ConvesioPay

## What is ConvesioPay for Platforms?

ConvesioPay for Platforms (CfP) is an API-only white-label offering that lets your platform or agency create, onboard, and fully manage sub-merchants on top of ConvesioPay's payments infrastructure. You bring the UI — whether that is your own platform portal, a white-labeled onboarding flow, or a fully embedded merchant dashboard — and the CfP API handles everything underneath.

Unlike a standard ConvesioPay integration, where each merchant logs in to their own ConvesioPay dashboard, CfP merchants interact exclusively through your platform. They do not have direct ConvesioPay dashboard access. Your platform is their interface.

## What can you do with this API?

With the CfP Platform API you can:

*   **Onboard sub-merchants programmatically** — provision legal entities, account holders, balance accounts, bank accounts, Terms of Service, and PCI compliance documents entirely via API, without any manual dashboard steps.

*   **Manage payment methods** — enable or disable Apple Pay and Google Pay for each sub-merchant, including domain registration, verification file delivery, and merchant provisioning.

*   **Configure payment connectors** — create and manage HyperSwitch payment orchestration connectors on behalf of your sub-merchants.

*   **Handle disputes** — retrieve applicable defense reasons from Adyen, accept liability, or submit a full dispute defense with supporting documents.

*   **List and monitor sub-merchants** — retrieve a paginated, filterable list of all merchants onboarded under your platform.

*   **Configure statement delivery** — connect your Google Shared Drive so that statements and data CSVs for all of your sub-merchants are delivered automatically to your platform.

## Who is this API for?

The CfP Platform API is intended for technical teams building platform products — such as SaaS platforms, vertical software vendors, agencies, and ISOs — that need to manage payments on behalf of multiple merchants under a single integration.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>This is an API-only product. There is no ConvesioPay dashboard UI for CfP sub-merchants. All merchant lifecycle management is handled exclusively through this API.</p>
</Callout>

## Base URL

All Platform API requests are made to the following base URL:

```
https://api.convesiopay.com/platform/v1
```

A QA environment is also available for testing:

```
https://api-qa.convesiopay.com/platform/v1
```

## API Design

The CfP Platform API is a REST API. It accepts JSON request bodies and returns JSON responses. Standard HTTP response codes are used to indicate success or failure.

All requests must be made server side and over HTTPS. Calls made without `https://` or proper authentication will fail.

Introduction

API Authentication

The CfP Platform API uses two complementary authentication mechanisms depending on the endpoint being called.

---

## Platform Secret Key

The Platform Secret Key is the primary credential for all CfP API requests. It identifies your platform and authorizes you to act on behalf of any sub-merchant in your platform's `partnerMerchants` map.

The Platform Secret Key is passed as the raw value of the `Authorization` header on every request:

```
Authorization: cpfp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

<Callout attributes='{"isFitToPage":true,"dataType":"error","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — Platform secret keys must be stored securely. Never expose your platform secret key in client-side code, a browser, or a mobile application. All CfP Platform API requests must be made server side.</p>
</Callout>

Your Platform Secret Key is issued once via the `POST /dashboard/platform/secret-key` bootstrap endpoint, which must be called by a ConvesioPay SuperAdmin. **The key is returned exactly once** and cannot be retrieved again — store it immediately in a secure secrets manager.

If a key is lost or compromised, a new key can be issued via the same bootstrap endpoint. Rotation invalidates the previous key; a copy is kept in `previousSecretKeys` for audit purposes.

---

## Merchant ID Header (`X-Merchant-Id`)

Most CfP Platform API endpoints act on a specific sub-merchant. For these endpoints, you must also pass the sub-merchant's ConvesioPay `_id` in the `X-Merchant-Id` header:

```
X-Merchant-Id: 64f1a2b3c4d5e6f7a8b9c0d1
```

The authorizer validates that the merchant ID you supply belongs to your platform's `partnerMerchants` map. Any request referencing a merchant that does not belong to your platform will be rejected with a `403 Unauthorized` response.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>A small number of endpoints are platform-scoped rather than merchant-scoped — specifically <code class="slate-code">GET /merchants</code> and <code class="slate-code">PATCH /google-config</code>. These endpoints resolve the platform from your secret key alone and do <strong class="slate-bold">not</strong> require an <code class="slate-code">X-Merchant-Id</code> header.</p>
</Callout>

---

## SuperAdmin JWT (Bootstrap Only)

The `POST /dashboard/platform/secret-key` endpoint is the only endpoint that does not use a Platform Secret Key. It requires a ConvesioPay SuperAdmin dashboard JWT passed as a standard Bearer token:

```
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

This is a one-time bootstrap call made by a ConvesioPay team member during platform setup. Once your Platform Secret Key has been issued, all subsequent API calls use the Platform Secret Key.

---

## Authentication Headers at a Glance

| Header | Required on | Value |
|---|---|---|
| `Authorization` | All endpoints except the bootstrap | Your raw Platform Secret Key |
| `X-Merchant-Id` | All merchant-scoped endpoints | The sub-merchant's ConvesioPay `_id` |
| `Authorization: Bearer <JWT>` | Bootstrap endpoint only | SuperAdmin dashboard JWT |

---

## Error Responses

Authentication failures return standard HTTP error codes:

*   `401 Unauthorized` — The `Authorization` header is missing or the secret key is invalid.

*   `403 Forbidden` — The request is authenticated but not permitted. This is returned when the `X-Merchant-Id` value does not belong to the calling platform, or when a non-SuperAdmin credential is used on the bootstrap endpoint.

All error responses follow the standard CfP error envelope:

```json
{
  "status": 403,
  "body": {
    "message": "Unauthorized"
  }
}
```

Authentication and API Keys

Onboarding

Onboarding Merchants

Provisions a new sub-merchant end-to-end entirely via API. This single endpoint orchestrates the full onboarding pipeline: legal entity creation, account holder setup, balance account provisioning, business line registration, store creation, bank account attachment, payment method scheme requests, and Terms of Service and PCI signature preparation.

Upon successful completion, the new merchant's ID is stamped onto your platform's `partnerMerchants` map, making it immediately available for use with all other CfP Platform API endpoints.

Onboarding requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure). Calls made without `https://` or proper authentication will fail.

<Callout attributes='{"isFitToPage":true,"dataType":"error","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — Your Platform Secret Key must be stored securely. Never expose it in client-side code, a browser, or a mobile application. All onboarding requests must be made server side.</p>
</Callout>

## Onboarding Modes

The `onboardingMode` field controls which pipeline is used:

*   `cfp` — Full ConvesioPay for Platforms onboarding. The merchant is provisioned under your platform's master balance account, with revenue sweep and chargeback funding configured automatically. Use this mode for merchants onboarded as part of your white-label platform.

*   `agency` — Standard agency / ISO onboarding path. The merchant has their own independent balance account and bank sweep. Use this mode for standalone merchants that your agency is onboarding on their behalf.

## Response Shape

The response is discriminated on the `success` and `status` fields:

*   `success: true, status: "complete"` — All onboarding pipeline steps completed. The `merchantId` field contains the new merchant's ConvesioPay ID. The `hostedOnboardingUrl` field contains an Adyen-hosted URL for any remaining manual KYC steps the merchant must complete.

*   `success: false, status: "partial"` — The pipeline halted partway through. The `failedStep` field identifies which step failed and the `completedSteps` array lists what was successfully provisioned before the failure.

*   `success: false, error: "Validation failed"` — The request body failed schema validation before the pipeline started. The `details` array lists the specific validation errors.

*   `success: false, error: "Merchant already has completed onboarding"` — A merchant with this email address has already been fully onboarded. The existing `merchantId` is returned.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>After a successful onboarding, call <code class="slate-code">POST /merchant/tos-document/generate</code> and <code class="slate-code">POST /merchant/pci-document/generate</code> to retrieve the documents your merchant must review and sign before their account can be fully activated.</p>
</Callout>

The following properties are required to use this endpoint:

*   `onboardingMode`
*   `merchant`
*   `business`
*   `businessRepresentative`
*   `bankAccount`
*   `compliance`

Create Merchant

Update Merchant

Update Merchant Document

Supported Industry Codes

Update Platform Master Account

Merchants

Returns a paginated list of all sub-merchants onboarded under the authenticated platform. The platform is resolved from the `Authorization` secret key — this endpoint is platform-scoped and does **not** require an `X-Merchant-Id` header.

