Bolt Embeddable Checkout v1 API

openapi: 3.0.0
info:
  version: 1.0.1
  title: Embedded API Reference
  description: |
    Postman Collection:

    [![](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9136127-55d2bde1-a248-473f-95b5-64cfd02fb445?action=collection%2Ffork&collection-url=entityId%3D9136127-55d2bde1-a248-473f-95b5-64cfd02fb445%26entityType%3Dcollection%26workspaceId%3D78beee89-4238-4c5f-bd1f-7e98978744b4#?env%5BBolt%20Sandbox%20Environment%5D=W3sia2V5IjoiYXBpX2Jhc2VfdXJsIiwidmFsdWUiOiJodHRwczovL2FwaS1zYW5kYm94LmJvbHQuY29tIiwidHlwZSI6ImRlZmF1bHQiLCJlbmFibGVkIjp0cnVlfSx7ImtleSI6InRrX2Jhc2UiLCJ2YWx1ZSI6Imh0dHBzOi8vc2FuZGJveC5ib2x0dGsuY29tIiwidHlwZSI6ImRlZmF1bHQiLCJlbmFibGVkIjp0cnVlfSx7ImtleSI6ImFwaV9rZXkiLCJ2YWx1ZSI6IjxyZXBsYWNlIHdpdGggeW91ciBCb2x0IFNhbmRib3ggQVBJIGtleT4iLCJ0eXBlIjoic2VjcmV0IiwiZW5hYmxlZCI6dHJ1ZX0seyJrZXkiOiJwdWJsaXNoYWJsZV9rZXkiLCJ2YWx1ZSI6IjxyZXBsYWNlIHdpdGggeW91ciBCb2x0IFNhbmRib3ggcHVibGlzaGFibGUga2V5PiIsInR5cGUiOiJkZWZhdWx0IiwiZW5hYmxlZCI6dHJ1ZX0seyJrZXkiOiJkaXZpc2lvbl9pZCIsInZhbHVlIjoiPHJlcGxhY2Ugd2l0aCB5b3VyIEJvbHQgU2FuZGJveCBwdWJsaWMgZGl2aXNpb24gSUQ+IiwidHlwZSI6ImRlZmF1bHQiLCJlbmFibGVkIjp0cnVlfV0=)

