requests
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
      operationId: getV2PaymentMethodRequests
      x-operation-id-source: derived
    post:
      summary: Create a payment-method-on-file request
      description: Creates a customer payment-method-on-file request for the organization associated with the authenticated API key. Returns a portal URL. Does not email or SMS — the caller sends `url` to the customer. Requires `organizations:payment-method-requests:create`.
      tags:
      - Payment Method Requests
      security:
      - ApiKeyAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                customerId:
                  type: string
                  minLength: 1
                  maxLength: 200
                  description: The accounting system customer ID (e.g. the QuickBooks Id, Xero ContactID, Business Central id, or QBD ListID). Same value as `id` on GET /customers/:customerId.
                  example: '42'
                currency:
                  description: 3-letter currency code (e.g. USD). Used to pick the gateway.
                  type: string
                  minLength: 3
                  maxLength: 3
                  pattern: ^[A-Za-z]{3}$
                gatewayId:
                  description: Optional gateway selector. Accepts a gateway store identifier or a hash from GET /v2/gateways/capabilities. If omitted, gateway is chosen from currency / defaults.
                  type: string
                  minLength: 1
                  maxLength: 100
              required:
              - customerId
              - currency
      responses:
        '200':
          description: Payment method request created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentMethodRequest'
        '400':
          description: Bad Request — invalid body or portal/gateway/currency configuration
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '401':
          description: Unauthorized — invalid or missing authentication, or API access is not active for this organization (disabled or missing).
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '403':
          description: Forbidden — missing required OAuth scope (`organizations:payment-method-requests:create`) and/or insufficient live mapping permission on the API key owner (e.g. `companyAdmin`). Scope and mapping are independent gates; see response `detail`.
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
                examples:
                  missingScope:
                    summary: Missing OAuth scope
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: 'Missing required scope: organizations:payment-method-requests:create'
                      instance: /v2/payment-method-requests
                  insufficientMappingPermission:
                    summary: Insufficient live mapping permission (API key owner)
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: Insufficient permission for this resource
                      instance: /v2/payment-method-requests
        '404':
          description: Organization or customer not found
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '429':
          description: Too Many Requests
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/CorrelationIdHeader'
      - $ref: '#/components/parameters/IdempotencyKeyHeader'
      operationId: postV2PaymentMethodRequests
      x-operation-id-source: derived
  /v2/payment-method-requests/{paymentMethodRequestId}:
    get:
      summary: Get a payment-method-on-file request
      description: Returns a single customer payment-method-on-file request by its `id` (from create or list). Scoped to the organization associated with the authenticated API key. Generic (no-customer) portal-link submissions are treated as not found. Requires `organizations:payment-method-requests:read`.
      tags:
      - Payment Method Requests
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/CorrelationIdHeader'
      - in: path
        name: paymentMethodRequestId
        schema:
          type: string
          pattern: ^[0-9a-fA-F]{24}$
          description: Payment method request Mongo id (`id` from create or list).
          example: 507f1f77bcf86cd7994390cc
        required: true
        description: Payment method request Mongo id (`id` from create or list).
      responses:
        '200':
          description: Payment method request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentMethodRequest'
        '400':
          description: Bad Request — invalid id or portal/accounting configuration
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '401':
          description: Unauthorized — invalid or missing authentication, or API access is not active for this organization (disabled or missing).
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '403':
          description: Forbidden — missing required OAuth scope (`organizations:payment-method-requests:read`) and/or insufficient live mapping permission on the API key owner (e.g. `companyAdmin`). Scope and mapping are independent gates; see response `detail`.
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
                examples:
                  missingScope:
                    summary: Missing OAuth scope
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: 'Missing required scope: organizations:payment-method-requests:read'
                      instance: /v2/payment-method-requests/{paymentMethodRequestId}
                  insufficientMappingPermission:
                    summary: Insufficient live mapping permission (API key owner)
                    value:
                      type: https://api.benjipays.com/problems/forbidden
                      title: Forbidden
                      status: 403
                      detail: Insufficient permission for this resource
                      instance: /v2/payment-method-requests/{paymentMethodRequestId}
        '404':
          description: Organization or payment method request not found
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
        '429':
          description: Too Many Requests
          content:
            application/problem+json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                  title:
                    type: string
                  status:
                    type: number
                  detail:
                    type: string
                  instance:
                    type: string
                required:
                - type
                - title
                - status
                - detail
                additionalProperties: false
                description: RFC 7807 Problem Details error response
      operationId: getV2PaymentMethodRequestsByPaymentMethodRequestId
      x-operation-id-source: derived
components:
  parameters:
    IdempotencyKeyHeader:
      name: Idempotency-Key
      in: header
      required: false
      description: 'Optional client-supplied key that makes retries safe for POST/PATCH/PUT. Scoped per actor; cached for 24 hours. Replays return the cached response with `X-Idempotency-Replayed: true`. Same key with a different body returns 409. In-flight duplicates return 429 with `Retry-After`. See the Idempotency section in the API overview.'
      schema:
        type: string
        pattern: ^[a-zA-Z0-9]+$
        minLength: 1
        maxLength: 255
      example: a1b2c3d4e5f6
    RequestIdHeader:
      name: X-Request-ID
      in: header
      required: false
      description: Optional client-supplied unique ID for one request. The server generates a UUID v4 if omitted and always echoes the value in the response.
      schema:
        type: string
        format: uuid
    CorrelationIdHeader:
      name: X-Correlation-ID
      in: header
      required: false
      description: Optional ID that flows across service boundaries for distributed tracing. The server generates a UUID v4 if omitted and always echoes the value in the response.
