Partners

The Partners API allows you to manage and retrieve information about partners in the system. You can create, update, delete, and fetch partner details, as well as manage a partner's members, invites, financial institutions, and platform accounts/reserves.

Most endpoints below operate on a single partner and are scoped under {% $apiBase %}/v2/partner/:partnerId. The :partnerId path parameter accepts either:

A partner's id.
A partner's routingIdentifier.
The literal value @self, which resolves to the partner authenticated via the Authorization header (partner API key). Using @self without partner authentication returns a 401.

Get partners

Retrieve a list of all partners in the system.

Request

http
GET https://api.staging.qash.cloud/v2/partners

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Authorization

Some data for this endpoint requires an authenticated user or partner. You may authenticate using a partner API key via the Authorization header.

http
Authorization: Bearer <your_api_token>

Response

Returns an array of partners.

json
[
    {
        "id": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "name": "Qash (Staging)",
        "logoUrl": "partner_logos/par_30cDoRAkxP6gnaVBicqU7kfSFU1.ab67240f-c492-4abc-b2d9-9933dd25a7ad.usr_30cDhEFCw3vXIgAvPhTEJa5WtTl.png",
        "routable": true,
        "routingIdentifier": "QASHQAX",
        "isClearingHousePartner": true,
        "isCoreBankingPartner": true,
        "platformAccountHolderId": "ahld_30ckdeyyXcmJ3J0RBizCneTtNIG",
        "revokedAt": null,
        "revocationReason": null,
        "createdAt": "2025-07-30T23:29:01.642Z",
        "updatedAt": "2026-07-06T00:31:11.699Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the partner.
`name`	`string`	The name of the partner.
`logoUrl`	`string`	The URL path to the partner's logo image.
`routable`	`boolean`	Indicates whether the partner is routable within the system.
`routingIdentifier`	`string`	The routing identifier associated with the partner.
`isClearingHousePartner`	`boolean`	Indicates whether the partner is a clearing house partner.
`isCoreBankingPartner`	`boolean`	Indicates whether the partner is a core banking partner.
`platformAccountHolderId`	`string`	The unique identifier for the platform account holder associated with the partner.
`revokedAt`	`string` \| `null`	The timestamp when the partner's access was revoked, if applicable.
`revocationReason`	`string` \| `null`	The reason for revocation, if applicable.
`createdAt`	`string`	The timestamp when the partner was created.
`updatedAt`	`string`	The timestamp when the partner was last updated.

Errors

This endpoint does not require authentication, and will not return an error under normal circumstances.

Example

bash
curl https://api.staging.qash.cloud/v2/partners

Register partner

Creates a new partner. Requires an authenticated admin user in OVS mode.

Request

http
POST https://api.staging.qash.cloud/v2/partners

Request Body

Field	Type	Description
`name`	`string`	The partner's name

Authorization

This endpoint requires an authenticated admin user in OVS mode.

http
Authorization: Bearer <your_api_token>

Response

Returns the newly created partner.

json
{
    "id": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "name": "Qash (Staging)",
    "logoUrl": null,
    "routable": false,
    "routingIdentifier": null,
    "isClearingHousePartner": false,
    "isCoreBankingPartner": false,
    "platformAccountHolderId": null,
    "revokedAt": null,
    "revocationReason": null,
    "createdAt": "2025-07-30T23:29:01.642Z",
    "updatedAt": "2025-07-30T23:29:01.642Z"
}

Response fields

Same fields as Get partner.

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`401`	The request was not authenticated.
`403`	The authenticated user is not an admin, or the request is not in OVS mode.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partners \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "Qash"}'

Get partner

Retrieve a single partner by its ID, routing identifier, or @self.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`members`	The partner's memberships
`members.user`	The user associated with each membership (requires `members`)
`financialInstitutions`	The partner's linked financial institutions
`fees`	The partner's fee entries
`fees.currency`	The currency of each fee entry (requires `fees`)

Authorization

Some data for this endpoint requires an authenticated user or partner. You may authenticate using a partner API key via the Authorization header.

http
Authorization: Bearer <your_api_token>

Response

Returns the partner.

json
{
    "id": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "name": "Qash (Staging)",
    "logoUrl": "partner_logos/par_30cDoRAkxP6gnaVBicqU7kfSFU1.ab67240f-c492-4abc-b2d9-9933dd25a7ad.usr_30cDhEFCw3vXIgAvPhTEJa5WtTl.png",
    "routable": true,
    "routingIdentifier": "QASHQAX",
    "isClearingHousePartner": true,
    "isCoreBankingPartner": true,
    "platformAccountHolderId": "ahld_30ckdeyyXcmJ3J0RBizCneTtNIG",
    "revokedAt": null,
    "revocationReason": null,
    "createdAt": "2025-07-30T23:29:01.642Z",
    "updatedAt": "2026-07-06T00:31:11.699Z"
}