Results can be filtered by merchant `status` and a `createdAt` date range using the `from` and `to` query parameters. Results are paginated; use `pageSize` and `pageNumber` to navigate through large result sets.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

List Merchants

Orchestration

Returns all HyperSwitch payment orchestration connectors currently configured for the sub-merchant identified by the `X-Merchant-Id` header.

Connectors represent the payment processors the sub-merchant routes transactions through via the ConvesioPay orchestration layer. Each connector has a unique `connectorId`, a `connectorName` identifying the processor, a human-readable `connectorLabel`, and an `enabled` flag.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

List Payment Processors

Creates a new HyperSwitch payment orchestration connector for the sub-merchant identified by the `X-Merchant-Id` header. The request body shape varies by processor — use the appropriate variant for the connector you are configuring.

Connectors are created in the enabled state by default. To disable a connector after creation, use `PATCH /orchestration/connector/{connectorId}`.

<Callout attributes='{"isFitToPage":true,"dataType":"warning","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — Connector credentials are stored securely and used exclusively for routing transactions. Never expose connector private keys or passwords in client-side code.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required for all connectors:

*   `connectorName`
*   `connectorLabel`
*   `enabled`

Additional required fields vary by `connectorName` — see the request schema variants below.

Enable Payment Processor

Enables, disables, relabels, or updates the credentials of an existing HyperSwitch connector for the sub-merchant identified by the `X-Merchant-Id` header. All fields are optional — only the fields present in the request body will be updated.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Update Payment Processor

Payment Methods

Returns the current Apple Pay and Google Pay enabled status for the sub-merchant identified by the `X-Merchant-Id` header. Both wallet values default to `false` if the wallet has not yet been configured.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

List Payment Methods

Enables or disables Apple Pay and/or Google Pay for the sub-merchant identified by the `X-Merchant-Id` header. Only the wallet objects present in the request body are updated — you can toggle a single wallet without affecting the other.

<Callout attributes='{"isFitToPage":true,"dataType":"warning","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — Enabling either wallet requires that the merchant's OL fees bank account was provided during onboarding. If it was not, this endpoint will return <code class="slate-code">422 Unprocessable Entity</code> with error code <code class="slate-code">E047</code>. Ensure the <code class="slate-code">bankAccount</code> field is included in the <code class="slate-code">POST /merchant/onboarding</code> request before attempting to enable wallet payment methods.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Toggle Payment Method

Apple Pay

Returns the current Apple Pay merchant configuration for the sub-merchant identified by the `X-Merchant-Id` header. The response includes the currently registered domains, the partner merchant name, the internal merchant identifier, the validation URI, and the `encryptTo` identifier used by the Apple Pay JS API.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

List Apple Pay Domains

Returns the public URL of the static `apple-developer-merchantid-domain-association` verification file that must be served from every domain enrolled in Apple Pay for a sub-merchant.

Before registering any domain with Apple Pay (via `POST /merchant/applepay/register`), the integrator or merchant must serve this exact file at the following path on each domain:

```
https://<your-domain>/.well-known/apple-developer-merchantid-domain-association
```

<Callout attributes='{"isFitToPage":true,"dataType":"warning","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — The domain verification file must be accessible over HTTPS at the <code class="slate-code">/.well-known/</code> path before you attempt to register the domain. Registration will fail if Apple cannot reach the file at the time of the request.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Get Domain Verification File

Registers one or more checkout domains with Apple Pay for the sub-merchant identified by the `X-Merchant-Id` header.

<Callout attributes='{"isFitToPage":true,"dataType":"error","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">Before registering a domain</strong>, you must ensure the Apple Pay domain verification file is being served from <code class="slate-code">https://&lt;domain&gt;/.well-known/apple-developer-merchantid-domain-association</code>. Use <code class="slate-code">GET /merchant/applepay/domain-file</code> to retrieve the file URL. Registration will fail if Apple cannot reach the verification file at the time of the request.</p>
</Callout>

Multiple domains can be registered in a single request by providing an array with more than one entry in `domainNames`.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required to use this endpoint:

*   `domainNames`

Register Apple Pay Domains

Removes one or more domains from the sub-merchant's Apple Pay merchant registration. Unregistered domains will no longer be able to present Apple Pay as a payment option.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required to use this endpoint:

*   `domainNames`

Unregister Apple Pay Domains

Google Pay

Returns the list of web domains currently registered with the sub-merchant's Google Pay merchant.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

List Google Pay Domains

Provisions a new Google Pay merchant for the sub-merchant identified by the `X-Merchant-Id` header. This call accepts the Google Pay Terms of Service, enables the merchant, and performs initial provisioning.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>This endpoint provisions a ConvesioPay-managed Google Pay merchant ID. If the merchant already has a Google Pay merchant ID from outside of ConvesioPay (a BYO / unmanaged MID), skip this step and use <code class="slate-code">PATCH /merchant/googlepay/id</code> to attach it instead.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required to use this endpoint:

*   `mcc`

Create Google Pay MID

Returns the current Google Pay merchant configuration for the sub-merchant identified by the `X-Merchant-Id` header, including the merchant ID, current state, registered addresses, contact details, and merchant category.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Get Google Pay MID Status

Registers a web domain with the sub-merchant's Google Pay merchant, making Google Pay available on that domain's checkout pages.

<Callout attributes='{"isFitToPage":true,"dataType":"warning","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">Known constraint — BYO / unmanaged Google Pay MIDs:</strong> Merchants using a BYO (Bring Your Own) Google Pay merchant ID cannot register domains via this endpoint. Google returns <code class="slate-code">403 PERMISSION_DENIED</code> for unmanaged MIDs. For those merchants, domain registration must be handled as part of the BYO MID setup process outside of ConvesioPay. Use <code class="slate-code">PATCH /merchant/googlepay/id</code> to attach a BYO MID after it has been domain-provisioned externally.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required to use this endpoint:

*   `webDomain`

Register Google Pay Domains

Disputes

Accepts the dispute on Adyen's side, acknowledging liability and waiving the right to defend it. This action is irreversible — once a dispute is accepted, it cannot be re-opened for defense.

Use this endpoint when the merchant agrees with the customer's claim and does not intend to contest the chargeback. For CfP merchants, the chargeback amount will be funded from the Platform Master Balance Account.

The `disputeId` path parameter accepts either the internal ConvesioPay `paymentId` or the Adyen `pspReference` of the disputed payment. No request body is required.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Accept dispute

Returns the list of Adyen-applicable defense reasons for the given dispute, along with the supporting document types required for each reason. Use this endpoint before calling `POST /merchant/dispute/adyen/{disputeId}/defend` to determine which `defenseReasonCode` and `defenseDocumentTypeCode` values are valid for the dispute you intend to defend.

The `disputeId` path parameter accepts either the internal ConvesioPay `paymentId` or the Adyen `pspReference` of the disputed payment — use whichever you have on hand.

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

Get Defense Reasons

Defends the dispute by uploading supporting documents and submitting a defense reason to Adyen. ConvesioPay uploads each provided document to Adyen via `supplyDefenseDocument` and then submits the defense with the chosen `defenseReasonCode`.

Before calling this endpoint, retrieve the applicable defense reasons and required document types for this specific dispute using `GET /merchant/dispute/adyen/{disputeId}/reasons`. The `defenseReasonCode` and `defenseDocumentTypeCode` values in your request must come from that response.

The `disputeId` path parameter accepts either the internal ConvesioPay `paymentId` or the Adyen `pspReference` of the disputed payment.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>Documents should be encoded as base64 strings. Accepted MIME types include <code class="slate-code">application/pdf</code>, <code class="slate-code">image/jpeg</code>, and <code class="slate-code">image/png</code>. Check Adyen's documentation for the latest accepted file types and size limits for your dispute type.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

The following properties are required to use this endpoint:

*   `defenseReasonCode`
*   `defenseDocuments`

Defend dispute

Reporting

Configures or reconfigures the Google Shared Drive target used to automatically deliver statements and data CSVs for your platform's sub-merchants. The platform is resolved from the `Authorization` secret key — this endpoint is platform-scoped and does **not** require an `X-Merchant-Id` header.

