Buyers can invite authorised users to access their account. Once on-boarded, authorised users can transact on behalf of the identity they are on-boarded with. Authorised users are typically employees who have access to company's banking accounts. Note that `/users` endpoints are to be used only for performing operations related to authorised users - getting or updating the details of _admin_ users is to be done via `/buyers` endpoints.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/weavr-buyer-authorised-users-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.2.0
info:
version: v1
title: Weavr Embedded Payment Run Buyer Authorised Users API
license:
name: private
url: https://weavr.io
x-logo:
url: https://weavr-cdn.s3.eu-central-1.amazonaws.com/weavr-payment-run-logo.png
backgroundColor: '#FFFFFF'
altText: Weavr
description: "Weavr Payment Run Plug-in API provides a simple and flexible way for Embedders to add payment execution capabilities in their application.\n\nBy integrating Weavr Payment Run plug-in API in your application, you can embed banking and payment capabilities within your app to boost productivity for your users in a seamless experience.\n\n# Authentication\nEach request to the API must include an `api_key` that represents your account. You can obtain an API Key by registering for a Embedder account [here](https://portal.weavr.io/register/?plugin=payment-run).\n\nAlmost all endpoints require a secondary authentication token `auth_token` that represents the user for whom the request is being executed.\n\n# Postman Collection\nTo help you get started with your integration, you can download the [Postman](https://postman.com) collection [here](https://sandbox.weavr.io/payment-run/v1/postman). The collection includes the steps you’ll need to follow to integrate Embedded Payment Run within your app. \n\nThe collection makes use of environment variables to pre-fill details associated with your Sandbox account, such as your account’s API Key. You can download your Sandbox Account environment file from the [Sandbox Portal](https://portal.weavr.io/register/?plugin=payment-run).\n"
servers:
- url: https://sandbox.weavr.io/payment-run
description: Sandbox
security:
- apiKey: []
authToken: []
tags:
- name: Buyer Authorised Users
description: 'Buyers can invite authorised users to access their account. Once on-boarded, authorised users can transact on behalf of the identity they are on-boarded with.
Authorised users are typically employees who have access to company''s banking accounts.
Note that `/users` endpoints are to be used only for performing operations related to authorised users - getting or updating the details of _admin_ users is to be done via `/buyers` endpoints.
'
paths:
/v1/users:
post:
description: 'Creates a user that belongs to the buyer that the logged-in user belongs to. To Create an Authorised User you would need a stepped-up token. After calling this endpoint you need to step-up ( issue a challenge `/stepup/challenges/otp/{channel}` ). More details on how to step-up a token can be found here [Step-Up](https://docs.weavr.io/payment-run/plugin-api/plugin-api-authentication-stepup/).
Once on-boarded, users have access and manage the buyer''s payment runs.
Users are assigned `roles` which limit the level of access they have and what they can do on behalf of the buyer.
Required user role: `ADMIN`'
summary: Create a user
operationId: userCreate
tags:
- Buyer Authorised Users
parameters:
- in: header
name: idempotency-ref
description: A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: UserCreate
required:
- email
- name
- surname
- roles
type: object
properties:
name:
minLength: 1
maxLength: 20
type: string
description: The first name of the user.
surname:
minLength: 1
maxLength: 20
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
active:
type: boolean
description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
- type: object
required:
- roles
properties:
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
- type: object
properties:
addedBy:
type: object
required:
- roleNames
- userId
properties:
rolesNames:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `ADMIN`: Users assigned to this role can create a business and ensure that systems and processes are effectively managed.
'
items:
type: string
enum:
- ADMIN
userId:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user who added this user.
'400':
description: Bad Request Error - Your request is invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
message:
maxLength: 255
type: string
description: When present helps to identify and fix the problem.