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the partner.
`name`	`string`	The name of the partner.
`logoUrl`	`string`	The URL path to the partner's logo image.
`routable`	`boolean`	Indicates whether the partner is routable within the system.
`routingIdentifier`	`string`	The routing identifier associated with the partner.
`isClearingHousePartner`	`boolean`	Indicates whether the partner is a clearing house partner.
`isCoreBankingPartner`	`boolean`	Indicates whether the partner is a core banking partner.
`platformAccountHolderId`	`string`	The unique identifier for the platform account holder associated with the partner.
`revokedAt`	`string` \| `null`	The timestamp when the partner's access was revoked, if applicable.
`revocationReason`	`string` \| `null`	The reason for revocation, if applicable.
`createdAt`	`string`	The timestamp when the partner was created.
`updatedAt`	`string`	The timestamp when the partner was last updated.

Errors

Status	Description
`401`	`partnerId` was `@self` but the request was not authenticated as a partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1

Get partner's logo

Retrieves the logo image file for a partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/logo

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Response

Returns the logo image file.

Errors

Status	Description
`401`	`partnerId` was `@self` but the request was not authenticated as a partner.
`404`	The partner was not found, or the partner has no logo.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/logo

Update partner's logo

Updates the logo image for a partner. Requires an authenticated admin user in OVS mode.

Request

http
PATCH https://api.staging.qash.cloud/v2/partner/:partnerId/logo

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Body

This endpoint expects a multipart/form-data request with the following field:

Field	Type	Description
`file`	`File`	The logo image file. Must be `image/jpeg` or `image/png`.

Authorization

This endpoint requires an authenticated admin user in OVS mode.

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`400`	No file was provided, or the file's mimetype is not `image/jpeg` or `image/png`.
`401`	The request was not authenticated.
`403`	The authenticated user is not an admin, or the request is not in OVS mode.
`404`	The partner was not found.

Example

bash
curl -X PATCH https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/logo \
  -H "Authorization: Bearer <your_api_token>" \
  -F "file=@/path/to/logo.png"

Update partner

Updates a partner's details. Requires an authenticated admin user in OVS mode.

Request

http
PATCH https://api.staging.qash.cloud/v2/partner/:partnerId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Body

Field	Type	Description
`name`	`string?`	The partner's name
`routable`	`boolean?`	Whether the partner is routable within the system
`routingIdentifier`	`string?`	The partner's routing identifier. Must be exactly 7 characters.
`platformAccountHolderId`	`string?`	The account ID to use as the partner's platform settlement account holder. Must belong to the platform's own partner (`QASH_PARTNER_ID`).
`isClearingHousePartner`	`boolean?`	Whether the partner is a clearing house partner
`isCoreBankingPartner`	`boolean?`	Whether the partner is a core banking partner

Authorization

This endpoint requires an authenticated admin user in OVS mode.

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`401`	The request was not authenticated.
`403`	The authenticated user is not an admin, or the request is not in OVS mode.
`404`	The partner was not found, or `platformAccountHolderId` does not reference a valid account of the platform's partner.

Example

bash
curl -X PATCH https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1 \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "Qash", "routable": true, "routingIdentifier": "QASHQAX"}'

Get partner's members

Retrieve a partner's members.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/members

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`user`	The user associated with the membership

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of memberships.

json
[
    {
        "id": "mem_31gK2pXQz8nAa9VbTsY6ohLp3Rc",
        "userId": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "joinedAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the membership.
`userId`	`string`	The ID of the member's user.
`partnerId`	`string`	The ID of the partner.
`joinedAt`	`string`	The timestamp when the user joined the partner.
`updatedAt`	`string`	The timestamp when the membership was last updated.
`user`	`object`	The associated user, when `include=user`.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/members \
  -H "Authorization: Bearer <your_api_token>"

Get partner's member

Retrieve a single member of a partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/member/:memberId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`memberId`	`string`	The user ID of the member

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`user`	The user associated with the membership
`partner`	The partner associated with the membership

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns the membership.

json
{
    "id": "mem_31gK2pXQz8nAa9VbTsY6ohLp3Rc",
    "userId": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "joinedAt": "2025-08-01T12:00:00.000Z",
    "updatedAt": "2025-08-01T12:00:00.000Z"
}

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the membership.
`userId`	`string`	The ID of the member's user.
`partnerId`	`string`	The ID of the partner.
`joinedAt`	`string`	The timestamp when the user joined the partner.
`updatedAt`	`string`	The timestamp when the membership was last updated.
`user`	`object`	The associated user, when `include=user`.
`partner`	`object`	The associated partner, when `include=partner`.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the member was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/member/usr_30cDhEFCw3vXIgAvPhTEJa5WtTl \
  -H "Authorization: Bearer <your_api_token>"

Remove partner's member

Removes a member from a partner. A member cannot remove themselves.