Once configured, ConvesioPay will automatically deliver statements and reporting CSVs for all sub-merchants under your platform into the specified Google Drive folder, organized by sub-merchant.

<Callout attributes='{"isFitToPage":true,"dataType":"info","style":{"width":"100%","minWidth":"100%"}}'>
  <p>You will need to create a Google service account and share your target Drive folder with the service account's email address (<code class="slate-code">serviceAccountEmail</code>) before calling this endpoint. The service account must have at minimum <strong class="slate-bold">Editor</strong> access on the folder.</p>
</Callout>

<Callout attributes='{"isFitToPage":true,"dataType":"warning","style":{"width":"100%","minWidth":"100%"}}'>
  <p><strong class="slate-bold">NOTE</strong> — The <code class="slate-code">serviceAccountCredential</code> object contains sensitive private key material. Treat it with the same care as any API secret. This endpoint must be called server side; never submit service account credentials from client-side code.</p>
</Callout>

Requests must be made server side and over [HTTPS](http://en.wikipedia.org/wiki/HTTP_Secure).

All fields are required.

Configure Shared Drive

Default

ConvesioPay for Platforms API

Production

Live

Test

Sandbox

<p class="slate-p " ></p><h2 class="slate-h2 " >What is ConvesioPay for Platforms?</h2><p class="slate-p " >ConvesioPay for Platforms (CfP) is an API-only white-label offering that lets your platform or agency create, onboard, and fully manage sub-merchants on top of ConvesioPay’s payments infrastructure. You bring the UI — whether that is your own platform portal, a white-labeled onboarding flow, or a fully embedded merchant dashboard — and the CfP API handles everything underneath.</p><p class="slate-p " >Unlike a standard ConvesioPay integration, where each merchant logs in to their own ConvesioPay dashboard, CfP merchants interact exclusively through your platform. They do not have direct ConvesioPay dashboard access. Your platform is their interface.</p><p class="slate-p " ></p><h2 class="slate-h2 " >What can you do with this API?</h2><p class="slate-p " >With the CfP Platform API you can:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Onboard sub-merchants programmatically</strong> — Provision legal entities, account holders, bank accounts, upload KYC documents entirely via API.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Manage payment methods</strong> — Enable or disable payment methods like credit card, Apple Pay, and Google Pay for each sub-merchant, including domain registration, verification file delivery, and merchant provisioning.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Configure payment connectors</strong> — Create and manage payment processors on our orchestration layer on behalf of your sub-merchants.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Handle disputes</strong> — Retrieve applicable defense reasons from ConvesioPay, accept liability, or submit a full dispute defense with supporting documents.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">List and monitor sub-merchants</strong> — Retrieve a paginated, filterable list of all merchants under your platform, whether active or currently onbaording and see their progress.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Configure statement delivery</strong> — Connect your Google Shared Drive so that statements and data CSVs for all of your sub-merchants are delivered automatically to your platform.</div></li></ul><p class="slate-p " ></p><h2 class="slate-h2 " >Who is this API for?</h2><p class="slate-p " >The CfP Platform API is intended for technical teams building platform products — such as SaaS platforms, vertical software vendors, agencies, and ISOs — that need to manage payments on behalf of multiple merchants under a single integration.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >This is an API-only product. There is no ConvesioPay dashboard UI for CfP sub-merchants. All merchant lifecycle management is handled exclusively through this API.</p></div></div><p class="slate-p " ></p>

ConvesioPay for Platforms (CfP) is an API-only white-label offering that lets your platform or agency create, onboard, and fully manage sub-merchants on top of ConvesioPay’s payments infrastructure. You bring the UI — whether that is your own platform portal, a white-labeled onboarding flow, or a fully embedded merchant dashboard — and the CfP API handles everything underneath.

Unlike a standard ConvesioPay integration, where each merchant logs in to their own ConvesioPay dashboard, CfP merchants interact exclusively through your platform. They do not have direct ConvesioPay dashboard access. Your platform is their interface.

The CfP Platform API is intended for technical teams building platform products — such as SaaS platforms, vertical software vendors, agencies, and ISOs — that need to manage payments on behalf of multiple merchants under a single integration.