    ## About
    The Embedded API reference is a consolidation of critical APIs that a developer will use when integrating with Bolt's Embedded Accounts product suite.
servers:
  - url: https://api.boltapp.com
    description: The Production URL (Live Data).
  - url: https://api-sandbox.boltapp.com
    description: The Sandbox URL (Test Data).
  - url: https://api-staging.boltapp.com
    description: The Staging URL (Staged Data).
security:
  - X-API-Key: []
  - OAuth:
      - bolt.account.manage
      - bolt.account.view
tags:
  - name: Account
    description: |
      Create Embedded Accounts user flows for logged-in and guest experiences by interacting with and updating shopper data.
  - name: Transactions
    description: |
      Authorize credit card transactions and perform operations on those transactions with Bolt's transaction API.
  - name: OAuth
    description: |
      Interact with Shopper data by completing the Bolt OAuth process.
  - name: Testing
    description: |
      A collection of endpoints that provide useful functionality to assist in testing your Bolt integration.
paths:
  /v1/account:
    get:
      description: Fetch a shopper's account details to pre-fill checkout fields. This request must come from your backend for security purposes, as it requires the use of your private key to authenticate. For PCI compliance, only limited information is returned for each credit card available in the shopper’s wallet.
      operationId: getAccount
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/account_details'
          description: Account Details Fetched
      security:
        - OAuth:
            - bolt.account.manage
            - bolt.account.view
          X-API-Key: []
      summary: Get Account Details
      tags:
        - Account
    post:
      description: Create a Bolt shopping account.
      operationId: createAccount
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/create_account_input'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/account_details'
          description: Account Created
      security:
        - X-API-Key: []
      summary: Create Bolt Account
      tags:
        - Account
  /v1/account/profile:
    patch:
      description: Update the identifiers for a shopper's profile (first name or last name).
      operationId: updateAccountProfile
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/update_profile'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/profile_view'
          description: Profile Updated
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Update Profile
      tags:
        - Account
  /v1/account/addresses:
    post:
      description: Add an address to a shopper's account address book.
      operationId: addAddress
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/address_account'
      responses:
        '200':
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/address_view_account'
                  - properties:
                      default:
                        type: boolean
                    type: object
          description: Address Added Successfully
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Add Address
      tags:
        - Account
  /v1/account/addresses/{id}:
    delete:
      description: |
        Deletes an existing address in a shopper's address book.
      operationId: deleteAddress
      parameters:
        - $ref: '#/components/parameters/shopper_address_id_path_param'
        - $ref: '#/components/parameters/x-publishable-key'
      responses:
        '200':
          description: Address Successfully Deleted
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Delete Address
      tags:
        - Account
    post:
      description: |
        Replace an existing address in a shopper's address book.
        These changes delete the existing address and create a new one.
      operationId: replaceAddress
      parameters:
        - $ref: '#/components/parameters/shopper_address_id_path_param'
        - $ref: '#/components/parameters/x-publishable-key'
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/address_account'
      responses:
        '200':
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/address_view_account'
                  - properties:
                      default:
                        type: boolean
                    type: object
          description: Address Updated Successfully
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Replace Address
      tags:
        - Account
    put:
      description: |
        Edit an existing address in a shopper's address book.
        This endpoint fully replaces the information for an existing address while retaining the same address ID.
      operationId: editAddress
      parameters:
        - $ref: '#/components/parameters/shopper_address_id_path_param'
        - $ref: '#/components/parameters/x-publishable-key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/address_account'
      responses:
        '200':
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/address_view_account'
                  - properties:
                      default:
                        type: boolean
                    type: object
          description: Address Updated Successfully
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Edit Address
      tags:
        - Account
  /v1/account/exists:
    get:
      description: Check whether an account exists using one of `email`, `phone`, or `sha256_email` as the unique identifier.
      operationId: detectAccount
      parameters:
        - $ref: '#/components/parameters/email'
        - $ref: '#/components/parameters/sha256_email'
        - $ref: '#/components/parameters/phone'
        - $ref: '#/components/parameters/x_publishable_key_required'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1_accounts_view'
          description: Has Bolt Account
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errors_bolt_api_response'
          description: Missing Query Parameter
      summary: Detect Account
      tags:
        - Account
      security: []
  /v1/account/payment_methods:
    post:
      description: |
        Add a payment method to a shopper's Bolt account Wallet. For security purposes, this request must come from your backend because authentication requires the use of your private key.

        **Note**: Before using this API, the credit card details must be tokenized using Bolt's JavaScript library function, which is documented in [Install the Bolt Tokenizer](https://help.boltapp.com/developers/references/bolt-tokenizer).
      operationId: addPaymentMethod
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/credit_card_account'
                - properties:
                    currency:
                      description: This can be left empty. A 3-digit ISO code for currency that will be used in the credit card authorization.
                      type: string
                      example: USD
                  type: object
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/saved_credit_card_view'
          description: Payment Method Added
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Add Payment Method
      tags:
        - Account
  /v1/account/payment_methods/{payment_method_id}:
    delete:
      description: Delete a saved payment method from a shopper's Bolt account Wallet.
      operationId: deletePaymentMethod
      parameters:
        - $ref: '#/components/parameters/shopper_payment_method_id_path_param'
        - $ref: '#/components/parameters/x-publishable-key'
      responses:
        '200':
          description: Success
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errors_bolt_api_response'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errors_bolt_api_response'
          description: Not Found
      security:
        - OAuth:
            - bolt.account.manage
          X-API-Key: []
      summary: Delete Payment Method
      tags:
        - Account
  /v1/oauth/token:
    post:
      description: |
        Endpoint for receiving access, ID, and refresh tokens from Bolt's OAuth server. 

