Platform

5 operations. Authenticate with your secret API key (see Authentication); failures use the shape described in Errors. Example requests read $GIEP_API_URL, your deployment’s API host.

List API keys

GET/v1/api-keys

Signed-in owner, admin or developer only (apikey:read): refused to an API key (403 api_key_management_requires_user) and in a GIEP support session. Name, prefix, createdAt, createdBy (from the creation audit row; null for keys GIEP issued at onboarding), lastUsedAt (recorded at most once a minute per key), revokedAt. Never the secret or its hash.

Authentication: API key (Bearer)
Permission: apikey:read
Idempotency-Key: Not used
Success: 200

Responses

200Success
401Missing or invalid credentials Body is an error object with code and message.
403Role not permitted Body is an error object with code and message.
429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL

curl -X GET "$GIEP_API_URL/v1/api-keys" \
  -H "Authorization: Bearer $GIEP_API_KEY"

// JSON object. The OpenAPI document does not list its fields.

{
  "error": {
    "code": "unauthorized",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Human-readable explanation"
  }
}

Create an API key

POST/v1/api-keys

Signed-in owner/admin only (apikey:manage): refused to an API key (403 api_key_management_requires_user) and in a GIEP support session. The secret (key, giep_sk_<prefix>_<secret>) appears in this response only (Cache-Control: no-store); GIEP stores a SHA-256 hash. Keys are merchant-wide (every store). At most 20 creations per merchant per hour (429 rate_limited). Audited (api_key.created, prefix only).

Authentication: API key (Bearer)
Permission: apikey:manage
Idempotency-Key: Not used
Success: 201

Request body · application/jsonrequired

namestringrequired
min 1 chars · max 100 chars

Responses

201Success
401Missing or invalid credentials Body is an error object with code and message.
403Role not permitted Body is an error object with code and message.
422Validation failed (invalid_request) Body is an error object with code and message.
429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL

curl -X POST "$GIEP_API_URL/v1/api-keys" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'

// JSON object. The OpenAPI document does not list its fields.

{
  "error": {
    "code": "unauthorized",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Human-readable explanation"
  }
}

Revoke an API key

DELETE/v1/api-keys/{id}

Signed-in owner/admin only (refused to an API key and in a support session); immediate: the next request with the key is refused (401). Idempotent (a second revoke returns the original time). Audited (api_key.revoked).

Authentication: API key (Bearer)
Permission: apikey:manage
Idempotency-Key: Not used
Success: 200

Path parameters

idstringrequired

Responses

200Success
401Missing or invalid credentials Body is an error object with code and message.
403Role not permitted Body is an error object with code and message.
429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL

curl -X DELETE "$GIEP_API_URL/v1/api-keys/9a8e240b-09da-4685-a411-304303d0b" \
  -H "Authorization: Bearer $GIEP_API_KEY"

// JSON object. The OpenAPI document does not list its fields.

{
  "error": {
    "code": "unauthorized",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Human-readable explanation"
  }
}

Merchant audit log

GET/v1/audit-log

The merchant's audit log, newest first: who did what to which object. GIEP staff appear as GIEP support #<id>, never by name. Cursor pagination: pass nextCursor back as cursor. Requires audit:read.

Authentication: API key (Bearer)
Permission: audit:read
Idempotency-Key: Not used
Success: 200

Query parameters

actionstring
min 1 chars · max 100 chars
limitinteger
min 1 · max 200
cursorstring
max 200 chars

Responses

200Success
401Missing or invalid credentials Body is an error object with code and message.
403Role not permitted Body is an error object with code and message.
422Validation failed (invalid_request) Body is an error object with code and message.
429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL

curl -X GET "$GIEP_API_URL/v1/audit-log" \
  -H "Authorization: Bearer $GIEP_API_KEY"

// JSON object. The OpenAPI document does not list its fields.

{
  "error": {
    "code": "unauthorized",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Human-readable explanation"
  }
}

When GIEP support accessed the account (support sessions)

GET/v1/support-access

Each session: "GIEP support #id" (never a staff name), reason, mode, start and end, end reason, requests made and refused.

Authentication: API key (Bearer)
Permission: audit:read
Idempotency-Key: Not used
Success: 200

Responses

200Success
401Missing or invalid credentials Body is an error object with code and message.
403Role not permitted Body is an error object with code and message.
429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL

curl -X GET "$GIEP_API_URL/v1/support-access" \
  -H "Authorization: Bearer $GIEP_API_KEY"

// JSON object. The OpenAPI document does not list its fields.

{
  "error": {
    "code": "unauthorized",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Human-readable explanation"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Human-readable explanation"
  }
}