Authorization

X-Merchant-Id

<div class="slate-div"></div><h2 class="slate-h2 " >Platform Secret Key</h2><p class="slate-p " >The Platform Secret Key is the primary credential when using the CfP API as a platform owner. It identifies your platform and authorizes you to act on behalf of any sub-merchant in your platform’s <code class="slate-code">partnerMerchants</code> map.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=warning ><div class="callout-icon"><svg width="18" height="16" viewBox="0 0 18 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0.916637 15.5009C0.791637 15.5009 0.683998 15.4732 0.59372 15.4176C0.503443 15.362 0.430526 15.2857 0.37497 15.1884C0.319415 15.0912 0.288165 14.9905 0.28122 14.8864C0.274276 14.7822 0.305526 14.6745 0.37497 14.5634L8.4583 0.605103C8.52775 0.493991 8.60761 0.41413 8.69789 0.365519C8.78816 0.316908 8.88886 0.292603 8.99997 0.292603C9.11108 0.292603 9.21178 0.316908 9.30205 0.365519C9.39233 0.41413 9.47219 0.493991 9.54164 0.605103L17.625 14.5634C17.6944 14.6745 17.7257 14.7822 17.7187 14.8864C17.7118 14.9905 17.6805 15.0912 17.625 15.1884C17.5694 15.2857 17.4965 15.362 17.4062 15.4176C17.3159 15.4732 17.2083 15.5009 17.0833 15.5009H0.916637ZM1.99997 14.2509H16L8.99997 2.1676L1.99997 14.2509ZM9.0833 13.0634C9.26386 13.0634 9.41316 13.0044 9.53122 12.8864C9.64928 12.7683 9.7083 12.619 9.7083 12.4384C9.7083 12.2579 9.64928 12.1086 9.53122 11.9905C9.41316 11.8725 9.26386 11.8134 9.0833 11.8134C8.90275 11.8134 8.75344 11.8725 8.63539 11.9905C8.51733 12.1086 8.4583 12.2579 8.4583 12.4384C8.4583 12.619 8.51733 12.7683 8.63539 12.8864C8.75344 13.0044 8.90275 13.0634 9.0833 13.0634ZM9.0833 10.7509C9.26386 10.7509 9.41316 10.6919 9.53122 10.5739C9.64928 10.4558 9.7083 10.3065 9.7083 10.1259V6.70927C9.7083 6.52871 9.64928 6.37941 9.53122 6.26135C9.41316 6.1433 9.26386 6.08427 9.0833 6.08427C8.90275 6.08427 8.75344 6.1433 8.63539 6.26135C8.51733 6.37941 8.4583 6.52871 8.4583 6.70927V10.1259C8.4583 10.3065 8.51733 10.4558 8.63539 10.5739C8.75344 10.6919 8.90275 10.7509 9.0833 10.7509Z" fill="#F1C21B"></path></svg></div><div ><p class="slate-p " >Your Platform Secret Key is provisioned for you by ConvesioPay and provided to you upon onboarding as a Platform. This key cannot be retrieved again — store it immediately in a secure secrets manager. If it is lost, a new one will have to be generated and the existing key will be invalidated.</p></div></div><p class="slate-p " ></p><p class="slate-p " >The Platform Secret Key is passed as the raw value of the <code class="slate-code">Authorization</code> header on every Platform API request:</p><div class="slate-div"></div><div class="slate-div"></div><p class="slate-p " ></p><h2 class="slate-h2 " >Merchant ID Header (X-Merchant-Id)</h2><p class="slate-p " >Most CfP Platform API endpoints act on a specific sub-merchant. For these endpoints, you must also pass the sub-merchant’s ConvesioPay Merchant ID in the <code class="slate-code">X-Merchant-Id</code> header:</p><p class="slate-p " >ConvesioPay validates that the sub-merchant&apos;s Merchant ID supplied belongs to your platform’s <code class="slate-code">partnerMerchants</code> map. Any request referencing a merchant that does not belong to your platform will be rejected with a <code class="slate-code">403 Unauthorized</code> response.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >A small number of endpoints are platform-scoped rather than merchant-scoped — specifically <code class="slate-code">POST /merchant/onboarding</code> ,  <code class="slate-code">GET /merchants</code>, <code class="slate-code">PATCH /account</code>, and <code class="slate-code">PATCH /google-config</code>. These endpoints resolve the platform from your secret key alone and do <strong class="slate-bold">not</strong> require an <code class="slate-code">X-Merchant-Id</code> header.</p></div></div><p class="slate-p " ></p><h2 class="slate-h2 " >Errors</h2><p class="slate-p " >Authentication failures return standard HTTP error codes:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">401 Unauthorized</code> — The <code class="slate-code">Authorization</code> header is missing or the secret key is invalid.</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">403 Forbidden</code> — The request is authenticated but not permitted. This is returned when the <code class="slate-code">X-Merchant-Id</code> value does not belong to the calling platform.</div></li></ul><p class="slate-p " >All error responses follow the standard CfP error envelope:</p><div class="code-block-wrapper"  style="width:100%" ><div class="code-block-header">JSON</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-json keep-markup drop-tokens"><div class="slate-code_line">{
</div><div class="slate-code_line">  &quot;status&quot;: 403,
</div><div class="slate-code_line">  &quot;body&quot;: {
</div><div class="slate-code_line">    &quot;message&quot;: &quot;Unauthorized&quot;
</div><div class="slate-code_line">  }
</div><div class="slate-code_line">}
</div></code></pre></div><p class="slate-p " ></p><p class="slate-p " >All API requests must be made server side and over <a href="http://en.wikipedia.org/wiki/HTTP_Secure" target="_blank">HTTPS</a>. Calls made without <code class="slate-code">https://</code> or proper authentication will fail.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=error ><div class="callout-icon"><svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.08366 9.9801C9.25033 9.9801 9.39269 9.92107 9.51074 9.80302C9.6288 9.68496 9.68783 9.53566 9.68783 9.3551V5.31344C9.68783 5.14677 9.62533 5.00441 9.50033 4.88635C9.37533 4.7683 9.22949 4.70927 9.06283 4.70927C8.88227 4.70927 8.73296 4.7683 8.61491 4.88635C8.49685 5.00441 8.43783 5.15371 8.43783 5.33427V9.37594C8.43783 9.5426 8.50033 9.68496 8.62533 9.80302C8.75033 9.92107 8.9031 9.9801 9.08366 9.9801ZM9.00033 13.1676C9.19477 13.1676 9.35796 13.1016 9.48991 12.9697C9.62185 12.8377 9.68783 12.6745 9.68783 12.4801C9.68783 12.2857 9.62185 12.1225 9.48991 11.9905C9.35796 11.8586 9.19477 11.7926 9.00033 11.7926C8.80588 11.7926 8.64269 11.8586 8.51074 11.9905C8.3788 12.1225 8.31283 12.2857 8.31283 12.4801C8.31283 12.6745 8.3788 12.8377 8.51074 12.9697C8.64269 13.1016 8.80588 13.1676 9.00033 13.1676ZM9.00033 17.3343C7.81977 17.3343 6.72255 17.1225 5.70866 16.6989C4.69477 16.2752 3.81283 15.6884 3.06283 14.9384C2.31283 14.1884 1.72602 13.3065 1.30241 12.2926C0.878798 11.2787 0.666992 10.1815 0.666992 9.00094C0.666992 7.83427 0.878798 6.74399 1.30241 5.7301C1.72602 4.71621 2.31283 3.83427 3.06283 3.08427C3.81283 2.33427 4.69477 1.74399 5.70866 1.31344C6.72255 0.88288 7.81977 0.667603 9.00033 0.667603C10.167 0.667603 11.2573 0.88288 12.2712 1.31344C13.285 1.74399 14.167 2.33427 14.917 3.08427C15.667 3.83427 16.2573 4.71621 16.6878 5.7301C17.1184 6.74399 17.3337 7.83427 17.3337 9.00094C17.3337 10.1815 17.1184 11.2787 16.6878 12.2926C16.2573 13.3065 15.667 14.1884 14.917 14.9384C14.167 15.6884 13.285 16.2752 12.2712 16.6989C11.2573 17.1225 10.167 17.3343 9.00033 17.3343ZM9.00033 16.0843C10.9448 16.0843 12.6114 15.3898 14.0003 14.0009C15.3892 12.612 16.0837 10.9454 16.0837 9.00094C16.0837 7.05649 15.3892 5.38982 14.0003 4.00094C12.6114 2.61205 10.9448 1.9176 9.00033 1.9176C7.05588 1.9176 5.38921 2.61205 4.00033 4.00094C2.61144 5.38982 1.91699 7.05649 1.91699 9.00094C1.91699 10.9454 2.61144 12.6989 4.00033 14.0009C5.38921 15.3898 7.05588 16.0843 9.00033 16.0843Z" fill="#E90005"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> - Secret keys must be stored securely. Don’t expose your secret key on a website or embed it in a mobile application. ConvesioPay retains the right to rotate your secret keys if a public leak is detected.</p></div></div><p class="slate-p " ></p>

The Platform Secret Key is the primary credential when using the CfP API as a platform owner. It identifies your platform and authorizes you to act on behalf of any sub-merchant in your platform’s 

The Platform Secret Key is passed as the raw value of the 

Most CfP Platform API endpoints act on a specific sub-merchant. For these endpoints, you must also pass the sub-merchant’s ConvesioPay Merchant ID in the 

ConvesioPay validates that the sub-merchant's Merchant ID supplied belongs to your platform’s 

 map. Any request referencing a merchant that does not belong to your platform will be rejected with a 

Authentication failures return standard HTTP error codes:

All error responses follow the standard CfP error envelope:

All API requests must be made server side and over 

<p class="slate-p " >As a Platform integrator, you can provision new sub-merchants end-to-end entirely via API. The <a href="6a2c69abe34b4614d75fc85d/6a2c69abe34b4614d75fc85f" target="">Create Merchant</a> endpoint orchestrates the full onboarding pipeline: legal entity creation, account holder setup, balance account provisioning, business line registration, store creation, and payment method scheme requests on behalf of the sub-merchant.</p><p class="slate-p " >Sub-merchant onboarding requires KYC (Know Your Customer) verification to ensure that only legitimate businesses are provisioned on your platform. In some cases, additional validation may be required beyond the initial Create Merchant request — such as clarifying information or uploading supporting documents to verify the sub-merchant&apos;s business identity or the account representative&apos;s details. When this occurs, you will receive status updates via the webhook notification URL provided during the Create Merchant request. You can use the Update Merchant and Upload Documents endpoints at any time to complete the onboarding process or to make changes after a sub-merchant has already been onboarded.</p><p class="slate-p " >Once a sub-merchant has successfully completed the onboarding process and passed KYC review, you will receive a webhook notification confirming that the sub-merchant is ready to process payments.</p><p class="slate-p " ></p>

As a Platform integrator, you can provision new sub-merchants end-to-end entirely via API. The 

 endpoint orchestrates the full onboarding pipeline: legal entity creation, account holder setup, balance account provisioning, business line registration, store creation, and payment method scheme requests on behalf of the sub-merchant.

Sub-merchant onboarding requires KYC (Know Your Customer) verification to ensure that only legitimate businesses are provisioned on your platform. In some cases, additional validation may be required beyond the initial Create Merchant request — such as clarifying information or uploading supporting documents to verify the sub-merchant's business identity or the account representative's details. When this occurs, you will receive status updates via the webhook notification URL provided during the Create Merchant request. You can use the Update Merchant and Upload Documents endpoints at any time to complete the onboarding process or to make changes after a sub-merchant has already been onboarded.

Once a sub-merchant has successfully completed the onboarding process and passed KYC review, you will receive a webhook notification confirming that the sub-merchant is ready to process payments.