        To use this endpoint, first use the Authorization Code Request flow by using the `authorization_code` Grant Type (`grant_type`). Then, in the event that you would need a second or subsequent code, use the `refresh_token` value returned from a successful request as the `refresh_token` input value in your subsequent `refresh_token` Grant Type (`grant_type`) request.

         **Reminder - the Content-Type of this request must be application/x-www-form-urlencoded**
      operationId: OAuthToken
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
      requestBody:
        content:
          application/x-www-form-urlencoded:
            examples:
              authorization_code_request:
                value:
                  client_id: PUBLISHABLE_KEY_PLACEHOLDER
                  client_secret: API_KEY_PLACEHOLDER
                  code: AUTH_CODE_PLACEHOLDER
                  grant_type: authorization_code
                  scope: bolt.account.manage+openid
              refresh_token_request:
                value:
                  client_id: PUBLISHABLE_KEY_PLACEHOLDER
                  client_secret: API_KEY_PLACEHOLDER
                  grant_type: refresh_token
                  refresh_token: REFRESH_TOKEN_PLACEHOLDER
                  scope: bolt.account.view
            schema:
              oneOf:
                - $ref: '#/components/schemas/o_auth_token_input'
                - $ref: '#/components/schemas/o_auth_token_input_refresh'
      responses:
        '200':
          content:
            application/json:
              examples:
                authorization_code_response:
                  value:
                    access_token: $ACCESS_TOKEN
                    expires_in: 3600
                    id_token: $ID_TOKEN
                    refresh_token: $REFRESH_TOKEN
                    refresh_token_scope: bolt.account.view
                    scope: bolt.account.manage
                    token_type: bearer
                refresh_token_response:
                  value:
                    access_token: $NEW_ACCESS_TOKEN
                    expires_in: 3600
                    refresh_token: $NEW_REFRESH_TOKEN
                    refresh_token_scope: bolt.account.view
                    scope: bolt.account.view
                    token_type: bearer
              schema:
                $ref: '#/components/schemas/o_auth_token_response'
          description: OAuth token response.
        '400':
          $ref: '#/components/responses/oauth_400'
        '403':
          $ref: '#/components/responses/oauth_403'
        '422':
          $ref: '#/components/responses/oauth_422'
      summary: OAuth Token Endpoint
      tags:
        - OAuth
  /v1/merchant/transactions/authorize:
    post:
      description: |
        This endpoint authorizes card payments and has three main use cases:
        * • Authorize a payment using an unsaved payment method for a guest or logged-in shopper.
        * • Authorize a payment using a saved payment method for a logged-in shopper.
        *  • Re-charge a previous transaction using the `credit_card_id` of the transaction.
      operationId: authorizeTransaction
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/merchant_credit_card_authorization'
                - $ref: '#/components/schemas/merchant_credit_card_authorization_recharge'
        description: |
          **Authorize a Transaction**
          * • `merchant_credit_card_authorization`: For authorizing with a new, unsaved card. This can be for a guest checkout flow, one-time payment, or an existing Bolt shopper.
          * • `merchant_credit_card_authorization_recharge`: For authorizing a card using a shoppers saved payment methods.
          * • **Anytime the shopper is paying while logged-in attach their OAuth `access_token` to the request.**
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/i_authorize_result_view'
          description: Authorization Successful
      security:
        - OAuth: []
          X-API-Key: []
      summary: Authorize a Card
      tags:
        - Transactions
  /v1/merchant/transactions/capture:
    post:
      description: |
        This captures funds for the designated transaction. A capture can be done for any partial amount or for the total authorized amount.