      schema:
        type: string
        format: uuid
  schemas:
    PaymentMethodRequest:
      type: object
      properties:
        id:
          type: string
          description: Payment method request Mongo id.
        url:
          type: string
          description: Portal link to send to the customer so they can save a payment method. Does not email or SMS.
        status:
          type: string
          enum:
          - pending
          - completed
          description: Request status. Create always returns `pending`. Completed after the customer saves a payment method.
        customerId:
          anyOf:
          - type: string
          - type: 'null'
          description: Accounting system customer ID the request is for.
        currency:
          anyOf:
          - type: string
          - type: 'null'
          description: Normalized 3-letter currency code.
        gatewayId:
          anyOf:
          - type: string
          - type: 'null'
          description: Resolved gateway store identifier (or default-currency hash).
        createdDate:
          anyOf:
          - type: string
          - type: 'null'
          description: ISO timestamp when the request was created.
        completedDate:
          anyOf:
          - type: string
          - type: 'null'
          description: ISO timestamp when the customer completed the request, or null if still pending.
      required:
      - id
      - url
      - status
      - customerId
      - currency
      - gatewayId
      - createdDate
      - completedDate
      additionalProperties: false
      description: Payment method on-file request
    ListPaymentMethodRequestsResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/PaymentMethodRequest'
        pagination:
          type: object
          properties:
            total:
              type: number
              description: Total matching payment method requests across all pages
            limit:
              type: number
            offset:
              type: number
            hasMore:
              type: boolean
            nextOffset:
              anyOf:
              - type: number
              - type: 'null'
            prevOffset:
              anyOf:
              - type: number
              - type: 'null'
          required:
          - total
          - limit
          - offset
          - hasMore
          - nextOffset
          - prevOffset
          additionalProperties: false
      required:
      - data
      - pagination
      additionalProperties: false
      description: Paginated payment-method-request list response
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: Organization-scoped API key. Send it in the x-api-key header. Available on organization endpoints only.
x-speakeasy-retries:
  strategy: backoff
  backoff:
    initialInterval: 500
    maxInterval: 60000
    maxElapsedTime: 3600000
    exponent: 1.5
  statusCodes:
  - 5XX
  retryConnectionErrors: true
x-provenance:
  method: searched
  source: https://developer.benjipays.com/reference
  harvested: '2026-11-02'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://developer.benjipays.com/reference/delete_v2-customers-customerid-alert.md
  - https://developer.benjipays.com/reference/delete_v2-customers-customerid-notes-noteid.md
  - https://developer.benjipays.com/reference/get_v2-accounting-accounts.md
  - https://developer.benjipays.com/reference/get_v2-autoprocessing-forecast.md
  - https://developer.benjipays.com/reference/get_v2-customers-customerid-notes-noteid.md
  - https://developer.benjipays.com/reference/get_v2-customers-customerid-notes.md
  - https://developer.benjipays.com/reference/get_v2-customers-customerid.md
  - https://developer.benjipays.com/reference/get_v2-customers.md
  - https://developer.benjipays.com/reference/get_v2-emails-emailid.md
  - https://developer.benjipays.com/reference/get_v2-emails.md
  - https://developer.benjipays.com/reference/get_v2-gateways-capabilities.md
  - https://developer.benjipays.com/reference/get_v2-gateways.md
  - https://developer.benjipays.com/reference/get_v2-invoices-invoiceid-pdf.md
  - https://developer.benjipays.com/reference/get_v2-invoices-invoiceid.md
  - https://developer.benjipays.com/reference/get_v2-invoices.md
  - https://developer.benjipays.com/reference/get_v2-notes-categories.md
  - https://developer.benjipays.com/reference/get_v2-notes-statuses.md
  - https://developer.benjipays.com/reference/get_v2-organization.md
  - https://developer.benjipays.com/reference/get_v2-payment-method-requests-paymentmethodrequestid.md
  - https://developer.benjipays.com/reference/get_v2-payment-method-requests.md
  - https://developer.benjipays.com/reference/get_v2-payment-methods-id.md
  - https://developer.benjipays.com/reference/get_v2-payment-methods.md
  - https://developer.benjipays.com/reference/get_v2-settings.md
  - https://developer.benjipays.com/reference/get_v2-transactions-transactionid-receipt.md
  - https://developer.benjipays.com/reference/get_v2-transactions.md
  - https://developer.benjipays.com/reference/get_v2-users.md
  - https://developer.benjipays.com/reference/get_v2-whoami-1.md
  - https://developer.benjipays.com/reference/patch_v2-customers-customerid-notes-noteid.md
  - https://developer.benjipays.com/reference/patch_v2-customers-customerid.md
  - https://developer.benjipays.com/reference/post_v2-customers-customerid-alert.md
  - https://developer.benjipays.com/reference/post_v2-customers-customerid-notes-noteid-replies.md
  - https://developer.benjipays.com/reference/post_v2-customers-customerid-notes-noteid-status.md
  - https://developer.benjipays.com/reference/post_v2-customers-customerid-notes.md
  - https://developer.benjipays.com/reference/post_v2-payment-links-applied-invoiceid.md
  - https://developer.benjipays.com/reference/post_v2-payment-links-unapplied.md
  - https://developer.benjipays.com/reference/post_v2-payment-method-requests.md
  - https://developer.benjipays.com/reference/post_v2-transactions-prepayments.md
  - https://developer.benjipays.com/reference/post_v2-transactions-transactionid-resend-receipt.md
  - https://developer.benjipays.com/reference/post_v2-transactions-transactionid-retry-accounting.md
  - https://developer.benjipays.com/reference/post_v2-transactions.md
  merge:
    pages: 40
    deduped: 167
    conflicts_kept_first: 0