<p class="slate-p " >Creates a sub-merchant entity and begins the process of onboarding them onto the platform. Onboarding requires KYC (Know Your Customer) verification to ensure that only legitimate businesses are provisioned on your platform. Upon successful completion, the new merchant’s ID is stamped onto your platform’s <code class="slate-code">partnerMerchants</code> map, making it immediately available for use with all other CfP Platform API endpoints.</p><p class="slate-p " ></p><h2 class="slate-h2 " >Onboarding Modes</h2><p class="slate-p " >The <code class="slate-code">onboardingMode</code> field controls which pipeline is used:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">cfp</code> — Full ConvesioPay for Platforms onboarding. The sub-merchant is provisioned under your platform’s master account, with payment revenue, refund, and chargeback funding all configured to your account automatically. Use this mode for merchants onboarded as part of your white-label platform.</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">agency</code> — Standard agency / ISO onboarding path. The merchant has their own independent account and bank payouts. Use this mode for standalone merchants that your agency is onboarding on their behalf.</div></li></ul><h2 class="slate-h2 " ></h2><p class="slate-p " >The following properties are required to use this endpoint:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">onboardingMode</code></div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">merchant</code></div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">business</code></div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">businessRepresentative</code></div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">bankAccount</code></div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">supportDetails</code></div></li></ul><p class="slate-p " ></p><p class="slate-p " >Onboarding requests must be made server side and over <a href="http://en.wikipedia.org/wiki/HTTP_Secure" target="_self">HTTPS</a>. Calls made without <code class="slate-code">https://</code> or proper authentication will fail.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=error ><div class="callout-icon"><svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.08366 9.9801C9.25033 9.9801 9.39269 9.92107 9.51074 9.80302C9.6288 9.68496 9.68783 9.53566 9.68783 9.3551V5.31344C9.68783 5.14677 9.62533 5.00441 9.50033 4.88635C9.37533 4.7683 9.22949 4.70927 9.06283 4.70927C8.88227 4.70927 8.73296 4.7683 8.61491 4.88635C8.49685 5.00441 8.43783 5.15371 8.43783 5.33427V9.37594C8.43783 9.5426 8.50033 9.68496 8.62533 9.80302C8.75033 9.92107 8.9031 9.9801 9.08366 9.9801ZM9.00033 13.1676C9.19477 13.1676 9.35796 13.1016 9.48991 12.9697C9.62185 12.8377 9.68783 12.6745 9.68783 12.4801C9.68783 12.2857 9.62185 12.1225 9.48991 11.9905C9.35796 11.8586 9.19477 11.7926 9.00033 11.7926C8.80588 11.7926 8.64269 11.8586 8.51074 11.9905C8.3788 12.1225 8.31283 12.2857 8.31283 12.4801C8.31283 12.6745 8.3788 12.8377 8.51074 12.9697C8.64269 13.1016 8.80588 13.1676 9.00033 13.1676ZM9.00033 17.3343C7.81977 17.3343 6.72255 17.1225 5.70866 16.6989C4.69477 16.2752 3.81283 15.6884 3.06283 14.9384C2.31283 14.1884 1.72602 13.3065 1.30241 12.2926C0.878798 11.2787 0.666992 10.1815 0.666992 9.00094C0.666992 7.83427 0.878798 6.74399 1.30241 5.7301C1.72602 4.71621 2.31283 3.83427 3.06283 3.08427C3.81283 2.33427 4.69477 1.74399 5.70866 1.31344C6.72255 0.88288 7.81977 0.667603 9.00033 0.667603C10.167 0.667603 11.2573 0.88288 12.2712 1.31344C13.285 1.74399 14.167 2.33427 14.917 3.08427C15.667 3.83427 16.2573 4.71621 16.6878 5.7301C17.1184 6.74399 17.3337 7.83427 17.3337 9.00094C17.3337 10.1815 17.1184 11.2787 16.6878 12.2926C16.2573 13.3065 15.667 14.1884 14.917 14.9384C14.167 15.6884 13.285 16.2752 12.2712 16.6989C11.2573 17.1225 10.167 17.3343 9.00033 17.3343ZM9.00033 16.0843C10.9448 16.0843 12.6114 15.3898 14.0003 14.0009C15.3892 12.612 16.0837 10.9454 16.0837 9.00094C16.0837 7.05649 15.3892 5.38982 14.0003 4.00094C12.6114 2.61205 10.9448 1.9176 9.00033 1.9176C7.05588 1.9176 5.38921 2.61205 4.00033 4.00094C2.61144 5.38982 1.91699 7.05649 1.91699 9.00094C1.91699 10.9454 2.61144 12.6989 4.00033 14.0009C5.38921 15.3898 7.05588 16.0843 9.00033 16.0843Z" fill="#E90005"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> — Your Platform Secret Key must be stored securely. Never expose it in client-side code, a browser, or a mobile application. All onboarding requests must be made server.</p></div></div><p class="slate-p " ></p>

Creates a sub-merchant entity and begins the process of onboarding them onto the platform. Onboarding requires KYC (Know Your Customer) verification to ensure that only legitimate businesses are provisioned on your platform. Upon successful completion, the new merchant’s ID is stamped onto your platform’s 

 map, making it immediately available for use with all other CfP Platform API endpoints.

The following properties are required to use this endpoint:

Onboarding requests must be made server side and over 

The onboarding pipeline to use. `cfp` provisions the merchant under your platform's master account. `agency` provisions the merchant with their own independent account and bank payouts.

onboardingMode

The merchant's ConvesioPay user account credentials. A new user record is created if one does not already exist for the provided email.

merchant

The merchant's legal business entity details

business

The authorized representative of the business — typically the individual legally authorized to sign agreements on behalf of the merchant

businessRepresentative

Any individual with significant direct/indirect financial stake or ultimate operational control over the company.

businessOwners

The merchant's bank account, necessary for KYC of the merchant (even for CfP sub-merchants, in which case it will not be used beyond onboarding) and for payouts to Agency sub-merchants.

bankAccount

Customer support contact details for the merchant. These are displayed to cardholders on payment statements and dispute communications.

supportDetails

Webhook URL for this merchant that ConvesioPay will forward downstream merchant account events to. Useful for surfacing KYC and verification state changes on your platform's own UI without polling.

platformWebhooks

Content-Type

success

status

The ConvesioPay Merchant ID of the merchant. Use this value as `X-Merchant-Id` in merchant-scoped requests.

merchantId

completedSteps

Onboarding successful or partially successful

body

Missing or invalid `Authorization` header or Platform Secret Key.

Authenticated but not permitted. Typically returned when the `X-Merchant-Id` value does not belong to the calling platform.

error

failedStep

Pipeline halted partway through. See `failedStep` in the response body.

Updates a narrow set of merchant fields after onboarding. Each field in the 

 object maps to a specific API calls to create legal entities, account holders, balance accounts, business lines, stores, and payment method schemes and is processed independently — meaning a single request can partially succeed if one field update fails while others complete successfully.

 header to identify the sub-merchant. Include only the 

 fields you want to change — omitted fields are left unchanged.

The following fields can be updated. Each is processed independently — include only the fields you need:

The merchant's industry code (similar to but not always an actual MCC). Must be a valid code from the supported industry list. Refer to the 

Changes the merchant's store lifecycle status. Accepted values:

Updates the merchant's legal business details. Include only the fields you want to change — all fields are optional. Accepts the same country-conditional field requirements as the  

Updates the authorized representative's details. Include only the fields you want to change. Accepts the same country-conditional field requirements as the  

Updates one or more UBOs (Ultimate Beneficial Owners). Each owner must include their 

 — the legal entity ID returned during the original 

 onboarding response — to identify which owner record to update. Include only the fields you want to change. Accepts the same country-conditional field requirements as the 

 object are processed independently. You can include any combination of fields in a single request — each will be applied as a separate entity API call regardless of whether the others succeed or fail.

Requests must be made server side and over 

The updates object for updating a narrow set of merchant fields after onboarding

updates

`true` if the updates were received and processed successfully

results

	

Empty `updates`, or unknown field names.