Request

http
DELETE https://api.staging.qash.cloud/v2/partner/:partnerId/member/:memberId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`memberId`	`string`	The user ID of the member to remove

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.
`409`	The authenticated user attempted to remove themselves.

Example

bash
curl -X DELETE https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/member/usr_30cDhEFCw3vXIgAvPhTEJa5WtTl \
  -H "Authorization: Bearer <your_api_token>"

Get partner's invites

Retrieve a partner's member invitation links.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/invites

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`usedBy`	The user who consumed the invite
`revokedBy`	The user who revoked the invite
`createdBy`	The user who created the invite

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of invites.

json
[
    {
        "id": "inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "usedById": null,
        "usedAt": null,
        "revokedById": null,
        "revokedAt": null,
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the invite.
`partnerId`	`string`	The ID of the partner the invite belongs to.
`usedById`	`string` \| `null`	The ID of the user who consumed the invite, if any.
`usedAt`	`string` \| `null`	The timestamp when the invite was consumed, if any.
`revokedById`	`string` \| `null`	The ID of the user who revoked the invite, if any.
`revokedAt`	`string` \| `null`	The timestamp when the invite was revoked, if any.
`createdById`	`string`	The ID of the user who created the invite.
`createdAt`	`string`	The timestamp when the invite was created.
`updatedAt`	`string`	The timestamp when the invite was last updated.
`usedBy`	`object`	The user who consumed the invite, when `include=usedBy`.
`revokedBy`	`object`	The user who revoked the invite, when `include=revokedBy`.
`createdBy`	`object`	The user who created the invite, when `include=createdBy`.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/invites \
  -H "Authorization: Bearer <your_api_token>"

Create partner invite

Creates a new member invitation link for a partner.

Request

http
POST https://api.staging.qash.cloud/v2/partner/:partnerId/invites

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

json
{
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "linkId": "inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd"
}

Response fields

Field	Type	Description
`partnerId`	`string`	The ID of the partner the invite belongs to.
`linkId`	`string`	The ID of the newly created invite.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/invites \
  -H "Authorization: Bearer <your_api_token>"

Get partner invite

Retrieves details for a member invitation link. The information returned depends on whether the requester is already a member of the partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/invite/:inviteId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`inviteId`	`string`	The ID of the invite

Authorization

This endpoint requires an authenticated user.

http
Authorization: Bearer <your_api_token>

Response

If the authenticated user is already a member of the partner, the full invite is returned:

json
{
    "invite": {
        "id": "inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "usedById": null,
        "usedAt": null,
        "revokedById": null,
        "revokedAt": null,
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    },
    "isMember": true
}

Otherwise, a reduced payload is returned:

json
{
    "invite": {
        "id": "inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd",
        "partner": "par_30cDoRAkxP6gnaVBicqU7kfSFU1"
    },
    "isMember": false
}

Response fields

Field	Type	Description
`invite`	`object`	The invite (full object if `isMember` is `true`, otherwise only `id` and `partner`).
`isMember`	`boolean`	Whether the authenticated user is already a member of the partner.

Errors

Status	Description
`401`	The request was not authenticated.
`404`	The partner was not found, or the invite was not found.
`409`	The invite has already been revoked or used, and the requester is not a partner member.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/invite/inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd \
  -H "Authorization: Bearer <your_api_token>"

Revoke partner invite

Revokes a member invitation link.

Request

http
DELETE https://api.staging.qash.cloud/v2/partner/:partnerId/invite/:inviteId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`inviteId`	`string`	The ID of the invite

Authorization

This endpoint requires an authenticated user.

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`401`	The request was not authenticated.
`404`	The partner was not found, or the invite was not found.
`409`	The invite has already been revoked or used.

Example

bash
curl -X DELETE https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/invite/inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd \
  -H "Authorization: Bearer <your_api_token>"

Consume partner invite

Consumes a member invitation link, adding the authenticated user as a member of the partner.

Request

http
POST https://api.staging.qash.cloud/v2/partner/:partnerId/invite/:inviteId/consume

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`inviteId`	`string`	The ID of the invite

Authorization

This endpoint requires an authenticated user.