        Although the response returns the standard `transaction_view` object, only `captures` and either `id` or `reference` are needed.
      operationId: captureTransaction
      parameters:
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        $ref: '#/components/requestBodies/capture_transaction'
        description: Capture a Transaction
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transaction_view'
          description: Capture Successful
        '403':
          $ref: '#/components/responses/transaction_capture_error_403'
        '404':
          $ref: '#/components/responses/transaction_capture_error_404'
        '422':
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      properties:
                        code:
                          example: 1000001
                          type: number
                        field:
                          example: transaction_id
                          type: string
                        message:
                          example: '`TA8hLkJh4db4JJ` must be a valid public id of type transaction'
                          type: string
                      type: object
                    type: array
                  result:
                    type: object
                type: object
          description: Unprocessable Entity
      security:
        - X-API-Key: []
      summary: Capture a Transaction
      tags:
        - Transactions
  /v1/merchant/transactions/credit:
    post:
      description: This refunds a captured transaction. Refunds can be done for any partial amount or for the total authorized amount. These refunds are processed synchronously and return information about the refunded transaction in the standard `transaction_view` object.
      operationId: refundTransaction
      parameters:
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/transaction_credit'
        description: Refund a Transaction
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transaction_view'
          description: Refund Successful
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errors_bolt_api_response'
          description: Generic Error Schema
      security:
        - X-API-Key: []
      summary: Refund a Transaction
      tags:
        - Transactions
  /v1/merchant/transactions/void:
    post:
      description: |
        This voids the authorization for a given transaction. Voids must be completed before the authorization is captured.
        In the request, either `transaction_id` or `transaction_reference` is required.
        Although the response returns the standard `transaction_view` object, only `status` and either `id` or `reference` are needed.
      operationId: voidTransaction
      parameters:
        - $ref: '#/components/parameters/idempotency_key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/credit_card_void'
        description: Void a Transaction
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transaction_view'
          description: Void Successful
        '403':
          $ref: '#/components/responses/transaction_void_error_403'
        '404':
          $ref: '#/components/responses/transaction_void_error_404'
      security:
        - X-API-Key: []
      summary: Void a Transaction
      tags:
        - Transactions
  /v1/merchant/transactions/{REFERENCE}:
    get:
      description: |
        This allows you to pull the full transaction details for a given transaction.

