Buyers can invite authorised users to access their account. Once on-boarded, authorised users can transact on behalf of the identity they are on-boarded with. Authorised users are typically employees who have access to company's banking accounts. Note that `/users` endpoints are to be used only for performing operations related to authorised users - getting or updating the details of _admin_ users is to be done via `/buyers` endpoints.
openapi: 3.1.0
info:
version: v3
title: Weavr Multi Product BackOffice Access Token Buyer Authorised Users API
x-logo:
url: https://storage.googleapis.com/weavr-cdn/weavr_logo-new.png
backgroundColor: '#FFFFFF'
altText: Weavr
description: 'Weavr Multi Back Office API allows you, as an innovator, to perform various back office operations concerning
identities and their instruments, without requiring the users to be logged in.
A token is to be obtained through the `access_token` method, and this will allow relevant operations
to be performed on behalf of this same identity.
'
contact:
name: Weavr
url: https://weavr.io
servers:
- description: Weavr Sandbox Environment
url: https://sandbox.weavr.io/multi/backoffice
tags:
- name: Buyer Authorised Users
description: 'Buyers can invite authorised users to access their account. Once on-boarded, authorised users can transact on behalf of the identity they are on-boarded with.
Authorised users are typically employees who have access to company''s banking accounts.
Note that `/users` endpoints are to be used only for performing operations related to authorised users - getting or updating the details of _admin_ users is to be done via `/buyers` endpoints.
'
paths:
/v1/users:
post:
description: 'Creates a user that belongs to the buyer that the logged-in user belongs to. To Create an Authorised User you would need a stepped-up token. After calling this endpoint you need to step-up ( issue a challenge `/stepup/challenges/otp/{channel}` ). More details on how to step-up a token can be found here [Step-Up](https://docs.weavr.io/payment-run/plugin-api/plugin-api-authentication-stepup/).
Once on-boarded, users have access and manage the buyer''s payment runs.
Users are assigned `roles` which limit the level of access they have and what they can do on behalf of the buyer.
Required user role: `ADMIN`'
summary: Create a user
operationId: userCreate
tags:
- Buyer Authorised Users
parameters:
- in: header
name: idempotency-ref
description: A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: UserCreate
required:
- email
- name
- surname
- roles
type: object
properties:
name:
minLength: 1
maxLength: 20
type: string
description: The first name of the user.
surname:
minLength: 1
maxLength: 20
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
active:
type: boolean
description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
- type: object
required:
- roles
properties:
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
- type: object
properties:
addedBy:
type: object
required:
- roleNames
- userId
properties:
rolesNames:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `ADMIN`: Users assigned to this role can create a business and ensure that systems and processes are effectively managed.
'
items:
type: string
enum:
- ADMIN
userId:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user who added this user.
'400':
description: Bad Request Error - Your request is invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
message:
maxLength: 255
type: string
description: When present helps to identify and fix the problem.
syntaxErrors:
type: object
description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
properties:
invalidFields:
type: array
items:
type: object
properties:
params:
type: array
items:
type: string
fieldName:
type: string
error:
type: string
enum:
- REQUIRED
- HAS_TEXT
- REQUIRES
- SIZE
- RANGE
- IN
- NOT_IN
- REGEX
- EXACTLY
- AT_LEAST
- AT_MOST
- ALL_OR_NONE
'401':
description: Unauthorized - Your credentials or access token are invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'403':
description: Forbidden - Access to the requested resource or action is forbidden.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- STEP_UP_REQUIRED
'409':
description: Conflict
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- EMAIL_NOT_UNIQUE
- MOBILE_NOT_UNIQUE
- MOBILE_OR_COUNTRY_CODE_INVALID
- EMAIL_DOMAIN_NOT_ALLOWED
- INSUFFICIENT_PERMISSIONS
- IDEMPOTENT_REQUEST_IN_PROGRESS
'413':
description: Content Too Large
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'422':
description: Unprocessable Entity
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'429':
description: Too many requests.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
x-ratelimit-limit:
description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)
'
required: true
schema:
type: string
x-ratelimit-reset:
description: The number of seconds until the window is reset.
required: true
schema:
minimum: 0
type: integer
format: int32
'500':
description: Internal Server Error - There is a problem with the server. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'503':
description: Service Unavailable - We're temporarily offline for maintenance. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
default:
description: Error
content:
application/json:
schema:
type: object
properties:
code:
type: string
message:
type: string
get:
description: 'Fetches all authorised users associated with the buyer that the logged-in user belongs to.