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`401`	The request was not authenticated.
`404`	The partner was not found, or the invite was not found.
`409`	The authenticated user is already a member of the partner, or the invite has already been revoked or used.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/invite/inv_31hL3qYRz9oBb0WcUtZ7piMq4Sd/consume \
  -H "Authorization: Bearer <your_api_token>"

Get partner's financial institutions

Retrieve a partner's linked financial institutions.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/financial-institutions

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`currency`	Currency of the financial institution
`jurisdiction`	Jurisdiction of the financial institution

Response

Returns an array of financial institutions. See the Financial Institutions API for the full field reference.

json
[
    {
        "id": "fi_3GCsJGvcOFncmFs7OrxJ23HRmxa",
        "name": "Qash",
        "logoUrl": null,
        "firmName": "Qash, LLC.",
        "firmCode": "Qash",
        "jurisdictionId": "jur_35lcZMA4h8vk7JhDOB6qRfy1JCg",
        "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "redmontReserveAccountHolderId": null,
        "redmontReserveAccountId": null,
        "redmontReserveRelationsChannel": null,
        "revokedAt": null,
        "createdAt": "2026-07-08T05:00:11.296Z",
        "updatedAt": "2026-07-08T05:00:11.296Z"
    }
]

Errors

Status	Description
`401`	`partnerId` was `@self` but the request was not authenticated as a partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/financial-institutions

Get partner's platform accounts

Retrieve a partner's platform accounts (the accounts used to hold the partner's own settlement funds on the platform, one per currency).

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/platform/accounts

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`account`	The underlying CBS account
`currency`	The currency of the platform account
`partner`	The owning partner
`account.pendingDebits`	Sum of pending debit transactions on the account (requires `account`)
`account.pendingCredits`	Sum of pending credit transactions on the account (requires `account`)
`maximumTransactionAuthorized`	Maximum amount authorized for a transaction on the account, accounting for pending debits and overdraft

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of platform accounts.

json
[
    {
        "id": "ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
        "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the platform account.
`partnerId`	`string`	The ID of the owning partner.
`currencyId`	`string`	The ID of the platform account's currency.
`accountId`	`string`	The ID of the underlying CBS account.
`createdAt`	`string`	The timestamp when the platform account was created.
`updatedAt`	`string`	The timestamp when the platform account was last updated.
`account`	`object`	The underlying CBS account, when `include=account`.
`currency`	`object`	The currency, when `include=currency`.
`partner`	`object`	The owning partner, when `include=partner`.
`maximumTransactionAuthorized`	`number`	Present when `include=maximumTransactionAuthorized`.

Errors

Status	Description
`403`	The requester is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/accounts \
  -H "Authorization: Bearer <your_api_token>"

Get partner's platform transactions

Retrieve the transactions of all of a partner's platform accounts.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/platform/transactions

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`account`	The account the transaction belongs to
`currency`	The currency of the transaction
`relatedAccountTransaction`	The linked account transaction, if any
`relatedCashRequest`	The linked cash request, if any
`relatedMandate`	The linked mandate, if any
`relatedNetworkTransaction`	The linked network transaction, if any

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of account transactions.

json
[
    {
        "id": "atx_31lP7uCVz3sFf4agYxD1tmQu8Wh",
        "type": "DEPOSIT",
        "direction": "CREDIT",
        "status": "COMPLETED",
        "description": null,
        "remarks": null,
        "relatedNetworkTransactionId": null,
        "relatedAccountTransactionId": null,
        "relatedCashRequestId": "cr_31kO6tBUz2rEe3ZfXwC0slPt7Vg",
        "relatedMandateId": null,
        "invoiceCode": null,
        "billCategoryCode": null,
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
        "amount": 10000,
        "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the transaction.
`type`	`string`	One of `DEPOSIT`, `WITHDRAWAL`, `MANDATE_TRANSACTION`, `ACCOUNT_TRANSFER`, `BILLED_FEE`, `SETTLEMENT`, `FEE_REVERSAL`.
`direction`	`string`	`CREDIT` or `DEBIT`.
`status`	`string`	`COMPLETED`, `PENDING`, or `FAILED`.
`description`	`string` \| `null`	Customer-facing description.
`remarks`	`string` \| `null`	Additional remarks.
`relatedNetworkTransactionId`	`string` \| `null`	ID of the linked network transaction, if any.
`relatedAccountTransactionId`	`string` \| `null`	ID of the linked account transaction, if any.
`relatedCashRequestId`	`string` \| `null`	ID of the linked cash request, if any.
`relatedMandateId`	`string` \| `null`	ID of the linked mandate, if any.
`invoiceCode`	`string` \| `null`	Invoicing code, for billed fees.
`billCategoryCode`	`string` \| `null`	Bill category code, for billed fees.
`partnerId`	`string`	The ID of the partner the transaction belongs to.
`accountId`	`string`	The ID of the account the transaction belongs to.
`amount`	`number`	The transaction amount, in the smallest unit of the currency.
`currencyId`	`string`	The ID of the transaction's currency.
`createdAt`	`string`	The timestamp when the transaction was created.
`updatedAt`	`string`	The timestamp when the transaction was last updated.