syntaxErrors:
type: object
description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
properties:
invalidFields:
type: array
items:
type: object
properties:
params:
type: array
items:
type: string
fieldName:
type: string
error:
type: string
enum:
- REQUIRED
- HAS_TEXT
- REQUIRES
- SIZE
- RANGE
- IN
- NOT_IN
- REGEX
- EXACTLY
- AT_LEAST
- AT_MOST
- ALL_OR_NONE
'401':
description: Unauthorized - Your credentials or access token are invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'403':
description: Forbidden - Access to the requested resource or action is forbidden.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- STEP_UP_REQUIRED
'409':
description: Conflict
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- EMAIL_NOT_UNIQUE
- MOBILE_NOT_UNIQUE
- MOBILE_OR_COUNTRY_CODE_INVALID
- EMAIL_DOMAIN_NOT_ALLOWED
- INSUFFICIENT_PERMISSIONS
- IDEMPOTENT_REQUEST_IN_PROGRESS
'413':
description: Content Too Large
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'422':
description: Unprocessable Entity
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'429':
description: Too many requests.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
x-ratelimit-limit:
description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)
'
required: true
schema:
type: string
x-ratelimit-reset:
description: The number of seconds until the window is reset.
required: true
schema:
minimum: 0
type: integer
format: int32
'500':
description: Internal Server Error - There is a problem with the server. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'503':
description: Service Unavailable - We're temporarily offline for maintenance. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
default:
description: Error
content:
application/json:
schema:
type: object
properties:
code:
type: string
message:
type: string
get:
description: 'Fetches all authorised users associated with the buyer that the logged-in user belongs to.
Required user role: `ADMIN`'
summary: Get all users
operationId: usersGet
tags:
- Buyer Authorised Users
parameters:
- name: offset
in: query
required: false
description: The offset value for paging, indicating the initial item number to be returned from the data set satisfying the given criteria. Leave out to fetch the first page of results.
schema:
minimum: 0
type: integer
format: int32
default: 0
- name: limit
in: query
required: false
description: The limit of the results for paging, starting at the offset. Limit is always capped at 100.
schema:
maximum: 100
minimum: 1
type: integer
format: int32
default: 100
- name: active
in: query
required: false
schema:
type: boolean
description: Filter for active or deactivated users. Leave out to fetch all users.
- name: email
in: query
required: false
schema:
type: string
format: email
description: Filter for users with the specified email address.
responses:
'200':
description: Success
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
users:
type: array
description: The list of users matching the criteria specified.
items:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
active:
type: boolean
description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
- type: object
required:
- roles
properties:
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
- type: object
properties:
addedBy:
type: object
required:
- roleNames
- userId
properties:
rolesNames:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `ADMIN`: Users assigned to this role can create a business and ensure that systems and processes are effectively managed.
'
items:
type: string
enum:
- ADMIN
userId:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user who added this user.
count:
type: integer
description: The total number of records (excluding the paging limit).
format: int32
responseCount:
type: integer
description: The total number of records returned in this response (always capped at 100).
format: int32
'400':
description: Bad Request Error - Your request is invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
message:
maxLength: 255
type: string
description: When present helps to identify and fix the problem.
syntaxErrors:
type: object
description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
properties:
invalidFields:
type: array
items:
type: object
properties:
params:
type: array
items:
type: string
fieldName:
type: string
error:
type: string
enum:
- REQUIRED
- HAS_TEXT
- REQUIRES
- SIZE
- RANGE
- IN
- NOT_IN
- REGEX
- EXACTLY
- AT_LEAST
- AT_MOST
- ALL_OR_NONE
'401':
description: Unauthorized - Your credentials or access token are invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'403':
description: Forbidden - Access to the requested resource or action is forbidden.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- INSUFFICIENT_PERMISSIONS
'429':
description: Too many requests.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
x-ratelimit-limit:
description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)
'
required: true
schema:
type: string
x-ratelimit-reset:
description: The number of seconds until the window is reset.
required: true
schema:
minimum: 0
type: integer
format: int32
'500':
description: Internal Server Error - There is a problem with the server. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'503':
description: Service Unavailable - We're temporarily offline for maintenance. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
default:
description: Error
content:
application/json:
schema:
type: object
properties:
code:
type: string
message:
type: string
/v1/users/{user_id}:
get:
description: 'Retrieves the user identified by the `user_id` path parameter.
Required user role: `ADMIN`'
summary: Get a user
operationId: userGetById
tags:
- Buyer Authorised Users
parameters:
- name: user_id
in: path
required: true
description: The unique identifier for the user.
schema:
type: string
pattern: ^[0-9]+$
example: '110747174434373672'
responses:
'200':
description: Success
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
# --- truncated at 32 KB (114 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/weavr/refs/heads/main/openapi/weavr-buyer-authorised-users-api-openapi.yml