Depot portal billing

Registers the billing routes behind the org middleware.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/portal/v1/orgs/{clientID}/autopay

GETportal:autopay:manageportal facemspIdempotent

Source: [object Object]

getAutopay is whether automatic payments are on, with the authorization as agreed, and what enrolling would offer.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalAutopay	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:autopay:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
authorization	PortalAuthorization	PortalAuthorization is an autopay authorization as agreed: the exact text, who authorized it, when and how.
authorization.authorizedAtrequired	string (date-time)
authorization.authorizedByNamerequired	string
authorization.authorizedViarequired	string
authorization.consentTextrequired	string
authorization.consentVersionrequired	string
authorization.idrequired	string
authorization.methodIdrequired	string
authorization.methodLabelrequired	string
authorization.revokedAt	string (date-time) or null
authorization.revokedViarequired	string
authorization.statusrequired	string
availablerequired	boolean
consentVersionrequired	string
enrolledrequired	boolean
methodsrequired	array of string
surchargerequired	SurchargeRule	SurchargeRule is what the pay page states BEFORE a method is picked.
surcharge.basisPointsrequired	integer
surcharge.creditOnlyrequired	boolean
surcharge.enabledrequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/portal/v1/orgs/{clientID}/autopay

PUTportal:autopay:manageportal facemspIdempotent

Source: [object Object]

enrollAutopay creates the authorization the member accepted, with the text they read (a changed text is 409 quote_changed), recording the member as the authorizing person.

A copy and a one-click revoke link are mailed.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalSetupResult	Success.
201	application/json, PortalEnrolResult	Created.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:autopay:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
method	PortalSavedMethod	PortalSavedMethod is a payment method on file.
method.autopayrequired	boolean
method.bankNamerequired	string
method.brandrequired	string
method.createdAtrequired	string (date-time)
method.expMonthrequired	integer
method.expYearrequired	integer
method.fundingrequired	string
method.idrequired	string
method.labelrequired	string
method.last4required	string
method.statusrequired	string
method.typerequired	string
nextActionrequired	any	Arbitrary JSON.
setupRefrequired	string
statusrequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/portal/v1/orgs/{clientID}/autopay

DELETEportal:autopay:manageportal facemspIdempotent

Source: [object Object]

revokeAutopay stops automatic payments before the next charge.

The billing contact is mailed a confirmation. 404 when autopay is off.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalAuthorization	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:autopay:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
authorizedAtrequired	string (date-time)
authorizedByNamerequired	string
authorizedViarequired	string
consentTextrequired	string
consentVersionrequired	string
idrequired	string
methodIdrequired	string
methodLabelrequired	string
revokedAt	string (date-time) or null
revokedViarequired	string
statusrequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/autopay/preview

POSTportal:autopay:manageportal facemsp

Source: [object Object]

autopayPreview returns the authorization text for the tokenized method, naming the signed-in member as the person authorizing.

Reading it is its own step, never a checkbox on a payment (NACHA).

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalConsent	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:autopay:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
methodLabelrequired	string
payerNamerequired	string
sha256required	string
textrequired	string
versionrequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/preview");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/autopay/session

POSTportal:autopay:manageportal facemsp

Source: [object Object]

autopaySession is the hosted fields in set-up mode for the method autopay will charge.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalPaySession	Success.
400	application/problem+json, ProblemDetails	The request body is not acceptable.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:autopay:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
amountCentsrequired	integer	int64.
configIdrequired	string
currencyCoderequired	string
methodsrequired	array of string
providerKindrequired	string
publicrequired	any	Arbitrary JSON.
savedMethodsrequired	array of PortalSavedMethod
savedMethods[].autopayrequired	boolean
savedMethods[].bankNamerequired	string
savedMethods[].brandrequired	string
savedMethods[].createdAtrequired	string (date-time)
savedMethods[].expMonthrequired	integer
savedMethods[].expYearrequired	integer
savedMethods[].fundingrequired	string
savedMethods[].idrequired	string
savedMethods[].labelrequired	string
savedMethods[].last4required	string
savedMethods[].statusrequired	string
savedMethods[].typerequired	string
scriptrequired	string
surchargerequired	SurchargeRule	SurchargeRule is what the pay page states BEFORE a method is picked.
surcharge.basisPointsrequired	integer
surcharge.creditOnlyrequired	boolean
surcharge.enabledrequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/autopay/session");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/estimate

GETportal:estimate:readportal facemspIdempotent

Source: [object Object]

getEstimate is the next bill on the client’s active agreement: each line with the devices and people it counts, what changed since the last invoice, when the counts were taken, and the period.

