Get the caller of the token
LiveServed by the v1 API in development with the same checks as production; production opens on the same contract. The capabilities from before v1 keep running in production at the path your account team gives you.
Answers which client, organization, company and scopes the access token you send carries. Use it to check your credentials before you build on them. It needs no scope, only a valid token. Responses are never cached.
oauth2AuthorizationBearer <token>OAuth 2.0 client credentials. Exchange your client_id and client_secret at /oauth/token of the environment for a bearer token valid for one hour. The playground of every operation asks for your own client and keeps it in your browser tab only.
OK
application/json- response
client_id*stringThe client the token was issued to.
organization_id*stringThe organization that owns the client.
company_id?stringThe company the token reaches. Absent when it carries none.
scopes*array<string>The scopes of the token.
curl -X GET 'https://api.dev.b2b.heru.app/v1/me'{ "client_id": "client-example", "organization_id": "organization-example", "company_id": "company-example", "scopes": [ "merchants:read", "charges:write" ]}Get an access tokenPOST
Exchanges your client credentials for a bearer token valid for one hour (OAuth 2.0 client credentials grant, RFC 6749). Send the token as `Authorization: Bearer <token>` on every other operation. This endpoint lives at the root of the environment, not under `/v1`: `https://api.b2b.heru.app/oauth/token` in production and `https://api.dev.b2b.heru.app/oauth/token` in development. A client only works in the environment it was issued for. Send the client in the form body, as below, or with HTTP Basic; a JSON body with the same fields is accepted too. Leave `scope` out to get every scope of the client, or list the ones you need separated by spaces to get a narrower token. Errors follow RFC 6749: `error` and `error_description`, not the `code` shape of the rest of the API. Responses are never cached.
Validate a person's tax statusPOST
Checks the CURP and RFC against RENAPO and the SAT and returns the person's fiscal profile: registered name, tax address postal code, regimes, RFC status, e.firma and CSD validity, and whether invoices can be issued on their behalf. Asynchronous: you get a receipt with status `received` now and the result by webhook, usually within a minute. Needs the `fiscal_validations:write` scope.