         **Note**: All objects and fields marked `required` in the Transaction Details response are also **nullable**. This includes any sub-components (objects or fields) also marked `required`.
      operationId: getTransactionDetails
      parameters:
        - $ref: '#/components/parameters/transaction_reference_path_param'
      responses:
        '200':
          $ref: '#/components/responses/transaction_details'
        '403':
          $ref: '#/components/responses/transaction_details_error_403'
        '422':
          $ref: '#/components/responses/transaction_details_error_422'
      security:
        - X-API-Key: []
      summary: Transaction Details
      tags:
        - Transactions
    patch:
      description: This allows you to update certain transaction properties post-authorization.
      operationId: updateTransaction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/transaction_update_input'
              description: Update a Transaction
      parameters:
        - $ref: '#/components/parameters/transaction_reference_path_param'
        - $ref: '#/components/parameters/idempotency_key'
      responses:
        '200':
          $ref: '#/components/responses/transaction_details'
        '403':
          $ref: '#/components/responses/transaction_details_error_403'
        '404':
          $ref: '#/components/responses/transaction_details_error_404'
      security:
        - X-API-Key: []
      summary: Update a Transaction
      tags:
        - Transactions
  /v1/testing/shopper/create:
    post:
      description: Create a Bolt shopper account for testing purposes. Available for sandbox use only and the created account will be recycled after a certain time.
      operationId: createTestingShopperAccount
      parameters:
        - $ref: '#/components/parameters/x-publishable-key'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/testing_account_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/testing_account_details'
          description: Testing Account Created
      security:
        - X-API-Key: []
      summary: Create Testing Shopper Account
      tags:
        - Testing
  /v1/testing/card_token:
    get:
      description: This endpoint fetches a new credit card token for Bolt's universal test credit card number `4111 1111 1111 1004`. This is for testing and is available only in sandbox.
      operationId: getTestCreditCardToken
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    description: The newly generated credit card token.
                    type: string
                    example: 7i8322df93jsor663bsf02be798e672afd9360a81d203rc97778ff4bddedertg
                  expiry:
                    description: The date at which the token expires. A token must be used within 15 minutes of creation.
                    type: integer
                    example: 1671140825305
                  last4:
                    description: The last 4 digits of the card number.
                    type: string
                    example: '1004'
                  bin:
                    description: The credit card bin.
                    type: string
                    example: '411111'
                  network:
                    description: The credit card network.
                    type: string
                    example: visa
          description: Successfully Fetched Credit Card Token
      security:
        - X-API-Key: []
      summary: Fetch a Test Credit Card Token
      tags:
        - Testing
  /v1/tokenizer/proxy:
    post:
      summary: Authorize a Card using TaaS
      description: |
        The `POST  /v1/tokenizer/proxy` endpoint allows enterprise merchants to **securely authorize transactions with their  preferred payment processors (PSPs)** by proxying requests through Bolt's PCI-compliant infrastructure. This API is part of Bolt's Tokenization-as-a-Service (TaaS) platform, enabling merchants to inject sensitive card data (e.g., PAN, CVV) into PSP-native request formats without directly handling raw card data.
        The proxy replaces placeholders in the merchant-defined request body with actual card data retrieved securely using the provided `x-bolt-taas-id`, and forwards the complete request to the specified `x-bolt-forward-to` URL using the HTTP method specified in `x-bolt-forward-verb`.
      operationId: proxyTransaction
      tags:
        - Transactions
      security:
        - X-API-Key: []
      parameters:
        - $ref: '#/components/parameters/x-bolt-forward-to'
        - $ref: '#/components/parameters/x-bolt-taas-id'
        - $ref: '#/components/parameters/x-bolt-forward-verb'
      requestBody:
        description: |
          Use this API to proxy an authorization request to a third-party PSP endpoint using Bolt's secure infrastructure.

            - Replace raw card fields (e.g., card[number]) with placeholders like `{{tk:cc}}`, `{{tk:cvv}}`, `{{tk:exp_month}}`, etc.
            - The placeholders will be securely replaced by Bolt using the identifier from `x-bolt-taas-id`.
            - The `x-bolt-forward-to` header must point to a whitelisted PSP URL.
            - The `x-bolt-forward-verb` header specifies the HTTP method (POST, PUT, or PATCH) for the PSP request.