Errors

Status	Description
`403`	The requester is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/transactions \
  -H "Authorization: Bearer <your_api_token>"

Get partner's reserves

Retrieve the balances held in a partner's platform accounts and its financial institutions' Redmont reserve accounts.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/reserves

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Response

json
{
    "platformReserves": [
        {
            "currency": {
                "id": "cur_30c5YSuuE30lziMuCnr1edmcBtA"
            },
            "sum": 100000
        }
    ],
    "institutionsReserves": [
        {
            "reserve": "redmont",
            "currency": {
                "id": "cur_30c5YSuuE30lziMuCnr1edmcBtA"
            },
            "sum": 50000
        }
    ],
    "totalReserves": [
        {
            "currency": {
                "id": "cur_30c5YSuuE30lziMuCnr1edmcBtA"
            },
            "sum": 150000
        }
    ]
}

Response fields

Field	Type	Description
`platformReserves`	`array`	Sum of the partner's platform account balances, grouped by currency.
`institutionsReserves`	`array`	Sum of the partner's financial institutions' Redmont reserve account balances, grouped by reserve type and currency.
`totalReserves`	`array`	Sum of `platformReserves` and `institutionsReserves`, grouped by currency.
`[].currency`	`object`	The currency object for the entry.
`[].sum`	`number`	The settled balance sum for the entry, in the smallest unit of the currency.
`institutionsReserves[].reserve`	`string`	The reserve type, currently always `redmont`.

Errors

Status	Description
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/reserves

Get partner's platform account

Retrieve a single platform account of a partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/platform/account/:accountId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`accountId`	`string`	The platform account's ID, or the ID of its underlying CBS account

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`account`	The underlying CBS account
`currency`	The currency of the platform account
`partner`	The owning partner
`account.pendingDebits`	Sum of pending debit transactions on the account (requires `account`)
`account.pendingCredits`	Sum of pending credit transactions on the account (requires `account`)
`maximumTransactionAuthorized`	Maximum amount authorized for a transaction on the account, accounting for pending debits and overdraft
`maximumWithdrawalAuthorized`	Maximum amount authorized for a withdrawal on the account, accounting for pending debits

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns the platform account.

json
{
    "id": "ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te",
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
    "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
    "createdAt": "2025-08-01T12:00:00.000Z",
    "updatedAt": "2025-08-01T12:00:00.000Z"
}

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the platform account.
`partnerId`	`string`	The ID of the owning partner.
`currencyId`	`string`	The ID of the platform account's currency.
`accountId`	`string`	The ID of the underlying CBS account.
`createdAt`	`string`	The timestamp when the platform account was created.
`updatedAt`	`string`	The timestamp when the platform account was last updated.
`account`	`object`	The underlying CBS account, when `include=account`.
`currency`	`object`	The currency, when `include=currency`.
`partner`	`object`	The owning partner, when `include=partner`.
`maximumTransactionAuthorized`	`number`	Present when `include=maximumTransactionAuthorized`.
`maximumWithdrawalAuthorized`	`number`	Present when `include=maximumWithdrawalAuthorized`.

Errors

Status	Description
`403`	The requester is not a member of the partner.
`404`	The partner was not found, or the platform account was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/account/ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te \
  -H "Authorization: Bearer <your_api_token>"

Create platform account cash request

Creates a deposit or withdrawal cash request against a partner's platform account.

Request

http
POST https://api.staging.qash.cloud/v2/partner/:partnerId/platform/account/:accountId/cash-requests

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`accountId`	`string`	The platform account's ID, or the ID of its underlying CBS account

Request Body

Field	Type	Description
`type`	`"deposit"` \| `"withdraw"`	The direction of the cash request.
`amount`	`integer`	The amount to deposit or withdraw, in the smallest unit of the currency. Must be `>= 0`.