Devices no line bills are the MSP’s concern and are not listed. 404 when the client is on no agreement.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalEstimate	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:estimate:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
agreementNamerequired	string
countsTakenAtrequired	string (date-time)
currencyCoderequired	string
diffrequired	array of PortalEstimateDiff
diff[].addedrequired	array of PortalMember
diff[].added[].idrequired	string
diff[].added[].namerequired	string
diff[].deltaCentsrequired	integer	int64.
diff[].descriptionrequired	string
diff[].qtyAfterrequired	string
diff[].qtyBefore	string or null
diff[].removedrequired	array of PortalMember
diff[].removed[].idrequired	string
diff[].removed[].namerequired	string
linesrequired	array of PortalEstimateLine
lines[].amountCentsrequired	integer	int64.
lines[].descriptionrequired	string
lines[].kindrequired	string
lines[].membersrequired	array of PortalMember
lines[].members[].idrequired	string
lines[].members[].namerequired	string
lines[].method	string or null
lines[].quantityrequired	string
lines[].unitAmountCentsrequired	integer	int64.
periodEndrequired	string
periodStartrequired	string
previousInvoiceId	string or null
proratedrequired	boolean
subtotalCentsrequired	integer	int64.
taxCentsrequired	integer	int64.
totalCentsrequired	integer	int64.
warningsrequired	array of string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/estimate");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/invoices

GETportal:invoices:readportal facemspIdempotent

Source: [object Object]

listInvoices is the client’s invoices, newest first, filtered by status (“open” for what is owed), issue date and number.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
page	query	string	No
pageSize	query	string	No
q	query	string	No
status	query	string	No

Responses

Status	Body	Description
200	application/json, PagePortalInvoice	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
itemsrequired	array of PortalInvoice
items[].balanceCentsrequired	integer	int64.
items[].creditedCentsrequired	integer	int64.
items[].currencyCoderequired	string
items[].dueDate	string or null
items[].idrequired	string
items[].issueDate	string or null
items[].numberrequired	string
items[].paidCentsrequired	integer	int64.
items[].payablerequired	boolean
items[].paymentStaterequired	string, one of none, paid, processing
items[].pendingCentsrequired	integer	int64.
items[].periodEnd	string or null
items[].periodStart	string or null
items[].statusrequired	string, one of issued, paid, partial, past_due, sent, void
items[].subtotalCentsrequired	integer	int64.
items[].taxCentsrequired	integer	int64.
items[].totalCentsrequired	integer	int64.
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices?page=<page>&pageSize=<pageSize>&q=<q>&status=<status>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices?page=<page>&pageSize=<pageSize>&q=<q>&status=<status>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices"
params = {
    "page": "<page>",
    "pageSize": "<pageSize>",
    "q": "<q>",
    "status": "<status>",
}
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices?page=<page>&pageSize=<pageSize>&q=<q>&status=<status>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices");
url.searchParams.set("page", "<page>");
url.searchParams.set("pageSize", "<pageSize>");
url.searchParams.set("q", "<q>");
url.searchParams.set("status", "<status>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices?page=<page>&pageSize=<pageSize>&q=<q>&status=<status>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}