Missing or invalid `Authorization` header or Platform Secret Key

Uploads a verification document for a sub-merchant as part of the KYC onboarding process. Documents are base64-encoded and attached to the appropriate legal entity record within the onboarding pipeline.

 field determines the type of document being uploaded and controls which entity the document is attached to when 

 is omitted. For documents that require explicit entity scoping — such as a specific UBO or a bank account — use the optional 

 field. For paged document types such as 

 field is required to indicate whether the file represents the 

Automatically target the individual (business representative) unless 

documentType

Description

Default target varies by document type — see the 

Default target

Automatically targets the bank account (transfer instrument).

 field controls which Adyen legal entity within the sub-merchant's account receives the document. When omitted, the target is automatically resolved from the 

 as described in the Document Types section above. Use an explicit 

 value only when you need to override the default resolution — for example, to upload an ID document for a specific UBO rather than the business representative.

target

Routes document to

Upload a passport for the business representative

Upload a driver's license front for a specific business owner

Upload a VAT document for the organization

The type of document being uploaded. Determines both the document category and, when target is omitted, which legal entity the document is attached to. See the Document Types section above for all accepted values.

A human-readable description of the document being uploaded (e.g. `Business owner DL`)

description

The base64-encoded content of the document file. Accepted formats: `pdf`, `jpg`, `jpeg`, `png`. **Maximum file size: 5MB.**

base64Content

The original filename including extension (e.g. `passport.jpg`). Used as the display name for the document.

fileName

Scopes the document to a specific legal entity within the sub-merchant's account. **If omitted, the target is automatically resolved from the `documentType`** — ID documents are routed to the individual, organization documents to the legal entity, and bank statements to the transfer instrument. See the Target Resolution section below for explicit targeting options.

Indicates which side of a paged document is being uploaded. **Required for `driversLicense` and `identityCard`; omit for all other document types.**`front` — The front of the document.`back` — The back of the document.

pageType

`true` if the document was uploaded and attached to the legal entity successfully

data

A successful upload returns the document record as stored, including the assigned document `id`, the owning legal entity, and the `modificationDate` timestamp. The `id` can be used for audit and support purposes.

	

Invalid payload or unsupported document/target combination.

The following industry codes are accepted by the 

 requests. Codes are grouped by sector for easier reference.

Code

Industry

The following industries may not supported on ConvesioPay and/or are subject to approval before they can fully be onboarded if at all.