Required user role: `ADMIN`'
summary: Get all users
operationId: usersGet
tags:
- Buyer Authorised Users
parameters:
- name: offset
in: query
required: false
description: The offset value for paging, indicating the initial item number to be returned from the data set satisfying the given criteria. Leave out to fetch the first page of results.
schema:
minimum: 0
type: integer
format: int32
default: 0
- name: limit
in: query
required: false
description: The limit of the results for paging, starting at the offset. Limit is always capped at 100.
schema:
maximum: 100
minimum: 1
type: integer
format: int32
default: 100
- name: active
in: query
required: false
schema:
type: boolean
description: Filter for active or deactivated users. Leave out to fetch all users.
- name: email
in: query
required: false
schema:
type: string
format: email
description: Filter for users with the specified email address.
responses:
'200':
description: Success
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
users:
type: array
description: The list of users matching the criteria specified.
items:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
active:
type: boolean
description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
- day
properties:
year:
type: integer
format: int32
maximum: 2100
minimum: 1900
month:
type: integer
format: int32
maximum: 12
minimum: 1
day:
type: integer
format: int32
maximum: 31
minimum: 1
- type: object
required:
- roles
properties:
roles:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `CREATOR`: Users assigned this role can create, view and update payment runs.
* `CONTROLLER`: Users assigned this role can view and link their company''s bank accounts as well as fund payment runs.
'
items:
type: string
enum:
- CREATOR
- CONTROLLER
- type: object
properties:
addedBy:
type: object
required:
- roleNames
- userId
properties:
rolesNames:
type: array
minItems: 1
description: 'Roles define the level of access assigned to the user.
* `ADMIN`: Users assigned to this role can create a business and ensure that systems and processes are effectively managed.
'
items:
type: string
enum:
- ADMIN
userId:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user who added this user.
count:
type: integer
description: The total number of records (excluding the paging limit).
format: int32
responseCount:
type: integer
description: The total number of records returned in this response (always capped at 100).
format: int32
'400':
description: Bad Request Error - Your request is invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
message:
maxLength: 255
type: string
description: When present helps to identify and fix the problem.
syntaxErrors:
type: object
description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
properties:
invalidFields:
type: array
items:
type: object
properties:
params:
type: array
items:
type: string
fieldName:
type: string
error:
type: string
enum:
- REQUIRED
- HAS_TEXT
- REQUIRES
- SIZE
- RANGE
- IN
- NOT_IN
- REGEX
- EXACTLY
- AT_LEAST
- AT_MOST
- ALL_OR_NONE
'401':
description: Unauthorized - Your credentials or access token are invalid.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'403':
description: Forbidden - Access to the requested resource or action is forbidden.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
type: object
properties:
errorCode:
type: string
enum:
- INSUFFICIENT_PERMISSIONS
'429':
description: Too many requests.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
x-ratelimit-limit:
description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)
'
required: true
schema:
type: string
x-ratelimit-reset:
description: The number of seconds until the window is reset.
required: true
schema:
minimum: 0
type: integer
format: int32
'500':
description: Internal Server Error - There is a problem with the server. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
'503':
description: Service Unavailable - We're temporarily offline for maintenance. Please try again later.
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
default:
description: Error
content:
application/json:
schema:
type: object
properties:
code:
type: string
message:
type: string
/v1/users/{user_id}:
get:
description: 'Retrieves the user identified by the `user_id` path parameter.
Required user role: `ADMIN`'
summary: Get a user
operationId: userGetById
tags:
- Buyer Authorised Users
parameters:
- name: user_id
in: path
required: true
description: The unique identifier for the user.
schema:
type: string
pattern: ^[0-9]+$
example: '110747174434373672'
responses:
'200':
description: Success
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
content:
application/json:
schema:
allOf:
- required:
- id
- email
- name
- surname
- buyerId
- active
type: object
properties:
id:
type: string
pattern: ^[0-9]+$
description: The unique identifier of the user.
buyerId:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
name:
maxLength: 100
type: string
description: The first name of the user.
surname:
maxLength: 100
type: string
description: The last name of the user.
email:
type: string
description: E-mail Address of the user
format: email
mobile:
type: object
description: Mobile number of the user
required:
- number
- countryCode
properties:
countryCode:
maxLength: 6
minLength: 1
pattern: ^[\+][0-9]{1,5}$
type: string
description: The country code of the Buyer's admin user mobile number (e.g. +44).
number:
maxLength: 15
minLength: 1
pattern: ^[0-9]+$
type: string
description: The mobile number of the Buyer's admin user - excluding country code.
active:
type: boolean
description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
dateOfBirth:
description: Date of birth of the authorised user.
type: object
required:
- year
- month
# --- truncated at 32 KB (112 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/weavr/refs/heads/main/openapi/weavr-buyer-authorised-users-api-openapi.yml