GETportal:invoices:readportal facemspIdempotent

Source: [object Object]

getInvoice is one invoice: its lines with the devices and people each counted line was billed for, its payments (online and recorded by the MSP), credit notes, and any payment still processing.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
invoiceID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalInvoiceDetail	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
balanceCentsrequired	integer	int64.
creditNotesrequired	array of PortalCreditNote
creditNotes[].idrequired	string
creditNotes[].issueDate	string or null
creditNotes[].kindrequired	string
creditNotes[].numberrequired	string
creditNotes[].reasonrequired	string
creditNotes[].statusrequired	string
creditNotes[].totalCentsrequired	integer	int64.
creditedCentsrequired	integer	int64.
currencyCoderequired	string
dueDate	string or null
idrequired	string
inFlight	PortalAttempt	PortalAttempt is one online payment attempt as the payer sees it.
inFlight.amountCentsrequired	integer	int64.
inFlight.chargedCentsrequired	integer	int64.
inFlight.idrequired	string
inFlight.messagerequired	string
inFlight.methodTyperequired	string
inFlight.statusrequired	string
inFlight.surchargeCentsrequired	integer	int64.
issueDate	string or null
linesrequired	array of PortalInvoiceLine
lines[].amountCentsrequired	integer	int64.
lines[].descriptionrequired	string
lines[].idrequired	string
lines[].kindrequired	string
lines[].quantityrequired	string
lines[].receipt	PortalReceipt	PortalReceipt is a counted line's receipt of quantities.
lines[].receipt.countrequired	integer
lines[].receipt.membersrequired	array of PortalMember
lines[].receipt.members[].idrequired	string
lines[].receipt.members[].namerequired	string
lines[].receipt.method	string, one of daily, peak, snapshot or null
lines[].unitAmountCentsrequired	integer	int64.
notesrequired	string
numberrequired	string
paidCentsrequired	integer	int64.
payablerequired	boolean
paymentStaterequired	string, one of none, paid, processing
paymentsrequired	array of PortalPaymentRow
payments[].amountCentsrequired	integer	int64.
payments[].autopayrequired	boolean
payments[].currencyCoderequired	string
payments[].declineReasonrequired	string
payments[].idrequired	string
payments[].invoiceIdrequired	string
payments[].invoiceNumberrequired	string
payments[].methodrequired	string, one of ach, card, check, other
payments[].methodLabelrequired	string
payments[].occurredAtrequired	string (date-time)
payments[].onlinerequired	boolean
payments[].receiptAvailablerequired	boolean
payments[].referencerequired	string
payments[].statusrequired	string, one of canceled, failed, paid, pending, processing, requires_action, returned, void
payments[].surchargeCentsrequired	integer	int64.
pdfAvailablerequired	boolean
pendingCentsrequired	integer	int64.
periodEnd	string or null
periodStart	string or null
statusrequired	string, one of issued, paid, partial, past_due, sent, void
subtotalCentsrequired	integer	int64.
taxCentsrequired	integer	int64.
totalCentsrequired	integer	int64.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}/attempts/{attemptID}

GETportal:invoices:readportal facemspIdempotent

Source: [object Object]

getPayAttempt polls one payment attempt of this invoice; while it is in flight the processor is asked, so the page does not wait on a webhook.

Parameters

Name	In	Type	Required	Description
attemptID	path	string	Yes
clientID	path	string	Yes
invoiceID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalAttempt	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
amountCentsrequired	integer	int64.
chargedCentsrequired	integer	int64.
idrequired	string
messagerequired	string
methodTyperequired	string
statusrequired	string
surchargeCentsrequired	integer	int64.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/attempts/<attemptID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}/pay

POSTportal:invoices:payportal facemsp

Source: [object Object]

payConfirm takes the payment: the figures are quoted again (a change is 409 quote_changed), the attempt is written, then the processor is called.

The member is recorded as who paid.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
invoiceID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalPayResult	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:pay.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
attemptrequired	PortalAttempt	PortalAttempt is one online payment attempt as the payer sees it.
attempt.amountCentsrequired	integer	int64.
attempt.chargedCentsrequired	integer	int64.
attempt.idrequired	string
attempt.messagerequired	string
attempt.methodTyperequired	string
attempt.statusrequired	string
attempt.surchargeCentsrequired	integer	int64.
nextActionrequired	any	Arbitrary JSON.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}/pay/quote

POSTportal:invoices:payportal facemsp

Source: [object Object]

payQuote prices the chosen method: the balance and, for a credit card where the practice allows it, the surcharge on its own line, before the payer confirms.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
invoiceID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalPayQuote	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:pay.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
amountCentsrequired	integer	int64.
chargedCentsrequired	integer	int64.
configIdrequired	string
currencyCoderequired	string
fundingrequired	string
methodLabelrequired	string
methodTyperequired	string
savedMethodIdrequired	string
surchargeBasisPointsrequired	integer
surchargeCentsrequired	integer	int64.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/quote");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}/pay/session