<p class="slate-p " >As a CfP platform owner, you can update key attributes of your platform master account — including the master bank account used for sub-merchant revenue payouts to the platform and the hard descriptor displayed on customer payment statements.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=warning ><div class="callout-icon"><svg width="18" height="16" viewBox="0 0 18 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0.916637 15.5009C0.791637 15.5009 0.683998 15.4732 0.59372 15.4176C0.503443 15.362 0.430526 15.2857 0.37497 15.1884C0.319415 15.0912 0.288165 14.9905 0.28122 14.8864C0.274276 14.7822 0.305526 14.6745 0.37497 14.5634L8.4583 0.605103C8.52775 0.493991 8.60761 0.41413 8.69789 0.365519C8.78816 0.316908 8.88886 0.292603 8.99997 0.292603C9.11108 0.292603 9.21178 0.316908 9.30205 0.365519C9.39233 0.41413 9.47219 0.493991 9.54164 0.605103L17.625 14.5634C17.6944 14.6745 17.7257 14.7822 17.7187 14.8864C17.7118 14.9905 17.6805 15.0912 17.625 15.1884C17.5694 15.2857 17.4965 15.362 17.4062 15.4176C17.3159 15.4732 17.2083 15.5009 17.0833 15.5009H0.916637ZM1.99997 14.2509H16L8.99997 2.1676L1.99997 14.2509ZM9.0833 13.0634C9.26386 13.0634 9.41316 13.0044 9.53122 12.8864C9.64928 12.7683 9.7083 12.619 9.7083 12.4384C9.7083 12.2579 9.64928 12.1086 9.53122 11.9905C9.41316 11.8725 9.26386 11.8134 9.0833 11.8134C8.90275 11.8134 8.75344 11.8725 8.63539 11.9905C8.51733 12.1086 8.4583 12.2579 8.4583 12.4384C8.4583 12.619 8.51733 12.7683 8.63539 12.8864C8.75344 13.0044 8.90275 13.0634 9.0833 13.0634ZM9.0833 10.7509C9.26386 10.7509 9.41316 10.6919 9.53122 10.5739C9.64928 10.4558 9.7083 10.3065 9.7083 10.1259V6.70927C9.7083 6.52871 9.64928 6.37941 9.53122 6.26135C9.41316 6.1433 9.26386 6.08427 9.0833 6.08427C8.90275 6.08427 8.75344 6.1433 8.63539 6.26135C8.51733 6.37941 8.4583 6.52871 8.4583 6.70927V10.1259C8.4583 10.3065 8.51733 10.4558 8.63539 10.5739C8.75344 10.6919 8.90275 10.7509 9.0833 10.7509Z" fill="#F1C21B"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> — This endpoint is available to <code class="slate-code"><strong class="slate-bold">cfp</strong></code><strong class="slate-bold"> platforms only</strong>. Agency platforms cannot update master account attributes via the Platform API.</p></div></div><p class="slate-p " >Each field in the <code class="slate-code">updates</code> object maps to a specific API call and is processed independently — a single request can partially succeed if one field update fails while the other completes successfully. Include only the fields you want to change — omitted fields are left unchanged.</p><p class="slate-p " ></p><p class="slate-p " >The following fields can be updated:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><a href="https://docs.convesiopay.com/convesiopay-for-platforms-api/onboarding/update-merchant-copy#Bank-Account" target="">Bank Account</a></div></li><li class="slate-li " ><div style="position:relative"><a href="https://docs.convesiopay.com/convesiopay-for-platforms-api/onboarding/update-merchant-copy#Hard-Descriptor" target="">Hard Descriptor</a></div></li></ul><p class="slate-p " ></p><h3 class="slate-h3 " >Bank Account</h3><p class="slate-p " >The platform master bank account used for CfP payouts. All revenue collected from CfP sub-merchants flows into this account. Updating this field replaces the bank account currently on file for the platform master account.</p><p class="slate-p " >The following bank account fields are accepted. Country-conditional requirements match those of the Create Merchant endpoint — provide only the fields applicable to your <code class="slate-code">country</code>:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">accountNumber</code> — The bank account number. Format varies by the platform&apos;s <code class="slate-code">business.country</code>:</div><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">US</code> <code class="slate-code">CA</code> <code class="slate-code">AU</code> <code class="slate-code">GB</code> — Local account number (e.g. <code class="slate-code">000123456789</code>)</div></li><li class="slate-li " ><div style="position:relative"> <code class="slate-code">NL</code> <code class="slate-code">DE</code> <code class="slate-code">FR</code> <code class="slate-code">ES</code> <code class="slate-code">IT</code> — Full IBAN (e.g. <code class="slate-code">NL91ABNA0417164300</code>)</div></li></ul></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">routingNumber</code> — The payment routing number. <strong class="slate-bold">Required for </strong><code class="slate-code">US</code><strong class="slate-bold"> and </strong><code class="slate-code">CA</code><strong class="slate-bold"> only</strong>; omit for all other countries: </div><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><code class="slate-code">US</code> — ABA routing number, 9 digits (e.g. <code class="slate-code">021000021</code>)</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">CA</code> — 5-digit transit number concatenated with 3-digit institution number, no separator (e.g. <code class="slate-code">0010200003</code>)</div></li></ul></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">bsbCode</code> — <strong class="slate-bold">Required for </strong><code class="slate-code"><strong class="slate-bold">AU</strong></code><strong class="slate-bold"> only.</strong> 6-digit BSB code identifying the bank and branch (e.g. <code class="slate-code">062000</code>).</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">sortCode</code> — <strong class="slate-bold">Required for </strong><code class="slate-code"><strong class="slate-bold">GB</strong></code><strong class="slate-bold"> only.</strong> 6-digit sort code identifying the bank and branch, hyphens optional (e.g. <code class="slate-code">20-00-00</code>).</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">country</code> — ISO alpha-2 country code of the bank account (e.g. <code class="slate-code">US</code>).</div></li><li class="slate-li " ><div style="position:relative"><code class="slate-code">bankStatementBase64</code> — Base64-encoded bank statement (<code class="slate-code">pdf</code>, <code class="slate-code">jpg</code>, or <code class="slate-code">png</code>) for verification. Required when updating the bank account to complete the verification process.</div></li></ul><div class="code-block-wrapper"  style="width:100%" ><div class="code-block-header">JSON</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-json keep-markup drop-tokens"><div class="slate-code_line">{
  &quot;updates&quot;: {
    &quot;bankAccount&quot;: {
      &quot;accountNumber&quot;: &quot;000123456789&quot;,
      &quot;routingNumber&quot;: &quot;021000021&quot;,
      &quot;bsbCode&quot;: &quot;062-000&quot;,
      &quot;sortCode&quot;: &quot;&quot;,
      &quot;country&quot;: &quot;US&quot;,
      &quot;bankStatementBase64&quot;: &quot;5jh345l3k45j34l...&quot;
    }
  }
}
</div></code></pre></div><p class="slate-p " ></p><h3 class="slate-h3 " >Hard Descriptor</h3><p class="slate-p " >The platform name portion of the hard descriptor displayed on customer payment statements. For CfP platforms, the full statement descriptor follows the format <code class="slate-code">{PLATFORM_DESCRIPTOR} {SUB_MERCHANT_DESCRIPTOR}*</code> — this field sets the platform&apos;s descriptor and the sub-merchant&apos;s descriptor (combined, separated by a space) as the hard descriptor, before the asterisk.  Optionally, a soft descriptor (descriptor suffix, after the asterisk) can be provided with any additional value in the payment request using the <a href="https://docs.convesiopay.com/convesiopay-payment-checkout-integration-api/payments/create-a-payment-ol" target="_blank">Checkout API</a>.</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Maximum length: 22 characters total</strong> (including the sub-merchant&apos;s descriptor). Keep the platform prefix as short as possible to leave room for the sub-merchant descriptor value as well — longer strings will be truncated by the card network.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Allowed characters:</strong> <code class="slate-code">a-z</code>, <code class="slate-code">A-Z</code>, <code class="slate-code">0-9</code>, and spaces</div></li></ul><div class="code-block-wrapper"  style="width:100%" ><div class="code-block-header">JSON</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-json keep-markup drop-tokens"><div class="slate-code_line">{
  &quot;updates&quot;: {
    &quot;supportDetails&quot;: {
      &quot;statementDescriptor&quot;: &quot;MY_PLATFORM&quot;
    }
  }
}
</div></code></pre></div><p class="slate-p " ></p><p class="slate-p " >Requests must be made server side and over <a href="http://en.wikipedia.org/wiki/HTTP_Secure" target="_self">HTTPS</a>.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=error ><div class="callout-icon"><svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.08366 9.9801C9.25033 9.9801 9.39269 9.92107 9.51074 9.80302C9.6288 9.68496 9.68783 9.53566 9.68783 9.3551V5.31344C9.68783 5.14677 9.62533 5.00441 9.50033 4.88635C9.37533 4.7683 9.22949 4.70927 9.06283 4.70927C8.88227 4.70927 8.73296 4.7683 8.61491 4.88635C8.49685 5.00441 8.43783 5.15371 8.43783 5.33427V9.37594C8.43783 9.5426 8.50033 9.68496 8.62533 9.80302C8.75033 9.92107 8.9031 9.9801 9.08366 9.9801ZM9.00033 13.1676C9.19477 13.1676 9.35796 13.1016 9.48991 12.9697C9.62185 12.8377 9.68783 12.6745 9.68783 12.4801C9.68783 12.2857 9.62185 12.1225 9.48991 11.9905C9.35796 11.8586 9.19477 11.7926 9.00033 11.7926C8.80588 11.7926 8.64269 11.8586 8.51074 11.9905C8.3788 12.1225 8.31283 12.2857 8.31283 12.4801C8.31283 12.6745 8.3788 12.8377 8.51074 12.9697C8.64269 13.1016 8.80588 13.1676 9.00033 13.1676ZM9.00033 17.3343C7.81977 17.3343 6.72255 17.1225 5.70866 16.6989C4.69477 16.2752 3.81283 15.6884 3.06283 14.9384C2.31283 14.1884 1.72602 13.3065 1.30241 12.2926C0.878798 11.2787 0.666992 10.1815 0.666992 9.00094C0.666992 7.83427 0.878798 6.74399 1.30241 5.7301C1.72602 4.71621 2.31283 3.83427 3.06283 3.08427C3.81283 2.33427 4.69477 1.74399 5.70866 1.31344C6.72255 0.88288 7.81977 0.667603 9.00033 0.667603C10.167 0.667603 11.2573 0.88288 12.2712 1.31344C13.285 1.74399 14.167 2.33427 14.917 3.08427C15.667 3.83427 16.2573 4.71621 16.6878 5.7301C17.1184 6.74399 17.3337 7.83427 17.3337 9.00094C17.3337 10.1815 17.1184 11.2787 16.6878 12.2926C16.2573 13.3065 15.667 14.1884 14.917 14.9384C14.167 15.6884 13.285 16.2752 12.2712 16.6989C11.2573 17.1225 10.167 17.3343 9.00033 17.3343ZM9.00033 16.0843C10.9448 16.0843 12.6114 15.3898 14.0003 14.0009C15.3892 12.612 16.0837 10.9454 16.0837 9.00094C16.0837 7.05649 15.3892 5.38982 14.0003 4.00094C12.6114 2.61205 10.9448 1.9176 9.00033 1.9176C7.05588 1.9176 5.38921 2.61205 4.00033 4.00094C2.61144 5.38982 1.91699 7.05649 1.91699 9.00094C1.91699 10.9454 2.61144 12.6989 4.00033 14.0009C5.38921 15.3898 7.05588 16.0843 9.00033 16.0843Z" fill="#E90005"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> — Your Platform Secret Key must be stored securely. Never expose it in client-side code, a browser, or a mobile application. All onboarding requests must be made server.</p></div></div><p class="slate-p " ></p>

As a CfP platform owner, you can update key attributes of your platform master account — including the master bank account used for sub-merchant revenue payouts to the platform and the hard descriptor displayed on customer payment statements.

 object maps to a specific API call and is processed independently — a single request can partially succeed if one field update fails while the other completes successfully. Include only the fields you want to change — omitted fields are left unchanged.

The platform master bank account used for CfP payouts. All revenue collected from CfP sub-merchants flows into this account. Updating this field replaces the bank account currently on file for the platform master account.

The following bank account fields are accepted. Country-conditional requirements match those of the Create Merchant endpoint — provide only the fields applicable to your 

The platform name portion of the hard descriptor displayed on customer payment statements. For CfP platforms, the full statement descriptor follows the format 

{PLATFORM_DESCRIPTOR} {SUB_MERCHANT_DESCRIPTOR}*

 — this field sets the platform's descriptor and the sub-merchant's descriptor (combined, separated by a space) as the hard descriptor, before the asterisk.  Optionally, a soft descriptor (descriptor suffix, after the asterisk) can be provided with any additional value in the payment request using the 