          **Never submit raw PAN, CVV, or expiration directly. Use placeholders.**
          Supported placeholders:
            - `{{tk:cc}}` – Full card number  
            - `{{tk:cvv}}` – Card CVV  
            - `{{tk:exp_month}}` – Expiration month  
            - `{{tk:exp_year}}` – Expiration year
        required: true
        content:
          application/json:
            schema:
              type: object
            example:
              type: card
              card:
                number: '{{tk:cc}}'
                exp_month: '{{tk:exp_month}}'
                exp_year: '{{tk:exp_year}}'
                cvc: '{{tk:cvv}}'
              billing_details:
                name: Jane Doe
                address:
                  postal_code: '94107'
      responses:
        '200':
          description: Successful proxy to the PSP. Returns the PSP's response along with a unique proxy operation ID for tracking.
          content:
            application/json:
              schema:
                type: object
                properties:
                  status_code:
                    type: integer
                    description: HTTP status code returned by the PSP
                    example: 200
                  body:
                    type: string
                    description: Response body from the PSP (JSON string)
                    example: '{"id":"pm_1NQzWT2eZvKYlo2C","object":"payment_method","type":"card","card":{"last4":"4242","brand":"visa","exp_month":12,"exp_year":2026}}'
                  header:
                    type: object
                    description: Response headers from the PSP
                    additionalProperties:
                      type: array
                      items:
                        type: string
                    example:
                      Content-Type:
                        - application/json
                  proxy_operation_id:
                    type: string
                    description: Unique identifier for this proxy operation
                    example: PROXY-ABC123-DEF456-GHI789
              example:
                status_code: 200
                body: '{"id":"pm_1NQzWT2eZvKYlo2C","object":"payment_method","type":"card","card":{"last4":"4242","brand":"visa","exp_month":12,"exp_year":2026}}'
                header:
                  Content-Type:
                    - application/json
                proxy_operation_id: PROXY-ABC123-DEF456-GHI789
        '400':
          description: Missing required headers or invalid request body
          content:
            application/json:
              example:
                error: Missing required headers (x-bolt-forward-to, x-bolt-taas-id, x-bolt-forward-verb) or invalid JSON body
        '401':
          description: Unauthorized - missing or invalid merchant API key
          content:
            application/json:
              example:
                error: Invalid or missing merchant API key
        '422':
          description: Invalid TaaS ID or credit card/token not found
          content:
            application/json:
              example:
                error: Invalid x-bolt-taas-id. Credit card not found or expired.
        '502':
          description: Upstream PSP error during proxy forwarding
          content:
            application/json:
              example:
                error: Stripe returned 402 - Card declined
components:
  parameters:
    x-publishable-key:
      description: The publicly viewable identifier used to identify a merchant division. This key is found in the Developer > API section of the Bolt Merchant Dashboard [RECOMMENDED].
      in: header
      name: X-Publishable-Key
      required: false
      schema:
        type: string
    idempotency_key:
      description: A key created by merchants that ensures `POST` and `PATCH` requests are only performed once. [Read more about Idempotent Requests here](/developers/references/idempotency/).
      in: header
      name: Idempotency-Key
      required: false
      schema:
        type: string
    shopper_address_id_path_param:
      description: The ID for an address in the shopper's Address Book.
      in: path
      name: id
      required: true
      schema:
        type: string
    email:
      description: The shopper's email address is the primary mechanism for detecting an account. You **must** provide either a value for this parameter or for `sha256_email`.
      in: query
      name: email
      required: false
      schema:
        type: string
    sha256_email:
      description: The sha256 hash of the shopper's normalized email address can be used to detect an account instead of `email`.
      in: query
      name: sha256_email
      required: false
      schema:
        type: string
    phone:
      description: The shopper's phone number. Includes country code (e.g. +1); does not include dashes or spaces. Can be used to detect an account instead of `sha256_email` or `email`.
      in: query
      name: phone
      required: false
      schema:
        type: string
    x_publishable_key_required:
      description: The publicly viewable identifier used to identify a merchant division. This key is found in the Developer > API section of the Bolt Merchant Dashboard.
      in: header
      name: X-Publishable-Key
      required: true
      schema:
        type: string
    shopper_payment_method_id_path_param:
      description: The ID for a payment method in the shopper's Bolt account Wallet. This ID can be obtained using [Get Account Details](#tag/Account/operation/GetAccountDetails).
      in: path
      name: payment_method_id
      required: true
      schema:
        type: string
    transaction_reference_path_param:
      description: This is the Bolt transaction reference. (ex. N7Y3-NFKC-VFRF)
      in: path
      name: REFERENCE
      required: true
      schema:
        type: string
    x-bolt-forward-to:
      name: X-Bolt-Forward-To
      in: header
      description: |
        The fully qualified URL of the payment service provider (PSP) endpoint to which the request should be proxied. This URL must be whitelisted in advance by Bolt.
      required: true
      schema:
        type: string
        example: https://api.stripe.com/v1/payment_methods
    x-bolt-taas-id:
      name: X-Bolt-Taas-Id
      in: header
      description: |
        Provide your Tokenizer-as-a-Service (TaaS) identifier. This value tells Bolt which stored payment method to use when injecting sensitive data into the proxied request. The value must be in the

# --- truncated at 32 KB (313 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/bolt-financial/refs/heads/main/openapi/bolt-financial-embeddable-checkout-v1-openapi.yml