POSTportal:invoices:payportal facemsp

Source: [object Object]

paySession starts paying an invoice: the processor’s browser configuration, the methods offered, the surcharge rule, and the saved methods that can pay it.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
invoiceID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalPaySession	Success.
400	application/problem+json, ProblemDetails	The request body is not acceptable.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:pay.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
amountCentsrequired	integer	int64.
configIdrequired	string
currencyCoderequired	string
methodsrequired	array of string
providerKindrequired	string
publicrequired	any	Arbitrary JSON.
savedMethodsrequired	array of PortalSavedMethod
savedMethods[].autopayrequired	boolean
savedMethods[].bankNamerequired	string
savedMethods[].brandrequired	string
savedMethods[].createdAtrequired	string (date-time)
savedMethods[].expMonthrequired	integer
savedMethods[].expYearrequired	integer
savedMethods[].fundingrequired	string
savedMethods[].idrequired	string
savedMethods[].labelrequired	string
savedMethods[].last4required	string
savedMethods[].statusrequired	string
savedMethods[].typerequired	string
scriptrequired	string
surchargerequired	SurchargeRule	SurchargeRule is what the pay page states BEFORE a method is picked.
surcharge.basisPointsrequired	integer
surcharge.creditOnlyrequired	boolean
surcharge.enabledrequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pay/session");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/invoices/{invoiceID}/pdf

GETportal:invoices:readportal facemspIdempotentdownloadNot fully resolved

What this page does not know

• response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

invoicePdf is the invoice document as issued, named by its number.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
invoiceID	path	string	Yes

Responses

Status	Body	Description
200	application/octet-stream, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/invoices/<invoiceID>/pdf");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/payment-methods

GETportal:payment_methods:manageportal facemspIdempotent

Source: [object Object]

listPaymentMethods is the org’s payment methods on file and what can be added.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalMethodsOffer	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:payment_methods:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
canAddrequired	boolean
itemsrequired	array of PortalSavedMethod
items[].autopayrequired	boolean
items[].bankNamerequired	string
items[].brandrequired	string
items[].createdAtrequired	string (date-time)
items[].expMonthrequired	integer
items[].expYearrequired	integer
items[].fundingrequired	string
items[].idrequired	string
items[].labelrequired	string
items[].last4required	string
items[].statusrequired	string
items[].typerequired	string
methodsrequired	array of string
surchargerequired	SurchargeRule	SurchargeRule is what the pay page states BEFORE a method is picked.
surcharge.basisPointsrequired	integer
surcharge.creditOnlyrequired	boolean
surcharge.enabledrequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/payment-methods

POSTportal:payment_methods:manageportal facemsp

Source: [object Object]

addPaymentMethod keeps the tokenized method on file.

It authorizes no automatic payment: autopay is its own consented step.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalSetupResult	Success.
201	application/json, PortalSetupResult	Created.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:payment_methods:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
method	PortalSavedMethod	PortalSavedMethod is a payment method on file.
method.autopayrequired	boolean
method.bankNamerequired	string
method.brandrequired	string
method.createdAtrequired	string (date-time)
method.expMonthrequired	integer
method.expYearrequired	integer
method.fundingrequired	string
method.idrequired	string
method.labelrequired	string
method.last4required	string
method.statusrequired	string
method.typerequired	string
nextActionrequired	any	Arbitrary JSON.
setupRefrequired	string
statusrequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/portal/v1/orgs/{clientID}/payment-methods/{methodID}

DELETEportal:payment_methods:manageportal facemspIdempotent

Source: [object Object]

removePaymentMethod takes a method off file.

