Cowdidocs
API ReferenceInvoice financing

Create a supplier merchant in sales-app

Deprecated

POST
/v1/financing/merchants

Deprecated: use POST /v1/merchants with business_name, email and phone_number. Creates public.merchants with a database-generated id. Requires org:merchants:write on the caller’s organization. Organization scope comes only from the bearer token. Reuse idempotency_key with identical details to recover the same id after a timeout or a downstream failure. A changed payload returns 409. Core must mirror the returned id before payout registration and invitation; this operation does not create a Core merchant or a WorkOS grant.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Request Body

application/json

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/financing/merchants" \  -H "Content-Type: application/json" \  -d '{    "idempotency_key": "0cd90e5a-2c03-4ab6-81a8-d48818026e58",    "name": "string",    "contact_email": "string"  }'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"}
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}
{  "code": "INVALID_PARAMS",  "description": "user_id must be a UUID",  "identifier": "string",  "invalid_params": [    {      "path": "user_id",      "reason": "must be a UUID",      "sub_code": "string"    }  ]}

List every merchant’s invoices in the organization GET

The buyer’s org-wide receivables roll-up, newest first. Each row carries its merchant_id. Requires the org-scoped org:merchants:read permission, checked on the organization resource in the authorization provider (tokens carry no permissions).

List a merchant’s payout instruments GET

Returns a merchant’s payout instruments, newest first; the result is a small bounded set and is not paginated. Requires `merchant:financing.bank_details:read` on the merchant; an organization-scoped role can grant that same permission across every merchant it manages. An impersonated caller sees the account number and account holder name masked.