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns the created cash request.

json
{
    "id": "cr_31kO6tBUz2rEe3ZfXwC0slPt7Vg",
    "direction": "DEPOSIT",
    "status": "PENDING",
    "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
    "declaredAmount": 10000,
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
    "authorizedAmount": null,
    "remarks": null,
    "createdAt": "2025-08-01T12:00:00.000Z",
    "updatedAt": "2025-08-01T12:00:00.000Z",
    "answeredAt": null
}

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the cash request.
`direction`	`string`	`DEPOSIT` or `WITHDRAWAL`.
`status`	`string`	`PENDING`, `COMPLETED`, or `REJECTED`.
`currencyId`	`string`	The ID of the cash request's currency.
`declaredAmount`	`number`	The requested amount, in the smallest unit of the currency.
`partnerId`	`string`	The ID of the partner the cash request belongs to.
`accountId`	`string`	The ID of the CBS account the cash request applies to.
`authorizedAmount`	`number` \| `null`	The amount authorized upon answering, if answered.
`remarks`	`string` \| `null`	Remarks provided when answering the cash request.
`createdAt`	`string`	The timestamp when the cash request was created.
`updatedAt`	`string`	The timestamp when the cash request was last updated.
`answeredAt`	`string` \| `null`	The timestamp when the cash request was answered, if any.

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`403`	The requester is not a member of the partner.
`404`	The partner was not found, or the platform account was not found.
`409`	The underlying CBS account is unavailable (locked or missing), or, for withdrawals, has insufficient balance.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/account/ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te/cash-requests \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"type": "deposit", "amount": 10000}'

Get platform account transactions

Retrieve the transactions of a single platform account.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/platform/account/:accountId/transactions

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`accountId`	`string`	The platform account's ID, or the ID of its underlying CBS account

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`account`	The account the transaction belongs to
`currency`	The currency of the transaction
`partner`	The partner the transaction belongs to
`relatedCashRequest`	The linked cash request, if any
`relatedAccountTransaction`	The linked account transaction, if any
`relatedMandate`	The linked mandate, if any
`relatedNetworkTransaction`	The linked network transaction, if any

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of account transactions. See Get partner's platform transactions for the field reference.

json
[
    {
        "id": "atx_31lP7uCVz3sFf4agYxD1tmQu8Wh",
        "type": "DEPOSIT",
        "direction": "CREDIT",
        "status": "COMPLETED",
        "description": null,
        "remarks": null,
        "relatedNetworkTransactionId": null,
        "relatedAccountTransactionId": null,
        "relatedCashRequestId": "cr_31kO6tBUz2rEe3ZfXwC0slPt7Vg",
        "relatedMandateId": null,
        "invoiceCode": null,
        "billCategoryCode": null,
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
        "amount": 10000,
        "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Errors

Status	Description
`403`	The requester is not a member of the partner.
`404`	The partner was not found, or the platform account was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/account/ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te/transactions \
  -H "Authorization: Bearer <your_api_token>"

Get platform account cash requests

Retrieve the cash requests of a single platform account.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/platform/account/:accountId/cash-requests

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`accountId`	`string`	The platform account's ID, or the ID of its underlying CBS account

Request Query Parameters

Parameter	Type	Description
`include`	`string`	Comma-separated list of relation fields to include in the response

Available inclusions

Field	Description
`account`	The account the cash request applies to
`currency`	The currency of the cash request
`partner`	The partner the cash request belongs to

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode, or a matching partner API key).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of cash requests. See Create platform account cash request for the field reference.

json
[
    {
        "id": "cr_31kO6tBUz2rEe3ZfXwC0slPt7Vg",
        "direction": "DEPOSIT",
        "status": "PENDING",
        "currencyId": "cur_30c5YSuuE30lziMuCnr1edmcBtA",
        "declaredAmount": 10000,
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "accountId": "acc_31jN5sATz1qDd2YeWvB9rkOs6Uf",
        "authorizedAmount": null,
        "remarks": null,
        "createdAt": "2025-08-01T12:00:00.000Z",
        "updatedAt": "2025-08-01T12:00:00.000Z",
        "answeredAt": null
    }
]

Errors

Status	Description
`403`	The requester is not a member of the partner.
`404`	The partner was not found, or the platform account was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/platform/account/ppa_31iM4rZSz0pCc1XdVuA8qjNr5Te/cash-requests \
  -H "Authorization: Bearer <your_api_token>"

Get partner's API keys

Retrieve a partner's API keys.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/api/keys

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of API keys. The secretHash field is never included in the response.

json
[
    {
        "id": "ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi",
        "label": "Production key",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "lastUsedAt": null,
        "lastUsedIp": null,
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "revokedAt": null,
        "revokedById": null,
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the API key.
`label`	`string`	A human-readable label for the API key.
`partnerId`	`string`	The ID of the partner the key belongs to.
`lastUsedAt`	`string` \| `null`	The timestamp the key was last used, if any.
`lastUsedIp`	`string` \| `null`	The IP address the key was last used from, if any.
`createdById`	`string`	The ID of the user who issued the key.
`createdAt`	`string`	The timestamp when the key was created.
`revokedAt`	`string` \| `null`	The timestamp when the key was revoked, if any.
`revokedById`	`string` \| `null`	The ID of the user who revoked the key, if any.
`updatedAt`	`string`	The timestamp when the key was last updated.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/keys \
  -H "Authorization: Bearer <your_api_token>"

Issue partner API key

Issues a new API key for a partner. The plaintext secret is only ever returned once, in this response.