<p class="slate-p " >Returns a paginated list of all sub-merchants onboarded under the authenticated platform. The platform is resolved from the <code class="slate-code">Authorization</code> secret key — this endpoint is platform-scoped and does <strong class="slate-bold">not</strong> require an <code class="slate-code">X-Merchant-Id</code> header.</p><p class="slate-p " >Results can be filtered by merchant <code class="slate-code">status</code> and a <code class="slate-code">createdAt</code> date range using the <code class="slate-code">from</code> and <code class="slate-code">to</code> query parameters. Results are paginated; use <code class="slate-code">pageSize</code> and <code class="slate-code">pageNumber</code> to navigate through large result sets.</p><p class="slate-p " ></p><p class="slate-p " >Requests must be made server side and over <a href="http://en.wikipedia.org/wiki/HTTP_Secure" target="_self">HTTPS</a>.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=error ><div class="callout-icon"><svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.08366 9.9801C9.25033 9.9801 9.39269 9.92107 9.51074 9.80302C9.6288 9.68496 9.68783 9.53566 9.68783 9.3551V5.31344C9.68783 5.14677 9.62533 5.00441 9.50033 4.88635C9.37533 4.7683 9.22949 4.70927 9.06283 4.70927C8.88227 4.70927 8.73296 4.7683 8.61491 4.88635C8.49685 5.00441 8.43783 5.15371 8.43783 5.33427V9.37594C8.43783 9.5426 8.50033 9.68496 8.62533 9.80302C8.75033 9.92107 8.9031 9.9801 9.08366 9.9801ZM9.00033 13.1676C9.19477 13.1676 9.35796 13.1016 9.48991 12.9697C9.62185 12.8377 9.68783 12.6745 9.68783 12.4801C9.68783 12.2857 9.62185 12.1225 9.48991 11.9905C9.35796 11.8586 9.19477 11.7926 9.00033 11.7926C8.80588 11.7926 8.64269 11.8586 8.51074 11.9905C8.3788 12.1225 8.31283 12.2857 8.31283 12.4801C8.31283 12.6745 8.3788 12.8377 8.51074 12.9697C8.64269 13.1016 8.80588 13.1676 9.00033 13.1676ZM9.00033 17.3343C7.81977 17.3343 6.72255 17.1225 5.70866 16.6989C4.69477 16.2752 3.81283 15.6884 3.06283 14.9384C2.31283 14.1884 1.72602 13.3065 1.30241 12.2926C0.878798 11.2787 0.666992 10.1815 0.666992 9.00094C0.666992 7.83427 0.878798 6.74399 1.30241 5.7301C1.72602 4.71621 2.31283 3.83427 3.06283 3.08427C3.81283 2.33427 4.69477 1.74399 5.70866 1.31344C6.72255 0.88288 7.81977 0.667603 9.00033 0.667603C10.167 0.667603 11.2573 0.88288 12.2712 1.31344C13.285 1.74399 14.167 2.33427 14.917 3.08427C15.667 3.83427 16.2573 4.71621 16.6878 5.7301C17.1184 6.74399 17.3337 7.83427 17.3337 9.00094C17.3337 10.1815 17.1184 11.2787 16.6878 12.2926C16.2573 13.3065 15.667 14.1884 14.917 14.9384C14.167 15.6884 13.285 16.2752 12.2712 16.6989C11.2573 17.1225 10.167 17.3343 9.00033 17.3343ZM9.00033 16.0843C10.9448 16.0843 12.6114 15.3898 14.0003 14.0009C15.3892 12.612 16.0837 10.9454 16.0837 9.00094C16.0837 7.05649 15.3892 5.38982 14.0003 4.00094C12.6114 2.61205 10.9448 1.9176 9.00033 1.9176C7.05588 1.9176 5.38921 2.61205 4.00033 4.00094C2.61144 5.38982 1.91699 7.05649 1.91699 9.00094C1.91699 10.9454 2.61144 12.6989 4.00033 14.0009C5.38921 15.3898 7.05588 16.0843 9.00033 16.0843Z" fill="#E90005"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> — Your Platform Secret Key must be stored securely. Never expose it in client-side code, a browser, or a mobile application. All onboarding requests must be made server.</p></div></div><p class="slate-p " ></p>

Returns a paginated list of all sub-merchants onboarded under the authenticated platform. The platform is resolved from the 

 secret key — this endpoint is platform-scoped and does 

 query parameters. Results are paginated; use 

The number of merchants to return per page. Defaults to `100`.

pageSize

The page number to return. Defaults to `1`.

pageNumber

Filter merchants created on or after this date. ISO 8601 format.

from

Filter merchants created on or before this date. ISO 8601 format.

The list of sub-merchants for the current page

merchants

pagination

Paginated list of sub-merchants returned successfully.

<p class="slate-p " >Returns all payment processors currently configured for the sub-merchant identified by the <code class="slate-code">X-Merchant-Id</code> header.</p><p class="slate-p " >These payment processors represent those available for the sub-merchant to route transactions through via the ConvesioPay orchestration layer. Each processor or &quot;connector&quot; has a unique <code class="slate-code">connectorId</code>, a <code class="slate-code">connectorName</code> identifying the processor, a human-readable <code class="slate-code">connectorLabel</code>, and an <code class="slate-code">enabled</code> flag.</p><p class="slate-p " ></p><p class="slate-p " >Requests must be made server side and over <a href="http://en.wikipedia.org/wiki/HTTP_Secure" target="_self">HTTPS</a>.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=error ><div class="callout-icon"><svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.08366 9.9801C9.25033 9.9801 9.39269 9.92107 9.51074 9.80302C9.6288 9.68496 9.68783 9.53566 9.68783 9.3551V5.31344C9.68783 5.14677 9.62533 5.00441 9.50033 4.88635C9.37533 4.7683 9.22949 4.70927 9.06283 4.70927C8.88227 4.70927 8.73296 4.7683 8.61491 4.88635C8.49685 5.00441 8.43783 5.15371 8.43783 5.33427V9.37594C8.43783 9.5426 8.50033 9.68496 8.62533 9.80302C8.75033 9.92107 8.9031 9.9801 9.08366 9.9801ZM9.00033 13.1676C9.19477 13.1676 9.35796 13.1016 9.48991 12.9697C9.62185 12.8377 9.68783 12.6745 9.68783 12.4801C9.68783 12.2857 9.62185 12.1225 9.48991 11.9905C9.35796 11.8586 9.19477 11.7926 9.00033 11.7926C8.80588 11.7926 8.64269 11.8586 8.51074 11.9905C8.3788 12.1225 8.31283 12.2857 8.31283 12.4801C8.31283 12.6745 8.3788 12.8377 8.51074 12.9697C8.64269 13.1016 8.80588 13.1676 9.00033 13.1676ZM9.00033 17.3343C7.81977 17.3343 6.72255 17.1225 5.70866 16.6989C4.69477 16.2752 3.81283 15.6884 3.06283 14.9384C2.31283 14.1884 1.72602 13.3065 1.30241 12.2926C0.878798 11.2787 0.666992 10.1815 0.666992 9.00094C0.666992 7.83427 0.878798 6.74399 1.30241 5.7301C1.72602 4.71621 2.31283 3.83427 3.06283 3.08427C3.81283 2.33427 4.69477 1.74399 5.70866 1.31344C6.72255 0.88288 7.81977 0.667603 9.00033 0.667603C10.167 0.667603 11.2573 0.88288 12.2712 1.31344C13.285 1.74399 14.167 2.33427 14.917 3.08427C15.667 3.83427 16.2573 4.71621 16.6878 5.7301C17.1184 6.74399 17.3337 7.83427 17.3337 9.00094C17.3337 10.1815 17.1184 11.2787 16.6878 12.2926C16.2573 13.3065 15.667 14.1884 14.917 14.9384C14.167 15.6884 13.285 16.2752 12.2712 16.6989C11.2573 17.1225 10.167 17.3343 9.00033 17.3343ZM9.00033 16.0843C10.9448 16.0843 12.6114 15.3898 14.0003 14.0009C15.3892 12.612 16.0837 10.9454 16.0837 9.00094C16.0837 7.05649 15.3892 5.38982 14.0003 4.00094C12.6114 2.61205 10.9448 1.9176 9.00033 1.9176C7.05588 1.9176 5.38921 2.61205 4.00033 4.00094C2.61144 5.38982 1.91699 7.05649 1.91699 9.00094C1.91699 10.9454 2.61144 12.6989 4.00033 14.0009C5.38921 15.3898 7.05588 16.0843 9.00033 16.0843Z" fill="#E90005"></path></svg></div><div ><p class="slate-p " ><strong class="slate-bold">NOTE</strong> — Your Platform Secret Key must be stored securely. Never expose it in client-side code, a browser, or a mobile application. All onboarding requests must be made server.</p></div></div><p class="slate-p " ></p>

Returns all payment processors currently configured for the sub-merchant identified by the 

These payment processors represent those available for the sub-merchant to route transactions through via the ConvesioPay orchestration layer. Each processor or "connector" has a unique 

Sections