​

Conventions

​

Hosts and transport

• HTTPS only (TLS 1.2+)
• Content-Type: application/json for bodies
• Authorization: Bearer <access_token> on Partner endpoints

​

Amounts and time

​

Identity and correlation

There is no separate “end-customer id” in the API. Correlate your users with ext_id, card_id, holder fields, etc. on your side.

​

Isolation

• You only see your own funds, documents, cards, eSIMs, and gift purchases
• Another tenant’s resource → 404 (no existence leak)
• Missing scope → 403
• Wallet end-user tokens are rejected

​

Versioning

The Partner API is not versioned as a whole. Breaking changes to a method use a new scope and/or an explicit parameter / Accept variant for that method.

​

Async pattern

Most money and product creates return 202 (or idempotent 200/202 on replay). Track progress with:

1. Webhooks (terminal statuses)
2. GET /partner/documents/{ext_id}
3. Product GET endpoints (cards, esims, gift-cards)