Request

http
POST https://api.staging.qash.cloud/v2/partner/:partnerId/api/keys

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Body

Field	Type	Description
`label`	`string`	A human-readable label for the API key

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

json
{
    "apiKey": {
        "id": "ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi",
        "label": "Production key",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "lastUsedAt": null,
        "lastUsedIp": null,
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "createdAt": "2025-08-01T12:00:00.000Z",
        "revokedAt": null,
        "revokedById": null,
        "updatedAt": "2025-08-01T12:00:00.000Z"
    },
    "authString": "ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi:9f1c...e2a4"
}

Response fields

Field	Type	Description
`apiKey`	`object`	The newly created API key. See Get partner's API keys for the field reference.
`authString`	`string`	The API key's `id` and plaintext secret, joined by a colon (`id:secret`). This value is never shown again; store it securely.

To authenticate subsequent requests with the issued key, send it as:

http
Authorization: Basic {authString}

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/keys \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"label": "Production key"}'

Get partner API key

Retrieve a single API key of a partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/api/key/:keyId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`keyId`	`string`	The ID of the API key

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

Returns the API key. See Get partner's API keys for the field reference.

json
{
    "id": "ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi",
    "label": "Production key",
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "lastUsedAt": null,
    "lastUsedIp": null,
    "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
    "createdAt": "2025-08-01T12:00:00.000Z",
    "revokedAt": null,
    "revokedById": null,
    "updatedAt": "2025-08-01T12:00:00.000Z"
}

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the API key was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/key/ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi \
  -H "Authorization: Bearer <your_api_token>"

Revoke partner API key

Revokes an API key of a partner. Revoked keys can no longer be used to authenticate requests.

Request

http
DELETE https://api.staging.qash.cloud/v2/partner/:partnerId/api/key/:keyId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`keyId`	`string`	The ID of the API key

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Note: If the key was already revoked, this endpoint is idempotent and simply returns { "ok": true } without further changes.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the API key was not found.

Example

bash
curl -X DELETE https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/key/ak_31mQ8vDWz4tGg5bhZyE2unRv9Xi \
  -H "Authorization: Bearer <your_api_token>"

Get partner's webhooks

Retrieve a partner's webhooks.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/api/webhooks

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

Returns an array of webhooks. The secret field is never included in the response.

json
[
    {
        "id": "wh_31nR9wEXz5uHh6ciZzF3voSw0Yj",
        "label": "Order updates",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "url": "https://example.com/webhooks/qash",
        "active": true,
        "subscribedEvents": [
            "account.transaction.created"
        ],
        "lastDeliveryAt": null,
        "lastSuccessfulDeliveryAt": null,
        "failureCount": 0,
        "successCount": 0,
        "createdAt": "2025-08-01T12:00:00.000Z",
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    }
]

Response fields

Field	Type	Description
`id`	`string`	The unique identifier for the webhook.
`label`	`string`	A human-readable label for the webhook.
`partnerId`	`string`	The ID of the partner the webhook belongs to.
`url`	`string`	The destination URL that receives webhook deliveries.
`active`	`boolean`	Whether the webhook is currently active.
`subscribedEvents`	`string[]`	The list of event types the webhook is subscribed to.
`lastDeliveryAt`	`string` \| `null`	The timestamp of the last delivery attempt, if any.
`lastSuccessfulDeliveryAt`	`string` \| `null`	The timestamp of the last successful delivery, if any.
`failureCount`	`number`	The number of failed delivery attempts.
`successCount`	`number`	The number of successful deliveries.
`createdAt`	`string`	The timestamp when the webhook was created.
`createdById`	`string`	The ID of the user who created the webhook.
`updatedAt`	`string`	The timestamp when the webhook was last updated.

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/webhooks \
  -H "Authorization: Bearer <your_api_token>"

Create partner webhook

Creates a new webhook for a partner. The plaintext secret is only ever returned once, in this response, and is used to verify the signature of webhook deliveries.