If automatic payments charge it, they stop too, and the billing contact is told.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
methodID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:payment_methods:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/<methodID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/payment-methods/session

POSTportal:payment_methods:manageportal facemsp

Source: [object Object]

paymentMethodSession starts adding a payment method: the processor’s hosted fields in set-up mode.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PortalPaySession	Success.
400	application/problem+json, ProblemDetails	The request body is not acceptable.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:payment_methods:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
amountCentsrequired	integer	int64.
configIdrequired	string
currencyCoderequired	string
methodsrequired	array of string
providerKindrequired	string
publicrequired	any	Arbitrary JSON.
savedMethodsrequired	array of PortalSavedMethod
savedMethods[].autopayrequired	boolean
savedMethods[].bankNamerequired	string
savedMethods[].brandrequired	string
savedMethods[].createdAtrequired	string (date-time)
savedMethods[].expMonthrequired	integer
savedMethods[].expYearrequired	integer
savedMethods[].fundingrequired	string
savedMethods[].idrequired	string
savedMethods[].labelrequired	string
savedMethods[].last4required	string
savedMethods[].statusrequired	string
savedMethods[].typerequired	string
scriptrequired	string
surchargerequired	SurchargeRule	SurchargeRule is what the pay page states BEFORE a method is picked.
surcharge.basisPointsrequired	integer
surcharge.creditOnlyrequired	boolean
surcharge.enabledrequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payment-methods/session");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/payments

GETportal:invoices:readportal facemspIdempotent

Source: [object Object]

listPaymentHistory is the client’s payments, newest first: method, amount, status (a bank payment in flight is “processing”, never paid), the decline reason of a failure, and whether a receipt can be downloaded.

?status filters by row status; ?from and ?to bound the invoices’ issue dates.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
page	query	string	No
pageSize	query	string	No
status	query	string	No

Responses

Status	Body	Description
200	application/json, PagePortalPaymentRow	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
itemsrequired	array of PortalPaymentRow
items[].amountCentsrequired	integer	int64.
items[].autopayrequired	boolean
items[].currencyCoderequired	string
items[].declineReasonrequired	string
items[].idrequired	string
items[].invoiceIdrequired	string
items[].invoiceNumberrequired	string
items[].methodrequired	string, one of ach, card, check, other
items[].methodLabelrequired	string
items[].occurredAtrequired	string (date-time)
items[].onlinerequired	boolean
items[].receiptAvailablerequired	boolean
items[].referencerequired	string
items[].statusrequired	string, one of canceled, failed, paid, pending, processing, requires_action, returned, void
items[].surchargeCentsrequired	integer	int64.
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payments?page=<page>&pageSize=<pageSize>&status=<status>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payments?page=<page>&pageSize=<pageSize>&status=<status>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments"
params = {
    "page": "<page>",
    "pageSize": "<pageSize>",
    "status": "<status>",
}
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments?page=<page>&pageSize=<pageSize>&status=<status>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/portal/v1/orgs/<clientID>/payments");
url.searchParams.set("page", "<page>");
url.searchParams.set("pageSize", "<pageSize>");
url.searchParams.set("status", "<status>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments?page=<page>&pageSize=<pageSize>&status=<status>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/payments/{paymentID}/receipt

GETportal:invoices:readportal facemspIdempotentdownloadNot fully resolved

What this page does not know

• response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

paymentReceipt is a PDF receipt for money received, named by the invoice number and the date.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
paymentID	path	string	Yes

Responses

Status	Body	Description
200	application/octet-stream, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:invoices:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/payments/<paymentID>/receipt");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/usage

GETportal:estimate:readportal facemspIdempotent

Source: [object Object]

getUsage is the billable inventory now (the devices and people an agreement can count) and the daily counts between ?from and ?to (default the last 31 days, at most 400).

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalUsage	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:estimate:read.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
countsTakenAtrequired	string (date-time)
endpointsrequired	array of PortalUsageEndpoint
endpoints[].classrequired	string
endpoints[].idrequired	string
endpoints[].namerequired	string
endpoints[].osDisplayrequired	string
endpoints[].osFamilyrequired	string
endpoints[].serverrequired	boolean
fromrequired	string
historyrequired	array of PortalUsageDay
history[].carriedrequired	boolean
history[].daterequired	string
history[].endpointCountrequired	integer
history[].seatCountrequired	integer
seatsrequired	array of PortalUsageSeat
seats[].endpointIdsrequired	array of string
seats[].idrequired	string
seats[].namerequired	string
torequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/usage' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/usage' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/usage"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/usage", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/usage";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/usage");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());