Benji Pays Transactions API

openapi: 3.2.0
info:
  title: Benji Pays Merchant Transactions API
  description: 'The Benji Pays Merchant API is a JSON over HTTPS API. All endpoints live under `/v2`. Errors follow RFC 7807 and are served as `application/problem+json`. This overview describes the cross-cutting behavior shared by every merchant endpoint. Endpoint-specific schemas live with each operation. ## Authentication


    Merchant endpoints authenticate with an organization-scoped `x-api-key` header issued from the merchant app:


    ```

    x-api-key:

    ```


    The key is scoped to one organization and inherits the permissions of the login that created it. Failures return `401 Unauthorized` (missing/expired/invalid credentials) or `403 Forbidden` (insufficient mapping permission or organization lifecycle restrictions). ## Request and Correlation IDs


    Two header pairs help with tracing:


    | Header | Direction | Purpose |

    | --- | --- | --- |

    | `X-Request-ID` | request (optional) / response (always) | Unique identifier for one request. Generated as a UUID v4 when the client omits it. |

    | `X-Correlation-ID` | request (optional) / response (always) | Identifier that flows across service boundaries for distributed tracing. Generated as a UUID v4 when omitted. |


    Both IDs are echoed on success and included as `requestId` / `correlationId` extensions on `application/problem+json` error responses. These headers are auto-injected on every operation in this spec — do not redeclare them per route. ## Idempotency


    POST, PATCH, and PUT endpoints accept an `Idempotency-Key` header to make retries safe. - Format: 1–255 characters, alphanumeric only (`[a-zA-Z0-9]+`). - Scope: keys are scoped per actor (no cross-tenant collisions). - Cache: the first response for a given key is cached for 24 hours. - Replay: a duplicate request with the same key and the same body returns the cached response with `X-Idempotency-Replayed: true` only after credentials were resolved by the global authenticate middleware (API key or Auth0 JWT signature check) before the idempotency cache lookup. - Conflict: same key with a different body returns `409 Conflict`. - In-flight: a second request with the same key while the first is still being processed returns `429 Too Many Requests` with `Retry-After` and problem `type` `https://api.benjipays.com/problems/idempotency-processing` (distinct from rate-limit `…/rate-limit-exceeded`). `Idempotency-Key` is auto-injected on every POST/PATCH/PUT operation in this spec — do not redeclare it per route. Routes that intentionally opt out set `x-bp-skip-idempotency: true`. The middleware fails open: if the cache layer is unavailable the request proceeds without idempotency protection. Most write routes treat the header as optional. Routes that require it set `x-bp-require-idempotency: true` and return `400 Bad Request` when it is missing — currently `POST /v2/transactions`, `POST /v2/transactions/prepayments`, and `POST /v2/transactions/{transactionId}/retry-accounting`. Those routes are also the exception to the fail-open rule above: when the cache layer is unavailable they return `503 Service Unavailable` with `Retry-After` and problem `type` `https://api.benjipays.com/problems/idempotency-unavailable`, and the request is not processed. Retry with the same key. The two charge routes (`POST /v2/transactions` and `POST /v2/transactions/prepayments`) also save the key on the charge. Recover a charge with `GET /v2/transactions?idempotencyKey={key}` (empty `data` when the key was never used). After the 24-hour replay window, the same key creates a new charge. ## Pagination


    List endpoints use offset-based pagination with two query parameters:


    | Parameter | Type | Default | Bounds |

    | --- | --- | --- | --- |

    | `limit` | integer | `20` | `1`–`1000` |

    | `offset` | integer | `0` | `≥ 0` |


    Some endpoints use different bounds (for example usage/billing and autoprocessing forecast). Check the per-operation schema.'
  version: 2.0.0
  contact:
    name: Benji Pays API Support
    email: benji@benjipays.com
servers:
- url: https://api.benjipays.com
  description: Development server
security:
- ApiKeyAuth: []
tags:


# --- truncated at 32 KB (84 KB total) ---
# Full source: https://artifacts.apis.io/benjipays-com/openapi/benjipays-com-transactions-api-openapi.yml