Create an onboarding
LiveServed by the v1 API in development with the same checks as production; production opens on the same contract. The capabilities from before v1 keep running in production at the path your account team gives you.
Creates a new onboarding link for the merchant, valid for 7 days. Any previous link stops working. Use it when the first link expired, or when the CSD is about to expire (csd_expiring) and the merchant must upload the new one. The current onboarding always comes in onboarding when you get the merchant. Answers 409 when the merchant is active and its CSD is not expiring.
Needs the merchants:write scope.
oauth2 merchants:writeAuthorizationBearer <token>OAuth 2.0 client credentials. Exchange your client_id and client_secret at /oauth/token of the environment for a bearer token valid for one hour. The playground of every operation asks for your own client and keeps it in your browser tab only.
Scope: merchants:write
id*stringThe merchant id.
^mer_[0-7][0-9a-hjkmnp-tv-z]{25}$Idempotency-Key*stringUnique per operation. Retrying with the same key returns the original result for 24 hours.
length <= 255Created
application/json- response
status*stringpending while the link works, completed once the merchant uploaded a valid CSD, expired when the link ran out unused.
"pending""completed""expired"url*|nullexpires_at*|nullcompleted_at*|nullcurl -X POST 'https://api.dev.b2b.heru.app/v1/merchants/mer_01m4rc7b4tf4ca1e964d5zx99v/onboarding' \ -H 'Idempotency-Key: try-it-0001'{ "status": "pending", "url": "https://onboarding.heru.app/m/Hq8sY2vK9pLx", "expires_at": "2026-10-21T17:02:41.219Z", "completed_at": null}Add a merchantPOST
Registers a merchant that will invoice its card sales. The response carries `onboarding.url`, a page hosted by heru with your brand where the merchant uploads their CSD; send it to them. If you already hold the CSD, upload it with `PUT /merchants/{id}/csd` instead. `merchant.activated` tells you when the merchant can invoice. Needs the `merchants:write` scope.
Create a console linkPOST
Creates a link that opens the merchant's own console without a heru login: its invoices, the KPIs of the month and an accountant report with CSV. Give it to the merchant from your back office. The link can be opened as many times as needed until `expires_at` (a day by default). Each call creates a new link and revokes the merchant's previous ones, so repeating the request does not return the same link and needs no Idempotency-Key. `url` is `null` in an environment that has no console configured. Answers `409` when the merchant is closed. Needs the `merchants:console` scope.