WellnessLiving Payments API

openapi: 3.2.0
info:
  title: WellnessLiving Payments API
  description: Curated, representative subset of WellnessLiving's official production API (RESTful, JSON-over-HTTPS).
  version: 1.1.20260620071011
  contact:
    name: WellnessLiving Support
    email: support@wellnessliving.com
    url: https://www.wellnessliving.com/support
  license:
    name: Proprietary
    url: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
  termsOfService: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
servers:
- url: https://us.wellnessliving.com
  description: Production - United States data center
- url: https://au.wellnessliving.com
  description: Production - Australia data center
- url: https://staging.wellnessliving.com
  description: Staging (pre-release QA branch)
- url: https://demo.wellnessliving.com
  description: Demo/trunk (active development branch)
security:
- BearerAuth: []
tags:
- name: Payments
paths:
  /Thoth/WlPay/Account/Account.json:
    get:
      operationId: get_Thoth_WlPay_Account_Account
      summary: Retrieves information about accounts of given user in given business
      description: Retrieves information about accounts of given user in given business.
      tags:
      - Payments
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: is_owner
        in: query
        required: true
        schema:
          type: boolean
        description: 'If `true`, information for the account''s owner is returned. Clients can be configured to pay for a relative''s

          expenses. For example, a parent can pay'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: The key of the business to show information for.
      - name: uid
        in: query
        required: true
        schema:
          type: string
        description: The key of the user to show information for.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_account:
                    description: The `a_account` field.
                  a_account_nx:
                    description: The `a_account_nx` field.
                  is_debtor:
                    description: The `is_debtor` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Thoth/WlPay/Bank/Card/List.json:
    get:
      operationId: get_Thoth_WlPay_Bank_Card_List
      summary: Retrieves information about user's bank cards
      description: Retrieves information about user's bank cards.
      tags:
      - Payments
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: ID of current business.
      - name: k_location
        in: query
        required: true
        schema:
          type: string
        description: 'Location to show information for.

          Primary key in RsLocationSql table.


          `0` to use user''s home location.'
      - name: uid
        in: query
        required: true
        schema:
          type: string
        description: ID of a user to show information for.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_bank_card:
                    description: The `a_bank_card` field.
                  a_list:
                    description: The `a_list` field.
                  can_add:
                    description: The `can_add` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Thoth/WlPay/Account/Charge/Charge.json:
    post:
      operationId: post_Thoth_WlPay_Account_Charge_Charge
      summary: Allows the user account to be filled with a specified payment, or to perform…
      description: Allows the user account to be filled with a specified payment, or to perform the reset change manually.
      tags:
      - Payments
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: id_pay_account_charge
        in: query
        required: true
        schema:
          type: string
          description: Enumerated/coded value (see WellnessLiving *Sid constant classes).
        description: 'The account charge mode.


          One of the [RsPayAccountChargeSid](#/components/schemas/RsPayAccountChargeSid) constants.'
      - name: is_staff
        in: query
        required: true
        schema:
          type: boolean
        description: If `true`, the account is filled by a staff member in the backend. Otherwise, this will be `false`.
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: 'The ID of the business the user account belongs to.


          This shouldn''t be passed if a user account has already been created.

          In such cases, `k_pay_accoun'
      - name: k_pay_account
        in: query
        required: true
        schema:
          type: string
        description: 'The ID of the user account to refill.


          This may be 0 if a user account hasn''t been created yet.

          In such cases, `k_business` and `uid` should be passed'
      - name: uid
        in: query
        required: true
        schema:
          type: string
        description: 'The ID of the user whose account is being refilled.


          This shouldn''t be passed if a user account has already been created.

          In such cases, `k_pay_accoun'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                a_pay_form:
                  description: The `a_pay_form` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                id_mode:
                  description: The `id_mode` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                m_amount:
                  description: The `m_amount` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_comment:
                  description: The `s_comment` field. See WellnessLiving developer portal for full field semantics.
                  type: string
              required:
              - a_pay_form
              - id_mode
              - m_amount
              - s_comment
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Thoth/WlPay/Transaction/Report/TransactionAllPayment.json:
    get:
      operationId: get_Thoth_WlPay_Transaction_Report_TransactionAllPayment
      summary: Gets the daily transaction data
      description: Gets the daily transaction data.
      tags:
      - Payments
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: dl_date_end
        in: query
        required: true
        schema:
          type: string
        description: The end date in local time to retrieve transactions for.
      - name: dl_date_start
        in: query
        required: true
        schema:
          type: string
        description: The end date in local time to retrieve transactions for.
      - name: i_page
        in: query
        required: true
        schema:
          type: integer
        description: 'The page of the report, starting from 0.

          Each page will contain a maximum of `LIMIT` rows.'
      - name: is_refresh
        in: query
        required: true
        schema:
          type: boolean
        description: 'Determines whether the report should be refreshed.


          If `true`, this report should be refreshed. A report refresh can''t be requested while the report i'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: The key of the business for which report should be generated.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_field:
                    description: The `a_field` field.
                  a_row:
                    description: The `a_row` field.
                  a_warning:
                    description: The `a_warning` field.
                  dtu_complete:
                    description: The `dtu_complete` field.
                  dtu_queue:
                    description: The `dtu_queue` field.
                  dtu_start:
                    description: The `dtu_start` field.
                  id_report_status:
                    description: The `id_report_status` field.
                  is_more:
                    description: The `is_more` field.
                  is_report_complete:
                    description: The `is_report_complete` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  responses:
    NotFound:
      description: The requested resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: 'Client-side error: invalid input, failed validation, throttling, or other request error (only returned as an HTTP status when `X-Error-Rules` opts in; otherwise encoded in a 200 body).'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Authenticated but not permitted to access this business, location, or resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: The request payload failed field-level validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, expired, or invalid Bearer token / session.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      description: Standard WellnessLiving API error response shape.
      properties:
        status:
          type: string
          description: Machine-readable status/error code string (e.g. `access-denied`, `not-found`).
        text_message:
          type: string
          description: Human-readable error message.
        a_field:
          type: object
          additionalProperties: true
          description: Per-field validation errors, when the failure is a 422-style validation error.
  parameters:
    XErrorRules:
      name: X-Error-Rules
      in: header
      required: false
      schema:
        type: string
      description: Opt in to mapping internal API error statuses to real 4xx HTTP codes. By default the API always answers HTTP 200 even on error, with the failure encoded in the JSON body; setting this header (e.g. to `default`) makes the gateway translate matched error statuses to 400/403/404 responses instead.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'The officially published OpenAPI declares a JWT Bearer scheme: sign in via `POST /Core/Passport/Login/Enter/Enter.json`, then mint a token with `GET /Core/Passport/Enter/Jwt/JwtToken.json` and send it as `Authorization: Bearer <token>`. The underlying PHP/JS SDKs additionally support the legacy scheme: a registered Application ID + secret code sign a per-request HMAC (SHA3-based) placed in the `Authorization:` header alongside session cookies established by the `Notepad`/`Enter` model pair. Both schemes require WellnessLiving''s Integrations Team to first approve API access, sign an NDA and API Agreement, and issue application credentials.'