Request

http
POST https://api.staging.qash.cloud/v2/partner/:partnerId/api/webhooks

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`

Request Body

Field	Type	Description
`label`	`string`	A human-readable label for the webhook
`url`	`string`	The destination URL that will receive webhook deliveries

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

The webhook is created as active, with no subscribed events.

json
{
    "webhook": {
        "id": "wh_31nR9wEXz5uHh6ciZzF3voSw0Yj",
        "label": "Order updates",
        "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
        "url": "https://example.com/webhooks/qash",
        "active": true,
        "subscribedEvents": [],
        "lastDeliveryAt": null,
        "lastSuccessfulDeliveryAt": null,
        "failureCount": 0,
        "successCount": 0,
        "createdAt": "2025-08-01T12:00:00.000Z",
        "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
        "updatedAt": "2025-08-01T12:00:00.000Z"
    },
    "secret": "9f1c2b7a...e2a4"
}

Response fields

Field	Type	Description
`webhook`	`object`	The newly created webhook. See Get partner's webhooks for the field reference.
`secret`	`string`	The webhook's plaintext signing secret. This value is never shown again; store it securely.

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found.

Example

bash
curl -X POST https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/webhooks \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"label": "Order updates", "url": "https://example.com/webhooks/qash"}'

Get partner webhook

Retrieve a single webhook of a partner.

Request

http
GET https://api.staging.qash.cloud/v2/partner/:partnerId/api/webhook/:webhookId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`webhookId`	`string`	The ID of the webhook

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

Returns the webhook. See Get partner's webhooks for the field reference.

json
{
    "id": "wh_31nR9wEXz5uHh6ciZzF3voSw0Yj",
    "label": "Order updates",
    "partnerId": "par_30cDoRAkxP6gnaVBicqU7kfSFU1",
    "url": "https://example.com/webhooks/qash",
    "active": true,
    "subscribedEvents": [
        "account.transaction.created"
    ],
    "lastDeliveryAt": null,
    "lastSuccessfulDeliveryAt": null,
    "failureCount": 0,
    "successCount": 0,
    "createdAt": "2025-08-01T12:00:00.000Z",
    "createdById": "usr_30cDhEFCw3vXIgAvPhTEJa5WtTl",
    "updatedAt": "2025-08-01T12:00:00.000Z"
}

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the webhook was not found.

Example

bash
curl https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/webhook/wh_31nR9wEXz5uHh6ciZzF3voSw0Yj \
  -H "Authorization: Bearer <your_api_token>"

Update partner webhook

Updates a webhook's details.

Request

http
PATCH https://api.staging.qash.cloud/v2/partner/:partnerId/api/webhook/:webhookId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`webhookId`	`string`	The ID of the webhook

Request Body

Field	Type	Description
`label`	`string?`	A human-readable label for the webhook
`active`	`boolean?`	Whether the webhook is active
`subscribed_events`	`string[]?`	The list of event types to subscribe to. Non-admin users cannot add new `internal.*` event types, but may keep ones already subscribed.

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

json
{
    "ok": true
}

Errors

Status	Description
`400`	The request body failed validation (see `errors` array in the response).
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the webhook was not found.

Example

bash
curl -X PATCH https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/webhook/wh_31nR9wEXz5uHh6ciZzF3voSw0Yj \
  -H "Authorization: Bearer <your_api_token>" \
  -H "Content-Type: application/json" \
  -d '{"active": false}'

Revoke partner webhook

Revokes (deactivates) a webhook.

Note: This endpoint is currently not implemented server-side and always responds with a 500 error, regardless of input. It is documented here for completeness, matching the route as currently deployed.

Request

http
DELETE https://api.staging.qash.cloud/v2/partner/:partnerId/api/webhook/:webhookId

Request Path Parameters

Parameter	Type	Description
`partnerId`	`string`	The partner's ID, routing identifier, or `@self`
`webhookId`	`string`	The ID of the webhook

Authorization

This endpoint requires an authenticated user who is a member of the partner (or an admin user in OVS mode).

http
Authorization: Bearer <your_api_token>

Response

Intended response once implemented:

json
{
    "ok": true
}

Errors

Status	Description
`401`	The request was not authenticated.
`403`	The authenticated user is not a member of the partner.
`404`	The partner was not found, or the webhook was not found.
`500`	This endpoint is not yet implemented and currently always fails.

Example

bash
curl -X DELETE https://api.staging.qash.cloud/v2/partner/par_30cDoRAkxP6gnaVBicqU7kfSFU1/api/webhook/wh_31nR9wEXz5uHh6ciZzF3voSw0Yj \
  -H "Authorization: Bearer <your_api_token>"